Set up Gloo Portal

To use Gloo Portal, you install or upgrade Gloo Mesh Gateway to deploy the portal server. Then, create a gateway listener for the API traffic that you want to expose to end users through the portal. Finally, you deploy some sample apps to get started.

Before you begin link

1. Create or use an existing Kubernetes or OpenShift cluster, and save the cluster name in an environment variable. Note: The cluster name must be alphanumeric with no special characters except a hyphen (-), lowercase, and begin with a letter (not a number).

   export CLUSTER_NAME=<cluster_name>

2. Set your Gloo Mesh Gateway license key as an environment variable. If you do not have one, contact an account representative. If you prefer to specify license keys in a secret instead, see Licensing. To check your license’s validity, you can run meshctl license check --key $(echo $GLOO_MESH_GATEWAY_LICENSE_KEY} | base64 -w0).

   export GLOO_MESH_GATEWAY_LICENSE_KEY=<license_key>

3. Install the following command-line (CLI) tools.

   • helm, the Kubernetes package manager.
   • kubectl, the Kubernetes command line tool. Download the kubectl version that is within one minor version of the Kubernetes clusters you plan to use.
   • meshctl, the Solo command line tool.

     curl -sL https://run.solo.io/meshctl/install | GLOO_MESH_VERSION=v2.6.13 sh -
     export PATH=$HOME/.gloo-mesh/bin:$PATH

Set up Gloo Portal link

Install Gloo Mesh Gateway with basic meshctl profiles that set up the portal server. These profiles are meant for quick demonstration and testing scenarios.

• gloo-gateway-single profile: Installs the management plane components that consists of the Gloo management server, Gloo UI, and their shared backing Redis database; the data plane that consists of the Gloo agent; observability components including the OpenTelemetry (OTel) collector and Prometheus; and the Istio ingress gateway proxy.
• portal profile: Installs the portal server, rate limiter, and external auth service, as well as a shared Redis instance for the portal server and external auth service.

1. Install Gloo Mesh Gateway with the required add-ons, including the external auth service, rate limiter, and portal server.

   meshctl install --profiles gloo-gateway-single,portal \
   	  --set common.cluster=$CLUSTER_NAME \
   	  --set demo.manageAddonNamespace=true \
   	  --set glooMgmtServer.createGlobalWorkspace=true \
   	  --set licensing.glooGatewayLicenseKey=$GLOO_MESH_GATEWAY_LICENSE_KEY

   1. Istio 1.19 and earlier only: Elevate the permissions of the following service accounts that will be created. These permissions allow the to make use of a user ID that is normally restricted by OpenShift. For more information, see the Istio on OpenShift documentation.

      oc adm policy add-scc-to-group anyuid system:serviceaccounts:istio-system
      oc adm policy add-scc-to-group anyuid system:serviceaccounts:gloo-mesh-gateways
      oc adm policy add-scc-to-group anyuid system:serviceaccounts:gloo-mesh
      oc adm policy add-scc-to-group anyuid system:serviceaccounts:gm-iop-1-23

   2. Install Gloo Mesh Gateway with basic meshctl profiles that set up the portal server. Note: In OpenShift 4.11 and later, you might see warnings for the pods and containers which violate the OpenShift PodSecurity "restricted:v1.24" profile, due to the elevated permissions required by Istio. You can ignore these warnings. For more info, see this article.

      meshctl install --profiles gloo-gateway-single-openshift,portal-openshift \
      --set common.cluster=$CLUSTER_NAME \
      --set glooMgmtServer.createGlobalWorkspace=true \
      --set licensing.glooGatewayLicenseKey=$GLOO_MESH_GATEWAY_LICENSE_KEY

2. Verify that Portal and the related components are installed.

   meshctl check

   In the example output, make sure that the portal server, external auth service, and rate limiter and all of the Gloo components are healthy.

   🟢 Gloo Platform License Status
   
    INFO  gloo-gateway enterprise license expires on 05 Nov 23 14:18 EST
   
   🟢 CRD Version check
   
   🟢 Gloo deployment status
   
   Namespace | Name                           | Ready | Status
   gloo-mesh | ext-auth-service               | 1/1   | Healthy
   gloo-mesh | gloo-mesh-agent                | 1/1   | Healthy
   gloo-mesh | gloo-mesh-mgmt-server          | 1/1   | Healthy
   gloo-mesh | gloo-mesh-portal-server        | 1/1   | Healthy
   gloo-mesh | gloo-mesh-redis                | 1/1   | Healthy
   gloo-mesh | gloo-mesh-ui                   | 1/1   | Healthy
   gloo-mesh | gloo-telemetry-collector-agent | 3/3   | Healthy
   gloo-mesh | prometheus-server              | 1/1   | Healthy
   gloo-mesh | rate-limiter                   | 1/1   | Healthy
   gloo-mesh | redis                          | 1/1   | Healthy
   
   🟢 Mgmt server connectivity to workload agents
   
   Cluster  | Registered | Connected Pod
   cluster1 | true       | gloo-mesh/gloo-mesh-mgmt-server-65bd557b95-v8qq6

3. Verify that the Istio ingress gateway proxy service is created and assigned an external IP address. It might take a few minutes for the load balancer to deploy.

   kubectl get svc -n gloo-mesh-gateways

   Example output:

   NAME                   TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)                                                      AGE
   istio-ingressgateway   LoadBalancer   10.XX.XXX.XXX   35.XXX.XXX.XXX   15021:30826/TCP,80:31257/TCP,443:30673/TCP,15443:30789/TCP   48s

Deploy sample apps link

Now that you have Gloo Portal installed, deploy some sample apps. Later, you expose these apps in a frontend developer portal.

You create two apps, Petstore and Tracks.

• Petstore is a collection of API microservices that together represent a Petstore. Different microservices perform different functions, providing information about pets, stores, and users.
• Tracks is a single API that provides information about a catalog of learning resources, or “tracks.”

The apps both consist of a deployment of a REST API and a matching service. Their services include several annotations that Gloo can use to automatically discover the service and create an ApiDoc for you. You learn more about ApiDocs later.

1. Create a namespace for the apps.

   kubectl create ns tracks
   kubectl create ns users
   kubectl create ns pets
   kubectl create ns store

2. Deploy the apps. The following sample files include the Kubernetes deployment and service for the app. The services include custom annotations that allow Gloo to automatically discover the services and create ApiDocs for them.

   kubectl apply -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/gloo-gateway/portal/tracks-api.yaml
   kubectl apply -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/gloo-gateway/portal/users-api.yaml
   kubectl apply -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/gloo-gateway/portal/pets-api.yaml
   kubectl apply -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/gloo-gateway/portal/store-api.yaml

3. Check that your apps are running

   kubectl get all -l demo=portal -A

Next steps link

Next, bundle your apps into API products that you can expose in a frontend developer portal.