Skip to content

Commit

Permalink
Update configure.mdx
Browse files Browse the repository at this point in the history
remove namespace consul from workload commands
  • Loading branch information
David Yu authored Oct 17, 2023
1 parent f52b909 commit a3a7414
Showing 1 changed file with 24 additions and 21 deletions.
45 changes: 24 additions & 21 deletions website/content/docs/k8s/multiport/configure.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -285,14 +285,14 @@ spec:
To apply these services to your Kubernetes deployment and register them with Consul, run the following command:
```shell-session
$ kubectl apply -f api.yaml -f web.yaml --namespace consul
$ kubectl apply -f api.yaml -f web.yaml
```

## Configure traffic permissions

Consul uses traffic permissions to validate communication between services based on L4 identity. In the beta release of the v2 catalog API, traffic permissions allow all services by default. In order to verify that services function correctly on each port, create CRDs that deny traffic to each port.

The following examples create Consul CRDs that allow traffic to only one port of the multi-port service. Each resource separately denies `web` permission when it is a source of traffic to one of the services. These traffic permissions work with either method for defining a multi-port service.
The following examples create Consul CRDs that allow traffic to only one port of the multi-port service. Each resource separately denies `web` permission when it is a source of traffic to one of the services. These traffic permissions work with either method for defining a multi-port service. The resources will be applied invidually in the steps below.

<CodeTabs tabs={[ "Deny port 80", "Deny port 90" ]}>

Expand Down Expand Up @@ -342,15 +342,18 @@ spec:
To open a shell to the `web` container, you need the name of the Pod it currently runs on. Run the following command to return a list of Pods:

```shell-session
$ kubectl get pods --namespace consul
$ kubectl get pods
NAME READY STATUS RESTARTS AGE
api-5784b54bcc-tp98l 3/3 Running 0 6m55s
consul-connect-injector-54865fbcbf-sfjsl 1/1 Running 0 8m33s
consul-server-0 1/1 Running 0 8m33s
consul-webhook-cert-manager-666676bd5b-cdbxc 1/1 Running 0 8m33s
web-6dcbd684bc-gk8n5 2/2 Running 0 6m55s
```

Set environment variables to remember the pod name for the web workload for use in future commands.

```shell-session
$ export WEB_POD=web-6dcbd684bc-gk8n5
```

### Validate both ports

Use the `web` Pod's name to open a shell session and test the `api` service on port 80.
Expand All @@ -360,14 +363,14 @@ Use the `web` Pod's name to open a shell session and test the `api` service on p
<Tab heading="Method 1" group="method1">

```shell-session
$ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api:80
$ kubectl exec -it ${WEB_POD} -c web -- curl api:80
hello world
```

Then test the `api` service on port 90.

```shell-session
$ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api:90
$ kubectl exec -it ${WEB_POD} -c web -- curl api:90
hello world from 9090 admin
```

Expand All @@ -376,14 +379,14 @@ hello world from 9090 admin
<Tab heading="Method 2" group="method2">

```shell-session
$ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api:80
$ kubectl exec -it ${WEB_POD} -c web -- curl api:80
hello world
```

Then test the `api-admin` service on port 90.

```shell-session
$ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api-admin:90
$ kubectl exec -it ${WEB_POD} -c web --namespace consul -- curl api-admin:90
hello world from 9090 admin
```

Expand All @@ -395,7 +398,7 @@ hello world from 9090 admin
Apply the CRD to allow traffic to port 80 only:

```shell-session
$ kubectl apply -f deny-90.yaml --namespace consul
$ kubectl apply -f deny-90.yaml
```

<Tabs>
Expand All @@ -405,14 +408,14 @@ $ kubectl apply -f deny-90.yaml --namespace consul
Then, open a shell session in the `web` container and test the `api` service on port 80.

```shell-session
$ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api:80
$ kubectl exec -it ${WEB_POD} -c web -- curl api:80
hello world
```

Test the `api` service on port 90. This command should fail, indicating that the traffic permission is in effect.

```shell-session
$ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api:90
$ kubectl exec -it ${WEB_POD} -c web -- curl api:90
```

</Tab>
Expand All @@ -422,14 +425,14 @@ $ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api:90
Then, open a shell session in the `web` container and test the `api` service on port 80.

```shell-session
$ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api:80
$ kubectl exec -it ${WEB_POD} -c web -- curl api:80
hello world
```

Test the `admin` service on port 90. This command should fail, indicating that the traffic permission is in effect.

```shell-session
$ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api-admin:90
$ kubectl exec -it ${WEB_POD} -c web -- curl api-admin:90
```

</Tab>
Expand All @@ -438,15 +441,15 @@ $ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api-ad
Before testing the other port, remove the `TrafficPermissions` CRD.

```shell-session
$ kubectl delete -f deny-90.yaml --namespace consul
$ kubectl delete -f deny-90.yaml
```

### Validate port 90

Apply the CRD to allow traffic to port 90 only:

```shell-session
$ kubectl apply -f deny-80.yaml --namespace consul
$ kubectl apply -f deny-80.yaml
```

<Tabs>
Expand All @@ -456,14 +459,14 @@ $ kubectl apply -f deny-80.yaml --namespace consul
Then, open a shell session in the `web` container and test the `api` service on port 90.

```shell-session
$ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api:90
$ kubectl exec -it ${WEB_POD} -c web -- curl api:90
hello world from 9090 admin
```

Test the `api` service on port 80. This command should fail, indicating that the traffic permission is in effect.

```shell-session
$ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api:80
$ kubectl exec -it ${WEB_POD} -c web -- curl api:80
```

</Tab>
Expand All @@ -473,14 +476,14 @@ $ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api:80
Then, open a shell session in the `web` container and test the `api-admin` service on port 90.

```shell-session
$ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api-admin:90
$ kubectl exec -it ${WEB_POD} -c web -- curl api-admin:90
hello world from 9090 admin
```

Test the `api` service on port 80. This command should fail, indicating that the traffic permission is in effect.

```shell-session
$ kubectl exec -it web-6dcbd684bc-gk8n5 -c web --namespace consul -- curl api:80
$ kubectl exec -it ${WEB_POD} -c web -- curl api:80
```

</Tab>
Expand Down

0 comments on commit a3a7414

Please sign in to comment.