Using Service Interconnect Red Hat Service Interconnect 1.8 Creating a service network with the CLI and YAML

Commands:
skupper version client version 1.8.1-rh-1
skupper init
skupper status
Skupper is enabled for namespace "west" in interior mode. It is not connected to any other sites.
skupper init --create-network-policy
skupper token create <filename>
skupper link create <filename> [-name <link-name>]
skupper link status Link link1 not connected
skupper link delete <link-name>
skupper link create <filename> --cost <integer-cost>
skupper link create token.yaml --cost 2
skupper link status link1 --verbose
Cost: 2 Created: 2022-11-17 15:02:01 +0000 GMT Name: link1 Namespace: default Site: default-0d99d031-cee2-4cc6-a761-697fe0f76275 Status: Connected
kubectl create deployment hello-world-backend --image quay.io/skupper/hello-world-backend
skupper expose [deployment <name>|pods <selector>]
skupper expose service <name> --address <skupper-service-name>
skupper expose statefulset <statefulsetname>
skupper expose statefulset --headless
skupper expose deployment/hello-world-backend --port 8080
skupper service status -v Services exposed through Skupper: ╰─ backend:8080 (tcp) ╰─ Sites: ├─ 4d80f485-52fb-4d84-b10b-326b96e723b2(west) │ policy: disabled ╰─ 316fbe31-299b-490b-9391-7b46507d76f1(east) │ policy: disabled ╰─ Targets: ╰─ backend:8080 name=backend-9d84544df-rbzjx
kubectl create deployment hello-world-backend --image quay.io/skupper/hello-world-backend
skupper service create <name> <port>
skupper service create hello-world-backend 8080
skupper service bind <service-name> <target-type> <target-name>
skupper service bind hello-world-backend deployment hello-world-backend
skupper init --enable-cluster-permissions
skupper expose service <service>.<namespace> --address <service>
skupper expose service backend.east-backend --port 8080 --address backend
skupper expose <resource> --port <port-number> --target-namespace <namespace>
skupper expose deployment/backend --port 8080 --target-namespace east-backend
skupper gateway expose <service> localhost <port>
skupper gateway expose mysql 192.168.1.200 3306
skupper gateway status Gateway Definition: ╰─ machine-user type:service version:1.8 ╰─ Bindings: ╰─ mydb:3306 tcp mydb:3306 localhost 3306
sudo dnf install skupper-router
skupper gateway init --type <gateway-type>
skupper service create <name> <port>
skupper service create mydb 3306
skupper gateway bind <service> <host> <port>
skupper gateway status
Gateway Definitions Summary Gateway Definition: ╰─ machine-user type:service version:1.8 ╰─ Bindings: ╰─ mydb:3306 tcp mydb:3306 localhost 3306
skupper gateway forward <service> <port>
skupper service create <name> <port>
skupper service create database 5432
name: database 1 bindings: - name: database 2 host: localhost 3 service: address: database:5432 4 protocol: tcp 5 ports: - 5432 6 target_ports: - 5432 7 qdr-listeners: - name: amqp host: localhost port: 5672
skupper gateway generate-bundle <config-filename> <destination-directory>
skupper gateway generate-bundle database.yaml ./
mkdir gateway tar -xvf <gateway-definition-file> --directory gateway cd gateway sh ./launch.py
systemctl --user status <gateway-definition-name>
podman inspect
docker inspect
skupper gateway status Gateway Definition: ╰─ machine-user type:service version:1.8 ╰─ Bindings: ╰─ mydb:3306 tcp mydb:3306 localhost 3306
skupper network status
Sites: ├─ [local] a960b766-20bd-42c8-886d-741f3a9f6aa2(west) 1 │ │ namespace: west │ │ site name: west 2 │ │ version: 1.8.1 3 │ ╰─ Linked sites: │ ├─ 496ca1de-0c80-4e70-bbb4-d0d6ec2a09c0(east) │ │ direction: outgoing │ ╰─ 484cccc3-401c-4c30-a6ed-73382701b18a() │ direction: incoming ├─ [remote] 496ca1de-0c80-4e70-bbb4-d0d6ec2a09c0(east) 4 │ │ namespace: east │ │ site name: east │ │ version: 1.8.1 │ ╰─ Linked sites: │ ╰─ a960b766-20bd-42c8-886d-741f3a9f6aa2(west) 5 │ direction: incoming ╰─ [remote] 484cccc3-401c-4c30-a6ed-73382701b18a() 6 │ site name: vm-user-c3d98 │ version: 1.8.1 ╰─ Linked sites: ╰─ a960b766-20bd-42c8-886d-741f3a9f6aa2(west) direction: outgoing
skupper init --create-network-policy
skupper status
Skupper enabled for namespace 'west'. It is not connected to any other sites.
