►
From YouTube: Gloo Edge in Action: Operational Tips and Tricks
Description
SoloCon 2022:
Gloo Edge in Action: Operational Tips and Tricks
Speakers:
Antonio Berben
Field Engineer- EMEA, Solo.io
Jesus Munoz Rodriguez
Field Engineer- EMEA, Solo.io
Session Abstract:
Gloo Edge is exceptional in its function-level routing; its support for legacy apps, microservices and serverless; its discovery capabilities; its numerous features; and its tight integration with leading open-source projects. However, it is also known for its learning curve when you’re just starting out!
The platform has been around long enough now, however, that individuals and teams who are new to the platform don’t have to figure everything out on their own. There’s plenty of help out there.
How do I compose a proper security workflow? Is my control plane production-ready? How can I get to know the filter flow? We will share our experiences and try to answer these questions.
Track:
Edge and API Gateway
A
I
wanted
to
welcome
you
to
this
talk
where
we
will
show
some
interesting
points
for
you,
blue
as
users.
My
name
is
anthony
berben
and
my
colleague
jesus
munoz
and
I
are
field
engineers
in
solo.
Our
job
consists
of
being
in
touch
with
customers
and
the
community
on
a
daily
basis,
understand
their
complexities,
their
struggles
and
how
we
can
help
them
to
meet
their
goals,
making
the
story
short.
We
help
on
the
path.
A
Based
on
that
experience
and
the
discussions
with
the
community,
we
have
collected
some
interesting
points
that
we
wanted
to
share
with
you
during
the
next
45
minutes.
We
will
talk
about
the
envoy
filter,
how
the
configuration
is
segregated
to
accommodate
it,
to
your
team
roles,
different
ways
of
how
to
implement
security
profile
and
envoy
admin
interfaces.
A
How
to
optimize
your
configuration
for
a
production
environment.
The
topics
are
have
been
selected
for
an
audience
with
some
experience
in
blueage.
However,
if
you,
if
you
are
new
to
blueh,
don't
worry,
the
concepts
are
quite
simple
and
you
might
find
them
interesting.
Then
later
you
can
join
one
of
our
workshops.
We
do
regularly.
A
B
B
There
is
the
control
plane
that
is
reading
the
crts,
the
configuration
and
is
producing
envoy
configuration
and
for
configuration
that
obviously
applies
to
emboy
proxy
and
that
envoy
proxy
is
is
also
having
additional
filters
that
are
provided
and
implemented
by
sol
and
compiled
into
the
envoy
proxy,
so
but
the
what
the
how
an
emboy
proxy
config
looks
like.
So
basically,
we
can
focus
in
three
parts.
The
first
part
is
the
listeners.
B
The
listeners
are
sockets
that
they
are
used
to
listen
for
traffic
and
then
clusters
that
are
destinations
upstream
backends
and
then
in
the
middle.
There
is
a
filter,
a
filter
chain
that
is
attached
to
our
to
a
listener
and
a
filter
chain
can
have
different
different
filters.
One
of
them
is
the
hdb
connection
manager,
that
is,
a
network
filter
that
allows
you
to
configure
the
routing
and
configure
many
other
operations
that
we
will
see
now.
B
B
The
upstream,
the
austrian
crd,
defines
a
destination
a
cluster
in
the
envoy,
and
a
virtual
service
is
used
to
describe
the
filter
chain.
You
can
define
roots
there
different
matches
and
then
routing
to
different
destinations
and
applying
different
operations
or
transformations
that
we
will
see
now
in
more
detail.
B
This
is
more
or
less
how
the
filter
chain
looks
like
so
a
client
makes
a
request,
then
goes
to
the
filter
chain
and
then
ends
in
an
upstream
in
our
destination
and
in
the
middle
we
are.
We
are
going
to
start
with
the
one
in
the
middle
of
this
external
auth.
That
is
a
filter
that
delegates
into
a
sternal
server.
B
In
the
next
talk,
I
will
explain
the
external
of
in
more
details
and
then,
and
in
this
field,
that
you
can
do
many
things
and
then
the
last
filter
in
the
chain
is
the
router
filter.
The
rudder
filter
obviously
forward
the
the
request
to
the
upstream,
but
everything
that
is
related
to
the
stream
like
retries,
timeouts
or
adding
or
removing
headers
from
the
request
or
response.
This
kind
of
thing
can
be
also
implemented
in
the
router
filter.
The
interpreter,
you
can
do
many
things.
B
B
B
B
That
is
actually
a
very
useful
feature
and
then
the
relieving
the
limiting
is
a
filter
that
can
be
applied
before
and
after
and
that
will
limiting
use
a
server
and
standard
server
to
to
provide
the
functionality
and
we
use
for
the
re-limiting,
something
that
is
called
the
set
style.
Api,
the
cell
style
api
is
a
way,
a
very
easy
way
to
describe
complex
scenarios.
