Force Awakens Cilium Mesh demo

From KubeCon Amsterdam. Putting it here for now because some of what I showed was in a feature branch.

TODO: [ ] Build from feature branch for external workload feature [ ] Re-test external workloads

Prerequisites

• Docker
• Kind
• direnv
• Cilium CLI

export CILIUM_DIR=<local Cilium repo> (defaults to ~/src/cilium)

Local registry for Kind clusters

Run create-kind-registry.sh. This runs a local registry, similar to this, and populates it with the images needed for this demo. I run the local registry on port 5001 because 5000 was already in use on my Mac.

Create universe

./start-multicluster-kind.sh

Initial deploy

The first time you cd into a directory you'll need to run direnv allow.

cd jakku
k apply -f bb-8.yaml
k apply -f resistance-jakku.yaml

cd d-qar
k apply -f r2-d2.yaml
k apply -f kylo-ren.yaml
k apply -f resistance-d-qar.yaml

Deploy Luke running in an external VM

Separate terminal:

docker run -d --network=kind --ip 172.19.100.2 --name ahch-to --rm -p 80:80 lizrice/ubuntu-ahch-to sleep 10000
docker exec -it ahch-to bash

# In VM
while true; do echo -e "HTTP/1.1 200 OK\n\nHi I'm Luke" | nc -l -p 80 -N ; done

Accessing services and endpoints

In Jakku, bb-8 can access resistance

cd ../jakku
k exec -it bb-8 -- curl resistance

Look at services and endpoints

k get svc
k get pods -o wide
k get endpoints
k get ciliumendpoints

ks exec -it $CPOD -- cilium service list
ks exec -it $CPOD -- cilium endpoint list

Clustermesh

Uncomment annotations in Jakku's resistance service to make it a global service, so bb-8 can access resistance in both locations. Then k apply -f resistance-jakku.yaml

k get endpoints
k get ciliumendpoints
k get svc
ks exec -it $CPOD -- cilium service list

Resistance service in D'Qar is annotated to prefer local, so curling from R2-D2 should only return responses from the local resistance in D'Qar.

Luke is an external endpoint

cilium endpoint add --name=ahch-to --labels=org=resistance --labels=jedi=luke --ip=172.19.100.2

kubectx kind-d-qar
k apply -f luke.yaml

k exec -it r2-d2 -- curl luke

Deploy Luke as a pod too

k apply -f jedi.yaml
k exec -it r2-d2 -- curl luke

Responses could come from the external endpoint or from the pod

Network policy

k apply -f protect.yaml

R2-D2 can curl to luke, but kylo-ren can't