Page History

...

Code Block

language	js
theme	Midnight
title	POST
linenumbers	true

URL: /v2/projects/{project-name}/composite-apps/{composite-app-name}/{version}/traffic-intent-set/us-to-us-intents/

POST BODY:
{
	"metadata": {
	"name": "bookinfo-reviews<>" // unique name for each intent
    "description": "connectivity intent for stateless micro-service to stateless micro-service communication"
	"userdata1": <>,
	"userdata2": <>
	}

	"spec": { // update the memory allocation for each field as per OpenAPI standards
	"application": "<app1>",
	"servicename": "httpbin" //actual name of the client service
	"protocol": "HTTP",
	"headless": "false", // default is false. Option "True" will make sure all the instances of the headless service will have access to the client service
	"mutualTLS": "ISTIO_MUTUAL", // Support 2 modes. SIMPLE and ISTIO_MUTUAL, For external Client, it is SIMPLE and MUTUAL (caCertificate required)
	"port" : "80", // port on which service is exposed as through servicemesh, not the port it is actually running on
	"serviceMesh": "istio", // get it from cluster record
	"istio-proxy": "yes", // The features (mTLS, LB, Circuit breaking) are not avaialble to services without istio-proxy. Only inbound routing is possible.

	// Traffic configuration - Loadbalancing is applicable per service. The traffic to this service is distrbuted amongst the pods under it.
	"loadbalancingType": "ConsistenHash", // "Simple" and "consistentHash" are the two modes
	"loadBalancerMode": "httpCookie" // Modes for consistentHash - "httpHeaderName", "httpCookie", "useSourceIP", "minimumRingSize", Modes for simple - "LEAST_CONN", "ROUND_ROBIN", "RANDOM", "PASSTHROUGH" // choices of the mode must be explicit
	"httpCookie": "user1" // Name of the cookie to maitain stick sessions

	// Circuit Breaking
	"maxConnections": 10 //connection pool for tcp and http traffic
	"concurrenthttp2Requests": 1000 // concurent http2 requests which can be allowed
	"httpRequestPerConnection": 100 //number of http requests per connection. Valid only for http traffic
	"consecutiveErrors": 8 // Default is 5.  Number of consecutive error before the host is removed from load balancing pool
	"baseEjectionTime" : 15 // Default is 5, time for which the host will be removed from load balancing pool when it returns error for no of times more than "consecutiveErrors" limit
	"intervalSweep": 5m, //time limit before the removed hosts are added back to the load balancing pool.

	// credentials for mTLS. Not required in this scenario since the services are in one logical cloud with common rootCA. ISTIO_MUTUAL is enabled by default.
	"Servicecertificate" : "" // Present actual certificate here.
	"ServicePrivateKey" : "" // Present actual private key here.

	// Access Control
	namespaces: [] // Workloads from this namespaces can access the inbound service
	
	}
}

RETURN STATUS: 201
RETURN BODY: 
{ 
  "name": "<name>"
  "Message": "inbound service created"
}

...

Code Block

language	js
theme	Midnight
title	POST
linenumbers	true

URL: /v2/projects/{project-name}/composite-apps/{composite-app-name}/{version}/traffic-group-intent/uservice-to-uservice-intent/clients
POST BODY:
{
	"metadata": {
	"name": "<name>" // unique name for each intent
    "description": "connectivity intent add client communication"
	"application": "<app1>",
	"userdata1": <>,
	"userdata2": <>
	}

	spec: {
		"clientServiceName": "sleep", // Name of the client service
		"headless": "false", // default is false. Option "True" will generate the required configs for all the instances of headless service
		"mutualTLS": "ISTIO_MUTUAL"
	}
}

RETURN STATUS: 201
RETURN BODY:
{ 
  "name": "<name>"
  "Message": "Client created"
}

...