B
But
I
can
do
it
now
so
before
the
external
off.
There
are
several
filters
like
all
these
ones,
that
make
sense,
for
example,
the
waft,
the
web
rotation
firewall
or
the
dlp,
the
data
loss
prevention,
or
course,
or
these
others,
and
there
is
also
one
that
is
at
the
beginning.
That
is
a
direct
response.
B
For
example,
you
can
define
the
filter
in
glue
in
two
different
places.
You
can
define
it
in
the
the
virtual
service
level
or
you
can
define
the
the
filter
at
the
root
level.
If
you
define
a
filter
for
a
particular
route,
only
that
will
take
precedence
that
the
settings
that
is
defined
at
the
virtual
server
level.
B
And
to
finalize
this
is
the
full
picture
of
how
the
all
the
filter
chain
looks
like,
and
there
are
filters
that
only
make
sense
after
the
external
loss,
for
example,
they
are
back
filter
or
these
other
ones
are.
The
refilter
in
this
case
needs
the
jot
filter
to
have
information
about
the
claims
and
an
additional
tip
that
you
can
define.
A
A
A
That
means
that
in
one
team
we
have
different
roles
to
fully
deliver
and
operate
the
service.
The
reality
is
that
not
every
company
can
make
that
change.
It
is
quite
common
to
find
different
teams
for
developers,
development
teams
and
for
operators,
for
example,
platform
teams.
Now,
let's
see
how
we
cover
all
these
with
blue
edge.
A
A
However,
as
we
can
see
here
in
the
case
that
you
have
different
setup,
you've
got
different
things.
We
need
to
create
an
abstraction
layer
to
link
the
two
worlds:
depths
and
ops.
This
object
is
called
root
table
and
it
is
designed
to
allow
you
the
segregation
that
we
are
talking
about,
as
well
as
to
increase
the
dynamism
in
the
configurations.
A
A
Our
environment
is
gonna.
Look
like
this.
We
are
gonna,
first,
deploy
an
application
under
king
one,
another
application
under
team,
two
and
finally
virtual
service
to
access
those
applications.
This
virtual
service
is
for
the
case
of
for
the
case
of
a
full
end-to-end
team,
where
they
own
other
resources
they
can
deploy
whenever
they
need.
A
A
A
And
for
the
sake
of
this
demo,
we're
gonna
see
that
we
inject
a
header
when
we
access
to
application
one
and
when
we
access
application,
two
we've
got
different
header,
so
we
can
differentiate
differentiate
them
now.
What
we're
gonna
do
is
to
split
this
virtual
service
set
into
two
route
tables
and
we're
gonna
make
the
delegation.
How
do
we
do
that?
It's
as
simple
as
now,
our
virtual
service
is
gonna
call
delegation
to
the
two
different
resources
deployed
in
application,
one
and
in
application
two.
A
A
As
we
can
see
here,
the
root
table
application
2
belongs
to
the
name,
space
2
and
the
root
table
for
application
1
it's
under
team
one.
That
is
how,
at
the
end,
we
get
what
we
need
now.
We've
got
that
all
the
resources
related
to
team
one
is
handled
by
team,
one
all
the
resources
related
to
team
two
is
handled
by
team
two
and
all
of
them
they
are
in
different
name
space.
B
In
this
part,
I
will
explain
how
to
you
can
compose
your
own
security.
Workflow
glue
edge,
come
with
the
different
filters
that
provide
different
features,
and
these
features,
as
you
are
already
aware,
are
the
transformation
web
application,
firewall,
dlp
connection
with
lambdas
and
all
this
kind
of
thing,
but
there
are
two
features
that
are
the
red
limit
and
the
external
oauth.
That
also
needs
a
an
additional
server,
and
this
server
is
provided
by
glue.
So
there
is
a
red
lining
server
and
there
is
the
exot
server.
B
Texo
server
comes
in
its
own
with
the
many
features,
so
you
can
configure
the
xsoft
server
in
glue
to
provide
basic
authentication
or
api
keys
or
oppa
or
this
kind
of
thing.
But
this
is
not
only
what
the
exopt
server
does.
There
is
also
the
possibility
to
connect
to
that
server.
Your
own
infrastructure,
your
government
servers,
so
any
open
id
provider
or
custom
authorization,
service
or
ldap,
or
all
this
kind
of
thing,
combined
with
the
features
that
are
implemented
in
the
excel
server.
B
B
So
in
this
case
the
first
step
is
an
oauth
authentication
with
the
with
a
google
account,
and
then
you
get
a
top.
You
get
a
token
for
the
first
step
in
the
second
step.
Using
that
token,
because
you
can
share
information
between
steps,
you
can
read
the
claims
of
that
token
and
using
your
own
server.
B
You
can
extend
the
information
with
your
own
logic.
