Git Product home page Git Product logo

ambassador-docs's Introduction

Ambassador Documentation

The documentation in this repository is built with Gatsby, which gives us control and flexibility over the layout.

Contributing

We welcome all contributions! See LICENSE for applicable terms and conditions.

Authoring Documentation

If you're authoring the documentation, just edit the Markdown files. You can use GitHub to preview the Markdown.

Strings like $variable$ are substituted with the values defined in versions.yml.

The doc-links.yml file is the table of contents (TOC) that appears on the left sidebar.

The aes-pages.yml file identifies which pages should be marked as "Ambassador Edge Stack" pages.

Documentation Infrastructure Notes

The docs in this repository can be "vendored" into other repositories using git subtree. Repositories that do this are encouraged to include some kind of convenience tooling to make syncing the docs easier. For example, the following Makefile snippet:

pull-docs: ## Update ./docs from https://github.com/datawire/ambassador-docs
	git subtree pull --prefix=docs https://github.com/datawire/ambassador-docs.git master
push-docs: ## Publish ./docs to https://github.com/datawire/ambassador-docs
	git subtree push --prefix=docs [email protected]:datawire/ambassador-docs.git master
.PHONY: pull-docs push-docs

The (private) getambassador.io.git repository contains the Gatsby-based toolchain that compiles the docs into website at https://www.getambassador.io/.

Other repositories that include the docs as a subtree should get in the habit of doing a git subtree pull from their master branch periodically. Documentation for code changes can then be committed right along-side the code changes. When a release is cut, and you are ready to publicize it, simply do a git subtree push.

Adding Release Notes

To add a Release Notes page for a product version, you should:

  1. Add a releaseNotes.yml file to the folder for that version of the product under ambassador-docs/docs. A template for this file can be found here:
# This file should be placed in the folder for the version of the
# product that's meant to be documented. A `/release-notes` page will
# be automatically generated and populated at build time.
#
# Note that an entry needs to be added to the `doc-links.yml` file in
# order to surface the release notes in the table of contents.
#
# The YAML in this file should contain:
#
# changelog: An (optional) URL to the CHANGELOG for the product.
# items: An array of releases with the following attributes:
#     - version: The (optional) version number of the release, if applicable.
#     - date: The date of the release in the format YYYY-MM-DD.
#     - notes: An array of noteworthy changes included in the release, each having the following attributes:
#         - type: The type of change, one of `bugfix`, `feature`, `security` or `change`.
#         - title: A short title of the noteworthy change.
#         - body: >-
#             Two or three sentences describing the change and why it
#             is noteworthy.  This is HTML, not plain text or
#             markdown.  It is handy to use YAML's ">-" feature to
#             allow line-wrapping.
#         - image: >-
#             The URL of an image that visually represents the
#             noteworthy change.  This path is relative to the
#             `release-notes` directory; if this file is
#             `FOO/releaseNotes.yml`, then the image paths are
#             relative to `FOO/release-notes/`.
#         - docs: The path to the documentation page where additional information can be found.

items:
  - version: 1.13.4
    date: '2021-05-13'
    notes:
      - type: security
        title: Envoy 1.15.5
        body: >-
          Emissary-ingress 1.13.4 and Edge Stack 1.13.4 have been
          updated to Envoy 1.15.5, which addresses a high severity
          security vulnerability (CVE-2021-29492). Edge Stack and
          Emissary-ingress can now be configured to reject client
          requests that contain escaped slashes.
        image: ./edge-stack-1.13.4.png
        docs: topics/running/ambassador/#rejecting-client-requests-with-escaped-slashes
  1. Add an entry to the doc-links.yml file to surface the release notes in the table of contents:
- title: Release Notes
  link: /release-notes
  1. If images need to be added, the images should be included in the ambassador-docs/public folder.

ambassador-docs's People

Contributors

aaronunosquare avatar acookin avatar agustinmiquelez avatar aliceproxy avatar aosoriodw avatar arturogonzalez58 avatar brianfleming avatar cindymullins-dw avatar concaf avatar dansipple avatar donnyyung avatar dromerounosquare avatar esmet avatar inercia avatar inoahnothing avatar jacoblbeck avatar josecv avatar joseocampodw avatar jwkartheiser avatar kflynn avatar khussey avatar leocontrerasn avatar lukeshu avatar mattmcclure-dw avatar rhs avatar ricardo-labarca avatar richarddli avatar scoyle391 avatar tenshinhigashi avatar thallgren avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

ambassador-docs's Issues

Argo Rollouts guide does too much and not enough

https://www.getambassador.io/docs/argo/latest/howtos/configure-argo-rollouts/

I’m not really sure if it’s useful to even mention ArgoCD or use it in this context. I know from personal experience that folks around me end up shortening all the Argo stuff to just Argo and I have to ask them ArgoRollouts or ArgoCD? - And they don’t realize those are totally different things.

