To use Gloo Portal, you install or upgrade Gloo Mesh Gateway to deploy the portal server. Then, create a gateway listener for the API traffic that you want to expose to end users through the portal. Finally, you deploy some sample apps to get started.

Before you begin

  1. Create or use an existing Kubernetes or OpenShift cluster, and save the cluster name in an environment variable. Note: The cluster name must be alphanumeric with no special characters except a hyphen (-), lowercase, and begin with a letter (not a number).

      export CLUSTER_NAME=<cluster_name>

  2. Set your Gloo Mesh Gateway license key as an environment variable. If you do not have one, contact an account representative. If you prefer to specify license keys in a secret instead, see Licensing. To check your license’s validity, you can run meshctl license check --key $(echo ${GLOO_MESH_GATEWAY_LICENSE_KEY} | base64 -w0).

      export GLOO_MESH_GATEWAY_LICENSE_KEY=<license_key>

  3. Install the following command-line (CLI) tools.

    • kubectl, the Kubernetes command line tool. Download the kubectl version that is within one minor version of the Kubernetes clusters you plan to use.
    • meshctl, the Solo command line tool.
        curl -sL https://run.solo.io/meshctl/install | GLOO_MESH_VERSION=v2.7.0-beta1 sh -
export PATH=$HOME/.gloo-mesh/bin:$PATH

Set up Gloo Portal

Install Gloo Mesh Gateway with basic meshctl profiles that set up the portal server. These profiles are meant for quick demonstration and testing scenarios.

  • gloo-gateway-single profile: Installs the management plane components that consists of the Gloo management server, Gloo UI, and their shared backing Redis database; the data plane that consists of the Gloo agent; observability components including the OpenTelemetry (OTel) collector and Prometheus; and the Istio ingress gateway proxy.
  • portal profile: Installs the portal server, rate limiter, and external auth service, as well as a shared Redis instance for the portal server and external auth service.

  1. Install Gloo Mesh Gateway with the required add-ons, including the external auth service, rate limiter, and portal server.

      meshctl install --profiles gloo-gateway-single,portal \
	  --set common.cluster=$CLUSTER_NAME \
	  --set demo.manageAddonNamespace=true \
	  --set glooMgmtServer.createGlobalWorkspace=true \
	  --set licensing.glooGatewayLicenseKey=$GLOO_MESH_GATEWAY_LICENSE_KEY

    1. Elevate the permissions of the following service accounts that will be created. These permissions allow the to make use of a user ID that is normally restricted by OpenShift. For more information, see the Istio on OpenShift documentation.

        oc adm policy add-scc-to-group anyuid system:serviceaccounts:istio-system
oc adm policy add-scc-to-group anyuid system:serviceaccounts:gloo-mesh-gateways
oc adm policy add-scc-to-group anyuid system:serviceaccounts:gloo-mesh
oc adm policy add-scc-to-group anyuid system:serviceaccounts:gm-iop-1-23

    2. Create the gloo-mesh-gateways project, and create NetworkAttachmentDefinition custom resources for the gloo-mesh-gateways and gloo-mesh projects.

        kubectl create ns gloo-mesh-gateways

cat <<EOF | oc -n gloo-mesh-gateways create -f -
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: istio-cni
EOF
  
        cat <<EOF | oc -n gloo-mesh create -f -
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: istio-cni
EOF

    3. Install Gloo Mesh Gateway with basic meshctl profiles that set up the portal server. Note: In OpenShift 4.11 and later, you might see warnings for the pods and containers which violate the OpenShift PodSecurity "restricted:v1.24" profile, due to the elevated permissions required by Istio. You can ignore these warnings. For more info, see this article.

        meshctl install --profiles gloo-gateway-single-openshift,portal-openshift \
  --set common.cluster=$CLUSTER_NAME \
  --set glooMgmtServer.createGlobalWorkspace=true \
  --set licensing.glooGatewayLicenseKey=$GLOO_MESH_GATEWAY_LICENSE_KEY

  2. Verify that Portal and the related components are installed.

      meshctl check

    In the example output, make sure that the portal server, external auth service, and rate limiter and all of the Gloo components are healthy.

      🟢 Gloo Platform License Status

 INFO  gloo-gateway enterprise license expires on 05 Nov 23 14:18 EST

🟢 CRD Version check

🟢 Gloo deployment status

Namespace        | Name                           | Ready | Status 
gloo-mesh        | ext-auth-service               | 1/1   | Healthy
gloo-mesh        | gloo-mesh-agent                | 1/1   | Healthy
gloo-mesh        | gloo-mesh-mgmt-server          | 1/1   | Healthy
gloo-mesh        | gloo-mesh-portal-server        | 1/1   | Healthy
gloo-mesh        | gloo-mesh-redis                | 1/1   | Healthy
gloo-mesh        | gloo-mesh-ui                   | 1/1   | Healthy
gloo-mesh        | prometheus-server              | 1/1   | Healthy
gloo-mesh        | rate-limiter                   | 1/1   | Healthy
gloo-mesh        | redis                          | 1/1   | Healthy
gloo-mesh        | gloo-telemetry-collector-agent | 3/3   | Healthy

🟢 Mgmt server connectivity to workload agents

Cluster  | Registered | Connected Pod                                   
cluster1 | true       | gloo-mesh/gloo-mesh-mgmt-server-65bd557b95-v8qq6

  3. Verify that the Istio ingress gateway proxy service is created and assigned an external IP address. It might take a few minutes for the load balancer to deploy.

      kubectl get svc -n gloo-mesh-gateways

    Example output:

      NAME                   TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)                                                      AGE
istio-ingressgateway   LoadBalancer   10.XX.XXX.XXX   35.XXX.XXX.XXX   15021:30826/TCP,80:31257/TCP,443:30673/TCP,15443:30789/TCP   48s

Deploy sample apps

Now that you have Gloo Portal installed, deploy some sample apps. Later, you expose these apps in a frontend developer portal.

You create two apps, Petstore and Tracks.

  • Petstore is a collection of API microservices that together represent a Petstore. Different microservices perform different functions, providing information about pets, stores, and users.
  • Tracks is a single API that provides information about a catalog of learning resources, or “tracks.”

The apps both consist of a deployment of a REST API and a matching service. Their services include several annotations that Gloo can use to automatically discover the service and create an ApiDoc for you. You learn more about ApiDocs later.

  1. Create a namespace for the apps.

      kubectl create ns tracks
kubectl create ns users
kubectl create ns pets
kubectl create ns store

  2. Deploy the apps. The following sample files include the Kubernetes deployment and service for the app. The services include custom annotations that allow Gloo to automatically discover the services and create ApiDocs for them.

      kubectl apply -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/gloo-gateway/portal/tracks-api.yaml
kubectl apply -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/gloo-gateway/portal/users-api.yaml
kubectl apply -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/gloo-gateway/portal/pets-api.yaml
kubectl apply -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/gloo-gateway/portal/store-api.yaml

  3. Check that your apps are running

      kubectl get all -l demo=portal -A

Next steps

Next, bundle your apps into API products that you can expose in a frontend developer portal.