Istio Crypto Scheduled Workflow #79

asubedy · 2023-07-06T11:16:06Z

Description

This PR fixes #

Notes for Reviewers

Signed commits

Yes, I signed my commits.

Signed-off-by: asubedy <[email protected]>

gyohuangxin

It's great to add Istio Crypto, I found some issues.

.github/workflows/scripts/istioCrypto.sh

.github/workflows/scheduled-istioCrypto-benchmark.yml

.github/workflows/scripts/istioCrypto.sh

Signed-off-by: asubedy <[email protected]>

gyohuangxin

One tiny nit but otherwise LGTM. @asubedy Thanks!

.github/workflows/scripts/istioCrypto.sh

Signed-off-by: asubedy <[email protected]>

gyohuangxin · 2023-07-14T02:53:50Z

@asubedy Can I confirm that this PR ready to be merged?

asubedy · 2023-07-14T02:56:28Z

No @gyohuangxin it is not cometely ready. It still needs a dynamic component registration feature. It will not be able to create performance profile now. So let's hold on merging a little. Ill let you know when its ready

Signed-off-by: asubedy <[email protected]>

gyohuangxin · 2023-07-18T05:57:10Z

.github/workflows/scripts/istioCrypto.sh

+export TCP_INGRESS_PORT=$(kubectl -n "$INGRESS_NS" get service "$INGRESS_NAME" -o jsonpath='{.spec.ports[?(@.name=="tcp")].port}')
+
+
+export GATEWAY_URL=http://$INGRESS_HOST:$INGRESS_PORT/headers


@asubedy For crypto test case, the GATEWAY_URL should be https://$INGRESS_HOST:$SECURE_INGRESS_PORT.
And we need to generate a self-signed certificate to use in performance profile, so we can create another shell script which can be named as generate_csr.sh , I can provide the script we used before:

# generate CA cerficate openssl genrsa -out fortio.com.key 2048 openssl req -new -x509 -days 365 -key fortio.com.key -subj "/C=CN/ST=GD/L=SZ/O=fortio.com, Inc./CN=fortio.com Root CA" -out fortio.com.crt # generate CSR openssl req -newkey rsa:2048 -nodes -keyout httpbin.fortio.com.key -subj "/C=CN/ST=GD/L=SZ/O=fortio.com, Inc./CN=*.fortio.com" -out httpbin.fortio.com.csr openssl x509 -req -extfile <(printf "subjectAltName=IP:10.239.241.168,DNS:fortio.com,DNS:www.fortio.com") -days 365 -in httpbin.fortio.com.csr -CA fortio.com.crt -CAkey fortio.com.key -CAcreateserial -out httpbin.fortio.com.crt # upload key and crt as a secret kubectl create -n istio-system secret tls httpbin-fortio-credential --key=httpbin.fortio.com.key --cert=httpbin.fortio.com.crt

Then we can use the URL and fortio.com.crt in performance file.

@gyohuangxin I created the file, so we run this script after deploying Istio Crypto and deploying httpbin application right?

@asubedy Yes, it's correct.

Signed-off-by: asubedy <[email protected]>

gyohuangxin · 2023-07-21T02:03:51Z

.github/workflows/scripts/generate_csr.sh

+
+# generate CSR
+openssl req -newkey rsa:2048 -nodes -keyout httpbin.fortio.com.key -subj "/C=CN/ST=GD/L=SZ/O=fortio.com, Inc./CN=*.fortio.com" -out httpbin.fortio.com.csr
+openssl x509 -req -extfile <(printf "subjectAltName=IP:10.239.241.168,DNS:fortio.com,DNS:www.fortio.com") -days 365 -in httpbin.fortio.com.csr -CA fortio.com.crt -CAkey fortio.com.key -CAcreateserial -out httpbin.fortio.com.crt


@asubedy The IP address is hardcoded here, we need to replace it to the ingress ip.

gyohuangxin · 2023-07-21T02:16:04Z

.github/workflows/scheduled-istioCrypto-benchmark.yml

+          endpoint_url: ${{env.ENDPOINT_URL}}
+          service_mesh: ${{env.SERVICE_MESH}}
+          load_generator: fortio
+          profile_name: 'istioCrypto-load-test.yaml'


