Deploy sample apps

These sample apps are used throughout the documentation to help test connectivity, such as in the traffic management, security, and resiliency policy guides.

Bookinfo link

To test out microservice traffic management in your service mesh, deploy the Bookinfo sample app.

1. Save the Istio revision that your istiod control plane runs as an environment variable.

     export REVISION=$(kubectl get pod -L app=istiod -n istio-system -o jsonpath='{.items[0].metadata.labels.istio\.io/rev}')
   echo $REVISION
     

2. Create the bookinfo namespace and label it for Istio injection so that the services become part of the service mesh.

     kubectl create ns bookinfo
   kubectl label ns bookinfo istio.io/rev=$REVISION --overwrite=true
     

   For more information, see the Istio on OpenShift documentation.

   1. Create and label the bookinfo project.

        kubectl create ns bookinfo
      kubectl label ns bookinfo istio.io/rev=$REVISION --overwrite=true
        

   2. Create a NetworkAttachmentDefinition custom resource for the bookinfo project.

        cat <<EOF | oc -n bookinfo create -f -
      apiVersion: "k8s.cni.cncf.io/v1"
      kind: NetworkAttachmentDefinition
      metadata:
        name: istio-cni
      EOF
        

   3. Elevate the permissions of the bookinfo service account to allow the Istio sidecars to make use of a user ID that is normally restricted by OpenShift.

        oc adm policy add-scc-to-group anyuid system:serviceaccounts:bookinfo
        

3. Deploy the Bookinfo app.

     # deploy bookinfo application components for all versions less than v3
   kubectl -n bookinfo apply -f https://raw.githubusercontent.com/istio/istio/1.18.7/samples/bookinfo/platform/kube/bookinfo.yaml -l 'app,version notin (v3)'
   # deploy an updated product page with extra container utilities such as 'curl' and 'netcat'
   kubectl -n bookinfo apply -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/productpage-with-curl.yaml
   # deploy all bookinfo service accounts
   kubectl -n bookinfo apply -f https://raw.githubusercontent.com/istio/istio/1.18.7/samples/bookinfo/platform/kube/bookinfo.yaml -l 'account'
     

4. Verify that the Bookinfo app is deployed successfully.

     kubectl get pods -n bookinfo
   kubectl get svc -n bookinfo
     

httpbin link

The httpbin sample app is a simple tool to test HTTP requests and responses. Unlike curl, you can see not only the response headers, but also the request headers.

1. Save the Istio revision that your istiod control plane runs as an environment variable.

     export REVISION=$(kubectl get pod -L app=istiod -n istio-system -o jsonpath='{.items[0].metadata.labels.istio\.io/rev}')
   echo $REVISION
     

2. Create an httpbin namespace and label the namespace for Istio injection so that the services in the namespace become part of the service mesh.

     kubectl create ns httpbin
   kubectl label ns httpbin istio.io/rev=$REVISION --overwrite=true
     

   1. Create and label the httpbin project.

        kubectl create ns httpbin
      kubectl label ns httpbin istio.io/rev=$REVISION --overwrite=true
        

   2. Create a NetworkAttachmentDefinition custom resource for the httpbin project.

        cat <<EOF | oc -n httpbin create -f -
      apiVersion: "k8s.cni.cncf.io/v1"
      kind: NetworkAttachmentDefinition
      metadata:
        name: istio-cni
      EOF
        

   3. Elevate the permissions of the httpbin service account to allow the Istio sidecars to make use of a user ID that is normally restricted by OpenShift.

        oc adm policy add-scc-to-group anyuid system:serviceaccounts:httpbin
        

3. Deploy the httpbin app.

     kubectl -n httpbin apply -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/httpbin.yaml
     

4. Verify that the httpbin app is running.

     kubectl -n httpbin get pods
     

hello world link

The hello world sample app is a simple way to test responses for different app versions. The following examples install four versions of hello world in your cluster.

1. Save the Istio revision that your istiod control plane runs as an environment variable.

     export REVISION=$(kubectl get pod -L app=istiod -n istio-system -o jsonpath='{.items[0].metadata.labels.istio\.io/rev}')
   echo $REVISION
     

2. Create the helloworld namespace and label it for Istio injection so that the services become part of the service mesh.

     kubectl create ns helloworld
   kubectl label ns helloworld istio.io/rev=$REVISION --overwrite=true
     

   1. Create and label the helloworld project.

        kubectl create ns helloworld
      kubectl label ns helloworld istio.io/rev=$REVISION --overwrite=true
        

   2. Create a NetworkAttachmentDefinition custom resource for the helloworld project.

        cat <<EOF | oc -n helloworld create -f -
      apiVersion: "k8s.cni.cncf.io/v1"
      kind: NetworkAttachmentDefinition
      metadata:
        name: istio-cni
      EOF
        

   3. Elevate the permissions of the helloworld service account to allow the Istio sidecars to make use of a user ID that is normally restricted by OpenShift.

        oc adm policy add-scc-to-group anyuid system:serviceaccounts:helloworld
        

3. Deploy hello world v1, v2, v3, and v4 to your cluster.

     kubectl -n helloworld apply -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/helloworld.yaml 
     

4. Verify that the hello world apps are running.

     kubectl -n helloworld get pods
     

Optional: Install Keycloak link

You might want to test how to restrict access to your applications to authenticated users, such as with external auth or JWT policies. You can install Keycloak in your cluster as an OpenID Connect (OIDC) provider.

The following steps install Keycloak in your cluster, and configure two user credentials as follows.

