Page History

URL: /v2/projects/{project-name}/composite-apps/blue-app/{version}/traffic-intent-set/inbound-intents/{serviceName}/authorization-policies

POST BODY:
{
	"metadata": {
	"name": "<>" // unique name for each intent
    "description": "Authorization Policy for inbound services"
	"userdata1": <>,
	"userdata2": <>
	}

	"spec": {
	// Access Control
	"namespaces": [] // Workloads from this namespaces can access the inbound service - {istioobject - authorizationPolicy}
	"serviceAccountAccess" : {[ "cluster.local/ns/<Namespace>/sa/sleep": ["GET": "/status"]} // {istioobject - authorizationPolicy, will be applied for the inbound service}
	
	}
}

RETURN STATUS: 201
RETURN BODY: 
{ 
  "name": "<name>"
  "Message": "Authorizations Policy created"
}

URL: /v2/projects/{project-name}/composite-apps/brown-app/{version}/traffic-group-intent/outbound-intents/
POST BODY:
{
	"metadata": {
	

URL: /v2/projects/{project-name}/composite-apps/{composite-app-name}/{version}/traffic-group-intent/outbound-intents/
POST BODY:
{
	"metadata": {
	"name": "<name>" // unique name for each intent
    "description": "connectivity intent add client communication"
	"application": "<app1>",
	"userdata1": <>,
	"userdata2": <>
	}

	spec: {
		"clientServiceName": "sleep", // Name of the client service
		"type": "istio", // options are istio, k8s and external
		"inboundServiceName": "httpbin"
		"headless": "false", // default is false. Option "True" will generate the required configs for all the instances of headless service
	}
}

RETURN STATUS: 201
RETURN BODY:
{ 
  "name": "<name>"
  "Message": "Client created"
}

URL: /v2/projects/{project-name}/composite-apps/{compositebrown-app-name}/{version}/traffic-group-intent-set/inboundoutbound-intents/

POST BODY:
{
	"metadata": {
	"name": "<httpbin><name>" // unique name for each intent
    "description": "connectivity intent foradd stateless micro-service to stateless micro-service communication"client communication"
	"application": "<app1>",
	"userdata1": <>,
	"userdata2": <>
	}

	"spec": { 
		"applicationclientServiceName": "<app1>onap.k8s.org",
	"servicename": "productpage" //actual name  // Name of the client service
		"protocoltype": "HTTP",
	external", // options are istio, k8s and external
		"headless": "false", // default is false. Option "True" will make sure generate the required configs for all the instances of the headless service will have access to the client service
	"mutualTLS
		"targetService": "httpbin.k8s.com"
	}
}

RETURN STATUS: 201
RETURN BODY:
{ 
  "name": "<name>"
  "Message": "Client created"
}

URL: /v2/projects/{project-name}/composite-apps/blue-app/{version}/traffic-intent-set/inbound-intents/

POST BODY:
{
	"metadata": {
	"name": "<httpbin>" // unique name for each intent
    "description": "connectivity intent for stateless micro-service to stateless micro-service communication"
	"userdata1": <>,
	"userdata2": <>
	}

	"spec": { 
	"application": "<app1>",
	"servicename": "productpage" //actual name of the client service
	"externalName": "productpage.k8s.com"
	"protocol": "HTTP",
	"headless": "false", // default is false. Option "True" will make sure all the instances of the headless service will have access to the client service
	"mutualTLS": "MUTUAL", // default is simple. Option MUTUAL will enforce mtls
	"port" : "80", // port on which service is exposed as through servicemesh, not the port it is actually running on
	"serviceMesh": "istio", // get it from cluster record
	"sidecar-proxy": "yes", // The features (mTLS, LB, Circuit breaking) are no avaialble to services without istio-proxy. Only inbound routing is possible.

	// Traffic management fields below are valid only if the sidecar-proxy is set to "yes"
	traffic-management-info : {
	// Traffic configuration - Loadbalancing is applicable per service. The traffic to this service is distrbuted amongst the pods under it.
	"loadbalancingType": "ConsistenHash", // "Simple" and "consistentHash" are the two modesMUTUAL", // default is simple. Option MUTUAL will enforce mtls
	"port" : "80", // port on which service is exposed as through servicemesh, not the port it is actually running on
	"serviceMesh": "istio", // get it from cluster record
	"sidecar-proxy": "yes", // The features (mTLS, LB, Circuit breaking) are no avaialble to services without istio-proxy. Only inbound routing is possible.

