Kong Kong Builders Livestream Recordings, 25 May 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kong Builders - May 25 - How to install and run Kuma on AWS ECS

Description

Kong Builders is the livestream series that takes our developer-focused toolsets and puts them on display in the best venue possible – building applications and connecting workloads.

In this week's Livestream, Kat Morgan will walk through how to install and run Kuma on AWS ECS

00:00 - stream starts
03:29 - Intro
06:18 - Diving In
07:42 - Configure Secrets in AWS
16:22 - Deploy Control-Plane
24:33 - Inspect Kuma API Auth JWT Web Token
30:38 - Configure kumactl
31:31 - Kong Mesh Web UI
34:43 - Kong Mesh ECS Controller
41:19 - Demo App, Deploy Redis Backend
45:59 - Demo App, Deploy Frontend
49:38 - Demo App, Success!

Github Repo: https://github.com/Kong/kong-mesh-ecs

See upcoming and past episodes at Konghq.com/kong-builders

#KongBuilders #DevOps #Livestream #livecoding

A

A

Hi, uh my name is kat morgan. Welcome to this week's kong builders episode, you might notice. I am new to the kong builders. I am a recently minted developer uh relations team advocate on the kong builders team and I hope you enjoy what we have for you today.

A

So jumping right in we are going to be exploring the white world of meshi mesh magic. Actually hang on just a second meshi mesh, yes meshimesh, magic minions. You guys might have to make that tech, twitter official, if you think it's corny, just forget. I ever said it so um kong mesh kuma mesh.

A

They are both part of the kong ecosystem, kuma being the open source version that uh is the upstream for the calling mesh product. Today, we're going to be focusing predominantly on the kong mesh piece and we're going to be deploying it in aws ecs.

A

So uh one of the unique things about the mesh product is the fact that it can be used in kubernetes like you would normally expect from a service mesh or you can also use it completely outside of kubernetes and that's called universal mode. We're going to jump into that and run it in its containerized version on ecs.

A

So anyway, um if you're joining us from around the world, please feel free to drop a message just saying hi and where you're joining us from glad to have you, of course, and um if you see glitches or crazy things happening, you know like the stream starting a couple minutes late, just blame it on taking off my training wheels when it comes to the streaming streaming stuff.

A

Just today, probably going to be a complete train wreck, don't blame anyone, but me it'll be a lot of fun to see just how uh how much polish that people, like victor gamma, bring to the table. You don't even notice from a little bit of practice.

A

So um without further ado, I think I'm going to go ahead and share my screen and we're going to jump into just taking a little bit of a look at the resources that I'm going to be using for today's demo.

A

We're going to get hands-on, deploying this and just kind of to show you a little bit about why, where we're heading with what I'm doing today, it actually is feeding into an initiative to further enhance and improve the ecs docs on our kong mesh and kuma mesh documentation sites, so we're kind of just giving a run, giving it a run for its money, testing the existing implementation and we'll validate that against our existing docs and improve them as needed. So I hope you enjoy. Let's see.

A

Here I have a git repo. Actually this is public, so if you guys feel like jumping in and taking a look at some of the cloud formation that we're going to be using, um that, of course, is usable on your side.

A

I went ahead and deployed the vpc component ahead of the stream. uh If you want to.

A

A

There we go okay.

A

So the first steps we're going to take, assuming that you have a vpc already created like I did, and you have things like kuma ctl already downloaded, I'm not going to show that here our docs do actually cover getting that. Of course we're going to be on the licensed kong mesh. That does require a license, and I have mine already stashed on my file system locally in this directory for use, and that is the step we're going to get started with.

A

So let me go ahead and jump to my terminal.

A

These are written for a bash shell, so I'm going to drop out of fish and go ahead and execute that if um anyone has trouble seeing just drop a note in the chat- and I will zoom in a little bit more on.

A

Hey look at that um we might have to start hacking on it a little bit. It looks like my.

A

Testing yesterday has left some artifacts. That aws, of course, is going to give us a little bit of a hiccup with. Let's go, take a look at our secrets, manager in aws.

A

I'm working today in us west, one.

A

And stuff is scheduled for deletion, so yeah we're gonna actually have to hack at this just a little bit but that'll be fun. It'll. Give us an excuse to dive into some of the cloud formation templates. So let's jump up here, we're gonna name this cloud formation secret, two yeah. I know that's really special.

A

Cool all right, so, let's actually find out where that's being used.

A

Looks like we have it in it and should see it somewhere. Besides, the readme, unless we're gonna say ah we're gonna call that by the arn later since we're using arn, that's not going to hurt a thing. So let's go ahead and.