skupper expose deployment <deployment-name> --port 443 --enable-tls
spec: containers: command: - "/certs/tls.key" - "/certs/tls.crt" volumeMounts: - mountPath: /certs name: certs readOnly: true volumes: - name: index-html configMap: name: index-html - name: certs secret: secretName: skupper-tls-<deployment-name>
spec: template: spec: containers: volumeMounts: - name: certs mountPath: /tmp/certs/skupper-service-client volumes: - name: certs secret: secretName: skupper-service-client
skupper token create token.yaml
skupper link create token.yaml --cost 99999
skupper service create <name> <port>
skupper service bind <service-name> <target-type> <target-name>
skupper service bind hello-world-backend deployment hello-world-backend
skupper expose deployment hello-world-backend --port 8080 --protocol <protocol>
apiVersion: v1 kind: ConfigMap metadata: name: skupper-site data: name: my-site ingress: "none"
skupper init --router-logging trace
skupper init --namespace backend
export SKUPPER_PLATFORM=kubernetes
skupper switch podman
skupper service create <name> <port>
podman info | grep networkBackend
sudo dnf install netavark
[network] network_backend = "netavark"
export SKUPPER_PLATFORM=podman
skupper switch podman
skupper init
It is recommended to enable lingering for <username>, otherwise Skupper may not start on boot. Skupper is now installed for user '<username>'. Use 'skupper status' to get more information.
loginctl enable-linger <username>
skupper init --ingress-host my-cloud-vm.example.com
skupper init --ingress none
skupper status Skupper is enabled for "<username>" with site name "<machine-name>-<username>" in interior mode. It is not connected to any other sites. It has no exposed services.
skupper token create <filename>
skupper token create <filename> --ingress-host <IP/Hostname>
skupper link create <filename>
skupper link status
skupper link create <filename> --cost <integer-cost>
skupper link create token.yaml --cost 2
skupper link status link1 --verbose
Cost: 2 Created: 2022-11-17 15:02:01 +0000 GMT Name: link1 Namespace: default Site: default-0d99d031-cee2-4cc6-a761-697fe0f76275 Status: Connected
podman run --name backend-target --network skupper --detach --rm -p 8080:8080 quay.io/skupper/hello-world-backend
skupper expose [host <hostname|ip>]
skupper expose host backend-target --address backend --port 8080
skupper expose host host.containers.internal --address backend --port 8080
skupper service create backend 8080
podman run --name backend-target --network skupper --detach --rm -p 8080:8080 quay.io/skupper/hello-world-backend
skupper service create <name> <port>
skupper service create hello-world-backend 8080
skupper service bind <service-name> <target-type> <target-name>
skupper service bind hello-world-backend host hello-world-backend
skupper service create <service-name> <port number>
podman ps -a --format "{{.ID}} {{.Image}} {{.Labels}}"
skupper status Skupper is enabled for "<username>" with site name "<machine-name>-<username>".
skupper delete Skupper is now removed for user "<username>".
skupper init --enable-console --enable-flow-collector
skupper status Skupper is enabled for namespace "west" in interior mode. It is not connected to any other sites. It has no exposed services. The site console url is: https://skupper-west.apps-crc.testing
kubectl get secret skupper-console-users -o jsonpath={.data.admin} | base64 -d JNZWzMHtyg
cat ~/.local/share/containers/storage/volumes/skupper-console-users/_data/admin JNZWzMHtyg
apiVersion: v1 kind: ConfigMap metadata: name: skupper-site data: name: my-site console: "true" console-user: "admin" console-password: "changeme" flow-collector: "true"
apiVersion: v1 kind: ConfigMap metadata: name: skupper-site data: name: my-site ingress: "none"
apply -f ~/my-site.yml
kubectl create deployment hello-world-backend --image quay.io/skupper/hello-world-backend
kubectl annotate deployment backend "skupper.io/address=backend" "skupper.io/port=8080" "skupper.io/proxy=tcp"
kubectl annotate service backend "skupper.io/address=van-backend" "skupper.io/port=8080" "skupper.io/proxy=tcp" "skupper.io/target=backend"
skupper service status -v Services exposed through Skupper: ╰─ backend:8080 (tcp) ╰─ Sites: ├─ 4d80f485-52fb-4d84-b10b-326b96e723b2(west) │ policy: disabled ╰─ 316fbe31-299b-490b-9391-7b46507d76f1(east) │ policy: disabled ╰─ Targets: ╰─ backend:8080 name=backend-9d84544df-rbzjx
apiVersion: v1 data: name: my-site console: "true" flow-collector: "true" console-authentication: internal console-user: "username" console-password: "password" cluster-local: "false" edge: "false" service-sync: "true" ingress: "none" kind: ConfigMap metadata: name: skupper-site
apiVersion: v1 kind: ConfigMap metadata: name: skupper-site namespace: my-namespace data: console: "true" flow-collector: "true" console-user: "admin" console-password: "changeme"
apiVersion: v1 kind: ConfigMap metadata: name: skupper-site namespace: my-namespace
kubectl apply -f skupper-site.yaml
kubectl get pods NAME READY STATUS RESTARTS AGE skupper-router-8c6cc6d76-27562 1/1 Running 0 40s skupper-service-controller-57cdbb56c5-vc7s2 1/1 Running 0 34s
apiVersion: skupper.io/v1alpha1 kind: SkupperClusterPolicy metadata: name: cluster-policy-sample-01 spec: namespaces: - "*" allowIncomingLinks: true allowedExposedResources: - "deployment/nginx" allowedOutgoingLinksHostnames: [".*\.example.comUSD"] allowedServices: - "*"
wget https://raw.githubusercontent.com/skupperproject/skupper/1.8/api/types/crds/skupper_cluster_policy_crd.yaml
kubectl apply -f skupper_cluster_policy_crd.yaml customresourcedefinition.apiextensions.k8s.io/skupperclusterpolicies.skupper.io created clusterrole.rbac.authorization.k8s.io/skupper-service-controller created
Skupper is enabled for namespace "<namespace>" in interior mode (with policies).
