{"type":"doc","content":[{"type":"extension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"d3c3c4e9-7620-4827-9e85-bdcbcb51dda2"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}}}},{"type":"heading","attrs":{"level":1},"content":[{"text":"Background","type":"text"}]},{"type":"paragraph","content":[{"text":"L7 Proxy Service Mesh Controller intends to provide connectivity, shape the traffic, apply policies, RBAC and provide","type":"text"}]},{"type":"paragraph","content":[{"text":"mutual TLS for applications/microservices running across clusters (with service mesh), within the cluster","type":"text"}]},{"type":"paragraph","content":[{"text":"and with external applications. The functionalities are subjected to the usage of underlying service mesh technology. ","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Design Overview","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":73.0},"content":[{"type":"media","attrs":{"width":1266,"id":"ac272e36-77ac-45f8-b7c3-49ea6a32acfc","collection":"contentId-16398295","type":"file","height":535}}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Traffic Controller Design Internals","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":100.0},"content":[{"type":"media","attrs":{"type":"external","url":"https://documents.lucidchart.com/documents/12320cda-6b70-4ee5-ac05-21ee82a832c8/pages/0_0?a=3055&x=-18&y=213&w=1707&h=1034&store=1&accept=image%2F*&auth=LCA%20d6c6dbc59a70af5385b1aa699668cedf8e4d5372-ts%3D1578954176"}}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Internal Implementation Details","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"NOTE - Current implementation will support the ISTIO service mesh technology and SD-WAN load balancer and ExternalDNS as DNS provider. The plugin architecture of the controller makes it extensible to work with any Service mesh technology and any external load balancer as well. It is also designed to configure and communicate with external DNS servers. ","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"JIRA","type":"text"}]},{"type":"table","attrs":{"layout":"full-width"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[653.53]},"content":[{"type":"paragraph","content":[{"text":"Component","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[458.28]},"content":[{"type":"paragraph","content":[{"text":"JIRA Items","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[653.53]},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"REST API Interface","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[458.28]},"content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://lf-onap.atlassian.net/browse/MULTICLOUD-913"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[653.53]},"content":[{"type":"paragraph","content":[{"text":"2. Controller Interface, Backend Process","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[458.28]},"content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://lf-onap.atlassian.net/browse/MULTICLOUD-914"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[653.53]},"content":[{"type":"paragraph","content":[{"text":"3. Developing backend code with interfaces","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[458.28]},"content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://lf-onap.atlassian.net/browse/MULTICLOUD-915"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[653.53]},"content":[{"type":"paragraph","content":[{"text":"4. Loadbalancer configuration (Firewall, IPVS, NAT, and other L3 connectivity) ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[458.28]},"content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://lf-onap.atlassian.net/browse/MULTICLOUD-924"}}]},{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://lf-onap.atlassian.net/browse/MULTICLOUD-925"}},{"type":"inlineCard","attrs":{"url":"https://lf-onap.atlassian.net/browse/MULTICLOUD-926"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[653.53]},"content":[{"type":"paragraph","content":[{"text":"5. External DNS Configuration ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[458.28]},"content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://lf-onap.atlassian.net/browse/MULTICLOUD-909"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[653.53]},"content":[{"type":"paragraph","content":[{"text":"6. Testing ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[458.28]},"content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://lf-onap.atlassian.net/browse/MULTICLOUD-918"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[653.53]},"content":[{"type":"paragraph","content":[{"text":"7.Documentation","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[458.28]},"content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://lf-onap.atlassian.net/browse/MULTICLOUD-923"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[653.53]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[458.28]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"Elements