Using Service Interconnect
Using Service Interconnect Red Hat Service Interconnect 1.8 Creating a service network with the CLI and YAML
skupper version client version 1.8.1-rh-1 skupper init skupper status Skupper is enabled for namespace "west" in interior mode. It is not connected to any other sites. skupper init --create-network-policy skupper token create <filename> skupper link create <filename> [-name <link-name>] skupper link status Link link1 not connected skupper link delete <link-name> skupper link create <filename> --cost <integer-cost> skupper link create token.yaml --cost 2 skupper link status link1 --verbose Cost: 2 Created: 2022-11-17 15:02:01 +0000 GMT Name: link1 Namespace: default Site: default-0d99d031-cee2-4cc6-a761-697fe0f76275 Status: Connected kubectl create deployment hello-world-backend --image quay.io/skupper/hello-world-backend skupper expose [deployment <name>|pods <selector>] skupper expose service <name> --address <skupper-service-name> skupper expose statefulset <statefulsetname> skupper expose statefulset --headless skupper expose deployment/hello-world-backend --port 8080 skupper service status -v Services exposed through Skupper: ╰─ backend:8080 (tcp) ╰─ Sites: ├─ 4d80f485-52fb-4d84-b10b-326b96e723b2(west) │ policy: disabled ╰─ 316fbe31-299b-490b-9391-7b46507d76f1(east) │ policy: disabled ╰─ Targets: ╰─ backend:8080 name=backend-9d84544df-rbzjx kubectl create deployment hello-world-backend --image quay.io/skupper/hello-world-backend skupper service create <name> <port> skupper service create hello-world-backend 8080 skupper service bind <service-name> <target-type> <target-name> skupper service bind hello-world-backend deployment hello-world-backend skupper init --enable-cluster-permissions skupper expose service <service>.<namespace> --address <service> skupper expose service backend.east-backend --port 8080 --address backend skupper expose <resource> --port <port-number> --target-namespace <namespace> skupper expose deployment/backend --port 8080 --target-namespace east-backend skupper gateway expose <service> localhost <port> skupper gateway expose mysql 192.168.1.200 3306 skupper gateway status Gateway Definition: ╰─ machine-user type:service version:1.8 ╰─ Bindings: ╰─ mydb:3306 tcp mydb:3306 localhost 3306 sudo dnf install skupper-router skupper gateway init --type <gateway-type> skupper service create <name> <port> skupper service create mydb 3306 skupper gateway bind <service> <host> <port> skupper gateway status Gateway Definitions Summary Gateway Definition: ╰─ machine-user type:service version:1.8 ╰─ Bindings: ╰─ mydb:3306 tcp mydb:3306 localhost 3306 skupper gateway forward <service> <port> skupper service create <name> <port> skupper service create database 5432 name: database 1 bindings: - name: database 2 host: localhost 3 service: address: database:5432 4 protocol: tcp 5 ports: - 5432 6 target_ports: - 5432 7 qdr-listeners: - name: amqp host: localhost port: 5672 skupper gateway generate-bundle <config-filename> <destination-directory> skupper gateway generate-bundle database.yaml ./ mkdir gateway tar -xvf <gateway-definition-file> --directory gateway cd gateway sh ./launch.py systemctl --user status <gateway-definition-name> podman inspect docker inspect skupper gateway status Gateway Definition: ╰─ machine-user type:service version:1.8 ╰─ Bindings: ╰─ mydb:3306 tcp mydb:3306 localhost 3306 skupper network status Sites: ├─ [local] a960b766-20bd-42c8-886d-741f3a9f6aa2(west) 1 │ │ namespace: west │ │ site name: west 2 │ │ version: 1.8.1 3 │ ╰─ Linked sites: │ ├─ 496ca1de-0c80-4e70-bbb4-d0d6ec2a09c0(east) │ │ direction: outgoing │ ╰─ 484cccc3-401c-4c30-a6ed-73382701b18a() │ direction: incoming ├─ [remote] 496ca1de-0c80-4e70-bbb4-d0d6ec2a09c0(east) 4 │ │ namespace: east │ │ site name: east │ │ version: 1.8.1 │ ╰─ Linked sites: │ ╰─ a960b766-20bd-42c8-886d-741f3a9f6aa2(west) 5 │ direction: incoming ╰─ [remote] 484cccc3-401c-4c30-a6ed-73382701b18a() 6 │ site name: vm-user-c3d98 │ version: 1.8.1 ╰─ Linked sites: ╰─ a960b766-20bd-42c8-886d-741f3a9f6aa2(west) direction: outgoing skupper init --create-network-policy skupper status Skupper enabled for namespace 'west'. It is not connected to any other sites. skupper expose deployment <deployment-name> --port 443 --enable-tls spec: containers: command: - "/certs/tls.key" - "/certs/tls.crt" volumeMounts: - mountPath: /certs name: certs readOnly: true volumes: - name: index-html configMap: name: index-html - name: certs secret: secretName: skupper-tls-<deployment-name> spec: template: spec: containers: volumeMounts: - name: certs mountPath: /tmp/certs/skupper-service-client volumes: - name: certs secret: secretName: skupper-service-client skupper token create token.yaml skupper link create token.yaml --cost 99999 skupper service create <name> <port> skupper service bind <service-name> <target-type> <target-name> skupper service bind hello-world-backend deployment hello-world-backend skupper expose deployment hello-world-backend --port 8080 --protocol <protocol> apiVersion: v1 kind: ConfigMap metadata: name: skupper-site data: name: my-site ingress: "none" skupper init --router-logging trace skupper init --namespace backend export SKUPPER_PLATFORM=kubernetes skupper switch podman skupper service create <name> <port> podman info | grep networkBackend sudo dnf install netavark [network] network_backend = "netavark" export SKUPPER_PLATFORM=podman skupper switch podman skupper init It is recommended to enable lingering for <username>, otherwise Skupper may not start on boot. Skupper is now installed for user '<username>'. Use 'skupper status' to get more information. loginctl enable-linger <username> skupper init --ingress-host my-cloud-vm.example.com skupper init --ingress none skupper status Skupper is enabled for "<username>" with site name "<machine-name>-<username>" in interior mode. It is not connected to any other sites. It has no exposed services. skupper token create <filename> skupper token create <filename> --ingress-host <IP/Hostname> skupper link create <filename> skupper link status skupper link create <filename> --cost <integer-cost> skupper link create token.yaml --cost 2 skupper link status link1 --verbose Cost: 2 Created: 2022-11-17 15:02:01 +0000 GMT Name: link1 Namespace: default Site: default-0d99d031-cee2-4cc6-a761-697fe0f76275 Status: Connected podman run --name backend-target --network skupper --detach --rm -p 8080:8080 quay.io/skupper/hello-world-backend skupper expose [host <hostname|ip>] skupper expose host backend-target --address backend --port 8080 skupper expose host host.containers.internal --address backend --port 8080 skupper service create backend 8080 podman run --name backend-target --network skupper --detach --rm -p 8080:8080 quay.io/skupper/hello-world-backend skupper service create <name> <port> skupper service create hello-world-backend 8080 skupper service bind <service-name> <target-type> <target-name> skupper service bind hello-world-backend host hello-world-backend skupper service create <service-name> <port number> podman ps -a --format "{{.ID}} {{.Image}} {{.Labels}}" skupper status Skupper is enabled for "<username>" with site name "<machine-name>-<username>". skupper delete Skupper is now removed for user "<username>". skupper init --enable-console --enable-flow-collector skupper status Skupper is enabled for namespace "west" in interior mode. It is not connected to any other sites. It has no exposed services. The site console url is: https://skupper-west.apps-crc.testing kubectl get secret skupper-console-users -o jsonpath={.data.admin} | base64 -d JNZWzMHtyg cat ~/.local/share/containers/storage/volumes/skupper-console-users/_data/admin JNZWzMHtyg apiVersion: v1 kind: ConfigMap metadata: name: skupper-site data: name: my-site console: "true" console-user: "admin" console-password: "changeme" flow-collector: "true" apiVersion: v1 kind: ConfigMap metadata: name: skupper-site data: name: my-site ingress: "none" apply -f ~/my-site.yml kubectl create deployment hello-world-backend --image quay.io/skupper/hello-world-backend kubectl annotate deployment backend "skupper.io/address=backend" "skupper.io/port=8080" "skupper.io/proxy=tcp" kubectl annotate service backend "skupper.io/address=van-backend" "skupper.io/port=8080" "skupper.io/proxy=tcp" "skupper.io/target=backend" skupper service status -v Services exposed through Skupper: ╰─ backend:8080 (tcp) ╰─ Sites: ├─ 4d80f485-52fb-4d84-b10b-326b96e723b2(west) │ policy: disabled ╰─ 316fbe31-299b-490b-9391-7b46507d76f1(east) │ policy: disabled ╰─ Targets: ╰─ backend:8080 name=backend-9d84544df-rbzjx apiVersion: v1 data: name: my-site console: "true" flow-collector: "true" console-authentication: internal console-user: "username" console-password: "password" cluster-local: "false" edge: "false" service-sync: "true" ingress: "none" kind: ConfigMap metadata: name: skupper-site apiVersion: v1 kind: ConfigMap metadata: name: skupper-site namespace: my-namespace data: console: "true" flow-collector: "true" console-user: "admin" console-password: "changeme" apiVersion: v1 kind: ConfigMap metadata: name: skupper-site namespace: my-namespace kubectl apply -f skupper-site.yaml kubectl get pods NAME READY STATUS RESTARTS AGE skupper-router-8c6cc6d76-27562 1/1 Running 0 40s skupper-service-controller-57cdbb56c5-vc7s2 1/1 Running 0 34s apiVersion: skupper.io/v1alpha1 kind: SkupperClusterPolicy metadata: name: cluster-policy-sample-01 spec: namespaces: - "*" allowIncomingLinks: true allowedExposedResources: - "deployment/nginx" allowedOutgoingLinksHostnames: [".*\.example.comUSD"] allowedServices: - "*" wget https://raw.githubusercontent.com/skupperproject/skupper/1.8/api/types/crds/skupper_cluster_policy_crd.yaml kubectl apply -f skupper_cluster_policy_crd.yaml customresourcedefinition.apiextensions.k8s.io/skupperclusterpolicies.skupper.io created clusterrole.rbac.authorization.k8s.io/skupper-service-controller created Skupper is enabled for namespace "<namespace>" in interior mode (with policies). kubectl get pods --all-namespaces --selector=app=skupper kubectl create clusterrolebinding skupper-service-controller-<namespace> --clusterrole=skupper-service-controller --serviceaccount=<namespace>:skupper-service-controller apiVersion: skupper.io/v1alpha1 kind: SkupperClusterPolicy metadata: name: allowincominglinks spec: namespaces: - "*" allowIncomingLinks: true apiVersion: skupper.io/v1alpha1 kind: SkupperClusterPolicy metadata: name: allowedoutgoinglinkshostnames spec: namespaces: - "*" allowedOutgoingLinksHostnames: ['.*\.example\.com'] apiVersion: skupper.io/v1alpha1 kind: SkupperClusterPolicy metadata: name: allowedservices spec: namespaces: - "*" allowedServices: ['^backend-'] apiVersion: skupper.io/v1alpha1 kind: SkupperClusterPolicy metadata: name: allowedexposedresources spec: namespaces: - "*" allowedExposedResources: ['deployment/nginx'] skupper status --namespace west Skupper is enabled for namespace "west" in interior mode. It is connected to 2 other sites. It has 1 exposed services. skupper network status Sites: ├─ [local] a960b766-20bd-42c8-886d-741f3a9f6aa2(west) │ │ namespace: west │ │ site name: west │ │ version: 1.8.1 │ ╰─ Linked sites: │ ├─ 496ca1de-0c80-4e70-bbb4-d0d6ec2a09c0(east) │ │ direction: outgoing │ ╰─ 484cccc3-401c-4c30-a6ed-73382701b18a() │ direction: incoming ├─ [remote] 496ca1de-0c80-4e70-bbb4-d0d6ec2a09c0(east) │ │ namespace: east │ │ site name: east │ │ version: 1.8.1 │ ╰─ Linked sites: │ ╰─ a960b766-20bd-42c8-886d-741f3a9f6aa2(west) │ direction: incoming ╰─ [remote] 484cccc3-401c-4c30-a6ed-73382701b18a() │ site name: vm-user-c3d98 │ version: 1.8.1 ╰─ Linked sites: ╰─ a960b766-20bd-42c8-886d-741f3a9f6aa2(west) direction: outgoing skupper service status -v Services exposed through Skupper: ╰─ backend:8080 (tcp) ╰─ Sites: ├─ 4d80f485-52fb-4d84-b10b-326b96e723b2(west) │ policy: disabled ╰─ 316fbe31-299b-490b-9391-7b46507d76f1(east) │ policy: disabled ╰─ Targets: ╰─ backend:8080 name=backend-9d84544df-rbzjx skupper debug events NAME COUNT AGE GatewayQueryRequest 3 9m12s 3 gateway request 9m12s SiteQueryRequest 3 9m12s 3 site data request 9m12s ServiceControllerEvent 9 10m24s 2 service event for west/frontend 10m24s 1 service event for west/backend 10m26s 1 Checking service for: backend 10m26s 2 Service definitions have changed 10m26s 1 service event for west/skupper-router 11m4s DefinitionMonitorEvent 15 10m24s 2 service event for west/frontend 10m24s 1 service event for west/backend 10m26s 1 Service definitions have changed 10m26s 5 deployment event for west/frontend 10m34s 1 deployment event for west/skupper-service-controller 11m4s ServiceControllerUpdateEvent 1 10m26s 1 Updating skupper-internal 10m26s ServiceSyncEvent 3 10m26s 1 Service interface(s) added backend 10m26s 1 Service sync sender connection to 11m4s amqps://skupper-router-local.west.svc.cluster.local:5671 established 1 Service sync receiver connection to 11m4s