Ambassador

Ambassador Edge Stack is an API gateway that serves as an ingress controller into your Kubernetes cluster. Ambassador Edge Stack offers a comprehensive set of security functionality, supports a broad range of protocols, and supports progressive releases with modern traffic management. To learn more about Ambassador Edge Stack, you can read more about it here.

What Will You Do¶

In this exercise, - You will create an "Ambassador Edge Stack" addon and use it in a custom cluster blueprint - You will then apply this cluster blueprint to a managed cluster

Assumptions¶

You have already provisioned or imported one or more Kubernetes clusters using the controller. You can learn more about getting started with clusters here.

Step 1: Add Repository To Integrations¶

Navigate to the "Integrations" section and select "Repositories." Select "+ New Repository" to create a new repository
Enter "ambassador-labs" in the "Name" section
Select "Helm" as your "Type"
Select "Create"
Enter "https://getambassador.io/" in the "Endpoint" section

Step 2: Customize Helm Install (optional)¶

Go to the Helm Chart Readme for all available Helm values. Create a values.yaml to customize your helm release, such as setting pod annotations or changing port values.

Step 3: Create Namespaces¶

Navigate to the "Infrastructure" section and select "Namespaces." Click on the "+ New Namespace" button to create a new namespace.
Enter "ambassador" in the "Name" section
For "Type" Select "Wizard" from the dropdown
In the Pod Security Policy section, enter "rafay-privileged-psp"
In the Description section, enter "Default namespace for Ambassador Labs products"
Click the "SAVE" button
Click "Save & Go To Placement"
Set "Placement Policy" to "Specific Clusters"
Select your cluster you want the namespace in
Click the "Save And Go To Publish" button
Click the "Publish" button
Select the "New Namespace" button to create another new namespace
Enter "quote-test" in the "Name" section
For "Type" Select "Wizard" from the dropdown
In the Pod Security Policy section, enter "rafay-privileged-psp"
Click the "SAVE" button
Click "Save & Go To Placement"
Set "Placement Policy" to "Specific Clusters"
Select your cluster you want the namespace in
Click the "Save And Go To Publish" button
Click the "Publish" button

Step 4: Create Addon¶

Navigate to the "Infrastructure" section and select "Add-Ons." Click on the "+ New Add-On" button to create a new add-on.
Select "Bring your own"
Enter "ambassador" in the "Name" section
Select "Helm 3" for the "Type" section
For "Artifact Sync," select the "Pull files from repository" option
For "Repository Type," select the "Helm" option
For "Namespace" Select "ambassador" from the dropdown.
Select the "Create" button
You will notice there is a box underneath your newly created add-on letting you know there are "No Versions Found." Click on "New Version" to add a new version of the add-on.
Enter "edge-stack" in the "Version Name" section
For "Repository" Select "ambassador-labs" from the dropdown
Enter "ambassador" in the "Chart Name" section
Enter "6.9.1" in the "Chart Version" section
(Optional) You may upload the values.yaml file from Step 2 in the "Upload Files" section if you'd like to apply any changes.
Select the "Save Changes" button

Step 5: Create Blueprint¶

Navigate to the "Infrastructure" section and select "Blueprints." Click on the "+ New Blueprint" button to create a new blueprint.
Enter "ambassador-edge-stack" in the "Name" section
Enter "Blueprint for Ambassador Edge Stack install" in the "Description" section
Click "SAVE"
You will notice there is a box underneath your newly created blueprint letting you know there are "No Versions Found." Click on "New Version" to add a new version of the blueprint
Enter "v1.14.1" in the "Version Name" section
Select "rafay-privileged-psp" in the "Pod Security Policies" section
Select the "cluster-scoped" option in the "PSP Policy Type" section
Select "Add More" in the "Add-Ons" section
Enter "ambassador" in the "Name" section
Enter "edge-stack" in the "Version" section
(IMPORTANT) In the "Managed System Add-Ons" be sure to DESELECT "Ingress Controller." The rest of the options you can leave as selected.
Select the "Save Changes" button

Step 6: Apply Blueprint¶

Navigate to the "Infrastructure" section and select "Clusters"
Identify the cluster and Select the gear icon on the right side and select "Update Blueprint"
Select "ambassador-edge-stack" in the "Blueprint" section
Select "v1.14.1" in the "Version" section

Step 7: Verify Deployment (optional)¶

Remain in the "Cluster" subsection inside the "Infrastructure" section
Select the KUBECTL button to open a virtual terminal
Run kubectl get pod -n ambassador in your terminal