kubectl get pods --all-namespaces --selector=app=skupper
kubectl create clusterrolebinding skupper-service-controller-<namespace> --clusterrole=skupper-service-controller --serviceaccount=<namespace>:skupper-service-controller
apiVersion: skupper.io/v1alpha1 kind: SkupperClusterPolicy metadata: name: allowincominglinks spec: namespaces: - "*" allowIncomingLinks: true
apiVersion: skupper.io/v1alpha1 kind: SkupperClusterPolicy metadata: name: allowedoutgoinglinkshostnames spec: namespaces: - "*" allowedOutgoingLinksHostnames: ['.*\.example\.com']
apiVersion: skupper.io/v1alpha1 kind: SkupperClusterPolicy metadata: name: allowedservices spec: namespaces: - "*" allowedServices: ['^backend-']
apiVersion: skupper.io/v1alpha1 kind: SkupperClusterPolicy metadata: name: allowedexposedresources spec: namespaces: - "*" allowedExposedResources: ['deployment/nginx']
skupper status --namespace west Skupper is enabled for namespace "west" in interior mode. It is connected to 2 other sites. It has 1 exposed services.
skupper network status Sites: ├─ [local] a960b766-20bd-42c8-886d-741f3a9f6aa2(west) │ │ namespace: west │ │ site name: west │ │ version: 1.8.1 │ ╰─ Linked sites: │ ├─ 496ca1de-0c80-4e70-bbb4-d0d6ec2a09c0(east) │ │ direction: outgoing │ ╰─ 484cccc3-401c-4c30-a6ed-73382701b18a() │ direction: incoming ├─ [remote] 496ca1de-0c80-4e70-bbb4-d0d6ec2a09c0(east) │ │ namespace: east │ │ site name: east │ │ version: 1.8.1 │ ╰─ Linked sites: │ ╰─ a960b766-20bd-42c8-886d-741f3a9f6aa2(west) │ direction: incoming ╰─ [remote] 484cccc3-401c-4c30-a6ed-73382701b18a() │ site name: vm-user-c3d98 │ version: 1.8.1 ╰─ Linked sites: ╰─ a960b766-20bd-42c8-886d-741f3a9f6aa2(west) direction: outgoing
skupper service status -v Services exposed through Skupper: ╰─ backend:8080 (tcp) ╰─ Sites: ├─ 4d80f485-52fb-4d84-b10b-326b96e723b2(west) │ policy: disabled ╰─ 316fbe31-299b-490b-9391-7b46507d76f1(east) │ policy: disabled ╰─ Targets: ╰─ backend:8080 name=backend-9d84544df-rbzjx
skupper debug events NAME COUNT AGE GatewayQueryRequest 3 9m12s 3 gateway request 9m12s SiteQueryRequest 3 9m12s 3 site data request 9m12s ServiceControllerEvent 9 10m24s 2 service event for west/frontend 10m24s 1 service event for west/backend 10m26s 1 Checking service for: backend 10m26s 2 Service definitions have changed 10m26s 1 service event for west/skupper-router 11m4s DefinitionMonitorEvent 15 10m24s 2 service event for west/frontend 10m24s 1 service event for west/backend 10m26s 1 Service definitions have changed 10m26s 5 deployment event for west/frontend 10m34s 1 deployment event for west/skupper-service-controller 11m4s ServiceControllerUpdateEvent 1 10m26s 1 Updating skupper-internal 10m26s ServiceSyncEvent 3 10m26s 1 Service interface(s) added backend 10m26s 1 Service sync sender connection to 11m4s amqps://skupper-router-local.west.svc.cluster.local:5671 established 1 Service sync receiver connection to 11m4s amqps://skupper-router-local.west.svc.cluster.local:5671 established IpMappingEvent 5 10m34s 1 172.17.0.7 mapped to frontend-6b4688bf56-rp9hc 10m34s 2 mapped to frontend-6b4688bf56-rp9hc 10m54s 1 172.17.0.4 mapped to 11m4s skupper-service-controller-6c97c5cf5d-6nzph 1 172.17.0.3 mapped to skupper-router-547dffdcbf-l8pdc 11m4s TokenClaimVerification 1 10m59s 1 Claim for efe3a241-3e4f-11ed-95d0-482ae336eb38 succeeded 10m59s
