Knative Community Meetups, 27 Apr 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Knative April Meetup/ Demo: Connecting a Knative Eventing Cluster by PAblo Mercado

Description

This demo show attendees how to use sources and sinks to connect multiple Eventing instances. We will be using TriggerMesh OSS components to build an authenticated flow between the two clusters.

A

Thanks for to everyone joining uh here today, so I'm paolo mercado, I'm a state's asset, I'm an engineer at trigger mesh where we build a a layer on top of k native to do integrations and what um more stuff. So um this is where you can reach me. If you want- and that's my uh you know- I'm not very social on the internet, but anyway there you have the links if you want to reach many time.

A

So what we are going to talk today is about connecting eventing clusters, so um this is going to uh um to be divided in four shorter steps. One of them is explain the the scenario.

A

Then we will try to solve that scenario by first exposing the broker publicly and then creating a cloud events gateway and then modifying that cloud. Events gateway to provide some basic authentication.

A

So first of all is why would someone want to connect multiple kinetic resources, so this is we've had. I think three people at twitter mess asking us the question, but then we never developed the case so well, I'm not sure what the if, at the end of the day, someone really really wants to do. This, but these these are the um at least the three scenarios that I picture that the people could use this for.

A

So, if you are migrating your cluster, I don't mean a version, but if you are migrating from one cloud provider to a different one of your own premises to the cloud or otherwise in the other direction, then for dumping events.

A

So if you have a production scenario and then want to test something that you've developed at the staging or testing a scenario, so probably you can, you might benefit from having uh communications or a string of events flowing from one environment to the other and another one would be for geographic distribution.

A

So if you have two different eventing clusters- and you want to.

A

Put your load where it should run or do you feel at every moment it should be the place for processing that that could be the geographic situation and there are some others, but I think those three which are three we should be good to go.

A

So this is what we are going to set up today. So I have two clusters so that line that you see there is a dividing the two clusters um and in one of them, um which is the top most um uh referred to that one, I think by k young one or the producer of events, and then we have another one at the bottom, which is will be the consumer of events and to produce events.

A

um I I'm going to use the heartbeat, so I guess people are more familiar with pin source, but these you know with spin source. You need to wait one minute to to get an event, so I decided to to use heartbeat um then heartbeat. I think I'm configuring that for generating events, every 10 seconds or 5 seconds- I don't remember so those events will get into a single broker and from that broker for debugging purposes.

A

We will have a trigger and even display, and then in the other cluster we will start only with a broker, then a trigger and even displays just the same for debugging purposes. So if you think that's okay, I think we can. We can set up this environment first.

A

So let me get to my window and I guess I will need to increase the font like this. So if, if anyone has problem, I need to increase more the phone. Please tell me so I have one of the clusters: is a mini queue, so it's running locally. That would be the producer and the other one will be one that we have a cloud provider which should have a public addressing so for this one. The producer I'm going to first configure.

A

This I'm going to configure okay and also get to where I have the.

A

The manifest so give me a second, but this is 19 yeah and for this other one, I'm also going to get it there.

A

And configure and oh by the way.

A

Okay, so I said the the one above: it's a is the producer and as such, I'm going to start doing the setup for that scenario. So let's take a look, but this should be probably familiar for most people. So I'm going to show you what the this looks like.

A

So you have that broker. I'm calling that export. uh I need to create this name space by the way, so I'm going to create it as when I go back from here from from bim. uh This is the the heartbeat and pop and as you see here, this is going to be sending data to the broker created above and then this is the event type that is going to generate.

A

This is the payload and it is emitting every 10 seconds and then this year it's a debugging part, so we will have an event display to see that everything is running properly and to join the even display with the broker. We will have a trigger here. Also, that is sending no filtering. So all the events are going to get to today, even display so qcdl or k.

A

This should be oh one, so k create ns, a k, n1 and now. Okay, apply minus f, 0 0 that one cluster one and there you go oh now. If I, if I should divide the screen a little bit more, I hope I have room for all these.

A

um I should be able to do k logs k and one uh let's see.

A

User container, minus f and there you go- this is addressing. There is internal to that the first instance and every 10 seconds I should be getting you see this id that is, is sequential, so I am expecting to have a id5 in in in 10 seconds, so there you go.

A

Okay, so this is this: one is set up as seen here, so we need to set up this one yet so, let's get to this this other cluster. So let me make sure yes, okay,.