We need to add the certificate generated by generate_csr.sh script in the profile, we can add another item cert_path to use the certificate. But it depends on this PR: meshery/meshery#8148.

gyohuangxin · 2023-07-21T02:22:11Z

.github/workflows/scripts/generate_csr.sh

+
+# generate CA cerficate
+openssl genrsa -out fortio.com.key 2048
+openssl req -new -x509 -days 365 -key fortio.com.key -subj "/C=CN/ST=GD/L=SZ/O=fortio.com, Inc./CN=fortio.com Root CA" -out fortio.com.crt


The address fortio.com is come from application we used in our test environment, it may be confusing to other developers. Can you replace all fortio.com here with another word, such as the application used in this test?

@gyohuangxin so change all the instances that mentions fortio.com with httpbin_app there are some instances that have httpbin.fortio.com.key so we will change this into httpbin.httpbin_app.key right?

gyohuangxin · 2023-07-21T02:26:52Z

@asubedy Left some comments, if you have any doubts feel free to ask here or on Slack channel. Thanks!

gyohuangxin · 2023-08-07T06:50:46Z

Related to #78 @asubedy Any updates here?

Signed-off-by: asubedy <[email protected]>

asubedy · 2023-08-14T16:06:28Z

@gyohuangxin could you please send the httpbin application file that you used file I am using this file but it is showing me some error

# Copyright Istio Authors
#
#   Licensed under the Apache License, Version 2.0 (the "License");
#   you may not use this file except in compliance with the License.
#   You may obtain a copy of the License at
#
#       http://www.apache.org/licenses/LICENSE-2.0
#
#   Unless required by applicable law or agreed to in writing, software
#   distributed under the License is distributed on an "AS IS" BASIS,
#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#   See the License for the specific language governing permissions and
#   limitations under the License.

##################################################################################################
# httpbin service
##################################################################################################
apiVersion: v1
kind: ServiceAccount
metadata:
  name: httpbin
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin
  labels:
    app: httpbin
    service: httpbin
spec:
  ports:
  - name: http
    port: 8000
    targetPort: 80
  selector:
    app: httpbin
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpbin
      version: v1
  template:
    metadata:
      labels:
        app: httpbin
        version: v1
    spec:
      serviceAccountName: httpbin
      containers:
      - image: docker.io/kong/httpbin
        imagePullPolicy: IfNotPresent
        name: httpbin
        ports:
        - containerPort: 80
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  # The selector matches the ingress gateway pod labels.
  # If you installed Istio using Helm following the standard documentation, this would be "istio=ingress"
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "httpbin.example.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - "httpbin.example.com"
  gateways:
  - httpbin-gateway
  http:
  - match:
    - uri:
        prefix: /status
    - uri:
        prefix: /delay
    route:
    - destination:
        port:
          number: 8000
        host: httpbin

gyohuangxin · 2023-08-15T06:01:57Z

@asubedy I think it comes from the Istio example: https://github.com/istio/istio/blob/master/samples/httpbin/httpbin.yaml, we are also using it. Can you show me the error you met?

asubedy · 2023-08-16T18:06:20Z

While using GitHub action this is the error I got:

When I try it on my local system this is the error i get

asubedy · 2023-08-16T18:09:43Z

A quick note that I have added these configuration too on the httpbin application

as given in this guide

gyohuangxin · 2023-08-17T01:48:42Z

While using GitHub action this is the error I got:

When I try it on my local system this is the error i get

I'm not sure what happen when you use mesheryctl app onboard to apply this file, can you try kubectl apply -f directly?

stale · 2023-10-15T11:14:33Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

stale · 2023-12-15T05:37:28Z

This issue is being automatically closed due to inactivity. However, you may choose to reopen this issue.

