deploy/istio/istio.sh

   1 #!/usr/bin/env bash
   2 set -eEux -o pipefail
   3
   4 SCRIPTDIR="$(readlink -f $(dirname ${BASH_SOURCE[0]}))"
   5 LIBDIR="$(dirname $(dirname ${SCRIPTDIR}))/env/lib"
   6
   7 source $LIBDIR/common.sh
   8
   9 BUILDDIR=${SCRIPTDIR/deploy/build}
  10 mkdir -p ${BUILDDIR}
  11
  12 function test_setup {
  13     clone_istio_repository
  14
  15     # Create a temporary kubeconfig file for the tests
  16     cluster_name=${CLUSTER_1_NAME:-management}
  17     local -r cluster_1_kubeconfig="${BUILDDIR}/${cluster_name}.conf"
  18     clusterctl -n metal3 get kubeconfig ${cluster_name} >${cluster_1_kubeconfig}
  19     cluster_name=${CLUSTER_2_NAME:-compute}
  20     local -r cluster_2_kubeconfig="${BUILDDIR}/${cluster_name}.conf"
  21     clusterctl -n metal3 get kubeconfig ${cluster_name} >${cluster_2_kubeconfig}
  22
  23     # Deploy sleep on cluster-1
  24     kubectl --kubeconfig=${cluster_1_kubeconfig}  create namespace foo
  25     kubectl --kubeconfig=${cluster_1_kubeconfig} label namespace foo istio-injection=enabled
  26     cat <<EOF | kubectl --kubeconfig=${cluster_1_kubeconfig} apply -f -
  27 apiVersion: rbac.authorization.k8s.io/v1
  28 kind: RoleBinding
  29 metadata:
  30   name: psp:privileged-foo
  31   namespace: foo
  32 roleRef:
  33   apiGroup: rbac.authorization.k8s.io
  34   kind: ClusterRole
  35   name: psp:privileged
  36 subjects:
  37 - kind: Group
  38   name: system:serviceaccounts:foo
  39   apiGroup: rbac.authorization.k8s.io
  40 EOF
  41     kubectl --kubeconfig=${cluster_1_kubeconfig} apply -n foo -f ${ISTIOPATH}/samples/sleep/sleep.yaml --wait
  42
  43     # Deploy httpbin on cluster-2
  44     kubectl --kubeconfig=${cluster_2_kubeconfig} create namespace bar
  45     kubectl --kubeconfig=${cluster_2_kubeconfig} label namespace bar istio-injection=enabled
  46     cat <<EOF | kubectl --kubeconfig=${cluster_2_kubeconfig} apply -f -
  47 apiVersion: rbac.authorization.k8s.io/v1
  48 kind: RoleBinding
  49 metadata:
  50   name: psp:privileged-bar
  51   namespace: bar
  52 roleRef:
  53   apiGroup: rbac.authorization.k8s.io
  54   kind: ClusterRole
  55   name: psp:privileged
  56 subjects:
  57 - kind: Group
  58   name: system:serviceaccounts:bar
  59   apiGroup: rbac.authorization.k8s.io
  60 EOF
  61     kubectl --kubeconfig=${cluster_2_kubeconfig} apply -n bar -f ${ISTIOPATH}/samples/httpbin/httpbin.yaml --wait
  62
  63     # Create service entry for httpbin on cluster-1
  64     cat <<EOF | kubectl --kubeconfig=${cluster_1_kubeconfig} apply -f -
  65 apiVersion: networking.istio.io/v1alpha3
  66 kind: ServiceEntry
  67 metadata:
  68   name: httpbin-bar
  69   namespace: foo
  70 spec:
  71   hosts:
  72   # DNS name selected for the service
  73   - httpbin.bar.cluster2
  74   # Treat remote cluster services as part of the service mesh
  75   # as all clusters in the service mesh share the same root of trust.
  76   location: MESH_INTERNAL
  77   ports:
  78   - name: tcp
  79     number: 8000
  80     protocol: TCP
  81   resolution: DNS
  82   addresses:
  83   # the IP address to which httpbin.bar.cluster2 will resolve to
  84   # must be unique for each remote service, within a given cluster.
  85   # This address need not be routable. Traffic for this IP will be captured
  86   # by the sidecar and routed appropriately.
  87   - 240.0.0.2
  88   endpoints:
  89   # This is the routable address of the ingress gateway in cluster2 that
  90   # sits in front of sleep.foo service. Traffic from the sidecar will be
  91   # routed to this address.