A

So in this case, I'm going to show you uh what is going to be created here, so it's a broker in this case called import at a different cluster and a different name space. I need to create kn2 and then just exactly like in the other cluster. We have this service and we have the trigger no filter, getting all the events to be shown for testing purposes.

A

So let me apply that uh minus f 0, 0 0 2.

A

Oh, I I said that drape as game 2., okay, now yeah, and uh also I'm going to do the same. So I'm not expecting at this moment any any even here, but just to make sure by the way, uh the streams.

A

Okay, oh okay, I need to also do the export at one and then okay, logs minus end kn2, and there you go user container, minus f and this should be empty. So there are no events going here. This is expected so far, so uh let's get to the first, uh the first solution. So there's a solution, I'm not commenting here. Obviously uh this broker is kafka. Nuts is rabbit and q, so you could forget about clean native and do that under the hood. But we are.

A

This is not as a solution, I'm um I'm showing here anyhow, because that's not part of the of what k native tries to abstract but anyway, ideally that same uh way of thinking, because the first thing we are going to do is to expose here you see at the the second cluster, the consuming cluster.

A

We are going to expose this publicly and then, when we do that there will be an endpoint that we can configure at a trigger at the producer cluster and connect both of them. So probably this is not the best solution ever, but you know this works uh has a some kv ads, but it works. So let's get to that, so we said that first at this cluster down here- and this is the second cluster we are going to expose the the broker so right now I can do this get uh brokers, minus and kn2.

A

So you see, this is the address that the um that we will need to find a public endpoint to for this. So since we are using istio here um we're going to create a virtual service, so let me take a let me show you how that looks like. So I think this is number one yeah and this should be zero one.

A

So the virtual service is using the kinetic gateways. You can see them here. This is the host that I want to be provisioned, so not to be permission to be exposed. So this this domain is already configured at created, so if this is successful or any of you uh wherever you are you'll, be able to contact this endpoint and send their cloud events if you win so then internally, where is this going to to go? So I want to redirect everything getting in there.

A

I want it to be sent to this address, which was the one that we saw before, but it's lacking the the path. So we are rewriting the path here, but probably you know that the brokers are. We are using the multi-number broker, so I didn't mention that we're using the multi-tenant memory rocker.

A

So uh this is the the global address for all of them, and then this is the way to to do the routing. um So, with with this, I should be able to expose the um the broker. So let's try that okay, I minus them kn2, and this is zero of minus f and by the way this is already part of the manifest.

A

Tier one blah blah blah okay, so the virtual service was created. um I think we can test it now to see if at least this is working. So I have this already reading somewhere to save some time, but uh we can go through this quickly. So you see here that I'm using playing card with the v to to see if there's some issue. This is the address. I was configuring at the virtual gateway and then this is a plain, simple um cloud event. So if this is right, I should be seeing here.

A

This is cluster 2, and this is a you know. I could be doing this from any any shell. Oh I I don't know what I did yeah. So if this is working, I should be watching here. The hello broker message. So let's get to that and there you go so at this moment. What we have is this scenario not a trigger yet, but this is being exposed, so any one of you uh getting to this end point we'll be able to to send events here.

A

So, let's get to the other part of the first cluster, which could be configuring the trigger. So to configure the trigger, that's super easy. We just need to use also the same address here at the at the trigger at this cluster. So let me show it to you, so this is a.

A

So, okay apply my new set zero one, um zero two! If I'm not wrong, oh no! First! I I want to to look at it so that you can see the contents. So these are the contents. So super easy, the I'm filtering here because later we are going to send a different type of message, but this is a message being produced by the event display and the subscriber. Usually you will see this as a reference to an object inclinated, but you can also use a uri.

A

So this is what I'm using here since this is an external endpoint and cannot be resolved as an object. So let me apply that so: okay apply minus set. Is there and look so? This is what is being read at cluster one you see. 55 was the last one 56 now, and this is cluster two, so yeah right now. We have both clusters connected.

A

Easy might be uh not everybody's cup of tea, but you know they're super easy to connect two of them doing this.

A

So, uh let's see why some people, including me, might not like this, so the broker is an internal object and while it can can grow in the future to provide some other capabilities- and I feel like adding all those capabilities of uh like being an internet facing or public facing uh object is probably too much and I feel a bit more comfortable having the broker do what it does best and having some other gateway component for for managing, maybe validating and doing filtering and so on.

A

Whatever is needed, authentication and so on so and the other one is the the virtual gateway is uh is specific to uh to the mesh, so I'm also not comfortable using that. So, if you use I know career, this will look different. Probably there might be other solutions like I having in invest research using, for example, services of type external services, but anyway, all those seems to be like tricks and not proper solutions.

