Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace "sleep" sample throughout Istio docs #15767

Merged
merged 5 commits into from
Oct 11, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions content/en/boilerplates/before-you-begin-egress.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,19 +9,19 @@
[configuration profile](/docs/setup/additional-setup/config-profiles/).
{{< /tip >}}

* Deploy the [sleep]({{< github_tree >}}/samples/sleep) sample app to use as a test source for sending requests.
* Deploy the [curl]({{< github_tree >}}/samples/curl) sample app to use as a test source for sending requests.
If you have
[automatic sidecar injection](/docs/setup/additional-setup/sidecar-injection/#automatic-sidecar-injection)
enabled, run the following command to deploy the sample app:

{{< text bash >}}
$ kubectl apply -f @samples/sleep/sleep.yaml@
$ kubectl apply -f @samples/curl/curl.yaml@
{{< /text >}}

Otherwise, manually inject the sidecar before deploying the `sleep` application with the following command:
Otherwise, manually inject the sidecar before deploying the `curl` application with the following command:

{{< text bash >}}
$ kubectl apply -f <(istioctl kube-inject -f @samples/sleep/sleep.yaml@)
$ kubectl apply -f <(istioctl kube-inject -f @samples/curl/curl.yaml@)
craigbox marked this conversation as resolved.
Show resolved Hide resolved
{{< /text >}}

{{< tip >}}
Expand All @@ -31,5 +31,5 @@
* Set the `SOURCE_POD` environment variable to the name of your source pod:

{{< text bash >}}
$ export SOURCE_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
$ export SOURCE_POD=$(kubectl get pod -l app=curl -o jsonpath={.items..metadata.name})
{{< /text >}}
6 changes: 3 additions & 3 deletions content/en/boilerplates/snips/before-you-begin-egress.sh
Original file line number Diff line number Diff line change
Expand Up @@ -21,13 +21,13 @@
####################################################################################################

bpsnip_before_you_begin_egress_before_you_begin_1() {
kubectl apply -f samples/sleep/sleep.yaml
kubectl apply -f samples/curl/curl.yaml
}

bpsnip_before_you_begin_egress_before_you_begin_2() {
kubectl apply -f <(istioctl kube-inject -f samples/sleep/sleep.yaml)
kubectl apply -f <(istioctl kube-inject -f samples/curl/curl.yaml)
}

bpsnip_before_you_begin_egress_before_you_begin_3() {
export SOURCE_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
export SOURCE_POD=$(kubectl get pod -l app=curl -o jsonpath={.items..metadata.name})
}
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ inpod_mark: 1337
Follow the steps below to confirm that the sockets on ports 15001, 15006, and 15008 are open and in the listening state.

{{< text bash >}}
$ kubectl debug $(kubectl get pod -l app=sleep -n ambient-demo -o jsonpath='{.items[0].metadata.name}') -it -n ambient-demo --image nicolaka/netshoot -- ss -ntlp
$ kubectl debug $(kubectl get pod -l app=curl -n ambient-demo -o jsonpath='{.items[0].metadata.name}') -it -n ambient-demo --image nicolaka/netshoot -- ss -ntlp
Defaulting debug container name to debugger-nhd4d.
State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0 128 127.0.0.1:15080 0.0.0.0:*
Expand All @@ -91,7 +91,7 @@ LISTEN 0 128 *:15008 *:*
To view the iptables rules setup inside one of the application pods, execute this command:

{{< text bash >}}
$ kubectl debug $(kubectl get pod -l app=sleep -n ambient-demo -o jsonpath='{.items[0].metadata.name}') -it --image gcr.io/istio-release/base --profile=netadmin -n ambient-demo -- iptables-save
$ kubectl debug $(kubectl get pod -l app=curl -n ambient-demo -o jsonpath='{.items[0].metadata.name}') -it --image gcr.io/istio-release/base --profile=netadmin -n ambient-demo -- iptables-save

Defaulting debug container name to debugger-m44qc.
# Generated by iptables-save
Expand Down
8 changes: 4 additions & 4 deletions content/en/docs/ambient/getting-started/cleanup/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -36,12 +36,12 @@ $ kubectl delete namespace istio-system