Code Block

language	js
theme	Midnight
title	POST
linenumbers	true

URL: /v2/projects/{project-name}/composite-apps/{composite-app-name}/{version}/traffic-intent-set/us-to-us-intents/

POST BODY:
{
	"metadata": {
	"name": "<httpbin><>" // unique name for each intent
    "description": "connectivity intent for stateless micro-service to stateless micro-service communication"
	"userdata1": <>,
	"userdata2": <>
	}

	"spec": { // update the memory allocation for each field as per OpenAPI standards
	"application": "<app1>",
	"servicename": "bookinfo-productpage" //actual name of the client service
	"protocol": "HTTP",
	"headless": "false", // default is false. Option "True" will make sure all the instances of the headless service will have access to the client service
	"mutualTLS": "ISTIO_MUTUAL", // Support 2 modes. SIMPLE and ISTIO_MUTUAL, For external Client, it is SIMPLE and MUTUAL (caCertificate required)
	"port" : "80", // port on which service is exposed as through servicemesh, not the port it is actually running on
	"serviceMesh": "istio", // get it from cluster record
	"istio-proxy": "yes", // The features (mTLS, LB, Circuit breaking) are no avaialble to services without istio-proxy. Only inbound routing is possible.

	// Traffic configuration - Loadbalancing is applicable per service. The traffic to this service is distrbuted amongst the pods under it.
	"loadbalancingType": "ConsistenHash", // "Simple" and "consistentHash" are the two modes
	"loadBalancerMode": "httpCookie" // Modes for consistentHash - "httpHeaderName", "httpCookie", "useSourceIP", "minimumRingSize", Modes for simple - "LEAST_CONN", "ROUND_ROBIN", "RANDOM", "PASSTHROUGH" // choices of the mode must be explicit
	"httpCookie": "user1" // Name of the cookie to maitain stick sessions

	// Circuit Breaking
	"maxConnections": 10 //connection pool for tcp and http traffic
	"concurrenthttp2Requests": 1000 // concurent http2 requests which can be allowed
	"httpRequestPerConnection": 100 //number of http requests per connection. Valid only for http traffic
	"consecutiveErrors": 8 // Default is 5.  Number of consecutive error before the host is removed from load balancing pool
	"baseEjectionTime" : 15 // Default is 5, time for which the host will be removed from load balancing pool when it returns error for no of times more than "consecutiveErrors" limit
	"intervalSweep": 5m, //time limit before the removed hosts are added back to the load balancing pool.

	// credentials for mTLS. Not required in this scenario since the services are in one logical cloud with common rootCA. ISTIO_MUTUAL is enabled by default.
	"Servicecertificate" : "" // Present actual certificate here.
	"ServicePrivateKey" : "" // Present actual private key here.

	// Access Control
	namespaces: [] // Workloads from this namespaces can access the inbound service
	
	}
}

RETURN STATUS: 201
RETURN BODY: 
{ 
  "name": "<name>"
  "Message": "inbound service created"
}

...

Code Block

language	js
theme	Midnight
title	POST
linenumbers	true

URL: /v2/projects/{project-name}/composite-apps/{composite-app-name}/{version}/traffic-group-intent/uservice-to-uservice-intent/clients
POST BODY:
{
	"metadata": {
	"name": "<name>" // unique name for each intent
    "description": "connectivity intent add client communication"
	"application": "<app1>",
	"userdata1": <>,
	"userdata2": <>
	}

	spec: {
		"clientServiceName": "sleepbookinfo-user", // Name of the client service
		"headless": "false", // default is false. Option "True" will generate the required configs for all the instances of headless service
	}
}

RETURN STATUS: 201
RETURN BODY:
{ 
  "name": "<name>"
  "Message": "Client created"
}

...

Code Block

language	js
theme	Midnight
title	GET
linenumbers	true

URL: /v2/projects/{project-name}/composite-apps/{composite-app-name}/{version}/traffic-group-intent/uservice-to-uservice-intent/clients/sleep/security/security-intent
{
	"metadata": {
	"name": "<name>" // unique name for each intent
    "description": "Security intent"
	"application": "<app1>",
	"userdata1": <>,
	"userdata2": <>
	}

	spec:{
	serviceAccountAccess : {[ "cluster.local/ns/default/sa/sleep": ["GET": "/static"],
							  "cluster.local/ns/default/sa/sleep" : ["GET": "/api/v1/products"]}
	}
}

RETURN STATUS: 201
RETURN BODY:
{ 
  "name": "<name>"
  "Message": "Security Rules created"
}

Client 02

POST - traffic intent to add clients for accessing a specific inbound service

Code Block

language	js
theme	Midnight
title	POST
linenumbers	true

URL: /v2/projects/{project-name}/composite-apps/{composite-app-name}/{version}/traffic-group-intent/uservice-to-uservice-intent/clients
POST BODY:
{
	"metadata": {
	"name": "<name>" // unique name for each intent
    "description": "connectivity intent add client communication"
	"application": "<app1>",
	"userdata1": <>,
	"userdata2": <>
	}

	spec: {
		"clientServiceName": "bookinfo-user", // Name of the client service
		"headless": "false", // default is false. Option "True" will generate the required configs for all the instances of headless service
	}
}