A

Just so you know, I cannot actually see chat live myself today. There was a little bit of a technical difficulty that we'll overcome before I do this next time.

A

So if you're saying anything, I'm going to need help getting that relayed and I apologize for the delay.

A

A

Actually, I wanted that there we're going to save our arns here.

A

So, of course, these are setting environment variables that we're going to call in here in a bit we're going to check on our load balancer address so.

A

After creating the license secret, we're gonna get ready to create some tls certificate. So, let's see if that load balancer is there.

A

And it looks like I need to reauthenticate.

A

A

Cool, so that's going to be our load balancer! I'm going to add that to my environment file that I can source.

A

And it looks like I have that dynamic already cool.

A

So we're gonna for the time being go ahead and leverage some self-signed certificates, part of the dependencies that we're relying on here includes the ability to pass up certificates just to serve things like the kuma api and the kuma gui the management, the control plane management web. You want um so let's go ahead and create the certificates there that we're going to pass into the aob.

A

A

Let's see so these should drop certs, I'm going to remove old ones, just in case.

A

I might not have exported that.

A

A

Let's make sure that environment as a variable is there and sure enough. It is good.

A

Okay, so here we're gonna go ahead and upload this secret, I'm guessing, there's probably going to be a collision there again, um based on what we saw with the license, so I'll have to rename that just a bit.

A

That's right: we exported the control plane um when we saw the fail, but we didn't recreate certificates there. We go.

A

A

So now we should be able to go ahead and generate a tls key.

A

Sure enough there it is.

A

We're going to do the same thing again for the certificate.

A

Thankfully we are doing this by air, and so I don't have to worry about renaming like we're doing today.

A

A

All right and we'll go ahead and check one more time to make sure that this environment variable gives us an error and that we can use as well.

A

And there it is good deal.

A

All right uh when we get this, deploy, going we're probably going to dive into some of the cloud formation here in just a bit. I'm curious a little bit more about. What's in those task, definitions.

A

And we can walk through those while the deploy is happening, which I think we are too now. So what we see here, of course, is that we have our cloud formation deployment.

A

We're going to be referencing our license secret by arn, which we just created and the same for both certificates there, and that stack is all defined in this deploy, control, plane.yaml.

A

So, let's carry that over to our terminal.

A

And see what we get.

A

Fingers crossed fingers crossed. Do we have the magic hey there? It is all right. So, let's go look at the aws console real quick. Make sure that we see that showing up in cloud formation, which we do those are creating.

A

A

Now we can go ahead and take a look at what's in. Let's see we said that was in deploy control, plane.yaml. So let's go see what is in that file.

A

um Now I am more familiar quite honestly with things like terraform, ansible and pollumi um so cloud formations. I can kind of recognize some objects in there, but it's going to be a little bit slower to walk through less familiar to myself. Anyway, of course, we have our vpc stack, we're referencing our license.

A

So this deployment of kong mesh- and this is a good call out- we are using a database backed deployment and there's a few different ways to manage state, um since we are not kubernetes native in this scenario where we are running on ecs, which of course is an abstraction over the top of eks.

A

We of course are running in universal mode again, that is the mesh mode where we can connect up, potentially virtual machines directly or physical, bare metal hosts without running um containers, even at all, so we're emulating some of that universal mode on ecs and we're not, we don't have the kubernetes integrations enabled for this particular deployment.

A

So our database for state management is going to be here in rds. That is a postgres style database.

A

So nothing just too unusual. There.

A

And let's double check that that's still running.

A

Sure enough, okay, I'll keep walking through.

A

So we're going to get that kuma api! You can see on port 5682.

A

And, of course, it's attaching that to our load balancer and then we're actually going to use a jot so a json web token for authentication against the api.

A

And what you see sorry excuse me: what you see here is actually.

A

Creating that secret for the kuma mesh api and dropping it into a secret so that we can get that in a bit.

A

Finally, we are defining the control plane task, so this is an ecs task definition if you've already spent time in ecs and are a user of cloud formations. This probably looks pretty familiar to you. One of the neat things about ecs is the fact that you can get attach iam profiles and things like that to specific tasks, that's like a per container or per pod roll attachment at the aws iam level, so that's actually kind of neat as far as the integration to the greater aws ecosystem.

A

Of course, you can see we're attaching the secret and the database credentials.

A

And this particular deployment does include cloudwatch configuration so you'll see that attached as well.

A

A

And I don't see anything else, that's just extremely. um We have extremely relevant to dive into. Let's see if there's anything else in the rest of this file.

A

A

So we're using the fargate feature on ecs.

A

Here's where the environment variables are passed directly into the container itself.

