1. Create m2.tar.gz:

   mvn -Dmaven.repo.local=./m2 clean package
   tar cvf m2.tar.gz ./m2

2. Create Docker image:

   docker image build -t arungupta/greeting .

   Explain multi-stage Dockerfile.

1. Create Docker image:

   mvn compile jib:build -Pjib

The benefits of using Jib over a multi-stage Dockerfile build include:

• Don’t need to install Docker or run a Docker daemon

• Don’t need to write a Dockerfile or build the archive of m2 dependencies

• Much faster

• Builds reproducibly

The above builds directly to your Docker registry. Alternatively, Jib can also build to a Docker daemon:

1. Run container:

   docker container run --name greeting -p 8080:8080 -d arungupta/greeting

2. Access application:

   curl http://localhost:8080/hello

3. Remove container:

   docker container rm -f greeting

This was tested using Docker for Mac/Kubernetes. Use the previously deployed Helm chart.

1. Show service:

   kubectl get svc
   NAME               TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                         AGE
   greeting-service   LoadBalancer   10.101.39.100    <pending>     80:30854/TCP                    8m
   kubernetes         ClusterIP      10.96.0.1        <none>        443/TCP                         90d
   myapp-greeting     LoadBalancer   10.108.104.178   localhost     8080:32189/TCP,5005:31117/TCP   4s

   Highlight the debug port is also forwarded.

2. In IntelliJ, Run, Debug, Remote:

   

3. Click on Debug, setup a breakpoint in the class:

   

4. Access the application:

   curl http://$(kubectl get svc/myapp-greeting \
   	-o jsonpath='{.status.loadBalancer.ingress[0].hostname}'):8080/hello

5. Show the breakpoint hit in IntelliJ:

   

6. Delete the Helm chart:

   helm delete --purge myapp

This was tested using Docker for Mac.

1. Run container:

   docker container run --name greeting -p 8080:8080 -p 5005:5005 -d arungupta/greeting

2. Check container:

   $ docker container ls -a
   CONTAINER ID        IMAGE                COMMAND                  CREATED             STATUS              PORTS                                            NAMES
   724313157e3c        arungupta/greeting   "java -jar app-swarm…"   3 seconds ago       Up 2 seconds        0.0.0.0:5005->5005/tcp, 0.0.0.0:8080->8080/tcp   greeting

3. Setup breakpoint as explained above.

4. Access the application using curl http://localhost:8080/resources/greeting.

1. Set a variable ROLE_NAME to IAM role for the EKS worker nodes:

   ROLE_NAME=$(aws iam list-roles \
   	--query \
   	'Roles[?contains(RoleName,`eksctl-myeks-nodegroup`)].RoleName' --output text)

2. Setup permissions for the worker nodes:

   aws iam attach-role-policy \
   	--role-name $ROLE_NAME \
   	--policy-arn arn:aws:iam::aws:policy/AWSAppMeshFullAccess

1. Enable side-car injection by running create.sh script from https://github.com/aws/aws-app-mesh-examples/tree/master/examples/apps/djapp/2_create_injector. You need to change ca-bundle.sh and change MESH_NAME to greeting-app.

2. Create prod namespace:

   kubectl create namespace prod

3. Label prod namespace:

   kubectl label namespace prod appmesh.k8s.aws/sidecarInjectorWebhook=enabled

4. Create CRDs:

   kubectl create -f https://raw.githubusercontent.com/aws/aws-app-mesh-examples/master/examples/apps/djapp/3_add_crds/mesh-definition.yaml
   kubectl create -f https://raw.githubusercontent.com/aws/aws-app-mesh-examples/master/examples/apps/djapp/3_add_crds/virtual-node-definition.yaml
   kubectl create -f https://raw.githubusercontent.com/aws/aws-app-mesh-examples/master/examples/apps/djapp/3_add_crds/virtual-service-definition.yaml
   kubectl create -f https://raw.githubusercontent.com/aws/aws-app-mesh-examples/master/examples/apps/djapp/3_add_crds/controller-deployment.yaml