asubedy added 2 commits July 6, 2023 16:47

added istioCrypto Deoploy Script

2e338d2

Signed-off-by: asubedy <[email protected]>

added scheduled workflow for istioCrypto

43791af

Signed-off-by: asubedy <[email protected]>

gyohuangxin reviewed Jul 6, 2023

View reviewed changes

gyohuangxin changed the title ~~Istio Crrypto Scheduled Workflow~~ Istio Crypto Scheduled Workflow Jul 6, 2023

asubedy added 2 commits July 7, 2023 00:14

added cryptoDesign and and httpbin

1311093

Signed-off-by: asubedy <[email protected]>

fixed httpbin spelling

2df0a0f

Signed-off-by: asubedy <[email protected]>

asubedy requested a review from gyohuangxin July 6, 2023 19:17

gyohuangxin approved these changes Jul 7, 2023

View reviewed changes

.github/workflows/scripts/istioCrypto.sh Outdated Show resolved Hide resolved

removed unnecessary space

79fbbe9

Signed-off-by: asubedy <[email protected]>

gyohuangxin added the pr/do-not-merge PRs not ready to be merged label Jul 14, 2023

asubedy added 2 commits July 17, 2023 20:24

components register check added

69f382f

Signed-off-by: asubedy <[email protected]>

proper url for checking registration

ddc266a

Signed-off-by: asubedy <[email protected]>

gyohuangxin requested changes Jul 18, 2023

View reviewed changes

added csr sript

9f67fc4

Signed-off-by: asubedy <[email protected]>

gyohuangxin reviewed Jul 21, 2023

View reviewed changes

added correctly deployable crypto Design

355fa95

Signed-off-by: asubedy <[email protected]>

stale bot added the issue/stale Issue has not had any activity for an extended period of time label Oct 15, 2023

stale bot closed this Dec 15, 2023

saurabh100ni removed the issue/stale Issue has not had any activity for an extended period of time label Jan 1, 2024

saurabh100ni added the issue/willfix This issue will be worked on label Jan 1, 2024

saurabh100ni reopened this Jan 1, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Istio Crypto Scheduled Workflow #79

Istio Crypto Scheduled Workflow #79

asubedy commented Jul 6, 2023

gyohuangxin left a comment

gyohuangxin left a comment

gyohuangxin commented Jul 14, 2023

asubedy commented Jul 14, 2023

gyohuangxin Jul 18, 2023 •

edited

Loading

asubedy Jul 20, 2023

gyohuangxin Jul 21, 2023

gyohuangxin Jul 21, 2023

gyohuangxin Jul 21, 2023

gyohuangxin Jul 21, 2023

asubedy Aug 14, 2023

gyohuangxin commented Jul 21, 2023

gyohuangxin commented Aug 7, 2023

asubedy commented Aug 14, 2023

gyohuangxin commented Aug 15, 2023

asubedy commented Aug 16, 2023

asubedy commented Aug 16, 2023

gyohuangxin commented Aug 17, 2023

stale bot commented Oct 15, 2023

stale bot commented Dec 15, 2023

		export TCP_INGRESS_PORT=$(kubectl -n "$INGRESS_NS" get service "$INGRESS_NAME" -o jsonpath='{.spec.ports[?(@.name=="tcp")].port}')


		export GATEWAY_URL=http://$INGRESS_HOST:$INGRESS_PORT/headers

Istio Crypto Scheduled Workflow #79

Are you sure you want to change the base?

Istio Crypto Scheduled Workflow #79

Conversation

asubedy commented Jul 6, 2023

gyohuangxin left a comment

Choose a reason for hiding this comment

gyohuangxin left a comment

Choose a reason for hiding this comment

gyohuangxin commented Jul 14, 2023

asubedy commented Jul 14, 2023

gyohuangxin Jul 18, 2023 • edited Loading

Choose a reason for hiding this comment

asubedy Jul 20, 2023

Choose a reason for hiding this comment

gyohuangxin Jul 21, 2023

Choose a reason for hiding this comment

gyohuangxin Jul 21, 2023

Choose a reason for hiding this comment

gyohuangxin Jul 21, 2023

Choose a reason for hiding this comment

gyohuangxin Jul 21, 2023

Choose a reason for hiding this comment

asubedy Aug 14, 2023

Choose a reason for hiding this comment

gyohuangxin commented Jul 21, 2023

gyohuangxin commented Aug 7, 2023

asubedy commented Aug 14, 2023

gyohuangxin commented Aug 15, 2023

asubedy commented Aug 16, 2023

asubedy commented Aug 16, 2023

gyohuangxin commented Aug 17, 2023

stale bot commented Oct 15, 2023

stale bot commented Dec 15, 2023

gyohuangxin Jul 18, 2023 •

edited

Loading