amqps://skupper-router-local.west.svc.cluster.local:5671 established IpMappingEvent 5 10m34s 1 172.17.0.7 mapped to frontend-6b4688bf56-rp9hc 10m34s 2 mapped to frontend-6b4688bf56-rp9hc 10m54s 1 172.17.0.4 mapped to 11m4s skupper-service-controller-6c97c5cf5d-6nzph 1 172.17.0.3 mapped to skupper-router-547dffdcbf-l8pdc 11m4s TokenClaimVerification 1 10m59s 1 Claim for efe3a241-3e4f-11ed-95d0-482ae336eb38 succeeded 10m59s get events | grep "deployment/skupper-service-controller" 10m Normal ServiceSyncEvent deployment/skupper-service-controller Service sync receiver connection to amqps://skupper-router-local.private1.svc.cluster.local:5671 established 10m Normal ServiceSyncEvent deployment/skupper-service-controller Service sync sender connection to amqps://skupper-router-local.private1.svc.cluster.local:5671 established 10m Normal ServiceControllerCreateEvent deployment/skupper-service-controller Creating service productcatalogservice 7m59s Normal TokenHandler deployment/skupper-service-controller Connecting using token link1 7m54s Normal TokenHandler deployment/skupper-service-controller Connecting using token link2 skupper link status --namespace east Links created from this site: ------------------------------- Link link1 is connected skupper link status --namespace west Links created from this site: ------------------------------- There are no links configured or connected Currently connected links from other sites: ---------------------------------------- A link from the namespace east on site east(536695a9-26dc-4448-b207-519f56e99b71) is connected skupper link status link1 --verbose --namespace east Cost: 1 Created: 2022-10-24 12:50:33 +0100 IST Name: link1 Namespace: east Site: east-536695a9-26dc-4448-b207-519f56e99b71 Status: Connected skupper gateway status Gateway Definition: ╰─ machine-user type:podman version:1.8 ╰─ Bindings: ╰─ mydb:3306 tcp mydb:3306 localhost 3306 podman ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 4e308ef8ee58 quay.io/skupper/skupper-router:1.8 /home/skrouterd/b... 26 seconds ago Up 27 seconds ago machine-user podman start machine-user kubectl exec deploy/skupper-service-controller -- get policies incominglink ALLOWED POLICY ENABLED ERROR ALLOWED BY false true Policy validation error: incoming links are not allowed kubectl exec deploy/skupper-service-controller -- get policies Validates existing policies Usage: get policies [command] Available Commands: expose Validates if the given resource can be exposed incominglink Validates if incoming links can be created outgoinglink Validates if an outgoing link to the given hostname is allowed service Validates if service can be created or imported kubectl exec deploy/skupper-service-controller -- get policies expose deployment nginx ALLOWED POLICY ENABLED ERROR ALLOWED BY false true Policy validation error: deployment/nginx cannot be exposed kubectl exec deploy/skupper-service-controller -- get policies expose deployment nginx ALLOWED POLICY ENABLED ERROR ALLOWED BY true true allowedexposedresources skupper debug dump my-site Skupper dump details written to compressed archive: `my-site.tar.gz` tar -xvf kind-site.tar.gz k8s-versions.txt skupper-versions.txt skupper-router-deployment.yaml skupper-router-867f5ddcd8-plrcg-skstat-g.txt skupper-router-867f5ddcd8-plrcg-skstat-c.txt skupper-router-867f5ddcd8-plrcg-skstat-l.txt skupper-router-867f5ddcd8-plrcg-skstat-n.txt skupper-router-867f5ddcd8-plrcg-skstat-e.txt skupper-router-867f5ddcd8-plrcg-skstat-a.txt skupper-router-867f5ddcd8-plrcg-skstat-m.txt skupper-router-867f5ddcd8-plrcg-skstat-p.txt skupper-router-867f5ddcd8-plrcg-router-logs.txt skupper-router-867f5ddcd8-plrcg-config-sync-logs.txt skupper-service-controller-deployment.yaml skupper-service-controller-7485756984-gvrf6-events.txt skupper-service-controller-7485756984-gvrf6-service-controller-logs.txt skupper-site-configmap.yaml skupper-services-configmap.yaml skupper-internal-configmap.yaml skupper-sasl-config-configmap.yaml skupper delete skupper init --router-cpu 5 minikube tunnel skupper init --ingress none kubectl get secret/skupper-console-users -o jsonpath={.data.admin} | base64 -d Error: Failed to create token: Policy validation error: Skupper is not enabled in namespace Token written to <path> (Note: token will only be valid for local cluster)