	// Traffic management fields below are valid only if the sidecar-proxy is set to "yes"
	traffic-management-info : {
	// Traffic configuration - Loadbalancing is applicable per service. The traffic to this service is distrbuted amongst the pods under it.
	"loadbalancingType": "ConsistenHash", // "Simple" and "consistentHash" are the two modes - {istioobject - destinationRule}
	"loadBalancerMode": "httpCookie" // Modes for consistentHash - "httpHeaderName", "httpCookie", "useSourceIP", "minimumRingSize", Modes for simple - "LEAST_CONN", "ROUND_ROBIN", 	"RANDOM", "PASSTHROUGH" // choices of the mode must be explicit - {istioobject - destinationRule}
	"httpCookie": "user2" // Name of the cookie to maitain sticky sessions - {istioobject - destinationRule}

	// Circuit Breaking
	"maxConnections": 10 //connection pool for tcp and http traffic - {istioobject - destinationRule}
	"concurrenthttp2Requests": 1000 // concurent http2 requests which can be allowed - {istioobject - destinationRule}
	"httpRequestPerConnectionloadBalancerMode": 100"httpCookie" // Modes numberfor ofconsistentHash http requests per connection. Valid only for http traffic - {istioobject - destinationRule}
	"consecutiveErrors": 8 // Default is 5.  Number of consecutive error before the host is removed - "httpHeaderName", "httpCookie", "useSourceIP", "minimumRingSize", Modes for simple - "LEAST_CONN", "ROUND_ROBIN", 	"RANDOM", "PASSTHROUGH" // choices of the mode must be explicit - {istioobject - destinationRule}
	"baseEjectionTimehttpCookie" : 15"user2" // Default is 5, Name of the cookie to maitain sticky sessions - {istioobject - destinationRule}

	"intervalSweep// Circuit Breaking
	"maxConnections": 5m,10 //timeconnection limitpool beforefor thetcp removedand hosts are added back to the load balancing pool. http traffic - {istioobject - destinationRule}
	
	}

	// credentials for mTLS.
	"Servicecertificateconcurrenthttp2Requests" : ""1000 // Presentconcurent actualhttp2 certificate here.
	"ServicePrivateKey" : "" // Present actual private key here.
	"caCertificate": ""requests which can be allowed - {istioobject - destinationRule}
	"httpRequestPerConnection": 100 // Trustednumber caCertificates used to verify the client

	// Access Control
	namespaces: [] // Workloads from this namespaces can access the inbound service
	serviceAccountAccess : {"cluster.local/ns/default/sa/sleep": {"GET": "/static"}} // {istioobject - authorizationPolicy, will be applied for the inbound serviceof http requests per connection. Valid only for http traffic - {istioobject - destinationRule}
	"consecutiveErrors": 8 // Default is 5.  Number of consecutive error before the host is removed - {istioobject - destinationRule}
	"baseEjectionTime" : 15 // Default is 5, - {istioobject - destinationRule}
	"intervalSweep": 5m, //time limit before the removed hosts are added back to the load balancing pool. - {istioobject - destinationRule}
	
	}
}

RETURN STATUS: 201
RETURN BODY: 
{ 
  "name": "<name>"
  "Message": "inbound service created"
}

URL: /v2/projects/{project-name}/composite-apps/blue-app/{version}/traffic-intent-set/inbound-intents/{serviceName}/authrization-policies

POST BODY:
{
	"metadata": {
	"name": "<httpbin>" // unique name for each intent
    "description": "Authorization Policy for the client"
	"intent add client communication"
	"application": "<app1>",
	"userdata1": <>,
	"userdata2": <>
	}

	"spec": {
	// Access Control
	"clientServiceNamenamespaces": "sleep",[] // Name of Workloads from this namespaces can access the clientinbound service
		"type"serviceAccountAccess : "istio", // options are istio, k8s and external
		"headless{"cluster.local/ns/default/sa/sleep": {"GET": "false/static",}} // default{istioobject is false. Option "True"- authorizationPolicy, will generate the required configsbe applied for all the instancesinbound of headless service}
		"serviceAccountAccess: : {"cluster.local/ns/default/sa/sleep" : {"GET": "/api/v1/products"}} // {istioobject - authorizationPolicy, will be applied for the inbound service}
	}
}

RETURN STATUS: 201
RETURN BODY:
{ 
  "name
	}
}

RETURN STATUS: 201
RETURN BODY: 
{ 
  "name": "<name>"
  "Message": "Clientinbound service created"
}

