Verrazzano Enterprise Container Platform – Deploy Applications Using Kubernetes Objects

Docs: Create a Kubernetes Deployment and Service

Mon, 01 Jan 0001 00:00:00 +0000

Create a namespace for the example application and add labels identifying the namespace as managed by Verrazzano and enabled for Istio.
```
$ kubectl create namespace hello-helidon
$ kubectl label namespace hello-helidon verrazzano-managed=true istio-injection=enabled
```
Deploy the Hello Helidon Greet application.
```
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    description: Hello Helidon application
    version: v1.0.0
  labels:
    app: hello-helidon
  name: hello-helidon-deployment
  namespace: hello-helidon
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: hello-helidon
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      annotations:
        verrazzano.io/metricsEnabled: "true" # This annotation is used in the ServiceMonitor YAML to specify whether metrics are enabled.
        verrazzano.io/metricsPath: /metrics  # This annotation is used in the ServiceMonitor YAML to replace the metrics path.
        verrazzano.io/metricsPort: "8080"    # This annotation is used in the ServiceMonitor YAML to replace the metrics port.
      labels:
        app: hello-helidon # This label is used in the Service YAML in the selector.
    spec:
      containers:
      - image: ghcr.io/verrazzano/example-helidon-greet-app-v1:1.0.0-1-20230126194830-31cd41f
        imagePullPolicy: IfNotPresent
        name: hello-helidon-container
        ports:
        - containerPort: 8080
          name: http
          protocol: TCP
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
```
Access the Hello Helidon Greet application inside the Kubernetes cluster.
```
apiVersion: v1
kind: Service
metadata:
  labels:
    app: hello-helidon
  name: hello-helidon-deployment
  namespace: hello-helidon
spec:
  ports:
  - name: hello-helidon-container-8080
    port: 8080
    protocol: TCP
    targetPort: 8080
  selector:
    app: hello-helidon
```

Docs: Gather Metrics and Collect Logs

Mon, 01 Jan 0001 00:00:00 +0000

Use Prometheus to collect system performance metrics and metrics for applications deployed or managed by Verrazzano. For information, see Prometheus.

Gather metrics

The following is an example of using Prometheus to scrape the metrics endpoint of the Hello Helidon Greet application.

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  labels:
    release: prometheus-operator
  name: hello-helidon
  namespace: hello-helidon
spec:
  endpoints:
  - bearerTokenSecret:
      key: ""
    enableHttp2: false
    path: /metrics
    relabelings:
    - action: replace
      replacement: local
      targetLabel: verrazzano_cluster
    - action: keep
      regex: true;hello-helidon
      sourceLabels:
      - __meta_kubernetes_pod_annotation_verrazzano_io_metricsEnabled
      - __meta_kubernetes_pod_label_app
    - action: replace
      regex: (.+)
      sourceLabels:
      - __meta_kubernetes_pod_annotation_verrazzano_io_metricsPath
      targetLabel: __metrics_path__
    - action: replace
      regex: ([^:]+)(?::\d+)?;(\d+)
      replacement: $1:$2
      sourceLabels:
      - __address__
      - __meta_kubernetes_pod_annotation_verrazzano_io_metricsPort
      targetLabel: __address__
    - action: replace
      regex: (.*)
      replacement: $1
      sourceLabels:
      - __meta_kubernetes_namespace
      targetLabel: namespace
    - action: labelmap
      regex: __meta_kubernetes_pod_label_(.+)
    - action: replace
      sourceLabels:
      - __meta_kubernetes_pod_name
      targetLabel: pod_name
    - action: labeldrop
      regex: (controller_revision_hash)
    - action: replace
      regex: .*/(.*)$
      replacement: $1
      sourceLabels:
      - name
      targetLabel: webapp
    - action: replace
      regex: ;(.*)
      replacement: $1
      separator: ;
      sourceLabels:
      - application
      - app
      targetLabel: application
    scheme: https
    tlsConfig:
      ca: {}
      caFile: /etc/istio-certs/root-cert.pem
      cert: {}
      certFile: /etc/istio-certs/cert-chain.pem
      insecureSkipVerify: true
      keyFile: /etc/istio-certs/key.pem
  namespaceSelector:
    matchNames:
    - hello-helidon
  selector: {}

Wiring for logs

Application logs record events happening in the Kubernetes cluster, which are automatically accessed by Verrazzano when required.

Docs: Certificate Management

Mon, 01 Jan 0001 00:00:00 +0000

Use the following example to secure public access to the Hello Helidon Greet application.

Replace domain name with the Kubernetes cluster domain used in Verrazzano. This ensures that you have a fully-qualified domain name for host entries in the resources.

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: hello-helidon-hello-helidon-ingress-cert
  namespace: istio-system # Note the use of the istio-system Namespace.
spec:
  dnsNames:
  - hello-helidon.hello-helidon.<domain name>
  issuerRef:
    kind: ClusterIssuer
    name: verrazzano-cluster-issuer
  secretName: hello-helidon-hello-helidon-ingress-cert-secret

Docs: Authorization Policy

Mon, 01 Jan 0001 00:00:00 +0000

An authorization policy enables access control on workloads in the mesh. Also, an authorization policy supports both allow and deny policies. In the following example, the authorization policy allows access from the listed service accounts that can access the Hello Helidon Greet application.

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  labels:
    verrazzano.io/istio: hello-helidon
  name: hello-helidon
  namespace: hello-helidon
spec:
  rules:
  - from:
    - source:
        principals:
        - cluster.local/ns/hello-helidon/sa/hello-helidon
        - cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account
        - cluster.local/ns/verrazzano-system/sa/verrazzano-monitoring-operator
        - cluster.local/ns/verrazzano-monitoring/sa/prometheus-operator-kube-p-prometheus
  selector:
    matchLabels:
      verrazzano.io/istio: hello-helidon

Docs: Istio Gateway and Virtual Service

Mon, 01 Jan 0001 00:00:00 +0000

Istio gateway

A gateway is a load balancer that connects to the mesh and receives incoming or outgoing HTTP/TCP connections. It specifies which ports are to be exposed, the protocol to be used, and so on.

The following is an example to direct public access to the Hello Helidon Greet application. Replace domain name with the Kubernetes cluster domain used in Verrazzano. This ensures that you have a fully-qualified domain name for host entries in the resources.

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: hello-helidon-hello-helidon-gw
  namespace: hello-helidon
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - hello-helidon.hello-helidon.<domain name>
    name: hello-helidon-ingress
    port:
      name: https-hello-helidon-ingress
      number: 443
      protocol: HTTPS
    tls:
      credentialName: hello-helidon-hello-helidon-ingress-cert-secret # Secret that contains the certificate used for TLS
      mode: SIMPLE

Istio virtual service

A virtual service helps in connecting the gateway to the Kubernetes service. It is a set of rules for routing traffic based on the match criteria for a specific protocol. If the traffic matches the criteria, then it will be sent to a named destination service.

The following is an example of registering the Hello Helidon Greet application in the Istio service registry.
Replace domain name with the Kubernetes cluster domain used in Verrazzano. This ensures that you have a fully-qualified domain name for host entries in the resources.

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: hello-helidon-ingress-rule-0-vs
namespace: hello-helidon
spec:
gateways:
- hello-helidon-hello-helidon-gw
hosts:
- hello-helidon.hello-helidon.<domain name>
http:
- match:
- uri:
prefix: /greet
route:
- destination:
host: hello-helidon-deployment
port:
number: 8080