Additionally, I didn’t follow this guide because it misses a bunch of seemingly very important information that this guide nails: https://argoproj.github.io/argo-rollouts/features/traffic-management/ambassador/

Finally, the ambassador guide for argo-rollouts sends you through Ambassador Cloud to complete the setup, which again, I thought wasn’t very useful from a “bare minimum” standpoint.

Telepresence docs | "Edit this page on GitHub" button is broken

docs/telepresence-oss & docs/telepresence have Edit this page on GitHub button broken.

docs/telepresence-oss on the latest version leads to gh:telepresence-oss/2.18
docs/telepresence on the latest version leads to gh:telepresence/2.19

All versions starting from including 2.17 & up are absent in github:datawire/ambassador-docs


ps. there is an inconsistency in links to telepresence documentation.

telepresence.io Docs menu section leads to getambassador.io/docs/telepresence-oss note the -oss part.
While getambassador.io/docs Telepresence menu section leads to getambassador.io/docs/telepresence with no -oss part.

again, the diagnostic service can help you here.

I've seen this statement several times when I was attempting to get acquainted, and each time I saw this again, the diagnostic service can help you here., I was like, "Again?" When was I taught anything about this service?

Literally, you start here:
https://www.getambassador.io/docs/edge-stack/latest/tutorials/getting-started/

Then "What's Next?"

https://www.getambassador.io/docs/edge-stack/latest/topics/using/intro-mappings/

Doing a search for Diagnostics was less than useful too. 😞

image

https://www.getambassador.io/docs/edge-stack/latest/topics/running/diagnostics/#diagnostics
First sentence is:

If you're experiencing issues with Ambassador Edge Stack, log in to your Edge Policy Console...

Oh, well, I'm not using the service yet... so maybe this isn't the page.

Then I go here: https://www.getambassador.io/docs/edge-stack/latest/topics/running/debugging/ and see:

If you’re experiencing issues with the Ambassador Edge Stack and cannot diagnose the issue through the /ambassador/v0/diag/ diagnostics endpoint, this document covers various approaches and advanced use cases for debugging Ambassador Edge Stack issues.

This doesn't explain where this endpoint is located, or how to access it. Searching the page of /v0 has 1 entry, which is this sentence, which doesn't actually tell me anything.

Closest thing to useful was this:
https://www.getambassador.io/docs/edge-stack/latest/topics/running/ambassador/#observability

This page actually caused more confusion than anything:
https://www.getambassador.io/docs/edge-stack/latest/topics/install/docker/#2-productnames-diagnostics

I see several references to http://localhost:8080/qotm/ and http://localhost:8080/ambassador/v0/diag/

And if you look at the files that you asked to deploy (https://app.getambassador.io/yaml/edge-stack/2.1.2/aes.yaml) I see no reference to this path.

I never got this working properly at first because I just kept getting 301 redirects. After deploying the Host that allows insecure traffic, that's when I was able to visit that URL. See #503

Anyways... circles.. Sorry this was long, but I wanted to accurately try to reproduce what I ended up going through as I ran into several different, related, interconnected issues, documentation failures, and some other things (#502, emissary-ingress/emissary#4071, and emissary-ingress/emissary#4072)

Hindsight is 2020, if I port-forwarded directly to the admin port on the pod, I would have been able to see this, even while I was having the 301 redirect issue, and the TLS issues.

Istio howto broken

I installed ambassador via Helm and followed the Istio HowTo.

Helm Chart version: ambassador-6.7.13
Isitio version: 1.10.3

I followed the instructions here: https://www.getambassador.io/docs/edge-stack/latest/howtos/istio/#integrating-productname-with-istio-15-and-above

The ambassador deployment YAML that includes the istio envoy proxy that is used on that page doesn't work with the deployment that is installed in the Helm Chart.