URL: /v2/projects/{project-name}/composite-apps/brown-app/{version}/traffic-group-intent/outbound-intents/httpbin
POST BODY:
{
	"metadata": {
	"name": "<name>" // unique name for each intent
    "description": "connectivity intent add client communication"
	"application": "<app1>",
	"userdata1": <>,
	"userdata2": <>
	}

	spec: {
		"clientServiceName": "bookinfo-user", // Name of the client service
		"type": "istio", // options are istio, k8s and external
		"headless": "false", // default is false. Option "True" will generate the required configs for all the instances of headless service
		"inboundServiceName": "productpage.k8s.com"		
	}
}

RETURN STATUS: 201
RETURN BODY:
{ 
  "name": "<name>"
  "Message": "Client created"
}

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: service-entry-httpbin
  namespace: <> // namespace where the client service are deployed
spec:
  hosts:
  - httpbin.<namespace_of_service>.logicalcloud02 // which is the translation of "httpbin.k8s.com"
  # template for the remote service name - <servicename.namespace.global>
  # Treat remote cluster services as part of the service mesh
  # as all clusters in the service mesh share the same root of trust.
  location: MESH_INTERNAL
  ports:
  - name: http1
    number: 8000
    protocol: http
  resolution: DNS
  addresses:
  # the IP address to which httpbin.<namespace>.<logicalcloudname> will resolve to
  # must be unique for each remote service, within a given cluster.
  # This address need not be routable. Traffic for this IP will be captured
  # by the sidecar and routed appropriately.
  - 240.0.0.2
  endpoints:
  # This is the routable address of the istio ingress gateway in cluster02
  # routed to this address.
  - address: 172.25.55.50 // IP of the istio-ingress-gateway
    ports:
      http1: 15443 //Sni. Do not change this

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: sleep-dr
  namespace: <namespace_of_sleep>
spec:
  host: "sleep"
  trafficPolicy:
    tls:
      mode: MUTUAL
      serverCertificate: /etc/certs/cert-chain.pem
      privateKey: /etc/certs/key.pem
      caCertificates: /etc/certs/root-cert.pem

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: bookinfo-productpage-dr
  namespace: <namespace_of_productpage>
spec:
  host: "productpage"
  trafficPolicy:
    tls:
	  mode: MUTUAL
      serverCertificate: /etc/certs/cert-chain.pem
      privateKey: /etc/certs/key.pem
      caCertificates: /etc/certs/root-cert.pem
    loadbalancer:
      consistentHash:
        httpCookie: "user2"
    connectionPool:
      tcp:
        maxConnections: 10
      http:
        http2MaxRequests: 1000
        maxRequestsPerConnection: 100
    outlierDetection:
      consecutiveErrors: 7
      interval: 5m
      baseEjectionTime: 15m

apiVersion:  consistentHashnetworking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
     name: service-entry-bookinfo-productpage
  namespace: httpCookie: "user2"namespace01
spec:
    connectionPoolhosts:
  - productpage.namespace01.logicalcloud01 // format  tcp:is <svc>.<namespace>.<logical_cluster_domain>
  # template for the remote service name maxConnections: 10- <servicename.namespace.global>
  # Treat remote cluster http:
services as part of the    http2MaxRequests: 1000service mesh
  # as all clusters in the maxRequestsPerConnection:service 100
mesh    outlierDetection:
      consecutiveErrors: 7
      interval: 5mshare the same root of trust.
  location: MESH_INTERNAL
  ports:
  - name: http1
      baseEjectionTime: 15m

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: sleep-dr
  namespace: namespace01
spec:
  host: "bookinfo-user"
  trafficPolicy:
    tls:
	  mode: MUTUAL
      serverCertificate: /etc/certs/cert-chain.pem
      privateKey: /etc/certs/key.pem
      caCertificates: /etc/certs/root-cert.pem

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: httpbin-dr
  namespace: namespace02
spec:
  host: "httpbin"
  trafficPolicy:
    tls:
      mode: MUTUAL
	  serverCertificate: /etc/certs/cert-chain.pem
      privateKey: /etc/certs/key.pem
      caCertificates: /etc/certs/root-cert.pem
    loadbalancer:
      consistentHash:
        httpCookie: "user1"
    connectionPool:
      tcp:
        maxConnections: 10
      http:
        http2MaxRequests: 1000
        maxRequestsPerConnection: 100
    outlierDetection:
      consecutiveErrors: 7
      interval: 5m
      baseEjectionTime: 15m

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
  namespace: namespace02
spec:
  selector      tcp:
        maxConnections: 10
      http:
        http2MaxRequests: 1000
  istio: ingressgateway # use Istio default gateway implementation
  servers:
  - port:
      maxRequestsPerConnectionnumber: 10080
      outlierDetectionname: http
      consecutiveErrorsprotocol: 7HTTP
      intervalhosts: 5m
    -  baseEjectionTime: 15m