of Traffic Controller with ISTIO as the service mesh","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Gateways - The inbound/outbound access for the service mesh. It is an envoy service","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"VirtualServices - To expose the service outside the service mesh","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"DestinationRule - To apply rules for the traffic flow","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"AuthorizationPolicy - Authorization for service access","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"serviceEntry - Add an external service into the mesh","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Authentication Policy - Authenticate external communication","type":"text"}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"These are the Kubernetes resources generated per cluster. There will be multiple of these resources depending on the intent","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"API","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"RESTful North API (with examples)","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"table","content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Types","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Intent APIs","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Functionality","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"1. outbound service communication","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"/v2/projects/{project-name}/composite-apps/blue-app/{version}/traffic-intent-set/inbound-intents/","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Define outbound traffic for a service","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"2. inbound service communication","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"v2/projects/{project-name}/composite-apps/blue-app/{version}/traffic-intent-set/outbound-intents/","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Define Inbound service for a service","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"3. Compound service communication ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"/v2/projects/{project-name}/composite-apps/blue-app/{version}/traffic-intent-set/compound-intents/{compund-intent-name}/inbound-intents/","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Define a virtual path for connecting to multiple services","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"codeBlock","content":[{"text":"URL: /v2/projects/{project-name}/composite-apps/{composite-app-name}/{version}/traffic-intent-set\nPOST BODY:\n{\n\t\"name\": \"john\",\n\t\"description\": \"Traffic intent groups\"\n \"set\":[\n {\n \"inbound\":\"abc\"\n },\n {\n \"outbound\":\"abc\"\n }\n ]\n}","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"1. Inbound access ","type":"text"}]},{"type":"paragraph","content":[{"text":"POST","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"POST","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"javascript"},"content":[{"text":"URL: /v2/projects/{project-name}/composite-apps/blue-app/{version}/traffic-intent-set/inbound-intents/\n\nPOST BODY:\n{\n\t\"metadata\": {\n\t\"name\": \"<>\" // unique name for each intent\n \"description\": \"connectivity intent for inbound communication\"\n\t\"userdata1\": <>,\n\t\"userdata2\": <>\n\t}\n\n\t\"spec\": { // update the memory allocation for each field as per OpenAPI standards\n\t\"application\": \"\",\n\t\"servicename\": \"httpbin\" //actual name of the client service - {istioobject - serviceEntry of client's cluster}\n\t\"externalName\": \"httpbin.k8s.com\"\n\t\"traffic-weeight\": \"\" // Default is \"\". Used for redirecting traffic percentage when compound API is called\n\t\"protocol\": \"HTTP\",\n\t\"headless\": \"false\", // default is false. Option \"True\" will make sure all the instances of the headless service will have access to the client service\n\t\"mutualTLS\": \"MUTUAL\", // default is simple. Option MUTUAL will enforce mtls {istioobject - destinationRule}\n\t\"port\" : \"80\", // port on which service is exposed as through servicemesh, not the port it is actually running on\n\t\"serviceMesh\": \"istio\", // get it from cluster record\n\t\"sidecar-proxy\": \"yes\", // The features (mTLS, LB, Circuit breaking) are not available to services without istio-proxy. Only inbound routing is possible.\n\t// Traffic management fields below are valid only if the sidecar-proxy is set to \"yes\"\n\t\"traffic-management-info\" : {\n\t// Traffic configuration - Loadbalancing is applicable per service. The traffic to this service is distrbuted amongst the pods under it.