A

So, let's get to the next way of doing things. Let's, let's try to build a cloud events gateway. So in this case that could be something that is aware or for its task. So that's something we created uh some time ago at triggermesh we created a component called webhook source, which is a component, a source that is listening to http requests and converting them to cloud events, and I I think that one is great because that allows us to integrate with so so many sas out there.

A

But I think if you have someone that already already produces cloud events and webhook source was needed to provide a fixed and a static um type, uh all the attributes were static. Well, in this case, you just want to consume code events. This is way more simpler.

A

So, let's get to to configure this, um I think we can leave the uh well. Let's see, uh let's create that that gateway first, so the gateway is going to be placed in the second um in the consumer cluster. So I'm going to.

A

I don't know if you want to see the spec, but since I talk too much- and this might get a bit long, I'm going to show you the object right now, which is laughable at the first view but and then later I I think I I will take you through the through the capabilities of this component, so yeah this is on cluster 2, the cloud events gateway. Let's look how it looks so that is stupid.

A

uh So you see we are creating this cloud event source and that it just has a sink, so it resembles a little bit, the virtual gateway that we saw for istio, but this is a pot, a dedicated pub in this case.

A

So let's do something. Let's, oh.

A

Let's create it so: okay apply minus f this one. uh Let me make sure yeah I'm in this whole cluster, okay, so it has been created. uh I think I could test it, but before that, let's do a get cloud event. Sources, um kn2.

A

You see it is ready, and then you also see the url it is supposed it is exposing to the internet. So uh I am now ready to execute almost the same car command as before.

A

But this time I'm going to change the url and I'm going also to change the the message hello broker uh using cloud event source. So there it goes 202 and where is it.

A

Oh, I don't know if the component went down, then it will kind of up.

A

So a bit of patience, please they get bought. I'm just saying: kn2.

A

Should be there, I'm going to send it again, just in case yeah yeah he's here, probably it's. I need to scroll something like that, but you see here that we are receiving uh events through the cloud events source, so uh we will need to uh modify the trigger or create a new tier. Probably I don't know so. We will need to uh yeah. I guess modify the trigger to um to use this new endpoint.

A

So let me do that. uh First of all, I'm going to delete the previous trigger and I guess I'm also going to delete the the recall service to make sure that we are not using the previous scenario. So here we have the zero two.

A

Suppose yeah the cluster out, I'm going to delete that one the trigger and then here I'm going to delete the virtual service. Okay, delete minus f01.

A

At virtual service, so now, uh if I send something here, sorry.

A

Yeah, it should still come here, but you see that this number will increase and it is not appearing here, so uh I will need to to honor this. I will need to create this trigger using this url, so I'm going to show it to you. uh Beam02 is gateway.

A

This is the second step, and you see that it's super similar to the previous one, just changing the url to use the cloud event source. So let's apply that one. Okay apply minus f, two two two two blah blah blah and um at some point yeah. You see now there, but the events are flowing there. So now we are, we have this complete, so we have the uh virtual service way of doing things and we also have the the cloud events, source or cloud events gateway.

A

So uh still, there's something that uh probably is bothering some people is that this is totally open to the internet. So anyone here that knows the url, although this is ssl protected, anyone could contact it. So.

A

So probably basic authentication is not the best uh around, but it is at least something so, and this is the the only authentication we have so far at the cloud events uh source. So that is what we are going to create now, but you know this is a super recent uh addition to the trigonometry stack um and it will grow for sure in in the following months. So, let's let's see if we can add that uh authentication, we could be adding some parameters in here in the cloud event source.

A

So uh we are going to to do that. Let me again show you at this cluster 2, how that could look like so.

A

The cloud event source accepts our range of credentials, uh I'll get you well I'm going to tell you why. So if you usually, you would expect a single set of credentials, but we thought that maybe if you were going to generate new credentials, you could need to do that with some hot swap, and probably you don't want to change overnight. So this accepts a range of credentials for classical authentication.

A

It is referencing a secret, so we will need to create the secret, the kubernetes secret, and this is not needed, but it's also a set a path to where it could be. Listening to those cloud events- um and this is just the symbol before this is a sending that to the broker and the the missing part- is the the secret. So the secret in this case is called password1 and the the contents is pw1, so that contains all that we need.

A

So let me apply that that could be a k, applying minus f.

A

There you go so this should be updating the the cloud event source.