A

A

Migration commands are specific to the database style management, that's where it actually load, populates, initializes and populates that that postgres database pack-in that we're using there in rds.

A

Let's see how our cloud formation deployment is coming along, yeah that that's still in progress, so we'll finish walking through this file, so we know kind of what's deploying um and then we will see what the next step is going to be before we continue on.

A

All right, so this url is.

A

Part of the queue api, it's grabbing the token and that's where we push it into the secret, looks like.

A

A

All right feeling pretty confident about what's in this file, particularly.

A

So let's go ahead and take a look at what's coming next.

A

We already did our license created our certificates that attached to the load balancer all that was passed in our deploy command all right. So next we're going to be fetching that jot token. Let's take a look at our cloud formation. Maybe we already have the token ready there. It is sure enough. Our deployment is complete, so this is something that I actually, I recently learned about the jot the json web token, and I want to play with that just a little bit.

A

I don't know if you're up for it, but we're gonna, give it a try. So let's try and go ahead and capture.

A

That json web token I'm gonna do this a little bit publicly. You won't get the certs out of it, uh but so I think we're safe and all of this environment is gonna, be torn down pretty shortly.

A

So people can call me out in a bit if I am violating all sorts of security here.

A

There's the arn. For the token I actually want to get the contents of that I'm trying to remember.

A

I know I pulled that before there it is okay, we're going to get the secret string here and then we'll go look what's actually in there.

A

Okay, so I'm going to echo.

A

Cool now what you'll notice is this is the token is comprised of three individual parts. They are delineated by the period there. Let's carry this over to our browser and we're going to dissect that just a bit.

A

So um if you're ever looking to try and uh create a jwt- and you want to design the the payload or the headers, um this is a really fun place that I actually first got hands-on with it to be able to play with those tokens I'm going to post mine and instead of creating a token which you can do here on the right, I'm going to read by pasting.

A

In my actual token here on the left, so you can see um the header uh just sets up the the the various kind of handshake establishing the communication.

A

We're going to see that our group is mesh system admin and then we have other details in there as well unique to the authentication scheme. So I'm going to close that out and now you can see that that is what we're passing in when we're actually using this authentication to configure our.

A

My cuddle binary so kuma cuddle config, is a lot like uh cube cuddle. um Actually on that topic, I read these words. So often tube, cuddle, cube, ctl. Everybody says it differently.

A

um I think it'd be fun if you feel like uh dropping in your favored pronunciation in chat just to see what different pronunciations we get from from our viewers today, men, don't judge me for how I say it, because I do plenty of judging all the time of myself all right so here in this command.

A

um We're naming our config for this particular control, plane, ecs.

A

We are setting up the address here and then for for finding the api itself we're setting off type to tokens. I have only done off type tokens so far like I said, I'm just diving into the mash world here and you guys can follow along while I dive into the ins and outs of that, for I'm sure the next good long while um and then we're actually passing. In our token, with that flag there, the off current flag.

A

Let's see if I still have a config, I do.

A

That's funny I did coop cuddle. Yes, I have a.

A

There we go so we can add list, remove and switch. So let's do list. I have ecs. So, let's remove because that's from yesterday it doesn't exist anymore.

A

I'm guessing sure enough: I'm gonna do the name flag.

A

So, let's do list on it again. Only one is local, and now we can go ahead and add the one that we just built awesome.

A

So if we list again sure enough, that is our load balance here here and let's see what the prescribed next step is so so far just rewinding to think through what we've done in a fresh vpc in aws, we have deployed ecs and a kong mesh control plane with our chrome license and self-signed certs for the time being, going to the load balancer in front of our calling api kong mesh api we've just configured kuma cuddle to with authentication for that api and next, if we want to, we can actually jump into the gui itself.

A

So let's do that.

A

So if I go back.

A

I can copy this link drop it in my browser and demo gods. Be willing, we'll see what happens so because we're using self-signed certs, I'm sure you're, all familiar with clicking through danger signs. It's one of my favorite things to do professionally.

A

I know infosec, beware: cats around.

A

And sure enough we're pulling up the welcome screen for our kong mesh, so we can skip through this I'm going to go ahead and actually walk through it. Real quick. um I have not explored all of the possible avenues yet, but I'll show you the one that I've done so far.

A

Basically um do remember: we've only set up the control plane. So far we have a little bit more work to do before we start using our mesh.

A

um We are going to go ahead and keep it uh stupid simple for the time being, we'll get into multi-zone in the future feel free to speak up. If you have a favorite topic that you'd like me to cover going forward- and I will put that on the agenda today- we're just going to do a standalone deployment.

