|
| 1 | +# AWS ALB and Istio Using Crossplane |
| 2 | + |
| 3 | +This blueprint builds a data-path that consists of the following AWS |
| 4 | +infrastructure: |
| 5 | + |
| 6 | +- Application load balancer (ALB). |
| 7 | +- Security group for ALB, together with ingress and egress rules (for |
| 8 | + both data and healthchecks). |
| 9 | +- ALB target group and listener definitions. |
| 10 | + |
| 11 | +This definition also includes the following Kubernetes infrastructure: |
| 12 | + |
| 13 | +- A 'child' `Gateway` using the *istio* `GatewayClass`. This creates |
| 14 | + an Istio ingress gateway. |
| 15 | +- `TargetGroupBinding` (an [AWS load balancer controller |
| 16 | + CRD](https://github.com/kubernetes-sigs/aws-load-balancer-controller/) |
| 17 | + for propagating Kubernetes endpoints for the Istio ingress gateway |
| 18 | + to the AWS ALB target group. This links the Kubernetes internal and |
| 19 | + AWS infrastructure. |
| 20 | + |
| 21 | +**Note** the ALB terminates TLS and forwards traffic un-encrypted to |
| 22 | +the Istio ingress gateway. |
| 23 | + |
| 24 | +This definition is provided in the following files: |
| 25 | + |
| 26 | +- [`gatewayclassblueprint-aws-alb-crossplane.yaml`](gatewayclassblueprint-aws-alb-crossplane.yaml) blueprint for infrastructure implementation |
| 27 | +- [`gatewayclass-aws-alb-crossplane.yaml`](gatewayclass-aws-alb-crossplane.yaml) definitions of `GatewayClass`es referencing the above `GatewayClassBlueprint`. Two `GatewayClass`es are created, one that is intended for internet exposed gateways, and one for non internet exposed gateways. |
| 28 | +- [`gatewayclassconfig-aws-alb-crossplane-dev-env.yaml`](../../test-data/gatewayclassconfig-aws-alb-crossplane-dev-env.yaml) example settings for the two `GatewayClass`es defined in `gatewayclass-aws-alb-crossplane.yaml`, i.e. with different subnet settings for the internet-exposed and non internet-exposed `GatewayClass'es. |
| 29 | +- [`gatewayclassblueprint-crossplane-aws-alb-values.yaml`](../../charts/bifrost-gateway-controller/ci/gatewayclassblueprint-crossplane-aws-alb-values.yaml) |
| 30 | +RBAC for bifrost-gateway-controller Helm deployment suited for the `aws-alb-crossplane` blueprint. |
| 31 | + |
| 32 | +## Compatibility |
| 33 | + |
| 34 | +This blueprint use AWS Crossplane resources through the [Upbound AWS |
| 35 | +Provider](https://marketplace.upbound.io/providers/upbound/provider-aws). The |
| 36 | +following compatibility between this blueprint, Crossplane, Crossplane |
| 37 | +Upbound AWS provider and Istio versions has been verified: |
| 38 | + |
| 39 | +| Blueprint | AWS Provider | Crossplane | Istio | Status | |
| 40 | +| --------- | ------------ | ---------- | ----- | ------ | |
| 41 | +| `0.0.18` | `v0.28.0` | `v1.11.0` | `1.16.1` | :heavy_check_mark: | |
| 42 | +| `0.0.18` | `v0.32.1` | `v1.11.0` | `1.16.1` | :x: | |
| 43 | +| `0.0.18` | `v0.33.0` | `v1.11.0` | `1.16.1` | :heavy_check_mark: | |
| 44 | +| `0.0.19` | `v0.33.0` | `v1.11.0` | `1.16.1` | :heavy_check_mark: | |
| 45 | + |
| 46 | +## Testing AWS/Crossplane/Istio Blueprint |
| 47 | + |
| 48 | +This section describes how to test the blueprint using different |
| 49 | +version of the dependencies. |
| 50 | + |
| 51 | +### Prerequisite |
| 52 | + |
| 53 | +- A Kubernetes cluster. |
| 54 | +- IAM roles for Crossplane to interact with AWS (see make target `deploy-crossplane-aws-provider`). |
| 55 | +- IAM role for AWS load balancer controller (see make target `deploy-aws-load-balancer-controller`) |
| 56 | +- A TLS certificate and associated domain name (see below). |
| 57 | + |
| 58 | +### Deploying Dependencies |
| 59 | + |
| 60 | +Deploy dependencies with the make targets shown below. Version information can be left out to use default versions: |
| 61 | + |
| 62 | +```bash |
| 63 | +make deploy-gateway-api |
| 64 | +make deploy-aws-load-balancer-controller-crds |
| 65 | +AWS_LOAD_BALANCER_CONTROLLER_CHART_VERSION=v1.4.6 make deploy-aws-load-balancer-controller |
| 66 | +CROSSPLANE_VERSION=v1.11.0 make deploy-crossplane |
| 67 | +CROSSPLANE_AWS_PROVIDER_VERSION=v0.28.0 make deploy-crossplane-aws-provider |
| 68 | +ISTIO_VERSION=1.16.1 make deploy-istio |
| 69 | +``` |
| 70 | + |
| 71 | +Deploy controller and blueprint: |
| 72 | + |
| 73 | +``` |
| 74 | +BIFROST_VERSION=0.1.6 make deploy-controller-aws-helm |
| 75 | +BIFROST_BLUEPRINTS_VERSION=0.0.18 make deploy-aws-istio-blueprint |
| 76 | +``` |
| 77 | + |
| 78 | +Note, there is also a `deploy-aws-istio-blueprint-local` make target to deploy |
| 79 | +local repository blueprint version which is useful when developing |
| 80 | +blueprints. |
| 81 | + |
| 82 | +A `GatewayClassConfig` is also needed - because it is very environment |
| 83 | +specific, this guide does not describe how to prepare it. Additionally, |
| 84 | +a namespace-default `GatewayClassConfig` may be needed: |
| 85 | + |
| 86 | +```bash |
| 87 | +CERTIFICATE_ARN=some-arn-for-foo.example.com make deploy-namespace-gatewayclassconfig |
| 88 | +``` |
| 89 | + |
| 90 | +Deploy the getting-started use-case: |
| 91 | + |
| 92 | +```bash |
| 93 | +GATEWAY_CLASS_NAME=aws-alb-crossplane-public DOMAIN=foo.example.com make deploy-getting-started-usecase |
| 94 | +``` |
| 95 | + |
| 96 | +Test the deployed data-path when resources are ready: |
| 97 | + |
| 98 | +```bash |
| 99 | +hack/demo/curl.sh $DOMAIN # Where DOMAIN is as defined above |
| 100 | +``` |
| 101 | + |
| 102 | +## Undeploying |
| 103 | + |
| 104 | +``` |
| 105 | +make undeploy-getting-started-usecase |
| 106 | +make undeploy-aws-istio-blueprint |
| 107 | +make undeploy-controller |
| 108 | +make undeploy-aws-load-balancer-controller |
| 109 | +make undeploy-crossplane-aws-provider |
| 110 | +make undeploy-crossplane |
| 111 | +make undeploy-istio |
| 112 | +``` |
0 commit comments