1. Create a Mesh:

   kubectl create -f mesh.yaml

2. Create Virtual Nodes:

   kubectl create -f virtualnodes.yaml

3. Create a Virtual Services:

   kubectl create -f virtualservice.yaml

4. Create deployments:

   kubectl create -f app-hello-howdy.yaml

5. Create services:

   kubectl create -f services.yaml

1. Find the name of the talker pod:

   TALKER_POD=$(kubectl get pods \
   	-nprod -lgreeting=talker \
   	-o jsonpath='{.items[0].metadata.name}')

2. Exec into the talker pod:

   kubectl exec -nprod $TALKER_POD -it bash

3. Invoke the mostly-hello service to get back mostly Hello response:

   while [ 1 ]; do curl http://mostly-hello.prod.svc.cluster.local:8080/hello; echo;done

4. CTRL+C to break the loop.

5. Invoke the mostly-howdy service to get back mostly Howdy response:

   while [ 1 ]; do curl http://mostly-howdy.prod.svc.cluster.local:8080/hello; echo;done

6. CTRL+C to break the loop.

1. Download Istio:

   curl -L https://git.io/getLatestIstio | sh -
   cd istio-1.*

2. Include istio-1.*/bin directory in PATH

3. Install Istio on Amazon EKS:

   helm install \
   	--wait \
   	--name istio \
   	--namespace istio-system \
   	install/kubernetes/helm/istio \
   	--set tracing.enabled=true \
   	--set grafana.enabled=true

4. Verify:

   kubectl get pods -n istio-system
   NAME                                        READY   STATUS    RESTARTS   AGE
   grafana-75485f89b9-4lwg5                    1/1     Running   0          1m
   istio-citadel-84fb7985bf-4dkcx              1/1     Running   0          1m
   istio-egressgateway-bd9fb967d-bsrhz         1/1     Running   0          1m
   istio-galley-655c4f9ccd-qwk42               1/1     Running   0          1m
   istio-ingressgateway-688865c5f7-zj9db       1/1     Running   0          1m
   istio-pilot-6cd69dc444-9qstf                2/2     Running   0          1m
   istio-policy-6b9f4697d-g8hc6                2/2     Running   0          1m
   istio-sidecar-injector-8975849b4-cnd6l      1/1     Running   0          1m
   istio-statsd-prom-bridge-7f44bb5ddb-8r2zx   1/1     Running   0          1m
   istio-telemetry-6b5579595f-nlst8            2/2     Running   0          1m
   istio-tracing-ff94688bb-2w4wg               1/1     Running   0          1m
   prometheus-84bd4b9796-t9kk5                 1/1     Running   0          1m

   Check that both Tracing and Grafana add-ons are enabled.

5. Enable side car injection for all pods in default namespace

   kubectl label namespace default istio-injection=enabled

6. From the repo’s main directory, deploy the application:

   kubectl apply -f manifests/app.yaml

7. Check pods and note that it has two containers (one for the application and one for the sidecar):

   kubectl get pods -l app=greeting
   NAME                       READY     STATUS    RESTARTS   AGE
   greeting-d4f55c7ff-6gz8b   2/2       Running   0          5s

8. Get list of containers in the pod:

   kubectl get pods -l app=greeting -o jsonpath={.items[*].spec.containers[*].name}
   greeting istio-proxy

9. Get response:

   curl http://$(kubectl get svc/greeting \
   	-o jsonpath='{.status.loadBalancer.ingress[0].hostname}')/hello

1. Deploy application with two versions of greeting, one that returns Hello and another that returns Howdy:

   kubectl delete -f manifests/app.yaml
   kubectl apply -f manifests/app-hello-howdy.yaml

2. Check the list of pods:

   kubectl get pods -l app=greeting
   NAME                              READY     STATUS    RESTARTS   AGE
   greeting-hello-69cc7684d-7g4bx    2/2       Running   0          1m
   greeting-howdy-788b5d4b44-g7pml   2/2       Running   0          1m

3. Access application multipe times to see different response:

   for i in {1..10}
   do
   	curl -q http://$(kubectl get svc/greeting -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')/hello
   	echo
   done

4. Setup an Istio rule to split traffic between 75% to Hello and 25% to Howdy version of the greeting service:

   kubectl apply -f manifests/istio/app-rule-75-25.yaml

5. Invoke the service again to see the traffic split between two services.

1. Setup an Istio rule to divert 10% traffic to canary:

   kubectl delete -f manifests/istio/app-rule-75-25.yaml
   kubectl apply -f manifests/istio/app-canary.yaml

2. Access application multipe times to see ~10% greeting messages with Howdy:

   for i in {1..50}
   do
   	curl -q http://$(kubectl get svc/greeting -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')/hello
   	echo
   done

Istio is deployed as a sidecar proxy into each of your pods; this means it can see and monitor all the traffic flows between your microservices and generate a graphical representation of your mesh traffic. We’ll use the application you deployed in the previous step to demonstrate this.