A

A

There's a side effect when the new part uh gets up the path for this cloud image: components that there will be a side effect is that there's a trigger here at the first cluster and that trigger is sending the cloud events, but it has no support for authentication and also no support for for the path.

A

So uh what I'm expecting there is this? This is going to start failing. Okay, but that's uh that's it at some point. You see this here and this will grow. While this one will get a stack, but we still have car. We can use car to to test this environment for now. So I'm going to launch the same.

A

The same request I was sending before. So you see that this is using. uh Oh sorry, no! I sorry. uh I totally confuse people, probably because I created a second a second cloud event source. So let me confirm that I didn't remember that if ucl get a cloud around event, sources- um kn2, oh yeah, there are two of them, so the first one is not going to fail. Sorry, but anyway, this one is pointing pointing if you see here to gateway oath to kn2 sorry. So this is the second that we created 100 seconds ago.

A

So let's try to use it using curve, and let me show you this, so I'm getting an asterisk, a 400 one here. Okay, so probably most of you know what we need to do, which is up here: minus you user, one pw one. I think okay, so no longer a four zero one, but a fourth q4, and that's because we were using a path. I think that was called my path.

A

So let's try that yep there you go so, uh let's see a hello broker secure there you go, it is receiving it really receiving the the events. uh So we now have a protected endpoint that uh or protect it. It's a it's using ssl and it's using uh basic authentication. I don't know if you call that protected. That is better than fully open so, uh but we have a problem. uh The problem is that we cannot use it from from here, so uh we are going to introduce also a component.

A

That is a work in progress, uh but you know I I hope it is. We published this very soon, which is the cloud events target, so that component will read cloud events will receive cloud events is we call targets and what the people usually call syncs. So this is a sync. At the end of the day, it will receive cloud events and those cloud events will be forwarded to whatever url to configure in there and in the way it supports uh everything that the cloud event source supports, so basic authentication and path.

A

So, let's, let's get to that, so this should be happening at cluster number one uh and we are going to produce a different set of events, because this one is is sending. I want to share this question to the world, so we are going to create another instance of the this is not needed, but you know this is the demo I created. So we are going to create a second instance of the heartbeats, but this time sending a different messaging and different event type.

A

So let me check from zero three.

A

Okay- so you see here, this is uh the super close to the heartbeats we created in the first step when we set up the environment, and but in this case there are a couple of differences. One of them is the event. Type is different, so the filterings we have already in place won't pick these events.

A

And then I want to share this message with authenticated people so that we make sure that we are receiving the proper the proper message. So this is going to be producing that cluster one along with the other messages from the other heartbeat, then we will have the same secret.

A

Obviously we need the the same password uh for the secret to use at the cloud events target and the cloud events target is a counterpart for the cloud event source and this one will be configured an endpoint so just like at the same endpoint we've been using with curl, so you can notice that this endpoint contains the the path.

A

uh So it's not that we explicitly support that, but there it is. You have the path there. um Then you also have uh the credentials here so same username and then a password that is going to be read from the secret we create about and finally a trigger that is going to uh to link the the event events flowing through that broker. The export broker here, which are of type secure message to the coincidence target so.

A

So that could be it I'm going to buy it.

A

And at this moment we should have this full configuration and as soon as those components are up and running uh here, I should be seeing not only. I want to share this message. Hey you saw that here is it's also speeding, but this is local to the kn one cluster. I want to share this message with authenticated, authenticated people and at some point I'm expecting.

A

Those messages to get here.

A

So to the world yeah, so here it is, you can see those messages are are getting here. So at this moment we have this two different clusters sending cloud events, one to the other in an authenticated way.

A

Before the questions, I also wanted to to tell you, um because some of the sources and things that you see around it- they might not use secrets directly, but they get secrets uh provided through environment variables. So we opted for this pattern because we are mounting the secrets and setting a file watcher on them. So the net result is that if you update the secret, you will get it updated in your component.

A

So that was a problem for I don't know if you configure some sources that do not follow this pattern and you change a secret. uh We don't have yet a watcher on secrets there and you will need to tear down the component and bring it back in this case. No, to be honest, it takes like sometimes even 30 seconds, but usually 10 seconds when you change the secret to to see that reflected, but this one's, if you change a secret, you won't need to do anything else.

A

The the changes will eventually be applied, and this is all I had for you. So this is a the two game message trigger ms repo and also at my personal github, there's a they're. The demo manifest, but I'm working on uh with me last minute and even post last minute, I'm working on arrhythmia that I'll upload sometime today.

A

So thanks a lot for for joining me in this session.

A