RETURN STATUS: 201
RETURN BODY:
{ 
  "name": "<name>"
  "Message": "Client created"
}

Add Security details for client 02

WARNING - This task requires mutual TLS enabled because the following examples use principal and namespace in the policies

Code Block

language	js
theme	Midnight
title	GET
linenumbers	true

URL: /v2/projects/{project-name}/composite-apps/{composite-app-name}/{version}/traffic-group-intent/uservice-to-uservice-intent/clients/sleep/security/security-intent
{
	"metadata": {
	"name": "<name>" // unique name for each intent
    "description": "Security intent"
	"application": "<app1>",
	"userdata1": <>,
	"userdata2": <>
	}

	spec:{
	serviceAccountAccess : {[ "cluster.local/ns/default/sa/sleep": ["GET": "/api/v1/products"],
							  "cluster.local/ns/default/sa/sleep" : ["GET": "/static"]}
	}
}

RETURN STATUS: 201
RETURN BODY:
{ 
  "name": "<name>"
  "Message": "Security Rules created"
}

Generate Istio object resources

...

sleep

...

destinationRule for simple TLS, Loadbalancing and circuit breaking

AuthorizationPolicy for Access Control

...

Generate Istio object resources

Name of the Cluster

Microservice

Istio Configuration

Comments

Cluster01

httpbin
sleep
bookinfo-productpage
bookinfo-user

Microservice	Resource
httpbin	destinationRule for simple TLS, Loadbalancing and circuit breaking AuthorizationPolicy for Access Control
sleep	destinationRule for TLS
bookinfo-productpage	destinationRule for simple TLS, Loadbalancing and circuit breaking AuthorizationPolicy for Access Control
bookinfo-user	destinationRule for TLS

Cluster01 Resources

1. DestinationRule for TLS, Loadbalancing and circuit breaking - productpage

Microservice	Resource
httpbin	destinationRule for simple TLS, Loadbalancing and circuit breaking AuthorizationPolicy for Access Control
sleep	destinationRule for TLS
bookinfo-user	destinationRule for TLS
common	serviceEntry (bookinfo-productpage)

Cluster01 Resources

1. ServiceEntry - To enable access to httpbin

Code Block

language	yml
theme	Eclipse
title	ServiceEntry
linenumbers	true

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: servicename-httpbin
spec:
  hosts:
  - httpbin.default.global
  # template for the remote service name - <servicename.namespace.global>
  # Treat remote cluster services as part of the service mesh
  # as all clusters in the service mesh share the same root of trust.
  location: MESH_INTERNAL
  ports:
  - name: http1
    number: 8000
    protocol: http
  resolution: DNS
  addresses:
  # the IP address to which httpbin.<namespace>.<logicalcloudname> will resolve to
  # must be unique for each remote service, within a given cluster.
  # This address need not be routable. Traffic for this IP will be captured
  # by the sidecar and routed appropriately.
  - 240.0.0.2
  endpoints:
  # This is the routable address of the istio ingress gateway in cluster02
  # routed to this address.
  - address: 172.25.55.50
    ports:
      http1: 15443 //Sni. Do not change this

2. DestinationRule for TLS, Loadbalancing and circuit breaking - productpage

Code Block

language	yml
theme	Eclipse
title	DestinationRule
linenumbers	true

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: bookinfo-productpage-dr
  namespace: default
spec:
  host: "productpage.default.svc.cluster.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
    loadbalancer:
      consistentHash:
        httpCookie: "user2"
    connectionPool:
      tcp:
        maxConnections: 10
      http:
        http2MaxRequests: 1000
        maxRequestsPerConnection: 100
    outlierDetection:
      consecutiveErrors: 7
      interval: 5m
      baseEjectionTime: 15m

3. AuthorizationPolicy

Code Block

language	yml
theme	Eclipse
title	AuthorizationPolicy
linenumbers	true

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: deny-all
 namespace: default
spec:
  selector:
   matchLabels:
     app: productpage
  rules:
  - from:
    - source:
        principals: ["cluster.global/ns/default/sa/sleep", "cluster.global/ns/default/sa/bookinfo-user" ]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/static*"]
    - operation:
        methods: ["GET"]
        paths: ["/api/v1/products"]

...