The first error prevents that the deployment is applied at all: spec.selector: Invalid value: v1.LabelSelector{MatchLabels:map[string]string{"service":"ambassador"}, MatchExpressions:[]v1.LabelSelectorRequirement(nil)}: field is immutable

The deployment from the Helm Chart has different selectors:

spec:
  selector:
    matchLabels:
      app.kubernetes.io/instance: ambassador
      app.kubernetes.io/name: ambassador

After changing the selectors, the YAML can be applied, and after a restart the ambassador pod boots and is healthy, but it doesn't work. I'm not sure what is going on, but I think the problem is in the istio-envoy container.

I managed to create a working version of the deployment by basically comparing the deployment from the Helm Chart and the one from the HowTo:

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ambassador
  namespace: ambassador
  labels:
    app.kubernetes.io/instance: ambassador
    app.kubernetes.io/name: ambassador
    app.kubernetes.io/part-of: ambassador
    product: aes
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: ambassador
      app.kubernetes.io/name: ambassador
  template:
    metadata:
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8877"
        prometheus.io/scheme: "http"
        prometheus.io/path: "/metrics"
      labels:
        app.kubernetes.io/instance: ambassador
        app.kubernetes.io/name: ambassador
        product: aes
    spec:
      volumes:
        - name: istio-certs
          emptyDir:
            medium: Memory
        - name: istiod-ca-cert
          configMap:
            defaultMode: 420
            name: istio-ca-root-cert
        - emptyDir:
            medium: Memory
          name: istio-envoy
        - name: istio-token
          projected:
            defaultMode: 420
            sources:
              - serviceAccountToken:
                  audience: istio-ca
                  expirationSeconds: 43200
                  path: istio-token
        - downwardAPI:
            defaultMode: 420
            items:
              - fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.labels
                path: labels
          name: ambassador-pod-info
        - name: ambassador-edge-stack-secrets
          secret:
            secretName: ambassador-edge-stack
            defaultMode: 420
      containers:
      - name: ambassador
        image: docker.io/datawire/aes:1.13.10
        imagePullPolicy: IfNotPresent
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        env:
        - name: AMBASSADOR_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: REDIS_URL
          value: ambassador-redis:6379
        - name: HOST_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.hostIP
        - name: AMBASSADOR_ISTIO_SECRET_DIR
          value: "/etc/istio-certs"
        - name: AMBASSADOR_ENVOY_BASE_ID
          value: "1"
        livenessProbe:
          httpGet:
            path: /ambassador/v0/check_alive
            port: admin
            scheme: HTTP
          initialDelaySeconds: 30
          timeoutSeconds: 1
          periodSeconds: 3
          successThreshold: 1
          failureThreshold: 3
        ports:
        - containerPort: 8080
          name: http
          protocol: TCP
        - containerPort: 8443
          name: https
          protocol: TCP
        - containerPort: 8877
          name: admin
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /ambassador/v0/check_ready
            port: admin
            scheme: HTTP
          initialDelaySeconds: 30
          timeoutSeconds: 1
          periodSeconds: 3
          successThreshold: 1
          failureThreshold: 3
        resources:
          limits:
            cpu: '1'
            memory: 600Mi
          requests:
            cpu: 200m
            memory: 300Mi
        securityContext:
          allowPrivilegeEscalation: false
        volumeMounts:
        - mountPath: /tmp/ambassador-pod-info
          name: ambassador-pod-info
        - mountPath: /.config/ambassador
          name: ambassador-edge-stack-secrets
          readOnly: true
        - mountPath: /etc/istio-certs/
          name: istio-certs
      - name: istio-proxy
        # Use the same version as your Istio installation
        image: istio/proxyv2:1.10.3
        args:
        - proxy
        - sidecar
        - --domain
        - $(POD_NAMESPACE).svc.cluster.local
        - --serviceCluster
        - istio-proxy-ambassador
        - --discoveryAddress
        - istio-pilot.istio-system.svc:15012
        - --connectTimeout
        - 10s
        - --statusPort
        - "15020"
        - --trust-domain=cluster.local
        - --controlPlaneBootstrap=false
        env:
        - name: OUTPUT_CERTS
          value: "/etc/istio-certs"
        - name: JWT_POLICY
          value: third-party-jwt
        - name: PILOT_CERT_PROVIDER
          value: istiod
        - name: CA_ADDR
          value: istiod.istio-system.svc:15012
        - name: ISTIO_META_MESH_ID
          value: cluster.local
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: SERVICE_ACCOUNT
          valueFrom:
            fieldRef:
              fieldPath: spec.serviceAccountName
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: ISTIO_META_POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: ISTIO_META_CONFIG_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: ISTIO_META_CLUSTER_ID
          value: Kubernetes
        imagePullPolicy: IfNotPresent
        readinessProbe:
          failureThreshold: 30
          httpGet:
            path: /healthz/ready
            port: 15020
            scheme: HTTP
          initialDelaySeconds: 1
          periodSeconds: 2
          successThreshold: 1
          timeoutSeconds: 1
        volumeMounts:
        - mountPath: /var/run/secrets/istio
          name: istiod-ca-cert
        - mountPath: /etc/istio/proxy
          name: istio-envoy
        - mountPath: /etc/istio-certs/
          name: istio-certs
        - mountPath: /var/run/secrets/tokens
          name: istio-token
        securityContext:
          runAsUser: 0
      restartPolicy: Always
      securityContext:
        runAsUser: 8888
      serviceAccountName: ambassador
      terminationGracePeriodSeconds: 0
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 25%
      maxSurge: 25%
  revisionHistoryLimit: 10
  progressDeadlineSeconds: 600