\n\t\"loadbalancingType\": \"ConsistenHash\", // \"Simple\" and \"consistentHash\" are the two modes - {istioobject - destinationRule}\n\t\"loadBalancerMode\": \"httpCookie\" // Modes for consistentHash - \"httpHeaderName\", \"httpCookie\", \"useSourceIP\", \"minimumRingSize\", Modes for simple - \"LEAST_CONN\", \"ROUND_ROBIN\", \t\"RANDOM\", \"PASSTHROUGH\" // choices of the mode must be explicit - {istioobject - destinationRule}\n\t\"httpCookie\": \"user1\" // Name of the cookie to maitain sticky sessions - {istioobject - destinationRule}\n\n\t// Circuit Breaking\n\t\"maxConnections\": 10 //connection pool for tcp and http traffic - {istioobject - destinationRule}\n\t\"concurrenthttp2Requests\": 1000 // concurent http2 requests which can be allowed - {istioobject - destinationRule}\n\t\"httpRequestPerConnection\": 100 // number of http requests per connection. Valid only for http traffic - {istioobject - destinationRule}\n\t\"consecutiveErrors\": 8 // Default is 5. Number of consecutive error before the host is removed - {istioobject - destinationRule}\n\t\"baseEjectionTime\" : 15 // Default is 5, - {istioobject - destinationRule}\n\t\"intervalSweep\": 5m, //time limit before the removed hosts are added back to the load balancing pool. - {istioobject - destinationRule}\n\t}\n\n\t// credentials for mTLS.\n\t\"Servicecertificate\" : \"\" // Present actual certificate here.\n\t\"ServicePrivateKey\" : \"\" // Present actual private key here.\n\t\"caCertificate\" : \"\" // present the trusted certificate to verify the client connection, Required only when mtls mode is MUTUAL\t\n\t}\n}\n\nRETURN STATUS: 201\nRETURN BODY: \n{ \n \"name\": \"\"\n \"Message\": \"inbound service created\"\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"GET","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"GET","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"javascript"},"content":[{"text":"URL: /v2/projects/{project-name}/composite-apps/blue-app/{version}/traffic-intent-set/inbound-intents/\n\nRETURN STATUS: 201\nRETURN BODY:\n{\n\t\"metadata\": {\n\t\"name\": \"<>\" // unique name for each intent\n \"description\": \"connectivity intent for stateless micro-service to stateless micro-service communication\"\n\t\"userdata1\": <>,\n\t\"userdata2\": <>\n\t}\n\n\t\"spec\": { // update the memory allocation for each field as per OpenAPI standards\n\t\"application\": \"\",\n\t\"servicename\": \"<>\" //actual name of the client service - {istioobject - serviceEntry of client's cluster}\n\t\"externalName\": \"<>\" // prefix to expose this service outside the cluster\n\t\"protocol\": \"\", // supported protocols are HTTP, TCP, UDP and HTTP2\n\t\"headless\": \"\", // default is false. Option \"True\" will make sure all the instances of the headless service will have access to the client service\n\t\"mutualTLS\": \"\", // default is simple. Option MUTUAL will enforce mtls {istioobject - destinationRule}\n\t\"port\" : \"80\", // port on which service is exposed as through servicemesh, not the port it is actually running on\n\t\"serviceMesh\": \"istio\", // get it from cluster record\n\t\"sidecar-proxy\": \"yes\", // The features (mTLS, LB, Circuit breaking) are not available to services without istio-proxy. Only inbound routing is possible.\n\n\t/ Traffic management fields below are valid only if the sidecar-proxy is set to \"yes\"\n\t\"traffic-management-info\" : {\n\t\t// Traffic configuration - Loadbalancing is applicable per service. The traffic to this service is distrbuted amongst the pods under it.\n\t\t\"loadbalancingType\": \"\", // \"Simple\" and \"consistentHash\" are the two modes - {istioobject - destinationRule}\n\t\t\"loadBalancerMode\": \"\" // Modes for consistentHash - \"httpHeaderName\", \"httpCookie\", \"useSourceIP\", \"minimumRingSize\", Modes for simple - \"LEAST_CONN\", \"ROUND_ROBIN\", \t\"RANDOM\", \"PASSTHROUGH\" // choices of the mode must be explicit - {istioobject - destinationRule}\n\t\t\"httpCookie\": \"user1\" // Name of the cookie to maitain sticky sessions - {istioobject - destinationRule}\n\n\t\t// Circuit Breaking\n\t\t\"maxConnections\": \"\" //connection pool for tcp and http traffic - {istioobject - destinationRule}\n\t\t\"concurrenthttp2Requests\": \"\" // concurent http2 requests which can be allowed - {istioobject - destinationRule}\n\t\t\"httpRequestPerConnection\": \"\" // number of http requests per connection. Valid only for http traffic - {istioobject - destinationRule}\n\t\t\"consecutiveErrors\": \"\" // Default is 5. Number of consecutive error before the host is removed - {istioobject - destinationRule}\n\t\t\"baseEjectionTime\" : \"\" // Default is 5, - {istioobject - destinationRule}\n\t\t\"intervalSweep\": '', //time limit before the removed hosts are added back to the load balancing pool. - {istioobject - destinationRule}\n\t\t}\t\n\n\t// credentials for mTLS.\n\t\"Servicecertificate\" : \"\" // Present actual certificate here.\n\t\"ServicePrivateKey\" : \"\" // Present actual private key here.