[spike: 5d] Demonstrate AppMesh working with TLS end-to-end (with nodes)

[mogul]

User Story

In order to evaluate whether the AWS AppMesh option is viable for implementing pod-to-pod TLS, the data.gov team wants to spend up to 5 days implementing the AWS-documented example.

Acceptance Criteria

[ACs should be clearly demoable/verifiable whenever possible. Try specifying them using BDD.]

• GIVEN we have spent 3 days of effort here
  WHEN we discuss the outcome
  THEN we know whether we should try spiking on other options instead.

Background

See issue GSA-TTS/datagov-brokerpak-eks#8

Security Considerations (required)

None, this is a spike... Outcome is not expected to be in production-ready condition.

Sketch

[Notes or a checklist reflecting our understanding of the selected approach]

• Walk through deploying the yelb example (skipping Step 5 since we don't care about traffic-shaping).
• Add certificate management/TLS
  • Demonstrate non-TLS traffic into the AppMesh gateway (using NLB or ALB, whatever works; no longer have ALB controller, no longer have ingress-nginx)
  • Add TLS to the load-balancer.

[mogul]

@srinirei said:

I pushed the code to a new branch appmesh-eks-nlb and created the script in terraform folder with the name "script-eks-appmesh-nlb.sh". Please checkout and let me know if you have any questions.

[mogul]

@chris-macdermaid said:

I was able to walk through the script and get the app stood up with Route53 and the NLB. For the most part, there weren't any issues except the namespace on line 207 which should be yelb instead of yelb-appserver and I ran into an issue attaching the GatewayRoute to the yelb-ui virtual service with kubectl, but was able to do it in the UI. To not have to tear down the working version, I ran this in a sandbox where I had some leftover credits. https://appmesh-getting-started-eks.cm-data-management.com/

@srinirei said:

Thank you Chris for the confirmation. I have corrected the namespace. I will be adding the Fargate version soon.

[mogul]

Further work with AppMesh picks up in this issue from here out.