  92   - address: $(kubectl --kubeconfig=${cluster_2_kubeconfig} config view | awk -F[/:] '/server/ {print $5}')
  93     ports:
  94       tcp: 32001 # Nodeport for istio-ingressgateway for port 15433
  95 EOF
  96
  97     # Create DestinationRule for httpbin on cluster-1
  98     cat <<EOF | kubectl --kubeconfig=${cluster_1_kubeconfig} apply -f -
  99 apiVersion: networking.istio.io/v1alpha3
 100 kind: DestinationRule
 101 metadata:
 102   name: httpbin-dr
 103   namespace: foo
 104 spec:
 105   host: httpbin.bar.cluster2
 106   trafficPolicy:
 107     tls:
 108       mode: ISTIO_MUTUAL
 109 EOF
 110
 111     # Create Gateway resource on cluster-2
 112     cat <<EOF | kubectl --kubeconfig=${cluster_2_kubeconfig} apply -f -
 113 apiVersion: networking.istio.io/v1alpha3
 114 kind: Gateway
 115 metadata:
 116   name: httpbin-gateway
 117   namespace: istio-system
 118 spec:
 119   selector:
 120     istio: ingressgateway
 121   servers:
 122     - port:
 123         number: 15443
 124         name: tls
 125         protocol: TLS
 126       tls:
 127         mode: AUTO_PASSTHROUGH
 128       hosts:
 129         - "httpbin.bar.cluster2"
 130 EOF
 131
 132     # Create ServiceEntry on cluster-2 that is required to map the
 133     # remote fqdn to local fqdn
 134     cat <<EOF | kubectl --kubeconfig=${cluster_2_kubeconfig} apply -f -
 135 apiVersion: networking.istio.io/v1alpha3
 136 kind: ServiceEntry
 137 metadata:
 138   name: httpbin-remote
 139   namespace: istio-system # must be in same namespace as gateway
 140 spec:
 141   resolution: DNS
 142   location: MESH_INTERNAL
 143   ports:
 144   - name: tcp
 145     number: 8000
 146     protocol: TCP
 147   exportTo:
 148   - .
 149   hosts:
 150   - "httpbin.bar.cluster2"
 151   endpoints:
 152   - address: httpbin.bar.svc.cluster.local
 153 EOF
 154
 155     # Create DestinationRule and Virtual Service on cluster-2
 156     cat <<EOF | kubectl --kubeconfig=${cluster_2_kubeconfig} apply -f -
 157 apiVersion: networking.istio.io/v1beta1
 158 kind: DestinationRule
 159 metadata:
 160   name: httpbin-dr
 161   namespace: istio-system
 162 spec:
 163   host: "httpbin.bar.cluster2"
 164   trafficPolicy:
 165     tls:
 166       mode: ISTIO_MUTUAL
 167 EOF
 168 }
 169
 170 function httpbin_accessible_from_sleep_service {
 171     cluster_name=${CLUSTER_1_NAME:-management}
 172     local -r cluster_1_kubeconfig="${BUILDDIR}/${cluster_name}.conf"
 173     local -r sleep_pod=$(kubectl --kubeconfig=${cluster_1_kubeconfig} get -n foo pod -l app=sleep -o jsonpath={.items..metadata.name})
 174     kubectl --kubeconfig=${cluster_1_kubeconfig} exec ${sleep_pod} -n foo -c sleep -- curl -I httpbin.bar.cluster2:8000/headers
 175 }
 176
 177 function test_teardown {
 178     cluster_name=${CLUSTER_1_NAME:-management}
 179     local -r cluster_1_kubeconfig="${BUILDDIR}/${cluster_name}.conf"
 180     cluster_name=${CLUSTER_2_NAME:-compute}
 181     local -r cluster_2_kubeconfig="${BUILDDIR}/${cluster_name}.conf"
 182
 183     kubectl --kubeconfig=${cluster_2_kubeconfig} -n istio-system delete DestinationRule httpbin-dr --ignore-not-found
 184     kubectl --kubeconfig=${cluster_2_kubeconfig} -n istio-system delete ServiceEntry httpbin-remote --ignore-not-found
 185     kubectl --kubeconfig=${cluster_2_kubeconfig} -n istio-system delete Gateway httpbin-gateway --ignore-not-found
 186
 187     kubectl --kubeconfig=${cluster_1_kubeconfig} -n foo delete DestinationRule httpbin-dr --ignore-not-found
 188     kubectl --kubeconfig=${cluster_1_kubeconfig} -n foo delete ServiceEntry httpbin-bar --ignore-not-found
 189
 190     kubectl --kubeconfig=${cluster_2_kubeconfig} -n bar delete -f ${ISTIOPATH}/samples/httpbin/httpbin.yaml --ignore-not-found
 191     kubectl --kubeconfig=${cluster_2_kubeconfig} -n bar delete RoleBinding psp:privileged-bar --ignore-not-found
 192     kubectl --kubeconfig=${cluster_2_kubeconfig} delete namespace bar --ignore-not-found
 193
 194     kubectl --kubeconfig=${cluster_1_kubeconfig} -n foo delete -f ${ISTIOPATH}/samples/sleep/sleep.yaml --ignore-not-found
 195     kubectl --kubeconfig=${cluster_1_kubeconfig} -n foo delete RoleBinding psp:privileged-foo --ignore-not-found
 196     kubectl --kubeconfig=${cluster_1_kubeconfig} delete namespace foo --ignore-not-found
 197 }
 198
 199 function test_istio {
 200     test_setup
 201
 202     WAIT_FOR_INTERVAL=10s
 203     WAIT_FOR_TRIES=6
 204     wait_for httpbin_accessible_from_sleep_service
 205
 206     test_teardown
 207 }
 208
 209 case $1 in
 210     "test") test_istio ;;
 211     *) cat <<EOF
 212 Usage: $(basename $0) COMMAND
 213
 214 The "test" command looks for the CLUSTER_1_NAME and CLUSTER_2_NAME
 215 variables in the environment (default: "management" and "compute").
 216 This should be the name of the Cluster resources to execute the tests
 217 in.
 218
 219 Commands:
 220   test          - Test Istio
 221 EOF
 222        ;;
 223 esac