GithubHelp home page GithubHelp logo

lab-ossm's Introduction

Red Hat OpenShift Service Mesh in Action

This repository contains the content for a Homeroom-based workshop that provides several exercises exploring Red Hat OpenShift Service Mesh (RHOSSM).

More information about Homeroom can be found here.

Contributing and Workflow

Contributions are most welcome. Please feel free to file issues.

When submitting pull requests, make sure to submit them against the develop branch. Once merged, those changes will automatically be built into a new image that lands on Quay.io: https://quay.io/repository/thoraxe/lab-ossm

Code Repository Tagging

This repository is cloned as part of a provisioning process associated with the Red Hat Product Demo System (RHPDS). As such, specific tags of this repository will always be fetched such that RHPDS can lock to a point-in-time of the repository. A normal versioning scheme that roughly aligns with the Service Mesh version should be used.

Image Tagging

The container image on Quay.io will be built continually for both the master and develop branches, resulting in image tags of latest, master, and develop.

A manual tag for production should be created when an update to what RHPDS deploys is desired. The tag for production should point at the image built from whatever code repository tag is being deployed by RHPDS. Example workflow:

  • Pull request merged to develop
  • Image built and tagged develop and latest
  • Testing performed and, if successful:
  • Pull request from develop to master
  • Image built and tagged master and latest
  • Tag master code repository with a version eg: 1.0.3
  • Tag master image in Quay.io with production and 1.0.3
  • Ensure RHPDS production is cloning repository tag 1.0.3

Deploying to your own cluster

Deploying this experience to your own cluster is not particularly difficult. You will need to understand the difference between the way the lab guide is written and the names you give your own resources in your own cluster.

We are using the prefix my- for Project names. The lab guide will be using your OpenShift username as the prefix. If you know your username is john, then you should use the prefix john- when creating Projects. That being said, you need cluster administrator access to install the operators. However, you cannot use the lab guide as kubeadmin. The kubeadmin user is an alias for kube:admin, and the colon causes the lab guide to attempt to use a serviceaccount with a colon, which is invalid, and breaks the lab guide.

If you don't already have real users in your cluster, you can use an htpasswd identity provider to create users easily and quickly.

There are three main steps to getting the lab going in your cluster.

Installing the Service Mesh operators and Control Plane

  1. Install an OpenShift 4 environment. You will need cluster-administrator access.
  2. Follow the documentation for installing the service mesh operators
  3. Create a project called my-smcp where the Service Mesh control plane will be installed.
  4. Follow the documentation for installing the service mesh control plane and install it into your my-smcp project (not istio-system).
  5. While you are waiting for the control plane to install, create a new project called my-tutorial.
  6. Follow the documentation for creating the member role being sure to use the project you created (my-tutorial) and to do so inside the my-smcp project.

Wait for the above steps to complete before continuing. You can track the progress of the Service Mesh control plane installation by looking at the control plane details (assuming defaults):

Installed Operators -> my-smcp -> Red Hat OpenShift Service Mesh -> Istio Service Mesh Control Plane -> basic install

In the Conditions area, you will see that Installed, Reconciled, and Ready are all True once the installation is successful.

Deploying the tutorial application

It will be easiest to do this from the command line. Note that the following scriptlet assumes you have created a project called my-tutorial:

oc create -n my-tutorial -f https://gist.githubusercontent.com/thoraxe/a189ade0d2dd19c8c275179b48577117/raw/02c4ea130cb6b1ebd83c7fd7a4cb2824fac179b7/curl.yaml 
oc create -n my-tutorial -f https://gist.githubusercontent.com/thoraxe/a189ade0d2dd19c8c275179b48577117/raw/02c4ea130cb6b1ebd83c7fd7a4cb2824fac179b7/customer.yaml
oc create -n my-tutorial -f https://gist.githubusercontent.com/thoraxe/a189ade0d2dd19c8c275179b48577117/raw/02c4ea130cb6b1ebd83c7fd7a4cb2824fac179b7/gateway.yaml
oc create -n my-tutorial -f https://gist.githubusercontent.com/thoraxe/a189ade0d2dd19c8c275179b48577117/raw/02c4ea130cb6b1ebd83c7fd7a4cb2824fac179b7/preference.yaml
oc create -n my-tutorial -f https://gist.githubusercontent.com/thoraxe/a189ade0d2dd19c8c275179b48577117/raw/0f55e6623bdd0a32b31be92f5b0869a0d7abf648/recommendation.yaml