I changed lots of things and I'm not sure what change made it work, but my version is basically a copy of the one from the Helm Chart, with the exception that I added the prometheus.io annotations which allows the prometheus operator to configure prometheus without having to change the ConfigMap manually how it is described later in the HowTo.

Since I don't really know what I'm doing, I didn't create a PR here (also for some reason I cannot find the istio HowTo page in this repository). But maybe my deployment YAML helps someone to update that HowTo.

If not then this is just a "bug" report, that the Istio HowTo doesn't work.

helm Installation fails

Was following the instructions and this error occurs. Retried several times, in case it can be fixed by retrying, but error still occurs

$ helm install ambassador --namespace ambassador datawire/ambassador
Error: INSTALLATION FAILED: failed to install CRD crds/filter.yaml: resource mapping not found for name: "filters.getambassador.io" namespace: "" from "": no matches for kind "CustomResourceDefinition" in
 version "apiextensions.k8s.io/v1beta1"
ensure CRDs are installed first

Update documentation for Listener/Host CR

In deploying emissary-ingress with multiple deployments it was unclear from the documentation that the ambassador_id parameter needed to be specified on Listener/Host custom resources.

Could we have the Listener and Host resource documentation updated to show that ambassador_id is an option available on these resources? https://www.getambassador.io/docs/emissary/latest/topics/running/listener https://www.getambassador.io/docs/emissary/latest/topics/running/host-crd

EdgeStack and Emissary-Ingress 3.x docs has typo of (defualt)

While reading the docs regarding the API change for Emissary-Ingress auth service I found a typo pictured below.

image

Also would like to know if in the same paragraph this section Emissary-ingress 3.Y. should actually be Emissary-ingress 3.x.

Will submit an MR to fix the default typo.

Quicker Start via Kubectl Port-Forward

For AWS users, it seems that using an AWS NLB is a good move in order to reduce latency when exposing a Kubernetes Cluster to outside traffic. With that said, I think the "GettingStarted" page could actually reduce the number of different things that are needed by requesting that the user not try to access the "quote" service from a loadbalancer at first, but instead, just kubectl port-forward to the edge-stack service.

Unfortunately, I found that when I attempted to do that, I ran into 2 issues. 1 of which was that the Getting Started guide doesn't have you deploy a Host object at all. And that ends up resulting in automatic https and a 301 redirect which I found somewhat surprising and hard to figure out what was going on and why.