Code Block

language	yml
theme	Eclipse
title	DestinationRule
linenumbers	true

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: sleepbookinfo-productpage-dr
  namespace: default
spec:
  host: "sleepproductpage.default.svc.cluster.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
    trafficPolicyloadbalancer:
    tls  consistentHash:
      mode  httpCookie: ISTIO_MUTUAL

Cluster 02 Resources

1. ServiceEntry - To enable access to bookinfo-productpage

Code Block

language	yml
theme	Eclipse
title	ServiceEntry
linenumbers	true

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: servicename-bookinfo-productpage
spec:
  hosts:
  - productpage.default.global
  # template for the remote service name - <servicename.namespace.global>
  # Treat remote cluster services as part of the service mesh
  # as all clusters in the service mesh share the same root of trust.
  location: MESH_INTERNAL
  ports:
  - name: http1
    number: 8000
    protocol: http
  resolution: DNS
  addresses:
  # the IP address to which httpbin.<namespace>.<logicalcloudname> will resolve to
  # must be unique for each remote service, within a given cluster.
  # This address need not be routable. Traffic for this IP will be captured
  # by the sidecar and routed appropriately.
  - 240.0.0.3
  endpoints:
  # This is the routable address of the istio ingress gateway in cluster02
  # routed to this address.
  - address: 172.25.55.210
    ports:
      http1: 15443 //Sni. Do not change this

...

"user2"
    connectionPool:
      tcp:
        maxConnections: 10
      http:
        http2MaxRequests: 1000
        maxRequestsPerConnection: 100
    outlierDetection:
      consecutiveErrors: 7
      interval: 5m
      baseEjectionTime: 15m

2. AuthorizationPolicy

Code Block

language	yml
theme	Eclipse
title	AuthorizationPolicy
linenumbers	true

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: deny-all
 namespace: default
spec:
  selector:
   matchLabels:
     app: productpage
  rules:
  - from:
    - source:
        principals: ["cluster.global/ns/default/sa/sleep", "cluster.global/ns/default/sa/bookinfo-user" ]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/static*"]
    - operation:
        methods: ["GET"]
        paths: ["/api/v1/products"]

3. DestinationRule for TLS - bookinfo-user

Code Block

language	yml
theme	Eclipse
title	DestinationRule
linenumbers	true

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: bookinfo-user
  namespace: default
spec:
  host: "bookinfo-user.default.svc.cluster.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

4. DestinationRule (httpbin) for simple TLS, Loadbalancing and circuit breaking

Code Block

language	yml
theme	Eclipse
title	DestinationRule
linenumbers	true

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: httpbin-dr
  namespace: default
spec:
  host: "httpbin.default.svc.cluster.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
    loadbalancer:
      consistentHash:
        httpCookie: "user1"
    connectionPool:
      tcp:
        maxConnections: 10
      http:
        http2MaxRequests: 1000
        maxRequestsPerConnection: 100
    outlierDetection:
      consecutiveErrors: 7
      interval: 5m
      baseEjectionTime: 15m

...

5. AuthorizationPolicy

Code Block

language	yml
theme	Eclipse
title	AuthorizationPolicy
linenumbers	true

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: deny-all
 namespace: default
spec:
  selector:
   matchLabels:
     app: httpbin
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/default/sa/sleep"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/status*"]
    - operation:
        methods: ["POST"]
        paths: ["/headers"]

...

6. DestinationRule for TLS - sleep

Code Block

language	yml
theme	Eclipse
title	DestinationRule
linenumbers	true

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: sleep-dr
  namespace: default
spec:
  host: "sleep.default.svc.cluster.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

...

Space shortcuts

Page tree

Versions Compared

Old Version 2

New Version 3

Key

Client 02

Add Security details for client 02

Cluster01 Resources

1. DestinationRule for TLS, Loadbalancing and circuit breaking - productpage

Cluster01 Resources

1. ServiceEntry - To enable access to httpbin

2. DestinationRule for TLS, Loadbalancing and circuit breaking - productpage

3. AuthorizationPolicy

Cluster 02 Resources

1. ServiceEntry - To enable access to bookinfo-productpage

2. AuthorizationPolicy

3. DestinationRule for TLS - bookinfo-user

4. DestinationRule (httpbin) for simple TLS, Loadbalancing and circuit breaking

5. AuthorizationPolicy

6. DestinationRule for TLS - sleep