By default, tracing is disabled. --set tracing.enabled=true was used during Istio installation to ensure tracing was enabled.

Setup access to the tracing dashboard URL using port-forwarding:

Access the dashboard at http://localhost:16686, click on Dependencies, DAG.

1. By default, Grafana is disabled. --set grafana.enabled=true was used during Istio installation to ensure Grafana was enabled. Alternatively, the Grafana add-on can be installed as:

   kubectl apply -f install/kubernetes/addons/grafana.yaml

2. Verify:

   kubectl get pods -l app=grafana -n istio-system
   NAME                       READY     STATUS    RESTARTS   AGE
   grafana-75485f89b9-n4skw   1/1       Running   0          10m

3. Forward Istio dashboard using Grafana UI:

   kubectl -n istio-system \
   	port-forward $(kubectl -n istio-system \
   		get pod -l app=grafana \
   		-o jsonpath='{.items[0].metadata.name}') 3000:3000 &

4. View Istio dashboard http://localhost:3000. Click on Home, Istio Workload Dashboard.

5. Invoke the endpoint:

   curl http://$(kubectl get svc/greeting \
   	-o jsonpath='{.status.loadBalancer.ingress[0].hostname}')/hello

Delays and timeouts can be injected in services.

1. Deploy the application:

   kubectl delete -f manifests/app.yaml
   kubectl apply -f manifests/app-ingress.yaml

2. Add a 5 seconds delay to calls to the service:

   kubectl apply -f manifests/istio/greeting-delay.yaml

3. Invoke the service using a 2 seconds timeout:

   export INGRESS_HOST=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
   export INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http")].port}')
   export GATEWAY_URL=$INGRESS_HOST:$INGRESS_PORT
   curl --connect-timeout 2 http://$GATEWAY_URL/resources/greeting

The service will timeout in 2 seconds.

1. Create an IAM role and add an in-line policy that will allow the CodeBuild stage to interact with the EKS cluster:

   ACCOUNT_ID=`aws sts get-caller-identity --query Account --output text`
   TRUST="{ \"Version\": \"2012-10-17\", \"Statement\": [ { \"Effect\": \"Allow\", \"Principal\": { \"AWS\": \"arn:aws:iam::${ACCOUNT_ID}:root\" }, \"Action\": \"sts:AssumeRole\" } ] }"
   echo '{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "eks:Describe*", "Resource": "*" } ] }' > /tmp/iam-role-policy
   aws iam create-role --role-name EksWorkshopCodeBuildKubectlRole --assume-role-policy-document "$TRUST" --output text --query 'Role.Arn'
   aws iam put-role-policy --role-name EksWorkshopCodeBuildKubectlRole --policy-name eks-describe --policy-document file:///tmp/iam-role-policy

2. Add this IAM role to aws-auth ConfigMap for the EKS cluster:

   ROLE="    - rolearn: arn:aws:iam::$ACCOUNT_ID:role/EksWorkshopCodeBuildKubectlRole\n      username: build\n      groups:\n        - system:masters"
   kubectl get -n kube-system configmap/aws-auth -o yaml | awk "/mapRoles: \|/{print;print \"$ROLE\";next}1" > /tmp/aws-auth-patch.yml
   kubectl patch configmap/aws-auth -n kube-system --patch "$(cat /tmp/aws-auth-patch.yml)"

1. Fork the repo https://github.com/aws-samples/kubernetes-for-java-developers

2. Create a new GitHub token https://github.com/settings/tokens/new, select repo as the scope, click on Generate Token to generate the token. Copy the generated token.

3. Launch CodePipeline CloudFormation template.

4. Specify the correct values for GitHubUser, GitHubToken, GitSourceRepo and EKS cluster name. Change the branch if you need to:

   

   Click on Create stack to create the resources.