\n\t\"caCertificate\" : \"\" // present the trusted certificate to verify the client connection, Required only when mtls mode is MUTUAL\n\n\t// Access Control\n\t\"namespaces\": [] // Workloads from this namespaces can access the inbound service - {istioobject - authorizationPolicy}\n\t\"serviceAccountAccess\" : {[ \"SaDetails\": [\"ACTION\": \"URI\"]} // {istioobject - authorizationPolicy, will be applied for the inbound service}\n\t\n\t}\n}\n","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"DELETE ","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"DELETE","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"javascript"},"content":[{"text":"DELETE\nURL: /v2/projects/{project-name}/composite-apps/blue-app/{version}/traffic-intent-set/inbound-intents/\n\nRETURN STATUS: 204\n","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"2. Outbound access","type":"text"}]},{"type":"paragraph","content":[{"text":"POST - ","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"POST","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"javascript"},"content":[{"text":"URL: /v2/projects/{project-name}/composite-apps/{composite-app-name}/{version}/traffic-group-intent/outbound-intents/\nPOST BODY:\n{\n\t\"metadata\": {\n\t\"name\": \"\" // unique name for each intent\n \"description\": \"connectivity intent add client communication\"\n\t\"application\": \"\",\n\t\"userdata1\": <>,\n\t\"userdata2\": <>\n\t}\n\n\tspec: {\n\t\t\"clientServiceName\": \"<>\", // Name of the client service\n\t\t\"type\": \"\", // options are istio, k8s and external\n\t\t\"inboundServiceName\": \"<>\"\n\t\t\"headless\": \"false\", // default is false. Option \"True\" will generate the required configs for all the instances of headless service\n\t}\n}\n\nRETURN STATUS: 201\nRETURN BODY:\n{ \n \"name\": \"\"\n \"Message\": \"Client created\"\n}","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"3. Compound Service access","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"POST","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"javascript"},"content":[{"text":"URL: /v2/projects/{project-name}/composite-apps/blue-app/{version}/traffic-intent-set/compound-intents/\n\nPOST BODY:\n{\n\t\"metadata\": {\n\t\"name\": \"<>\" // unique name for each intent\n \"description\": \"connectivity intent for inbound communication\"\n\t\"userdata1\": <>,\n\t\"userdata2\": <>\n\t}\n\n\t\"spec\": { \n\t\"application\": \"\",\n\t\"externalPrefix\": \"/canary\"\n\t\n\t}\n}\n\nRETURN STATUS: 201\nRETURN BODY: \n{ \n \"name\": \"\"\n \"Message\": \"inbound service created\"\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"Note - After the compound intent is created, Call the inbound services under it and make sure you assign the weightage to each service under it. As shown in the below example","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"POST","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"javascript"},"content":[{"text":"URL: /v2/projects/{project-name}/composite-apps/blue-app/{version}/traffic-intent-set/compound-intents/{compoungd-intent-name}/inbound-intents/\n\nPOST BODY:\n{\n\t\"metadata\": {\n\t\"name\": \"<>\" // unique name for each intent\n \"description\": \"connectivity intent for inbound communication\"\n\t\"userdata1\": <>,\n\t\"userdata2\": <>\n\t}\n\n\t\"spec\": { // update the memory allocation for each field as per OpenAPI standards\n\t\"application\": \"\",\n\t\"servicename\": \"httpbin\" //actual name of the client service - {istioobject - serviceEntry of client's cluster}\n\t\"externalName\": \"httpbin.k8s.com\"\n\t\"traffic-weight\": \"50\" // Default is \"\". Used for redirecting traffic percentage when compound API is called\n\t\"protocol\": \"HTTP\",\n\t\"headless\": \"false\", // default is false. Option \"True\" will make sure all the instances of the headless service will have access to the client service\n\t\"mutualTLS\": \"MUTUAL\", // default is simple. Option MUTUAL will enforce mtls {istioobject - destinationRule}\n\t\"port\" : \"80\", // port on which service is exposed as through servicemesh, not the port it is actually running on\n\t\"serviceMesh\": \"istio\", // get it from cluster record\n\t\"sidecar-proxy\": \"yes\", // The features (mTLS, LB, Circuit breaking) are not available to services without istio-proxy. Only inbound routing is possible.\n\t// Traffic management fields below are valid only if the sidecar-proxy is set to \"yes\"\n\t\"traffic-management-info\" : {\n\t// Traffic configuration - Loadbalancing is applicable per service. The traffic to this service is distrbuted amongst the pods under it.