A

Again, we're using that postgres for the database backend, so we don't need to change anything there and we would not expect any other meshes yet. So one thing to remember is a mesh is a virtual abstraction over your physical or other virtual infrastructure.

A

What we have here is the opportunity to see, observe, control and define multiple different meshes from a single control. Plane remember this is the control plane here, not the data plane itself, so let's go ahead and hit next we're not going to set up a demo app automatically.

A

um That would make more sense in kubernetes anyway, and we're going to jump to our dashboard.

A

So here's our cone dashboard, we have one zone, no services have been deployed, so there we shouldn't see any data plane proxies remember in a containerized world, you have your sidecar container and that is responsible for passing through your applications, traffic and maintaining all of that transparent um network handling from service to service, so that your application doesn't need to know how the networking is designed and implemented.

A

So let's go ahead and see what we get to do. Next, we pulled up the gui. The next thing we're going to do is actually create an ecs controller, so this is a little bit of glue code. You would not typically see this in a kubernetes installation um or in a universal mode outside of ecs.

A

Basically, this is going to be a unique ecs task. Definition that runs a um an additional controller tasks separate from the control plane and its primary function, as I uh was discovering yesterday, is just to help us manage and issue tokens for data planes to connect up to our control plane.

A

So remember that this is not um kubernetes integration, so we don't have things like secrets to pass around. We need to issue and hand out secrets from to each of our additional tasks so that they can actually can connect up to the control plane. So let's go ahead and get started with deploying this ecs controller.

A

So this ecs token is based on akuma ctl generated token.

A

So let's go ahead and issue that.

A

I'm not going to share that token right now, I'm going to trust that it was correctly provisioned.

A

So we're going to create also going to create a secret.

A

I'm probably going to have to rename this one. We are referencing it by arn, so hopefully I don't have to go in and patch any of our cloud formation. For that.

A

A

Sure enough, so that was that name collision that we ran into earlier. Let me rename the secret super creative secret too.

A

I think I'm uniquely qualified to rename collisions I'm joking everything is said, sarcastically here all right, so now we're going to go ahead and cloud formation, deploy our controller task, we'll go ahead and issue that command and then jump into that cloud. Formation. Definition next as well.

A

So this is that arn for the token secret, assuming everything populated correctly, that should kick off our cloud formation. For the token controller, let's go take a look sure enough.

A

We have our create in progress here. Let's take a look at what's in that task.

A

This one should be significantly shorter than the last than the first one go to deploy.

A

A

A

Sure enough, this is our ecs controller task. We are setting an image here, and this is a fairly new feature, so punch edges for the dev tag. um There actually is a 0.1.0 tag out there. If you want to pin it or you can pin it to the hash. If you try this yourself and you want to steer clear of the dev tag for obvious reasons,.

A

All right, so this is controller task execution, roll, we're giving it a roll.

A

Allowing it to get a secret.

A

Giving a cloud watch- and this should be the iam roll.

A

Log group for our cloudwatch security group.

A

And this is going to be the service, we're not actually going to be exposing any services for this. I don't think I think it just creates the secrets and the actual task definition. So this is the part that I wanted to look at.

A

Let's see so we're setting our cpu and memory limits, this should be a pretty light workload to run and again in ecs billing occurs based on allocated compute for each task.

A

So usually we would want to keep that pretty well sized.

A

To what's actually needed so you can see, we have our command run api server, url, we're telling it where the api server lives for our kuma control, plane.

A

And giving it the secret of course cool. So that should be a pretty quick task to spin up. Let's go, take a look and see how our cloud formation deployment is going and it is complete.

A

So if we catch back up to where we left off.

A

We created our token secret and we deployed our controller.

A

So it looks like we are ready to go ahead and deploy our demo apps. So this is a pretty standard. Camera demo, app you'll, see the demo app used elsewhere, we're going to have our redis backend and then an application front end and each one of those things is its own ecs task.

A

So the tasks should include a sidecar container which is going to connect up to our mesh control plane and that will create the data plane connecting the two services together.

A

So let's go ahead and do that and create our redis.

A

See if there's anything interesting in this command, setting our vpc name.

A

Our stack name and uh we'll go look at this file just like usual deploy counter demo redis.

A

All right, so, while that cloud formation is deploying, let's take a look and see what a task definition looks like on ecs when it has our kong mesh integration.

A

Deploy our app here is going to be the counter demo and we're deploying the back end right now that redis.

A

So I'm expecting this to have two task definitions or two container definitions in the task. Let's see how that works. Exactly, of course, um one image we'll see here is the kimono data plane image we're on the 1.7 release, which is our latest for the kong mesh.

