Secure Kubernetes Gateway

• Go to Site Type Selection section` and perform the following:

  • Select a region in the AWS Region drop-down field. This example selects us-east-2.
  • Select New VPC Parameters for the Select existing VPC or create new VPC field. Enter the name tag in the AWS VPC Name Tag field and enter the CIDR in the Primary IPv4 CIDR blocks field.
  • Select Ingress/Egress Gateway (Two Interface) for the Select Ingress Gateway or Ingress/Egress Gateway field.

• Click Edit to open the two-interface node configuration wizard and enter the configuration as per the following guidelines.

  • Select an option for the AWS AZ name field that matches the configured AWS Region.
  • Select New Subnet for the Select Existing Subnet or Create New field in the Subnet for Inside Interface section. Enter a subnet address in the IPv4 Subnet field.
  • Similarly configure a subnet address for the Subnet for Outside Interface section.

• Go to Site Network Firewall section and select Active Network Policies for the Manage Network Policy field. Click on the Network Policy field and select Create new network policy. Enter the configuration as per the following guidelines:

  • Enter a name and enter a CIDR for the IPv4 Prefix List field. This CIDR should be within the CIDR block of the VPC.

• Click Configure under Ingress Rules and enter the following configuration:

  • Set a name for the Rule Name field and select Allow for the Action field.
  • Select Match Protocol and Port Ranges for the Select Type of Traffic to Match field.
  • Select tcp for the Protocol field.
  • Enter a port range for the List Port of Range field.
  • Click Apply.

• Click Configure under Egress Rules and enter the following configuration:

  • Set a name for the Rule Name field and select Deny for the Action field. This example configures a deny rule for Google DNS query traffic.
  • Select IPv4 Prefix List for the Select Other Endpoint field and enter 8.8.4.4/32 for the IPv4 Prefix List field.
  • Select Match Application Traffic for the Select Type of Traffic to Match field.
  • Select APPLICATION_DNS for the Application Protocols field.

• Click Add item and configure another rule of type allow for the endpoint prefix 8.8.8.8/32. This is another Google DNS endpoint prefix.
• Click Add item and configure another rule with Allow action to allow rest of all egress TCP traffic.
• Click Apply.
• Click Continue to apply the network policy configuration.

• Select Active Forward Proxy Policies for the Manage Forward Proxy Policy field. Click on the Forward Proxy Policies field and select Create new forward proxy policy. Enter the configuration as per the following guidelines:

  • Enter a name and select All Proxies on Site for the Select Forward Proxy field.
  • Select Allowed connections for the Select Policy Rules section and click Configure under the TLS Domains field.
  • Click Add item. Select Exact Value from the drop-down list of the Enter Domain field and enter github.com for the Exact Value field. Click Add item and add the following domains with the Suffix Value type.
  • gcr.io
  • storage.googleapis.com
  • docker.io
  • docker.com
  • amazonaws.com

Note: The Allowed connections option allows the configured TLS domains and HTTP URLs. Everything else is denied.`

• Click Apply. Click Continue to apply the forward proxy policy configuration.

• Enable Show Advanced Fields in the Advanced Options section.
• Select Simple Static Route for the Static Route Config Mode field.
• Enter a route for your EKS subnet in the Simple Static Route field.

• Click Apply to return to the AWS VPC site configuration screen.

• Select Automatic Deployment for the Select Automatic or Assisted Deployment field.
• Select the AWS credentials created in Step 1.1 for the Automatic Deployment field.
• Select an instance type for the node for the AWS Instance Type for Node field in the Site Node Parameters section.
• Enter your public SSH key in the Public SSH key field. This is required to access Volterra site once it is deployed.

• Click Save and Exit to complete creating the AWS VPC object. The AWS VPC site object gets displayed.

Download the latest quickstart utility:

docker pull gcr.io/volterraio/volt-terraform

Download the deployment script:

docker run --rm -v $(pwd):/opt/bin:rw gcr.io/volterraio/volt-terraform:latest cp /deploy-terraform.sh /opt/bin

{
    "access_key": "<aws_access_key>",
    "secret_key": "<aws_secret_key>",
    "region": "us-east-2",
    "vpc_id": "vpc-065cdb075a2f05deb",
    "eks_cidr": "192.168.1.0/24",
    "deployment": "eks-skg",
    "volterra_site_name": "aws-skg-svcs",
    "machine_public_key": "<pub-key>"
}

./deploy-terraform.sh apply -p aws -i <tfvars> -tn self-serve/eks_only 

Note: The deployment approximately takes 10 to 15 minutes to complete.

• After the deployment is complete, download the kubeconfig files of the created EKS cluster using the following commands:

 
./deploy-terraform.sh output -n eks-skg eks_kubeconfig > /tmp/eks-test
 

• Set the KUBECONFIG environment variable with the downloaded kubeconfig file.

export KUBECONFIG=/tmp/eks-test

• Verify that the EKS worker node joined the cluster and pods are deployed on the K8s namespace. Enter the following commands:

kubectl get node -o wide

kubectl get pods -n hipster

Note: The deployment creates hipster K8s namespace.

• Enter a name for your load balancer in the metadata section.
• Enter a domain name in the Domains field. Ensure that its sub-domain is delegated to Volterra. This example sets hipster.skg.helloclouds.app domain. The hipster part is prefix and skg.helloclouds.app part is the domain delegated in Step 2.
• Select HTTPS for the Select Type of Load Balancer field.

• Click Configure in the Default Origin Servers section and configure the origin pool as per the following guidelines:

  • Click Add item in the Origin Pools configuration, Click Create new pool to load a new pool creation form.
  • In the pool creation form, enter a name for your pool in the metadata section.
  • In the Select Type of Origin Server field of Basic Configuration section, select k8s Service Name of Origin Server on given Sites.
  • Enter service name in the <servivename.k8s-namespace> format for the Service Name field. This example sets frontend.hipster as the service name. The hipster is the K8s namespace created in Step 1.
  • Select Site for the Select Site or Virtual Site field and select the site you created in Step 1.
  • Enter 80 for the Port field.

  

  • Click Continue to apply the origin pool and click Apply to set the origin pool to the load balancer configuration.

Scroll down and click Save and Exit to create load balancer. The load balancer object gets displayed with TLS Info field value as DNS Domain Verification. Wait for it to change to Certificate Valid.

The load balancer is now ready and you can verify it by accessing the domain URL from a browser.