\n\t\"loadbalancingType\": \"ConsistenHash\", // \"Simple\" and \"consistentHash\" are the two modes - {istioobject - destinationRule}\n\t\"loadBalancerMode\": \"httpCookie\" // Modes for consistentHash - \"httpHeaderName\", \"httpCookie\", \"useSourceIP\", \"minimumRingSize\", Modes for simple - \"LEAST_CONN\", \"ROUND_ROBIN\", \t\"RANDOM\", \"PASSTHROUGH\" // choices of the mode must be explicit - {istioobject - destinationRule}\n\t\"httpCookie\": \"user1\" // Name of the cookie to maitain sticky sessions - {istioobject - destinationRule}\n\n\t// Circuit Breaking\n\t\"maxConnections\": 10 //connection pool for tcp and http traffic - {istioobject - destinationRule}\n\t\"concurrenthttp2Requests\": 1000 // concurent http2 requests which can be allowed - {istioobject - destinationRule}\n\t\"httpRequestPerConnection\": 100 // number of http requests per connection. Valid only for http traffic - {istioobject - destinationRule}\n\t\"consecutiveErrors\": 8 // Default is 5. Number of consecutive error before the host is removed - {istioobject - destinationRule}\n\t\"baseEjectionTime\" : 15 // Default is 5, - {istioobject - destinationRule}\n\t\"intervalSweep\": 5m, //time limit before the removed hosts are added back to the load balancing pool. - {istioobject - destinationRule}\n\t}\n\n\t// credentials for mTLS.\n\t\"Servicecertificate\" : \"\" // Present actual certificate here.\n\t\"ServicePrivateKey\" : \"\" // Present actual private key here.\n\t\"caCertificate\" : \"\" // present the trusted certificate to verify the client connection, Required only when mtls mode is MUTUAL\t\n\t}\n}\n\nRETURN STATUS: 201\nRETURN BODY: \n{ \n \"name\": \"\"\n \"Message\": \"inbound service created\"\n}","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Scenarios supported for the current release","type":"text"}]},{"type":"table","content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Nature of application","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Page link ","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"comments","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"HTTP","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"HTTP","type":"text","marks":[{"type":"link","attrs":{"href":"https://lf-onap.atlassian.net/wiki/spaces/DW/pages/16409609"}},{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"HTTPS","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"HTTPS","type":"text","marks":[{"type":"link","attrs":{"href":"https://lf-onap.atlassian.net/wiki/spaces/DW/pages/16409773"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"TCP","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"TCP","type":"text","marks":[{"type":"link","attrs":{"href":"https://lf-onap.atlassian.net/wiki/spaces/DW/pages/16409777"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Development","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"go API library - ","type":"text"},{"text":"https://github.com/gorilla/mux","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/gorilla/mux"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"backend - mongo - ","type":"text"},{"text":"https://github.com/onap/multicloud-k8s/tree/master/src/k8splugin/internal/db","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/onap/multicloud-k8s/tree/master/src/k8splugin/internal/db"}}]},{"text":" - Reference","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"intent to config conversion - use go templates and admiral? ","type":"text"},{"text":"https://github.com/istio-ecosystem/admiral","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/istio-ecosystem/admiral"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"writing the config to etcd - WIP","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Unit tests and Integration test - go tests","type":"text"}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"External DNS - Design and intent API","type":"text"}]},{"type":"paragraph","content":[{"text":"See here: ","type":"text"},{"text":"External DNS provider update design and intent API","type":"text","marks":[{"type":"link","attrs":{"href":"https://lf-onap.atlassian.net/wiki/spaces/DW/pages/16407145"}}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"External application communication intents","type":"text"}]},{"type":"paragraph","content":[{"text":"Considering DNS resolution, No DNS resolution (IP addresses), Egress proxies of the Service Mesh, Third-party egress proxy","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"User facing communication intents","type":"text"}]},{"type":"paragraph","content":[{"text":"Considering Multiple DNS Servers","type":"text"}]},{"type":"paragraph","content":[{"text":"Considering multiple user-facing entities","type":"text"}]},{"type":"paragraph","content":[{"text":"Considering RBAC/ABAC","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Internal Design details","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Guidelines that need to keep in mind","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Support for metrics that can be retrieved by Prometheus","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Support for Jaeger distributed tracing by including open tracing libraries around HTTP calls.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Support for logging that is understood by fluentd","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Mutual exclusion of database operations (keeping internal modules accessing database records simultaneously and also by replication entities of the scheduler micro-service).