Flex Gateway と Istio サービスメッシュの統合

helm upgrade -i --wait --create-namespace -n istio-system istio-base istio/base --version 1.21.2 --set defaultRevision=default

helm upgrade -i --wait --create-namespace -n istio-system istiod istio/istiod --version 1.21.2

helm upgrade -i --wait --create-namespace -n istio-system istio-ingress istio/gateway --version 1.21.2

kubectl create ns flex && kubectl label ns flex istio-injection=enabled --overwrite

helm upgrade -i --wait -n flex --version 1.7.0 flex flex-gateway/flex-gateway \
--set gateway.scope=Namespace \
--set gateway.mode=connected \
--set service.type=ClusterIP \
--set service.http.port=8081 \
--set service.https.enabled=false \
--set-file registration.content=registration.yaml

kubectl -n flex get svc

kubectl create ns bookinfo \
&& kubectl label ns bookinfo istio-injection=enabled --overwrite \
&& kubectl -n bookinfo apply -l version!=v2,version!=v3 -f https://raw.githubusercontent.com/istio/istio/release-1.20/samples/bookinfo/platform/kube/bookinfo.yaml

kubectl -n bookinfo get pods

kubectl create ns test \
&& kubectl label ns test istio-injection=enabled --overwrite \
&& kubectl -n test apply -f https://raw.githubusercontent.com/istio/istio/release-1.20/samples/sleep/sleep.yaml

kubectl -n test get pods

cat <<EOF | kubectl apply -f -
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: flex
  namespace: flex
spec:
  selector:
    app: istio-ingress
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: flex
  namespace: flex
spec:
  hosts:
  - "*"
  gateways:
  - flex
  http:
  - route:
    - destination:
        host: flex
        port:
          number: 8081
    rewrite:
      uri: /ingress/
EOF

curl -v http://localhost/api/v1/products/1

< HTTP/1.1 200 OK
< server: istio-envoy
< date: Tue, 27 Feb 2024 22:06:33 GMT
< content-type: application/json
< content-length: 195
< x-envoy-upstream-service-time: 8
<
* Connection #0 to host localhost left intact
{"id": 2, "author": "William Shakespeare", "year": 1595, "type": "paperback", "pages": 200, "publisher": "PublisherA", "language": "English", "ISBN-10": "1234567890", "ISBN-13": "123-1234567890"}

cat <<EOF | kubectl apply -f -
---
apiVersion: gateway.mulesoft.com/v1alpha1
kind: ApiInstance
metadata:
  name: ingress
  namespace: flex
spec:
  address: http://0.0.0.0:8081/ingress/
  services:
    productpage:
      address: http://productpage.bookinfo.svc:9080
  policies:
  - policyRef:
      name: http-basic-authentication-flex
    config:
      username: user1
      password: password1
EOF

curl -v http://localhost/

cat <<EOF | kubectl apply -f -
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo-reviews
  namespace: istio-system
spec:
  hosts:
  - reviews.bookinfo.svc.cluster.local
  http:
  - match:
    - sourceLabels:
        app: flex
    route:
    - destination:
        host: reviews.bookinfo.svc.cluster.local
        port:
          number: 9080
  - route:
    - destination:
        host: flex.flex.svc.cluster.local
        port:
          number: 8081
    rewrite:
      uri: /bookinfo/reviews/
EOF

curl -v -u user1:password1 http://localhost/productpage

[flex-gateway-envoy][info] wasm log productpage-message-logging-flex-2.flex.productpage.flex.svc main: [policy: productpage-message-logging-flex-2.flex][api: productpage.flex.svc][req: 6e1f7c32-918d-4b6a-af3f-36a4430f80ae] [accessLog] > HTTP/1.1 GET localhost/ingress/productpage
[flex-gateway-envoy][info] wasm log bookinfo-reviews-message-logging-flex-1.flex.bookinfo-reviews.flex.svc main: [policy: bookinfo-reviews-message-logging-flex-1.flex][api: bookinfo-reviews.flex.svc][req: b23e9c64-a2aa-4464-8984-d1dd6c18f7ea] [accessLog] > HTTP/1.1 GET reviews:9080/bookinfo/reviews/reviews/0

cat <<EOF | kubectl apply -f -
---
apiVersion: gateway.mulesoft.com/v1alpha1
kind: ApiInstance
metadata:
  name: bookinfo-reviews
  namespace: flex
spec:
  address: http://0.0.0.0:8081/bookinfo/reviews/
  services:
    upstream:
      address: http://reviews.bookinfo.svc:9080
  policies:
  - policyRef:
      name: message-logging-flex
    config:
      loggingConfiguration:
      - itemName: "Request"
        itemData:
          message: "#['> ' ++ attributes.version ++ ' ' ++  attributes.method ++ ' ' ++ attributes.headers.host ++ attributes.requestUri]"
          level: "INFO"
          firstSection: true
      - itemName: "Response"
        itemData:
          message: "#['< Status=' ++ attributes.statusCode ++ ' Length=' ++ (attributes.headers['content-length'] default 'none') ++ ' Time=' ++ (attributes.headers['x-envoy-upstream-service-time'] default 'none')]"
          level: "INFO"
          secondSection: true
    order: 0
  - policyRef:
      name: rate-limiting-flex
    config:
      rateLimits:
      - timePeriodInMilliseconds: 60000
        maximumRequests: 2
      exposeHeaders: true
EOF

cat <<EOF | kubectl apply -f -
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: flex-allow
  namespace: bookinfo
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        namespaces:
        - flex
        - bookinfo
EOF

kubectl -n test exec -ti -c sleep $(kubectl -n test get pod --no-headers -o=name) -- curl -v details.bookinfo:9080/details/0

< HTTP/1.1 403 Forbidden
< content-length: 19
< content-type: text/plain
< date: Thu, 09 May 2024 15:51:11 GMT
< server: envoy
< x-envoy-upstream-service-time: 0
<
* Connection #0 to host details.bookinfo left intact
RBAC: access denied

kubectl -n flex exec -ti -c app  $(kubectl -n flex get pod --no-headers -o=name) -- flexctl check http http://details.bookinfo:9080/details/0

[flexctl][info] Access to http address 'http://details.bookinfo:9080/details/0': ok