## Remove the sample application

To delete the Bookinfo sample application and the `sleep` deployment, run the following:
To delete the Bookinfo sample application and the `curl` deployment, run the following:

{{< text bash >}}
$ kubectl delete -f {{< github_file >}}/samples/bookinfo/platform/kube/bookinfo.yaml
$ kubectl delete -f {{< github_file >}}/samples/bookinfo/platform/kube/bookinfo-versions.yaml
$ kubectl delete -f {{< github_file >}}/samples/sleep/sleep.yaml
$ kubectl delete -f samples/bookinfo/platform/kube/bookinfo.yaml
$ kubectl delete -f samples/bookinfo/platform/kube/bookinfo-versions.yaml
$ kubectl delete -f samples/curl/curl.yaml
{{< /text >}}

## Remove the Kubernetes Gateway API CRDs
Expand Down
6 changes: 3 additions & 3 deletions content/en/docs/ambient/getting-started/cleanup/snips.sh
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ istioctl waypoint delete --all
}

snip_remove_the_sample_application_1() {
kubectl delete -f https://raw.githubusercontent.com/istio/istio/master/samples/bookinfo/platform/kube/bookinfo.yaml
kubectl delete -f https://raw.githubusercontent.com/istio/istio/master/samples/bookinfo/platform/kube/bookinfo-versions.yaml
kubectl delete -f https://raw.githubusercontent.com/istio/istio/master/samples/sleep/sleep.yaml
kubectl delete -f samples/bookinfo/platform/kube/bookinfo.yaml
kubectl delete -f samples/bookinfo/platform/kube/bookinfo-versions.yaml
kubectl delete -f samples/curl/curl.yaml
}
Original file line number Diff line number Diff line change
Expand Up @@ -37,16 +37,16 @@ EOF

If you open the Bookinfo application in your browser (`http://localhost:8080/productpage`), you will see the product page, just as before. However, if you try to access the `productpage` service from a different service account, you should see an error.

Let's try accessing Bookinfo application from a `sleep` pod:
Let's try accessing Bookinfo application from a `curl` pod:

{{< text syntax=bash snip_id=deploy_sleep >}}
$ kubectl apply -f {{< github_file >}}/samples/sleep/sleep.yaml
{{< text syntax=bash snip_id=deploy_curl >}}
$ kubectl apply -f samples/curl/curl.yaml
{{< /text >}}

Since the `sleep` pod is using a different service account, it will not have access the `productpage` service:
Since the `curl` pod is using a different service account, it will not have access the `productpage` service:

{{< text bash >}}
$ kubectl exec deploy/sleep -- curl -s "http://productpage:9080/productpage"
$ kubectl exec deploy/curl -- curl -s "http://productpage:9080/productpage"
command terminated with exit code 56
{{< /text >}}

Expand All @@ -68,7 +68,7 @@ NAME CLASS ADDRESS PROGRAMMED AGE
waypoint istio-waypoint 10.96.58.95 True 42s
{{< /text >}}

Adding a [L7 authorization policy](/docs/ambient/usage/l7-features/) will explicitly allow the `sleep` service to send `GET` requests to the `productpage` service, but perform no other operations:
Adding a [L7 authorization policy](/docs/ambient/usage/l7-features/) will explicitly allow the `curl` service to send `GET` requests to the `productpage` service, but perform no other operations:

{{< text syntax=bash snip_id=deploy_l7_policy >}}
$ kubectl apply -f - <<EOF
Expand All @@ -87,7 +87,7 @@ spec:
- from:
- source:
principals:
- cluster.local/ns/default/sa/sleep
- cluster.local/ns/default/sa/curl
to:
- operation:
methods: ["GET"]
Expand All @@ -104,7 +104,7 @@ Confirm the new waypoint proxy is enforcing the updated authorization policy:

{{< text bash >}}
$ # This fails with an RBAC error because we're not using a GET operation
$ kubectl exec deploy/sleep -- curl -s "http://productpage:9080/productpage" -X DELETE
$ kubectl exec deploy/curl -- curl -s "http://productpage:9080/productpage" -X DELETE
RBAC: access denied
{{< /text >}}

