From 73ca236e7d4d6918adaefa2e939248db06b3a637 Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Fri, 20 Dec 2019 12:47:10 -0500 Subject: [PATCH] port the kubernetes sidecar branch --- .../kubernetes-sidecar-tunnel-quickstart.md | 133 ++ .../sidecar-tunnel/sidecar-diagram.svg | 1223 +++++++++++++++++ 2 files changed, 1356 insertions(+) create mode 100644 quickstart/kubernetes/sidecar-tunnel/kubernetes-sidecar-tunnel-quickstart.md create mode 100644 quickstart/kubernetes/sidecar-tunnel/sidecar-diagram.svg diff --git a/quickstart/kubernetes/sidecar-tunnel/kubernetes-sidecar-tunnel-quickstart.md b/quickstart/kubernetes/sidecar-tunnel/kubernetes-sidecar-tunnel-quickstart.md new file mode 100644 index 000000000..437bd4337 --- /dev/null +++ b/quickstart/kubernetes/sidecar-tunnel/kubernetes-sidecar-tunnel-quickstart.md @@ -0,0 +1,133 @@ +# Kubernetes Sidecar Client + +This guide shows you how to access a NetFoundry service from a pre-existing (or third party) application that's running +in a Kubernetes Pod. To provide access to the service, we will deploy the `ziti-tunnel` NetFoundry client in a sidecar +container. + +## Overview + +The [Ziti Network Quickstart](https://netfoundry.github.io/ziti-doc/ziti/quickstarts/networks-overview.html) +walked you through standing up a Ziti instance and accessing a Ziti service from your workstation with +`ziti-tunnel`. In this guide we'll deploy the same `ziti-tunnel` client, but instead of running it from the +command line we will deploy it in a sidecar container in a Kubernetes Pod. + +This guide also demonstrates `ziti-tunnel`'s internal DNS server, which allows us to access NetFoundry services +by hostname instead of IP address. + +[Here's some detail on how the various intercept modes work on Linux](https://netfoundry.github.io/ziti-doc/ziti/clients/linux.html) + + +### Solution Overview + +![Diagram of solution](./sidecar-diagram.svg) + + +## Prerequisites + +- Complete the [Ziti Network Quickstart](https://netfoundry.github.io/ziti-doc/ziti/quickstarts/networks-overview.html). This guide + uses the Ziti Controller and Ziti Edge Router that are created in the Ziti Quickstart. +- Admin-level access to a Kubernetes cluster via `kubectl`. + +## Create an Identity and AppWAN + +This guide will re-use the "eth0.ziti.cli" service that was created in the Ziti Network Quickstart. + +We will create a new identity for our client, with a new AppWAN that uses the eth0.ziti.cli service. + +Create the Identity: + + $ ziti edge controller create identity device tunnel-sidecar -o tunnel-sidecar.jwt + +Create the AppWAN: + + $ ziti edge controller create app-wan ziti-tunnel-appwan -i tunnel-sidecar -s eth0.ziti.cli + +## Create a Kubernetes Secret + +The `ziti-tunnel` sidecar will access its identity by mounting a Kubernetes secret in the container. +We can mount the JWT as a secret like this: + + $ kubectl create secret generic tunnel-sidecar.jwt --from-file=tunnel-sidecar.jwt + +## Deploy the Pod + +Deploy a Pod that runs a client application and `ziti-tunnel` as a sidecar container. For this +demonstration, the client application is `wget`. Our Pod runs `wget` in a loop so we can see content +from our NetFoundry service in the Pod's logs. + +Save the following yaml to a file named tunnel-sidecar-demo.yaml + + apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: tunnel-sidecar-pv-claim + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: ziti-tunnel-sidecar-demo + spec: + replicas: 1 + strategy: + type: Recreate + template: + spec: + containers: + - image: busybox + name: testclient + command: ["sh","-c","while true; do echo wget -qO - eth0.ziti.cli:80; sleep 5; done"] + - image: netfoundry/ziti-tunnel:0.5.7-2546 + env: + - name: NF_REG_NAME + value: tunnel-sidecar + volumeMounts: + - name: tunnel-sidecar-jwt + mountPath: "/var/run/secrets/netfoundry.io/enrollment-token" + readOnly: true + - name: ziti-tunnel-persistent-storage + mountPath: /netfoundry + restartPolicy: Always + volumes: + - name: ziti-tunnel-persistent-storage + persistentVolumeClaim: + claimName: ziti-tunnel-host-pv-claim + - name: tunnel-sidecar-jwt + secret: + secretName: tunnel-sidecar.jwt + +You'll notice that the `ziti-tunnel` sidecar container has a few requirements: + +1. The name of the identity that is assumed by `ziti-tunnel` must be passed into the container with the + `NF_REG_NAME` environment variable. +2. The secret that we created above for the enrollment token must be mounted into the container at + "/var/run/secrets/netfoundry.io/enrollment-token". +3. A persistent volume must be mounted at "/netfoundry". This