Skip to content

margamanterola/force-awakens

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

12 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Force Awakens Cilium Mesh demo

From KubeCon Amsterdam. Putting it here for now because some of what I showed was in a feature branch.

TODO: [ ] Build from feature branch for external workload feature [ ] Re-test external workloads

Prerequisites

  • Docker
  • Kind
  • direnv
  • Cilium CLI

export CILIUM_DIR=<local Cilium repo> (defaults to ~/src/cilium)

Local registry for Kind clusters

Run create-kind-registry.sh. This runs a local registry, similar to this, and populates it with the images needed for this demo. I run the local registry on port 5001 because 5000 was already in use on my Mac.

Create universe

./start-multicluster-kind.sh

Initial deploy

The first time you cd into a directory you'll need to run direnv allow.

cd jakku
k apply -f bb-8.yaml
k apply -f resistance-jakku.yaml

cd d-qar
k apply -f r2-d2.yaml
k apply -f kylo-ren.yaml
k apply -f resistance-d-qar.yaml

Deploy Luke running in an external VM

Separate terminal:

docker run -d --network=kind --ip 172.19.100.2 --name ahch-to --rm -p 80:80 lizrice/ubuntu-ahch-to sleep 10000
docker exec -it ahch-to bash

# In VM
while true; do echo -e "HTTP/1.1 200 OK\n\nHi I'm Luke" | nc -l -p 80 -N ; done

Accessing services and endpoints

In Jakku, bb-8 can access resistance

cd ../jakku
k exec -it bb-8 -- curl resistance

Look at services and endpoints

k get svc
k get pods -o wide
k get endpoints
k get ciliumendpoints

ks exec -it $CPOD -- cilium service list
ks exec -it $CPOD -- cilium endpoint list

Clustermesh

Uncomment annotations in Jakku's resistance service to make it a global service, so bb-8 can access resistance in both locations. Then k apply -f resistance-jakku.yaml

k get endpoints
k get ciliumendpoints
k get svc
ks exec -it $CPOD -- cilium service list

Resistance service in D'Qar is annotated to prefer local, so curling from R2-D2 should only return responses from the local resistance in D'Qar.

Luke is an external endpoint

cilium endpoint add --name=ahch-to --labels=org=resistance --labels=jedi=luke --ip=172.19.100.2
kubectx kind-d-qar
k apply -f luke.yaml

k exec -it r2-d2 -- curl luke

Deploy Luke as a pod too

k apply -f jedi.yaml
k exec -it r2-d2 -- curl luke

Responses could come from the external endpoint or from the pod

Network policy

k apply -f protect.yaml

R2-D2 can curl to luke, but kylo-ren can't

About

Config files for KubeCon Amsterdam demo

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Shell 94.8%
  • Dockerfile 5.2%