Expand All @@ -115,8 +115,8 @@ RBAC: access denied
{{< /text >}}

{{< text bash >}}
$ # This works as we're explicitly allowing GET requests from the sleep pod
$ kubectl exec deploy/sleep -- curl -s http://productpage:9080/productpage | grep -o "<title>.*</title>"
$ # This works as we're explicitly allowing GET requests from the curl pod
$ kubectl exec deploy/curl -- curl -s http://productpage:9080/productpage | grep -o "<title>.*</title>"
<title>Simple Bookstore App</title>
{{< /text >}}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -40,12 +40,12 @@ spec:
EOF
}

snip_deploy_sleep() {
kubectl apply -f https://raw.githubusercontent.com/istio/istio/master/samples/sleep/sleep.yaml
snip_deploy_curl() {
kubectl apply -f samples/curl/curl.yaml
}

snip_enforce_layer_4_authorization_policy_3() {
kubectl exec deploy/sleep -- curl -s "http://productpage:9080/productpage"
kubectl exec deploy/curl -- curl -s "http://productpage:9080/productpage"
}

! IFS=$'\n' read -r -d '' snip_enforce_layer_4_authorization_policy_3_out <<\ENDSNIP
Expand Down Expand Up @@ -87,7 +87,7 @@ spec:
- from:
- source:
principals:
- cluster.local/ns/default/sa/sleep
- cluster.local/ns/default/sa/curl
to:
- operation:
methods: ["GET"]
Expand All @@ -96,7 +96,7 @@ EOF

snip_enforce_layer_7_authorization_policy_4() {
# This fails with an RBAC error because we're not using a GET operation
kubectl exec deploy/sleep -- curl -s "http://productpage:9080/productpage" -X DELETE
kubectl exec deploy/curl -- curl -s "http://productpage:9080/productpage" -X DELETE
}

! IFS=$'\n' read -r -d '' snip_enforce_layer_7_authorization_policy_4_out <<\ENDSNIP
Expand All @@ -113,8 +113,8 @@ RBAC: access denied
ENDSNIP

snip_enforce_layer_7_authorization_policy_6() {
# This works as we're explicitly allowing GET requests from the sleep pod
kubectl exec deploy/sleep -- curl -s http://productpage:9080/productpage | grep -o "<title>.*</title>"
# This works as we're explicitly allowing GET requests from the curl pod
kubectl exec deploy/curl -- curl -s http://productpage:9080/productpage | grep -o "<title>.*</title>"
}

! IFS=$'\n' read -r -d '' snip_enforce_layer_7_authorization_policy_6_out <<\ENDSNIP
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ EOF
To confirm that roughly 10% of the of the traffic from 100 requests goes to `reviews-v2`, you can run the following command:

{{< text syntax=bash snip_id=test_traffic_split >}}
$ kubectl exec deploy/sleep -- sh -c "for i in \$(seq 1 100); do curl -s http://productpage:9080/productpage | grep reviews-v.-; done"
$ kubectl exec deploy/curl -- sh -c "for i in \$(seq 1 100); do curl -s http://productpage:9080/productpage | grep reviews-v.-; done"
{{< /text >}}

You'll notice the majority of requests go to `reviews-v1`. You can confirm the same if you open the Bookinfo application in your browser and refresh the page multiple times. Notice the requests from the `reviews-v1` don't have any stars, while the requests from `reviews-v2` have black stars.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -44,5 +44,5 @@ EOF
}

snip_test_traffic_split() {
kubectl exec deploy/sleep -- sh -c "for i in \$(seq 1 100); do curl -s http://productpage:9080/productpage | grep reviews-v.-; done"
kubectl exec deploy/curl -- sh -c "for i in \$(seq 1 100); do curl -s http://productpage:9080/productpage | grep reviews-v.-; done"
}
4 changes: 2 additions & 2 deletions content/en/docs/ambient/getting-started/test.sh
Original file line number Diff line number Diff line change
Expand Up @@ -39,8 +39,8 @@ _verify_like snip_deploy_and_configure_the_ingress_gateway_3 "$snip_deploy_and_c
_verify_contains snip_add_bookinfo_to_the_mesh_1 "$snip_add_bookinfo_to_the_mesh_1_out"

snip_deploy_l4_policy
snip_deploy_sleep
_wait_for_deployment default sleep
snip_deploy_curl
_wait_for_deployment default curl
_verify_contains snip_enforce_layer_4_authorization_policy_3 "$snip_enforce_layer_4_authorization_policy_3_out"