Deploying the lab guide

  1. Create a Project to hold the lab guide -- lab-ossm

  2. You will need the cluster's default route subdomain to use with new-app. The following will put it into a bash variable:

     export SUBDOMAIN=$(oc get ingresses.config.openshift.io cluster -o jsonpath='{.spec.domain}')
    
  3. Then, use the new-app subcommand of the oc CLI to deploy the lab guide:

     oc new-app -n lab-ossm https://raw.githubusercontent.com/openshift-homeroom/workshop-spawner/7.1.0/templates/hosted-workshop-production.json \
     --param CLUSTER_SUBDOMAIN="$SUBDOMAIN" \
     --param SPAWNER_NAMESPACE="lab-ossm" \
     --param WORKSHOP_NAME="lab-ossm" \
     --param WORKSHOP_IMAGE="quay.io/thoraxe/lab-ossm:production" \
     --param OC_VERSION="4.3"
    

Take special note of the route that is created. It will be something like lab-ossm-lab-ossm.xxxxxx.

Access the lab guide and then make sure to login using the username and password you use to access the OpenShift environment. Since you needed cluster administrative access to install the Service Mesh operators, you're probably fine.

Caveats

None of the variables are appropriately set in this environment. You will need to pay careful attention to all commands to make sure they look like they will evaluate correctly. The various bash scripts use an environment variable JUPYTERHUB_USER as a prefix to Project names (see the note above). Make sure it is set correctly in the terminals.

lab-ossm's People

Contributors

brian-avery avatar thoraxe avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar

lab-ossm's Issues

Typo for Intro Section

In the intro section, microservices is repeated in the background section as shown in the text below:

This proxy intercepts all network communication between your microservices microservices, and is configured and managed using Istio’s control plane functionality — not your application code!

Objects already exists in Lab 8

In the "Rate Limiting" lab, I was unable to "create" the new object.

[user5:~] $ oc create -n user5-tutorial -f /opt/app-root/workshop/content/src/istiofiles/destination-rule.yml
Error from server (AlreadyExists): error when creating "/opt/app-root/workshop/content/src/istiofiles/destination-rule.yml": destinationrules.networking.istio.io "recommendation" already exists
[user5:~] $ oc replace -n user5-tutorial -f /opt/app-root/workshop/content/src/istiofiles/destination-rule.yml
destinationrule.networking.istio.io/recommendation replaced

Might be related to #11

Mutual TLS: Not Seeing Lock Icon Used as Described

The workshop has the following text:

Looking at the Kiali graph, a lock is now present on the graph of communication between customer and preference, indicating that this communication is secured via mTLS.

I follow the instructions but never actually see the lock display in Kiali's Graph section.

[RateLimiting] Rate limiting lab is broken

I'll fix this. Just tracking broken labs with GitHub issues.

The rate limiting lab is currently broken. Executing

sed -e "s/USERNAME/$JUPYTERHUB_USER/" /opt/app-root/workshop/content/src/istiofiles/recommendation_rate_limit.yml | oc apply -n opentlc-mgr-smcp -f -

Yields:

quotaspec.config.istio.io/request-count unchanged
quotaspecbinding.config.istio.io/request-count unchanged
rule.config.istio.io/quota unchanged
unable to recognize "STDIN": no matches for kind "memquota" in version "config.istio.io/v1alpha2"
unable to recognize "STDIN": no matches for kind "quota" in version "config.istio.io/v1alpha2"

Deployment using script is broken

I tried deploying the workshop myself, using the scripts in the .workshop/scripts directory, but ended up with a deployment that was broken in multiple ways:

  • %username% apparently wasn't set; I just saw an empty string being inserted in the chapters, breaking all oc commands
  • neither Service Mesh operator nor an SMCP was deployed

Maybe I was just holding this wrong? Is there even a way to deploy the full thing from just this repo?

Provide More Specific Amount of Time When Introducing a Change

It takes an appreciable amount of time for changes to be introduced that may cause a user to question whether what he or she has done is working. It would be helpful to estimate how long changes take when it is mentioned that changes will take a while. An example from the Mutual TLS section is below:

Note: It may take some time before the mesh begins to enforce the policy. If *you do not see the expected behaviors, wait a few more moments and then try *again. Patience is a virtue.

There are also sections like Routing that don't warn the user of that changes will take appreciable time to take affect. The workshop should always warn the user in this case.