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Resilience - ensure that the information returned by controllers is not lost as the synchronization of resources to remote edge clouds can take hours or even days when the edge is not up and running and possibility of restart of scheduler micro service in the meantime.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Concurrency - Support multiple operations at a time and even synchronizing resources in various edge clouds in parallel.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Performance - Avoiding file system operations as much as possible.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Modules (Description, internal structures etc..)","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Service Mesh Config:","type":"text"}]},{"type":"paragraph","content":[{"text":"Main Function: the module is invoked by traffic controller after traffic controller receives","type":"text"},{"type":"hardBreak"},{"text":" intents from external world, and parses requests from traffic controller and","type":"text"},{"type":"hardBreak"},{"text":" extracts some key information to assemble a new yaml file for creating instances","type":"text"},{"type":"hardBreak"},{"text":" of inbound services and clients based on istio.","type":"text"}]},{"type":"paragraph","content":[{"text":"Main Operations:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"create/destroy inbound services (API: Add Inbound service)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"create/destroy client services (API: Add Clients)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"create/remove security details for client services (API: Add Security details for clients)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"create/destroy ServiceEntry for inbound services used by clients","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"create/destroy DestinationRules for both inbound and client services","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"create/destroy VirtualService for client services","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"create/destroy AuthorizationPolicy for inbound services used by clients","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"The key information includes but not limited:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"client name","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"inbound service name","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"protocol: http/https/tcp","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"TLS options: no/simple/mutual","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"port","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"The interface between SM config and Traffic Controller: maybe via gPRC, and APIs are TBD","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Traffic Controller","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Main Function: it acts as main controlling loop/daemon, and receives the request in a form of","type":"text"},{"type":"hardBreak"},{"text":" REST from external modules e.g. orchestrator. Then it parses these requests and ","type":"text"},{"type":"hardBreak"},{"text":" figures out the exact purposes which these requests want to express ","type":"text"},{"type":"hardBreak"},{"text":" e.g. service creation, DNS update or workload adjust. Afterwards, it invoke corresponding","type":"text"},{"type":"hardBreak"},{"text":" components like SM config, DNS updater, to fulfill these requirements by creating","type":"text"},{"type":"hardBreak"},{"text":" and configuring related uServices based on the various mechanisms of istio.","type":"text"}]},{"type":"paragraph","content":[{"text":"Main steps:","type":"text"}]},{"type":"paragraph","content":[{"text":"0. Traffic controller need to be registered in orchestrtor by calling the APIs provided by orchestrtor","type":"text"}]},{"type":"paragraph","content":[{"text":"1. Orchestrtor starts to instantiate the traffic controller","type":"text"}]},{"type":"paragraph","content":[{"text":"2. Traffic controller finds the config files about various plugins like SM config,","type":"text"},{"type":"hardBreak"},{"text":" Loadbalancers and DNS updater from some certain locations, and then instantiate","type":"text"},{"type":"hardBreak"},{"text":" these plugins. Here, these plugins may be defined as istio VirtualService and ","type":"text"},{"type":"hardBreak"},{"text":" their associated yaml files should be provided beforehand.","type":"text"}]},{"type":"paragraph","content":[{"text":"3. Traffic controller need to have some health-check about the instances of these","type":"text"},{"type":"hardBreak"},{"text":" plugins and make sure they are up and running well(some heath-check criteria","type":"text"},{"type":"hardBreak"},{"text":" also need to be defined).","type":"text"}]},{"type":"paragraph","content":[{"text":"4. Traffic controller may need to notify orchestrator that it, including the plugins,","type":"text"},{"type":"hardBreak"},{"text":" is