You should see something similar to the following as output:

kubectl get pod -n ambassador
NAME                                READY   STATUS    RESTARTS   AGE
ambassador-agent-69979f6598-5qrk4   1/1     Running   0          3m34s
ambassador-b6fd977c7-zk5lz          1/1     Running   0          3m34s
ambassador-redis-59f894b97f-fm4zc   1/1     Running   0          3m34s

Step 8: Create Workload¶

To get your external IP address, run the following command:

kubectl -n ambassador get svc ambassador -o "go-template={{range .status.loadBalancer.ingress}}{{or .ip .hostname}}{{end}}"

Register a DNS name for this endpoint using your preferred registrar.
(Note) For AWS users, you may have a preconstructed hostname that was automatically generated instead of an IP address. Use a tool like dig (dig <hostname> +short) to get an IP address associated with that name.

I Don't Have A Domain Name (optional)¶

Nip.io is a dynamic, wildcard DNS server that translates a hostname with an embedded IP address into that IP address itself.

Use the IP address obtained previously and construct a nip.io hostname. For example, if you have an IP address of 169.254.169.254, you can use 169.254.169.254.nip.io as your hostname.

Copy and save the following code in a file with the name quote-test.yaml
Replace "quote.example.com" under hostname with your hostname from step 8
Replace "my-email@datawire.io" with your own email address
Replace "quote.example.com" under tlsSecret with your hostname from step 8

---
apiVersion: getambassador.io/v2
kind: Host
metadata:
  name: quote-host
spec:
  hostname: quote.example.com # Replace with your hostname from step above.
  acmeProvider:
    authority: https://acme-v02.api.letsencrypt.org/directory
    email: my-email@datawire.io # Replace with your email
  tlsSecret:
    name: quote.example.com # Replace with your hostname from step above. 
---
apiVersion: getambassador.io/v2
kind: Mapping
metadata:
  name: quote-backend
spec:
  prefix: /backend/
  service: quote
---
apiVersion: v1
kind: Service
metadata:
  name: quote
spec:
  ports:
  - name: http
    port: 80
    targetPort: 8000
  - name: https
    port: 443
    targetPort: 8000
  selector:
    app: quote
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: quote
spec:
  replicas: 1
  selector:
    matchLabels:
      app: quote
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: quote
    spec:
      containers:
      - name: backend
        image: docker.io/datawire/quote:0.4.1
        ports:
        - name: http
          containerPort: 8000
        env:
        - name: PORT
          value: "8000"
        resources:
          limits:
            cpu: "0.1"
            memory: 100Mi

Navigate to the "Applications" section, and select "Workloads." Select the "+ New Workload" button to create a new workload
Enter "quote-test-service" in the "Name" section
Select the "k8's YAML" in the "Package Type" section
Enter "quote-test" in the "Namespace" section
Select "Continue"
In the "Upload Files section," select "Choose File"
Select your quote-test.yaml file created previously
Go to the "Placement" tab
Set "Drift Action" to "NotSet"
Set "Placement Policy" to "Specific Clusters"
Select your cluster you want the workload in
Select the "Publish" tab or select the "Save And Go To Publish" button
Select the "Publish" button

Step 9: Verify Workload¶

Navigate to the "Infrastructure" section and select "Clusters"
Click on the "Kubectl" button

Run the command kubectl get all -n quote-test and verify the workload is running correctly

You should see something similar to the following:

NAME                         READY   STATUS    RESTARTS   AGE
pod/quote-74bd568645-dv4mw   1/1     Running   0          34m

NAME            TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)          AGE
service/quote   ClusterIP   10.100.151.122   <none>        80/TCP,443/TCP   34m

NAME                    READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/quote   1/1     1            1           34m

NAME                               DESIRED   CURRENT   READY   AGE
replicaset.apps/quote-74bd568645   1         1         1       34m

Step 10: Access Your Cluster From An External Source¶

Open a terminal session on your computer. Run the following command to see if you can access the quote service from your machine:

`curl -k https://{HOST_NAME_FROM_STEP_8}/backend/` #Replace the "{HOST_NAME_FROM_STEP_8}" with the host name received from step 8.

You should get an output similar to the following:

{
  "server": "gargantuan-raspberry-3x2rdgd8",
  "quote": "A late night does not make any sense.",
  "..."
}

Recap¶

Congratulations! You have successfully created a custom cluster blueprint with the "Ambassador Edge Stack" addon and applied to a cluster. You can now use this blueprint on as many clusters as you require.