_verify_contains snip_deploy_waypoint "$snip_deploy_waypoint_out"
Expand Down
20 changes: 10 additions & 10 deletions content/en/docs/ambient/usage/extend-waypoint-wasm/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,10 @@ One of the key advantages of Wasm extensibility is that extensions can be loaded
1. Set up Istio by following the instructions in the [ambient mode Getting Started guide](/docs/ambient/getting-started).
1. Deploy the [Bookinfo sample application](/docs/ambient/getting-started/deploy-sample-app).
1. [Add the default namespace to the ambient mesh](/docs/ambient/getting-started/secure-and-visualize).
1. Deploy the [sleep]({{< github_tree >}}/samples/sleep) sample app to use as a test source for sending requests.
1. Deploy the [curl]({{< github_tree >}}/samples/curl) sample app to use as a test source for sending requests.

{{< text syntax=bash >}}
$ kubectl apply -f @samples/sleep/sleep.yaml@
$ kubectl apply -f @samples/curl/curl.yaml@
{{< /text >}}

## At a gateway
Expand Down Expand Up @@ -73,14 +73,14 @@ The Istio agent will interpret the WasmPlugin configuration, download remote Was
1. Test `/productpage` without credentials:

{{< text syntax=bash snip_id=test_gateway_productpage_without_credentials >}}
$ kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null "http://bookinfo-gateway-istio.default.svc.cluster.local/productpage"
$ kubectl exec deploy/curl -- curl -s -w "%{http_code}" -o /dev/null "http://bookinfo-gateway-istio.default.svc.cluster.local/productpage"
401
{{< /text >}}

1. Test `/productpage` with the credentials configured in the WasmPlugin resource:

{{< text syntax=bash snip_id=test_gateway_productpage_with_credentials >}}
$ kubectl exec deploy/sleep -- curl -s -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" -w "%{http_code}" "http://bookinfo-gateway-istio.default.svc.cluster.local/productpage"
$ kubectl exec deploy/curl -- curl -s -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" -w "%{http_code}" "http://bookinfo-gateway-istio.default.svc.cluster.local/productpage"
200
{{< /text >}}

Expand All @@ -99,7 +99,7 @@ $ istioctl waypoint apply --enroll-namespace --wait
Verify traffic reaches the service:

{{< text syntax=bash snip_id=verify_traffic >}}
$ kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null http://productpage:9080/productpage
$ kubectl exec deploy/curl -- curl -s -w "%{http_code}" -o /dev/null http://productpage:9080/productpage
200
{{< /text >}}

Expand Down Expand Up @@ -153,14 +153,14 @@ basic-auth-at-waypoint 14m
1. Test internal `/productpage` without credentials:

{{< text syntax=bash snip_id=test_waypoint_productpage_without_credentials >}}
$ kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null http://productpage:9080/productpage
$ kubectl exec deploy/curl -- curl -s -w "%{http_code}" -o /dev/null http://productpage:9080/productpage
401
{{< /text >}}

1. Test internal `/productpage` with credentials:

{{< text syntax=bash snip_id=test_waypoint_productpage_with_credentials >}}
$ kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" http://productpage:9080/productpage
$ kubectl exec deploy/curl -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" http://productpage:9080/productpage
200
{{< /text >}}

Expand Down Expand Up @@ -200,21 +200,21 @@ EOF
1. Test the internal `/productpage` with the credentials configured at the generic `waypoint` proxy:

{{< text syntax=bash snip_id=test_waypoint_service_productpage_with_credentials >}}
$ kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" http://productpage:9080/productpage
$ kubectl exec deploy/curl -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" http://productpage:9080/productpage
200
{{< /text >}}

1. Test the internal `/reviews` with credentials configured at the specific `reviews-svc-waypoint` proxy:

{{< text syntax=bash snip_id=test_waypoint_service_reviews_with_credentials >}}
$ kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic MXQtaW4zOmFkbWluMw==" http://reviews:9080/reviews/1
$ kubectl exec deploy/curl -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic MXQtaW4zOmFkbWluMw==" http://reviews:9080/reviews/1
200
{{< /text >}}