Here's the getting started page I'm referring to:
https://www.getambassador.io/docs/edge-stack/latest/tutorials/getting-started/

This page, which seems to be specific to AWS contained what appears to be invaluable data in regards to how to
https://www.getambassador.io/docs/edge-stack/latest/topics/running/ambassador-with-aws/#l4-load-balancer-default-elb-or-nlb

specifically how to essentially disable Ambassador's automatic TLS functionality via:

apiVersion: getambassador.io/v3alpha1
kind: Host
metadata:
  name: ambassador
spec:
  hostname: "*"
  selector:
    matchLabels:
      hostname: wildcard
  acmeProvider:
    authority: none
  requestPolicy:
    insecure:
      action: Route

This was really really helpful once I pulled some of my hair out trying to find it (again), since I looked all over these places:
https://www.getambassador.io/docs/edge-stack/latest/topics/running/listener/

this page does tell me a bit about this behavior I was seeing (the 301), but it wasn't clear where what requestPolicy was, or where I should be setting this configuration.
https://www.getambassador.io/docs/edge-stack/latest/topics/running/host-crd/#secure-and-insecure-requests

Finally, when request to run this command:

curl -Lki https://$LB_ENDPOINT/backend/

I was unsure why -L, --location Follow redirects was included, and it was clear that SSL was broken since it also required -k, --insecure Allow insecure server connections when using SSL in the command.

So, why not just skip the "automatic TLS and such" until a second page?


Additionally, there are multiple other pages that claim that Host is required for traffic routing to work, yet it's not part of the Getting Started at all.

AuthService page isn't about AES

The AuthService page (reference/auth-service.md) should be edited to clarify that OSS users should use an AuthService, but that AES users are discouraged from using an AuthService, and should use Filters instead.

  • The big downside of an AuthService is there can only be one for all of Ambassador. An "External" Filter (non-OSS) is a drop-in replacement for an AuthService, and there can be many of them, orchestrated by a FilterPolicy.
  • AES itself wants to be the AuthService. Using your own AuthService means deleting the ambassador-edge-stack-auth AuthService that is part of aes.yaml, which will disable a substantial portion of the non-OSS functionality, including the ACME client.
  • Perhaps some of the information in the AuthService page should be copied/moved to the docs about External Filters.

Getting Started - Qotm -> Quote service

Just wanted to drop another learning gotcha that I ran into - GettingStarted refers to a service called qotm, yet the repo matching that service (below) appears to be dead.

Filed an issue asking for redirection to datawire/quote as well as archiving the dead repo:

datawire/qotm#13

I also didn’t notice until later that the docker image, is actually datawire/quote of which, there is a repo for that, so I have another issue here asking for releases, tags, and better documentation, including of that on DockerHub.

datawire/quote#8


This is just a general request to update documentation on the website, as well as in Github and Dockerhub for consistency.

Thank you!

gRPC-Web docs are confused

In c5e93fd and a697e58, @scoyle391 wrote

gRPC-Web is a binary HTTP/2-based protocol that extends the benefits of gRPC to the browser; gRPC-Web wraps around gRPC for clients that cannot speak raw HTTP/2

Which is a little confused (which is on me, she sent me what she wrote before adding it, and I just didn't reply :/)

In truth:

  • gRPC (not "-Web") is a binary HTTP/2-based protocol
  • That is problematic for some programs, as some programs (such as JavaScript running in the browser) cannot speak raw HTTP/2
  • gRPC-Web is a JSON (instead of binary) HTTP-based (any version, instead of just HTTP/2) protocol that wraps around plain gRPC, to help alleviate that problem (at the cost of performance).

Request: Callout how to access the AES admin page with upgrades

The AES install instructions tell users to go to https://{{AES_URL}}/ to access the admin page. However, this does not work if you have a Mapping with prefix: /.

Therefore, I propose we edit the upgrade doc to just tell users to go to https://{{AES_URL}}/edge_stack/admin so there is no confusion

Callout that AES now automatically enables tls termination

Automatic HTTPS is a cool feature. However, for users who are currently running Ambassador to only listen for cleartext (ex: terminating tls at LB), the AES will appear broken since you now have to opt-out of TLS termination.

We need to call this out as much as we can so people are aware of what they must do to get AES working. If it appears broken, people will not upgrade. A good place to do this is in the upgrade docs but I believe it should be done as much as we can

Doc Typos

This PR addresses actual typos, such as misspelled words, missing words, incorrect word usage, etc.

Configure CODEOWNERS for datawire/ambassador-docs

Why?
Documentation PRs are an easy entrypoint for community contributions. However, members don't have the ability to tag reviewers, nor do they know who the best person to tag is. PRs might stay open and go stale as a result.

What?
Per a quick Slack thread with @kflynn, a CODEOWNERS configuration is an easy solution.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.