• Username: user1, password: password, email: user1@example.com
• Username: user2, password: password, email: user2@solo.io

Install and configure Keycloak:

1. Create a namespace for your Keycloak deployment.

     kubectl create namespace keycloak
     

2. Create the Keycloak deployment.

     kubectl -n keycloak apply -f https://raw.githubusercontent.com/solo-io/workshops/master/gloo-mesh-2-3/all/data/steps/deploy-keycloak/keycloak.yaml
     

3. Wait for the Keycloak rollout to finish.

     kubectl -n keycloak rollout status deploy/keycloak
     

4. Set the Keycloak endpoint details from the load balancer service.

     export ENDPOINT_KEYCLOAK=$(kubectl -n keycloak get service keycloak -o jsonpath='{.status.loadBalancer.ingress[0].*}'):8080
   export HOST_KEYCLOAK=$(echo ${ENDPOINT_KEYCLOAK} | cut -d: -f1)
   export PORT_KEYCLOAK=$(echo ${ENDPOINT_KEYCLOAK} | cut -d: -f2)
   export KEYCLOAK_URL=http://${ENDPOINT_KEYCLOAK}/auth
   echo $KEYCLOAK_URL
     

5. Set the Keycloak admin token. If you see a parsing error, try running the curl command by itself. You might notice that your internet provider or network rules are blocking the requests. If so, you can update your security settings or change the network so that the request can be processed.

     export KEYCLOAK_TOKEN=$(curl -d "client_id=admin-cli" -d "username=admin" -d "password=admin" -d "grant_type=password" "$KEYCLOAK_URL/realms/master/protocol/openid-connect/token" | jq -r .access_token)
   echo $KEYCLOAK_TOKEN
     

6. Use the admin token to configure Keycloak with the two users for testing purposes. If you get a 401 Unauthorized error, run the previous command and try again.

     # Create initial token to register the client
   read -r client token <<<$(curl -H "Authorization: Bearer ${KEYCLOAK_TOKEN}" -X POST -H "Content-Type: application/json" -d '{"expiration": 0, "count": 1}' $KEYCLOAK_URL/admin/realms/master/clients-initial-access | jq -r '[.id, .token] | @tsv')
   export KEYCLOAK_CLIENT=${client}
   
   # Register the client
   read -r id secret <<<$(curl -X POST -d "{ \"clientId\": \"${KEYCLOAK_CLIENT}\" }" -H "Content-Type:application/json" -H "Authorization: bearer ${token}" ${KEYCLOAK_URL}/realms/master/clients-registrations/default| jq -r '[.id, .secret] | @tsv')
   export KEYCLOAK_SECRET=${secret}
   
   # Add allowed redirect URIs
   curl -H "Authorization: Bearer ${KEYCLOAK_TOKEN}" -X PUT -H "Content-Type: application/json" -d '{"serviceAccountsEnabled": true, "directAccessGrantsEnabled": true, "authorizationServicesEnabled": true, "redirectUris": ["'https://${ENDPOINT_HTTPS_GW_CLUSTER1}'/callback"]}' $KEYCLOAK_URL/admin/realms/master/clients/${id}
   
   # Add the group attribute in the JWT token returned by Keycloak
   curl -H "Authorization: Bearer ${KEYCLOAK_TOKEN}" -X POST -H "Content-Type: application/json" -d '{"name": "group", "protocol": "openid-connect", "protocolMapper": "oidc-usermodel-attribute-mapper", "config": {"claim.name": "group", "jsonType.label": "String", "user.attribute": "group", "id.token.claim": "true", "access.token.claim": "true"}}' $KEYCLOAK_URL/admin/realms/master/clients/${id}/protocol-mappers/models
   
   # Create first user
   curl -H "Authorization: Bearer ${KEYCLOAK_TOKEN}" -X POST -H "Content-Type: application/json" -d '{"username": "user1", "email": "user1@example.com", "enabled": true, "attributes": {"group": "users"}, "credentials": [{"type": "password", "value": "password", "temporary": false}]}' $KEYCLOAK_URL/admin/realms/master/users
   
   # Create second user
   curl -H "Authorization: Bearer ${KEYCLOAK_TOKEN}" -X POST -H "Content-Type: application/json" -d '{"username": "user2", "email": "user2@solo.io", "enabled": true, "attributes": {"group": "users"}, "credentials": [{"type": "password", "value": "password", "temporary": false}]}' $KEYCLOAK_URL/admin/realms/master/users
     

Other service namespaces link

For any other namespaces that you want to deploy apps to, be sure to follow these steps to include your services in the service mesh.

Now that Istio is up and running, you can create service namespaces for your teams to run app workloads in. For any namespaces that you want to deploy apps to, be sure to follow these steps to include your services in the service mesh.

1. Label the namespace with the Istio revision so that Istio sidecars deploy to your app pods.

     export REVISION=$(kubectl get pod -L app=istiod -n istio-system -o jsonpath='{.items[0].metadata.labels.istio\.io/rev}')
   kubectl label ns <namespace> istio.io/rev=$REVISION --overwrite
     

   check_circle

   If you deployed revisionless installations in testing environments, you can instead label your workload namespaces with kubectl label ns istio-injection=enabled.

2. If you already deployed app pods to the namespace, restart the workloads so that sidecars are injected into the pods. For example, you might roll out a restart to each deployment by using a command similar to the following.

     kubectl rollout restart deployment -n <namespace> <deployment>
     

Next link

Verify routing to the sample apps and apply a fault injection policy to the reviews service to delay requests and simulate network issues or an overloaded service.