1. Test internal `/reviews` without credentials:

{{< text syntax=bash snip_id=test_waypoint_service_reviews_without_credentials >}}
$ kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null http://reviews:9080/reviews/1
$ kubectl exec deploy/curl -- curl -s -w "%{http_code}" -o /dev/null http://reviews:9080/reviews/1
401
{{< /text >}}

Expand Down
18 changes: 9 additions & 9 deletions content/en/docs/ambient/usage/extend-waypoint-wasm/snips.sh
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
####################################################################################################

snip_before_you_begin_1() {
kubectl apply -f samples/sleep/sleep.yaml
kubectl apply -f samples/curl/curl.yaml
}

snip_get_gateway() {
Expand Down Expand Up @@ -59,15 +59,15 @@ EOF
}

snip_test_gateway_productpage_without_credentials() {
kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null "http://bookinfo-gateway-istio.default.svc.cluster.local/productpage"
kubectl exec deploy/curl -- curl -s -w "%{http_code}" -o /dev/null "http://bookinfo-gateway-istio.default.svc.cluster.local/productpage"
}

! IFS=$'\n' read -r -d '' snip_test_gateway_productpage_without_credentials_out <<\ENDSNIP
401
ENDSNIP

snip_test_gateway_productpage_with_credentials() {
kubectl exec deploy/sleep -- curl -s -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" -w "%{http_code}" "http://bookinfo-gateway-istio.default.svc.cluster.local/productpage"
kubectl exec deploy/curl -- curl -s -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" -w "%{http_code}" "http://bookinfo-gateway-istio.default.svc.cluster.local/productpage"
}

! IFS=$'\n' read -r -d '' snip_test_gateway_productpage_with_credentials_out <<\ENDSNIP
Expand All @@ -79,7 +79,7 @@ istioctl waypoint apply --enroll-namespace --wait
}

snip_verify_traffic() {
kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null http://productpage:9080/productpage
kubectl exec deploy/curl -- curl -s -w "%{http_code}" -o /dev/null http://productpage:9080/productpage
}

! IFS=$'\n' read -r -d '' snip_verify_traffic_out <<\ENDSNIP
Expand Down Expand Up @@ -132,15 +132,15 @@ basic-auth-at-waypoint 14m
ENDSNIP

snip_test_waypoint_productpage_without_credentials() {
kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null http://productpage:9080/productpage
kubectl exec deploy/curl -- curl -s -w "%{http_code}" -o /dev/null http://productpage:9080/productpage
}

! IFS=$'\n' read -r -d '' snip_test_waypoint_productpage_without_credentials_out <<\ENDSNIP
401
ENDSNIP

snip_test_waypoint_productpage_with_credentials() {
kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" http://productpage:9080/productpage
kubectl exec deploy/curl -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" http://productpage:9080/productpage
}

! IFS=$'\n' read -r -d '' snip_test_waypoint_productpage_with_credentials_out <<\ENDSNIP
Expand Down Expand Up @@ -173,23 +173,23 @@ EOF
}

snip_test_waypoint_service_productpage_with_credentials() {
kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" http://productpage:9080/productpage
kubectl exec deploy/curl -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" http://productpage:9080/productpage
}

! IFS=$'\n' read -r -d '' snip_test_waypoint_service_productpage_with_credentials_out <<\ENDSNIP
200
ENDSNIP

snip_test_waypoint_service_reviews_with_credentials() {
kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic MXQtaW4zOmFkbWluMw==" http://reviews:9080/reviews/1
kubectl exec deploy/curl -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic MXQtaW4zOmFkbWluMw==" http://reviews:9080/reviews/1
}

! IFS=$'\n' read -r -d '' snip_test_waypoint_service_reviews_with_credentials_out <<\ENDSNIP
200
ENDSNIP

snip_test_waypoint_service_reviews_without_credentials() {
kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null http://reviews:9080/reviews/1
kubectl exec deploy/curl -- curl -s -w "%{http_code}" -o /dev/null http://reviews:9080/reviews/1
}

! IFS=$'\n' read -r -d '' snip_test_waypoint_service_reviews_without_credentials_out <<\ENDSNIP
Expand Down
Loading