Enable AWS App Mesh

terraform/provision/2048_fixture.yml

@@ -1,4 +1,16 @@
 ---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: deployment-2048-cert
+  namespace: default
+spec:
+  dnsNames:
+    - "deployment-2048.default.svc.cluster.local"
+  secretName: deployment-2048-tls
+  issuerRef:
+    name: ca-issuer
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -12,13 +24,24 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: app-2048
+      annotations:
+        appmesh.k8s.aws/secretMounts: ca-key-pair:/etc/keys/2048/
     spec:
+      serviceAccountName: appmesh-pod
       containers:
       - image: alexwhen/docker-2048
         imagePullPolicy: Always
         name: app-2048
         ports:
         - containerPort: 80
+        volumeMounts:
+         - mountPath: "/etc/keys/2048"
+           name: deployment-2048-tls
+           readOnly: true
+      volumes:
+        - name: deployment-2048-tls
+          secret:
+            secretName: deployment-2048-tls
 ---
 apiVersion: v1
 kind: Service
@@ -33,21 +56,155 @@ spec:
   selector:
     app.kubernetes.io/name: app-2048
 ---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
+apiVersion: appmesh.k8s.aws/v1beta2
+kind: VirtualNode
+metadata:
+  namespace: default
+  name: deployment-2048
+spec:
+  awsName: deployment-2048-virtual-node
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: app-2048
+  listeners:
+    - portMapping:
+        port: 80
+        protocol: http
+      tls:
+        certificate:
+          file:
+            certificateChain: /etc/keys/2048/tls.crt
+            privateKey: /etc/keys/2048/tls.key
+        mode: STRICT
+  serviceDiscovery:
+    dns:
+      hostname: service-2048.default.svc.cluster.local
+  backendDefaults:
+    clientPolicy:
+      tls:
+        enforce: true
+        validation:
+          trust:
+            file:
+              certificateChain: /etc/keys/2048/ca.crt
+---
+apiVersion: appmesh.k8s.aws/v1beta2
+kind: VirtualService
+metadata:
+  namespace: default
+  name: service-2048
+spec:
+  awsName: service-2048-virtual-service
+  provider:
+    virtualNode:
+      virtualNodeRef:
+        name: deployment-2048
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gw-2048-cert
+  namespace: default
+spec:
+  dnsNames:
+    - "gw-2048.default.svc.cluster.local"
+  secretName: gw-2048-tls
+  issuerRef:
+    name: ca-issuer
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gw-2048
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gw-2048
+  template:
+    metadata:
+      labels:
+        app: gw-2048
+      annotations:
+        appmesh.k8s.aws/secretMounts: ca-key-pair:/etc/keys/2048/
+    spec:
+      serviceAccountName: appmesh-pod
+      containers:
+        - name: envoy
+          image: 840364872350.dkr.ecr.us-west-2.amazonaws.com/aws-appmesh-envoy:v1.19.1.0-prod
+          ports:
+            - containerPort: 8443
+          volumeMounts:
+           - mountPath: "/etc/keys/2048"
+             name: gw-2048-tls
+             readOnly: true
+      volumes:
+        - name: gw-2048-tls
+          secret:
+            secretName: gw-2048-tls
+---
+apiVersion: v1
+kind: Service
 metadata:
-  name: ingress-2048
+  name: gw-2048
+  namespace: default
   annotations:
-    kubernetes.io/ingress.class: nginx
-    nginx.ingress.kubernetes.io/rewrite-target: /
-spec:
-  rules:
-  - http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
+    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
+    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "ssl"
+spec:
+  ports:
+    - port: 443
+      targetPort: 8443
+      name: https
+  type: LoadBalancer
+  selector:
+    app: gw-2048
+---
+apiVersion: appmesh.k8s.aws/v1beta2
+kind: VirtualGateway
+metadata:
+  name: gw-2048
+  namespace: default
+spec:
+  backendDefaults:
+    clientPolicy:
+      tls:
+        enforce: true
+  namespaceSelector:
+    matchLabels:
+      mesh: default
+  podSelector:
+    matchLabels:
+      app: gw-2048
+  gatewayRouteSelector:
+    matchLabels:
+      gateway: gw-2048
+  listeners:
+    - portMapping:
+        port: 8443
+        protocol: http
+      tls:
+        certificate:
+          file:
+            certificateChain: /etc/keys/2048/tls.crt
+            privateKey: /etc/keys/2048/tls.key
+        mode: STRICT
+---
+apiVersion: appmesh.k8s.aws/v1beta2
+kind: GatewayRoute
+metadata:
+  name: gateway-route
+  namespace: default
+  labels:
+    gateway: gw-2048
+spec:
+  httpRoute:
+    match:
+      prefix: "/"
+    action:
+      target:
+        virtualService:
+          virtualServiceRef:
             name: service-2048
-            port: 
-              number: 80