From f6ae2fdae7385c7b86d8e9f0192102c4e22c7403 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Charles-Edouard=20Br=C3=A9t=C3=A9ch=C3=A9?= Date: Mon, 11 Mar 2024 17:25:18 +0100 Subject: [PATCH 1/2] docs: improve demo readme MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Charles-Edouard Brétéché --- demo/istio/README.md | 158 +++++++++++++++++- demo/istio/bootstrap.sh | 2 - ...o-service.yaml => sample-application.yaml} | 0 3 files changed, 151 insertions(+), 9 deletions(-) rename demo/istio/manifests/{echo-service.yaml => sample-application.yaml} (100%) diff --git a/demo/istio/README.md b/demo/istio/README.md index b34bc43c..673cefcc 100644 --- a/demo/istio/README.md +++ b/demo/istio/README.md @@ -1,22 +1,167 @@ # Istio Demo -This Istio Demo is prototype of the kyverno envoy plugin . +This Istio Demo is prototype of the kyverno envoy plugin. ## Overview The goal of the demo to show user how kyverno-envoy-plugin will work with istio and how it can be used to enforce policies to the traffic between services. The Kyverno-envoy-plugin allows configuring these Envoy proxies to query Kyverno-json for policy decisions on incoming requests. -## Contains - -- A manifests folder with everything we need to run the demo . -- bootstrap.sh creates the cluster and installs istio . +## Demo instructions + +### Required tools + +1. [`kind`](https://kind.sigs.k8s.io/) +1. [`kubectl`](https://kubernetes.io/docs/tasks/tools/install-kubectl/) +1. [`helm`](https://helm.sh/docs/intro/install/) + +### Create a local cluster and install Istio + +The [bootstrap.sh](bootstrap.sh) script contains everything needed to create a local cluster and install Istio. + +```console +# create a local cluster and install istio +./bootstrap.sh +``` + +### Sample application + +Manifests for the sample application are available in [sample-application.yaml](manifests/sample-application.yaml). + +```console +# deploy sample application +kubectl apply -f ./manifests/sample-application.yaml +``` + +### Calling the sample application + +We are going to call the sample application using a pod in the cluster. + +```console +kubectl run test -it --rm --restart=Never --image=busybox -- wget -q --output-document - echo.demo.svc.cluster.local:8080/foo + +{ + "path": "/foo", + "headers": { + "host": "echo.demo.svc.cluster.local:8080", + "user-agent": "Wget", + "x-forwarded-proto": "http", + "x-request-id": "1badcd84-75eb-4911-9835-b3588e3c5eee", + "x-b3-traceid": "904f847c3db71758fa4076e48440800a", + "x-b3-spanid": "fa4076e48440800a", + "x-b3-sampled": "0" + }, + "method": "GET", + "body": "", + "fresh": false, + "hostname": "echo.demo.svc.cluster.local", + "ip": "::ffff:127.0.0.6", + "ips": [], + "protocol": "http", + "query": {}, + "subdomains": [ + "svc", + "demo", + "echo" + ], + "xhr": false, + "os": { + "hostname": "echo-6847f9f85-wbgbx" + }, + "connection": {} +} +``` + +### Authorization policy + +Now we can deploy an istio `AuthorizationPolicy`: + +```console +# deploy authorisation policy +kubectl apply -f - < Date: Mon, 11 Mar 2024 21:53:42 +0100 Subject: [PATCH 2/2] chore: nits MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Charles-Edouard Brétéché --- demo/istio/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/demo/istio/README.md b/demo/istio/README.md index 673cefcc..774a8e98 100644 --- a/demo/istio/README.md +++ b/demo/istio/README.md @@ -37,7 +37,7 @@ kubectl apply -f ./manifests/sample-application.yaml We are going to call the sample application using a pod in the cluster. ```console -kubectl run test -it --rm --restart=Never --image=busybox -- wget -q --output-document - echo.demo.svc.cluster.local:8080/foo +kubectl run test -it --rm --restart=Never --image=busybox -- wget -q --output-document - echo.demo.svc.cluster.local:8080/foo { "path": "/foo", @@ -103,14 +103,14 @@ The provider will be registered later in the istio config map. Calling the sample application again at the `/foo` path will return `403 Forbidden`. ```console -kubectl run test -it --rm --restart=Never --image=busybox -- wget -q --output-document - echo.demo.svc.cluster.local:8080/foo +kubectl run test -it --rm --restart=Never --image=busybox -- wget -q --output-document - echo.demo.svc.cluster.local:8080/foo wget: server returned error: HTTP/1.1 403 Forbidden ``` Note that calling another path (like `/bar`) succeeds as it's not part of the policy. ```console -kubectl run test -it --rm --restart=Never --image=busybox -- wget -q --output-document - echo.demo.svc.cluster.local:8080/bar +kubectl run test -it --rm --restart=Never --image=busybox -- wget -q --output-document - echo.demo.svc.cluster.local:8080/bar { "path": "/bar",