ready to serve (which API provided by orchestrator should be invoked?).","type":"text"}]},{"type":"paragraph","content":[{"text":"5. At this moment, orchestrator can start to monitor and manage the life-cycle of traffic","type":"text"},{"type":"hardBreak"},{"text":" controller. And the way/APIs of monitor and manage need to be clarified. ","type":"text"},{"type":"hardBreak"},{"text":" (Is HA is required for traffic controller?)","type":"text"}]},{"type":"paragraph","content":[{"text":"6. Users/admin are allowed to send their request to create uServices or access the running","type":"text"},{"type":"hardBreak"},{"text":" uServices directly via REST, like the inbound/client services creation. After traffic controller","type":"text"},{"type":"hardBreak"},{"text":" convert the intents to service description, the generated yml files which will be used by istio","type":"text"},{"type":"hardBreak"},{"text":" to create uSevices should be given to workload scheduler/placement helper to place and ","type":"text"},{"type":"hardBreak"},{"text":" instantiate these uService on edge cloud clusters. Namely, traffic controller need to inform ","type":"text"},{"type":"hardBreak"},{"text":" the workload scheduler/placement helper that there are some uServices to be placed and","type":"text"},{"type":"hardBreak"},{"text":" instantiated on edge cloud clusters.","type":"text"}]},{"type":"paragraph","content":[{"text":"7. Traffic controller need to call DNS module to expose the domain names of services to external world, ","type":"text"},{"type":"hardBreak"},{"text":" after it is aware of these uServices have been instantiated on edge cloud clusters. (how is traffic controller ","type":"text"},{"type":"hardBreak"},{"text":" aware of the accomplishment of of uServices instantiation?)","type":"text"}]},{"type":"paragraph","content":[{"text":"8. Traffic controller may need to manage the lifecycle of uServices (or done by some modules within orchestrator?)","type":"text"},{"type":"hardBreak"},{"text":" by a way e.g. detecting the heartbeat from various uServices periodically e.g. one check per 10 seconds.","type":"text"}]},{"type":"paragraph","content":[{"text":"9. Considering the HA, traffic controller should instantiate at least 2 of those plugins, and should be ","type":"text"},{"type":"hardBreak"},{"text":" able to monitor the health of those instances of plugins. when any of instances is down, traffic controller ","type":"text"},{"type":"hardBreak"},{"text":" can restart/recreate one for it again.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"LoadBalancer (aka GSLB/LB controller?)","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"GSLB(Geo-replicated Services LB/LB controller) is used to balance incoming load across multiple istio-ingress-gateways. ","type":"text"},{"type":"hardBreak"},{"text":"It shall be able to be aware of the run-time load of various working uService instances which are distributed on different ","type":"text"},{"type":"hardBreak"},{"text":"edge clouds or the general load level of each kind of uService in each edge cloud by interacting with actual LB(e.g. metallb, ","type":"text"},{"type":"hardBreak"},{"text":"or other module except metallb) running on one edge cloud. Metallb is responsible for the load balance jobs between instances ","type":"text"},{"type":"hardBreak"},{"text":"of uService within an edge cloud, while GSLB(controller) shall be in charge of guiding the traffic load to multiple edge clouds. ","type":"text"},{"type":"hardBreak"},{"text":"GSLB(LB controller) should be aware of the public IPs (achieved by using metallb? or SDWAN?) of all edge clouds. ","type":"text"}]},{"type":"paragraph","content":[{"text":"GSLB(LB controller) get requests from external users, and it evaluates the load level of the uServices that the user want to access ","type":"text"},{"type":"hardBreak"},{"text":"on various edge clouds, and then choose one certain edge cloud on which the targeted(or a set of) uService instance is running, ","type":"text"},{"type":"hardBreak"},{"text":"next GSLB returns the domain name of the chosen uService instance to users, so users can utilize this new domain name to access ","type":"text"},{"type":"hardBreak"},{"text":"their expected uService. These steps mentioned above imply that those domain names associated with different uServices distributed","type":"text"},{"type":"hardBreak"},{"text":"on edge clouds should point to the IP address of center cloud on which GSLB is running first, after GSLB figure out to which edge cloud ","type":"text"},{"type":"hardBreak"},{"text":"the users' request should be forwarded, the real domain name of uServices is given back to users by GSLB.","type":"text"}]},{"type":"paragraph","content":[{"text":"....","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Sequence flows","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Test cases","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}],"version":1}