get events | grep "deployment/skupper-service-controller" 10m Normal ServiceSyncEvent deployment/skupper-service-controller Service sync receiver connection to amqps://skupper-router-local.private1.svc.cluster.local:5671 established 10m Normal ServiceSyncEvent deployment/skupper-service-controller Service sync sender connection to amqps://skupper-router-local.private1.svc.cluster.local:5671 established 10m Normal ServiceControllerCreateEvent deployment/skupper-service-controller Creating service productcatalogservice 7m59s Normal TokenHandler deployment/skupper-service-controller Connecting using token link1 7m54s Normal TokenHandler deployment/skupper-service-controller Connecting using token link2
skupper link status --namespace east Links created from this site: ------------------------------- Link link1 is connected
skupper link status --namespace west Links created from this site: ------------------------------- There are no links configured or connected Currently connected links from other sites: ---------------------------------------- A link from the namespace east on site east(536695a9-26dc-4448-b207-519f56e99b71) is connected
skupper link status link1 --verbose --namespace east Cost: 1 Created: 2022-10-24 12:50:33 +0100 IST Name: link1 Namespace: east Site: east-536695a9-26dc-4448-b207-519f56e99b71 Status: Connected
skupper gateway status Gateway Definition: ╰─ machine-user type:podman version:1.8 ╰─ Bindings: ╰─ mydb:3306 tcp mydb:3306 localhost 3306
podman ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 4e308ef8ee58 quay.io/skupper/skupper-router:1.8 /home/skrouterd/b... 26 seconds ago Up 27 seconds ago machine-user
podman start machine-user
kubectl exec deploy/skupper-service-controller -- get policies incominglink ALLOWED POLICY ENABLED ERROR ALLOWED BY false true Policy validation error: incoming links are not allowed
kubectl exec deploy/skupper-service-controller -- get policies Validates existing policies Usage: get policies [command] Available Commands: expose Validates if the given resource can be exposed incominglink Validates if incoming links can be created outgoinglink Validates if an outgoing link to the given hostname is allowed service Validates if service can be created or imported
kubectl exec deploy/skupper-service-controller -- get policies expose deployment nginx ALLOWED POLICY ENABLED ERROR ALLOWED BY false true Policy validation error: deployment/nginx cannot be exposed
kubectl exec deploy/skupper-service-controller -- get policies expose deployment nginx ALLOWED POLICY ENABLED ERROR ALLOWED BY true true allowedexposedresources
skupper debug dump my-site Skupper dump details written to compressed archive: `my-site.tar.gz`
tar -xvf kind-site.tar.gz k8s-versions.txt skupper-versions.txt skupper-router-deployment.yaml skupper-router-867f5ddcd8-plrcg-skstat-g.txt skupper-router-867f5ddcd8-plrcg-skstat-c.txt skupper-router-867f5ddcd8-plrcg-skstat-l.txt skupper-router-867f5ddcd8-plrcg-skstat-n.txt skupper-router-867f5ddcd8-plrcg-skstat-e.txt skupper-router-867f5ddcd8-plrcg-skstat-a.txt skupper-router-867f5ddcd8-plrcg-skstat-m.txt skupper-router-867f5ddcd8-plrcg-skstat-p.txt skupper-router-867f5ddcd8-plrcg-router-logs.txt skupper-router-867f5ddcd8-plrcg-config-sync-logs.txt skupper-service-controller-deployment.yaml skupper-service-controller-7485756984-gvrf6-events.txt skupper-service-controller-7485756984-gvrf6-service-controller-logs.txt skupper-site-configmap.yaml skupper-services-configmap.yaml skupper-internal-configmap.yaml skupper-sasl-config-configmap.yaml
skupper delete
skupper init --router-cpu 5
minikube tunnel
skupper init --ingress none
kubectl get secret/skupper-console-users -o jsonpath={.data.admin} | base64 -d
Error: Failed to create token: Policy validation error: Skupper is not enabled in namespace
Token written to <path> (Note: token will only be valid for local cluster)