You
can
create
a
new
token
with
the
extended
information
of
your
company
and
after
that,
using
that
new
information
you
can
implement
an
oppa
policy
or
by
say
open
policy
agent
and
it's
a
glue
which
supports
out
of
the
box.
You
don't
have
to
provide
anything
else,
just
the
rules,
just
the
regular
rules,
and
that
in
this
case
can
be.
B
B
Additionally,
you
can
also
use
external
or
more
authorization
servers,
and
these
servers
can
have
a
custom
implementation,
a
different
implementation
in
each
one,
and
you
can
attach
or
use
those
servers
for
different
routes.
So
in
the
root
core
you
can
use
one
server
in
the
root
of
a
10
and
one
you
can
use
another
server,
but
as
many
as
you
want
and
also
combine
with
the
xo
server,
so
you
can
say
the
default
is
text
server
and
for
particular
routes.
I
use
particular
authorization
servers.
A
A
A
A
In
that
scenario,
how
could
you
know
the
reason
of
the
high
cpu
or
memory
usage
in
order
to
have
visibility
on
what's
happening?
Emboy
offers
to
the
user?
Some
tools
from
that
approach?
Blueh
has
come
out
with
similar
set
of
tools
to
help
on
debugging
and
understanding
what
is
happening
in
the
entire
system.
A
A
A
A
As
you
can
see,
it's
really
difficult
to
to
debug
in
here
and
to
find
what
we
want
to
see
to
solve
this
problem.
One
of
our
colleagues
danny,
has
created
a
very
easy
to
use
ui,
where
we
just
need
to
download
the
dump
and
upload
it
to
this.
Ui
here
is
publicly
accessible,
so
you
can
usually
use
it,
use
it
at
any
time,
and
here
it
was
the
example
that
we
used
in
the
previous
demo,
where
we
created
two
applications
app1
and
if
we
filter
the
app2.
A
A
Intention
with
this
is
like
we're
gonna
spot
quickly,
the
cpu
memory
that
is
being
used
at
that
time.
When
this
process
runs
this
process
or
this
function,
there
is
one
way
to
download
it
and
then
verify
it
locally.
But
here
what
we're
going
to
use
it's
a
tool
which
is
called
pyroscope
and
it's
following
the
same
approach
like
prometheus,
does
offers
you
the
possibility
to
configure
and
scraping
and
pulling
not
pushing
but
pulling
mechanism.
A
So
you
just
deploy
with
a
helm
chart
like
I
did
previously
and
the
applications
you
want
to
scrap.
You
need
to
give
them
notations
special
annotations
in
order
to
pyroscope
to
start
scraping
you're
going
to
define
the
port
exactly
like
more
or
less
if
you're
familiar
with
prometheus.
This
is
the
way
that
produces
that.
As
you
can
see
here,
we
can
promise
by
default.
The
glue
is
configured
like
that.
A
A
A
B
B
B
B
And
then
nothing
happens.
Nothing
happened
because
the
good
group,
this
one
doesn't
work
because
the
configuration
is
accepted
or
rejected
as
as
a
whole.
The
first
change
that
we
are
going
to
make
is
to
allow
partial
configuration
so
for
that
we
will
define
in
the
help
chart
this
invalid
config
policy
with
the
custom
message
that
you
can
choose.
A
custom
code
usually
is
404
and
this
replacing
valid
groups.
True,
so
after
this
is
applied,
then
we
see
that
the
good
root
starts
working.
B
B
For
example,
we
will
apply
several
changes
apart
from
the
one
that
we
did,
we
will
define
groups
as
health,
proofs
and
graceful
shutdown
for
the
getting
web
proxies
and
then
song
affinity,
so
note
affinity
in
this
case.
This
the
notes
should
be
labeled
with
this
label.
I
don't
have
any
note
of
this
kind,
so
let
me
label
them
and
see
that
after
I
level
them,
the
container
is
created
and
then
the
new
gateway
boxing
with
the
new
proofs
is
starting
and
the
other
one
is
terminating.
B
B
B
B
B
This
is
a
new
chart
that
we
can
install
and
that
will
allow
the
control
plane
to
be
a
scale
you
can,
as
you
can
see,
by
default,
is
coming
with
the
three
with
three
replicas
and
then
this
will
be
used
to
start
the
stable
snapshots
and
the
proxy
will
be
taking
these
snapshots
from
here.
So
how
to
do
that
very
easily,
just
defining
the
same
thing
that
we
did
before
and
defining
the
service
address
of
the
xds
relay
and
the
service
port.
B
B
It
can
and
you
don't
see
any
interruption
in
the
service
now
you
can
scale
the
report
again
and
the
change
is
until
you
scale
the
glue
pot
again,
you
cannot
make
changes
to
the
configuration,
so
the
everything
will
be
running
with
the
latest
stable
configuration.
But
if
you
apply
changes
in
the
configuration
they
won't
be
propagated
until
the
blue,
that
is
the
one
doing
the
translation.