A

This drops in the config map.

A

For our service in our protocol, so that the data plane knows what traffic it is going to be handling, we of course have a data plane. Token token secret. The controller, the ecs controller is issuing that and.

A

Get our role log group security group.

A

And our test definition.

A

So again, we're setting our pod resources.

A

And container definitions, so we have two container definitions here. We have data plane down here and workload up here. Of course, our workload for the redis container is going to be essential and.

A

So is the sidecar we have.

A

Our kuma token and the sidecar and.

A

Our command is going to be telling the data plane to join, uh hitting the control plane address there. Let's go see if our deploy was successful. I bet it's ready sure enough. There it is.

A

If we jump in here, I actually want to see the task running in ecs. So here is our cluster and sure enough. um All together here we have our.

A

Control plane, that is, the camera control plane. We have the ecs controller for issuing those tokens and we have redis. That's the back end. Let's go ahead and get that front end of our counter application deployed.

A

So here is where we deployed redis and.

A

I think that demo gods might be treating us halfway decently today. What would you say.

A

Okay, finally, let's take a look and see: what's in that demo app, I think it's going to be pretty simple.

A

I'm going to jump straight to our container definition, so this is the workload. This is the task definition setting our resources again there. Our redis host, of course, is going to be accessible in the separate pod at localhost. That is how we reach services that are exposed via the sidecar data plane for our kong mesh.

A

So this is the workload container and, of course, we're passing in the redis port, also accessible at that localhost address. The traffic, of course, is sent from data plane to data plane. We'll take a look at that in just a second in our web ui for kong, mash.

A

That is our token for joining the data plane to the control plane and our address it's passed in there. So let's go take a look at our cloud formation task. It is complete. We should see that here. If we refresh sure enough there it is so. This is our ecs task.

A

And let's go look at our web ui there. It is so we have two data plane proxies here.

A

Let's see if we can tell, which is which.

A

And so this is going to be our redis service. You can see our annotations are passing through into the web ui here, and this is our demo app again. That annotation is passing in.

A

You can see the the data plane service definition here.

A

A

That's fun I'll have to look into that all right. So let's take a look at our overview and finally I'll be curious. I haven't actually done this ahead of today, we'll see if we can.

A

Pull up our app.

A

If I understand correctly, we should be using the same load balancer and we should get that from port 80.. Yes, the demo gods were kind okay. So this is our basic uh counter. App. Of course, all of the data between the two ecs task- definitions for redis and our application front end are traveling through our kong mesh and finally, let's go take a look at our mesh.

A

So today we haven't implemented any kinds of additional mesh capabilities we'll get into that in the future.

A

I'm really excited to jump into setting up different meshes and connecting up virtual machines looking at possible multi-cloud use cases and all of those other fun kinds of usages. um If you have favorites again drop them as comments in the chat, and let us know what you most want to hear about. I'm sorry that I'm not as interactive today as I'd like to be just because I do not see the live, chat right now um feel free to um at me, userbaincat on twitter and follow up about what you thought of the stream today.

A

I wonder if there's any other fun things that I can think of to do.

A

We'll just kind of click around I actually haven't explored the web ui enough. Yet.

A

So the health checks are showing healthy. I'm curious if we can see where those health checks are showing.

A

uh Mtls that'll be a good topic for a future stream.

A

See we're doing universal mesh, so there are two different definitions: you can actually declaratively configure the the mesh um with kubernetes objects, as you can see here. Let me zoom into that just a little bit more um in universal mode. You just hit the kuma control plane ipad address directly, just like we did up here, and I want to see if I can find some of the traffic reports.

A

Another thing fun thing that we'll do is configure our mesh with the kong gateway as an ingress into our mesh. So right now we're using um the ecs service and attaching that to a load balancer. But that is not always available.

A

So we're going to see how we configure that when we use a con gateway.

A

A

A

Traffic logs, I'm not seeing any yet.

A

Routes ooh: this is a fun one.

A

So this is telling.

A

A

Oh hey traffic, microservices, observability yeah. We will definitely get into that um once I learn how no um that's one of the things I like about the uh kong builders, of course, is we do not always guarantee success. Today's success must be a um beginner's luck.

A

A

All I have are plans for the future, so um check out the repo take a look at some of that cloud. Formation stuff we'll be carrying this into some of our existing docs for setting up kong and kuma mesh on ecs to make sure that the documentation on the official site is working and ready for you to go. Build your own successes with.

A

Otherwise, I think we can go ahead and I will.

A

Tear down the lab and see you all next time.

A

As always have a great day, my name is kat morgan and thank you for joining kong builders.