Unable to delete objects in Lab 7

I Couldn't delete virtsvc and dest rules in the "Retries, Timeouts and Circuit Breaking " lab

[user5:~] $ oc delete -n user1-tutorial virtualservice.networking.istio.io/recommendation destinationrule.networking.istio.io/recommendation
Error from server (Forbidden): virtualservices.networking.istio.io "recommendation" is forbidden: User "user5" cannot delete resource "virtualservices" in API group "networking.istio.io" in the namespace "user1-tutorial" Error from server (Forbidden): destinationrules.networking.istio.io "recommendation" is forbidden: User "user5" cannot delete resource "destinationrules" in API group "networking.istio.io" in the namespace "user1-tutorial"

^ Note that I'm user5 trying to delete objects in the user1-tutorial namespace. There might be a "user1-tutorial" hard-coded somewhere.

Issue working through Kiali’s View of Jaeger Distributed Tracing

Whilst working through Kiali’s View of Jaeger Distributed Tracing - I don't see the Distributed Tracing option available.

Also receive the following from the Message Center [1]

Steps taken

  • Looked up route/URL for Jaeger UI
  • Pulled up URL in browser and accepted self-signed certs
    • Noticed no distributed tracing option in Kiali UI
    • Noticed error from message center

Attempted to remedy issue by restarting stack - issue continues.

[1]

Could not fetch Jaeger info. Turning off Jaeger integration., Info: [ Jaeger URL in cluster is not set in Kiali configuration ]
10/28/20198:12:35 PM```

Objects in OCP already exists in Lab 7

In the "Retries, Timeouts and Circuit Breaking" lab It tells you to create something that's already there.

[user5:~] $ oc create -n user5-tutorial -f /opt/app-root/workshop/content/src/istiofiles/virtual-service-recommendation-split.yml
virtualservice.networking.istio.io/recommendation created
Error from server (AlreadyExists): error when creating "/opt/app-root/workshop/content/src/istiofiles/virtual-service-recommendation-split.yml": destinationrules.networking.istio.io "recommendation" already exists

This is not a fatal error, but users might be confused. Might make a note about which "errors' are safe to ignore.

FWIW, I just used oc replace -n userX-tutorial -f ... to proceed without the warning.

Issues Rate Limiting Lab

Problem 1:

Before Starting Section -
In the previous lab, the destination rule for the recommendation was deleted so when the user runs

oc -n user1-tutorial get istio-io

It won't include the destination rule like the guide says

Problem 2:

Rate Limiting Section -
The istio resources are created in the -scmp folder, rather than the -tutorial folder and as a result the lab doesn't work. For example, the current script for user1 is

sed -e "s/USERNAME/$JUPYTERHUB_USER/" /opt/app-root/workshop/content/src/istiofiles/recommendation_rate_limit.yml \
| oc create -n user1-smcp -f -

it should be

sed -e "s/USERNAME/$JUPYTERHUB_USER/" /opt/app-root/workshop/content/src/istiofiles/recommendation_rate_limit.yml \
| oc create -n user1-tutorial -f -

[ACLs] listchecker and listentry CRDs not found in OCP 4.4

When trying to create ACLs in whitelisting step, listchecker and listentry CRDs are not found.

Issue:
$ oc apply -f lab-ossm/workshop/content/src/istiofiles/acl-whitelist.yml
rule.config.istio.io/checktorecommendation created
unable to recognize "lab-ossm/workshop/content/src/istiofiles/acl-whitelist.yml": no matches for kind "listchecker" in version "config.istio.io/v1alpha2"
unable to recognize "lab-ossm/workshop/content/src/istiofiles/acl-whitelist.yml": no matches for kind "listentry" in version "config.istio.io/v1alpha2"

Excpecting:
listchecker and listentry created. Or adapt acl-whitelist.yml according to any new CRDs ?

Environment:
OCP 4.4

destinationRule script is different from the description of page(Weighted Routing with the Service Mesh)

Description part

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: recommendation
spec:
  host: recommendation
  subsets:
  - labels:
      version: v1
    name: version-v1
  - labels:
      version: v2
    name: version-v2
  - labels:
      version: v3
    name: version-v3

has to be:

real script part

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: recommendation
  namespace: user1-tutorial
spec:
  host: recommendation
  subsets:
  - labels:
      version: v1
    name: v1
  - labels:
      version: v2
    name: v2
  - labels:
      version: v3
    name: v3

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.