volume is used to save the json file that is created + when the one-time enrollment token is used. If this volume is not persistent, you will need to provide a new + enrollment token each time the Pod is restarted! + +Once the yaml is saved, we can deploy the Pod with `kubectl` + + $ kubectl apply -f ./tunnel-sidecar-demo.yaml + +## Test the Service + +First we need to get the name of the Pod that Kubernetes deployed for us: + + $ kubectl get pods + ziti-tunnel-sidecar-demo-749c476989-6wpfn 1/1 Running 0 42s + +Then we can tail the logs for the "testclient" container: + + $ kubectl logs -f ziti-tunnel-sidecar-demo-749c476989-6wpfn --container testclient + 54.67.121.213 + 54.67.121.213 + 54.67.121.213 + +Notice that the `wget` client is using the DNS name that we provided in the Ziti service definition to make the +request. \ No newline at end of file diff --git a/quickstart/kubernetes/sidecar-tunnel/sidecar-diagram.svg b/quickstart/kubernetes/sidecar-tunnel/sidecar-diagram.svg new file mode 100644 index 000000000..d0c5ef4d8 --- /dev/null +++ b/quickstart/kubernetes/sidecar-tunnel/sidecar-diagram.svg @@ -0,0 +1,1223 @@ + + + + + + + + + + + + + + + + + + + + + + Page-1 + + + Rounded Rectangle + + + + + + + + + + + + + + + + + + + + + + Rounded Rectangle.1861 + Cluster A + + + + + + + + + + + + + + + + + + + + + + Cluster A + + Rounded Rectangle.1862 + Node + + + + + + + + + + + + + + + + + + + + + + Node + + Rounded Rectangle.1863 + PodA + + + + + + + + + + + + + + + + + + + + + + + + + PodA + + Sheet.1864 + + Rounded Rectangle.974 + Container A - Client app: wget eth0.ziti.cli + + + + + + + + + + + + + + + + + + + + + + Container A - Client app:wget eth0.ziti.cli + + Sheet.1866 + + + + Rounded Rectangle.1890 + Node + + + + + + + + + + + + + + + + + + + + + + Node + + Rounded Rectangle.1891 + Podz + + + + + + + + + + + + + + + + + + + + + + + + + Podz + + Sheet.1899 + + Rounded Rectangle.937 + Container... + + + + + + + + + + + + + + + + + + + + + + Container... + + + Rounded Rectangle.1933 + AWS Application Load Balancer + + + + + + + + + + + + + + + + + + + + + + + + + AWS Application Load Balancer + + Rounded Rectangle.1934 + Pod + + + + + + + + + + + + + + + + + + + + + + + + + Pod + + Rounded Rectangle.1935 + Container E ALB Ingress Controller + + + + + + + + + + + + + + + + + + + + + + + + + Container EALB Ingress Controller + + Sheet.1936 + + Sheet.1818 + Internet + + + + + + + Internet + + Sheet.1819 + + Sheet.1820 + + Sheet.1821 + + + + Sheet.1822 + + + + Sheet.1823 + + + + Sheet.1824 + + + + Sheet.1825 + + + + Sheet.1826 + + + + Sheet.1827 + + + + Sheet.1828 + + + + Sheet.1829 + + + + Sheet.1830 + + + + Sheet.1831 + + + + Sheet.1832 + + + + Sheet.1833 + + + + Sheet.1834 + + + + + Sheet.1835 + + + + + Sheet.1836 + + + + Sheet.1837 + + + + Sheet.1838 + + + + + Sheet.1839 + + + + + Sheet.1840 + + + + Sheet.1841 + + + + Sheet.1842 + + + + + Sheet.1843 + + + + Sheet.1844 + + + + + Sheet.1845 + + + + Sheet.1846 + + + + Sheet.1847 + + + + + Sheet.1848 + + + + + Sheet.1849 + + + + Sheet.1850 + + + + Sheet.1851 + + + + Sheet.1852 + + + + + + Sheet.1853 + NetFoundry Internet Overlay Fabric + + + + NetFoundry Internet Overlay Fabric + + + Rounded Rectangle.1883 + Container B + + + + + + + + + + + + + + + + + + + + + + Container B + + Sheet.1974 + + + + Sheet.1884 + + Sheet.1889 + NetFoundry Tunneler + + + + NetFoundry Tunneler + + Sheet.1885 + + Logo_Mark + + Sheet.1887 + + + + Sheet.1888 + + + + + + + Sheet.1976 + + Logo_Mark + + Sheet.1978 + + + + Sheet.1979 + + + + + + Rounded Rectangle.2065 + Pody + + + + + + + + + + + + + + + + + + + + + + + + + Pody + + Sheet.2066 + + Rounded Rectangle.937 + Container... + + + + + + + + + + + + + + + + + + + + + + Container... + + + Rounded Rectangle.2068 + Podx + + + + + + + + + + + + + + + + + + + + + + + + + Podx + + Sheet.2069 + + Rounded Rectangle.937 + Container... + + + + + + + + + + + + + + + + + + + + + + Container... + + + Rounded Rectangle.2072 + eth0.me service + + + + + + + + + + + + + + + + + + + + + + eth0.me service + + Sheet.2073 + + Sheet.1855 + + Sheet.1856 + + Sheet.1857 + + + + Sheet.1858 + + Sheet.1859 + + + + Sheet.1860 + + + + + + + Kubernetes_Logo_Hrz_lockup_POS.1868 + + Layer_1-2 + + Sheet.1870 + + + + Sheet.1871 + + + + text4373 + + path2985 + + + + + path2987 + + + + path2989 + + + + path2991 + + + + path2993 + + + + path2995 + + + + path2997 + + + + path2999 + + + + path3001 + + + + path3003 + + + + + + + Sheet.2063 + + Sheet.2062 + + + + + Sheet.2064 + Your NetFoundry AppWANs (Micro-Segmented Network) + + + + Your NetFoundry AppWANs (Micro-Segmented Network) + + +