Service Mesh

1cli, err := clientv3.New(clientv3.Config{
2    Endpoints:   []string{"http://my-etcd-cluster.my-etcd-namespace.svc.cluster.local:2379"},
3    DialTimeout: 5 * time.Second,
4    Username:    username,
5    Password:    password,
6})
7
8if err != nil {
9    return nil, fmt.Errorf("opening ETCD client failed: %v", err)
10}
11

1cli, err := clientv3.New(clientv3.Config{
2    Endpoints:   []string{"http://my-etcd-cluster.my-etcd-namespace.svc.cluster.local:2379"},
3    DialTimeout: 5 * time.Second,
4    Username:    username,
5    Password:    password,
6})
7
8if err != nil {
9    return nil, fmt.Errorf("opening ETCD client failed: %v", err)
10}
11{"level":"warn","ts":"2022-03-16T23:37:42.174Z","logger":"etcd-client","caller":"v3@v3.5.0/retry_interceptor.go:62","msg":"retrying of unary invoker failed",
12"target":"etcd-endpoints://0xc00057f500/#initially=[http://my-etcd-cluster.my-etcd-namespace.svc.cluster.local:2379]","attempt":0,
13"error":"rpc error: code = Unavailable desc = error reading from server: EOF"}
14...
151.647473862175209e+09   INFO    controller.etcdclient   Finish reconcile loop for some-service/test-svc-client  {"reconciler group": "my-controller.something.io", "reconciler kind": "ETCDClient", "name": "test-svc-client", "namespace": "some-service", "reconcile-etcd-client": "some-service/test-svc-client"}
161.6474738621752858e+09  ERROR   controller.etcdclient   Reconciler error        {"reconciler group": "my-controller.something.io", "reconciler kind": "ETCDClient", "name": "test-svc-client", "namespace": "some-service", "error": "opening ETCD client failed: rpc error: code = Unavailable desc = error reading from server: EOF"}
17sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
18        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.11.0/pkg/internal/controller/controller.go:266
19sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
20        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.11.0/pkg/internal/controller/controller.go:227
21

1cli, err := clientv3.New(clientv3.Config{
2    Endpoints:   []string{"http://my-etcd-cluster.my-etcd-namespace.svc.cluster.local:2379"},
3    DialTimeout: 5 * time.Second,
4    Username:    username,
5    Password:    password,
6})
7
8if err != nil {
9    return nil, fmt.Errorf("opening ETCD client failed: %v", err)
10}
11{"level":"warn","ts":"2022-03-16T23:37:42.174Z","logger":"etcd-client","caller":"v3@v3.5.0/retry_interceptor.go:62","msg":"retrying of unary invoker failed",
12"target":"etcd-endpoints://0xc00057f500/#initially=[http://my-etcd-cluster.my-etcd-namespace.svc.cluster.local:2379]","attempt":0,
13"error":"rpc error: code = Unavailable desc = error reading from server: EOF"}
14...
151.647473862175209e+09   INFO    controller.etcdclient   Finish reconcile loop for some-service/test-svc-client  {"reconciler group": "my-controller.something.io", "reconciler kind": "ETCDClient", "name": "test-svc-client", "namespace": "some-service", "reconcile-etcd-client": "some-service/test-svc-client"}
161.6474738621752858e+09  ERROR   controller.etcdclient   Reconciler error        {"reconciler group": "my-controller.something.io", "reconciler kind": "ETCDClient", "name": "test-svc-client", "namespace": "some-service", "error": "opening ETCD client failed: rpc error: code = Unavailable desc = error reading from server: EOF"}
17sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
18        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.11.0/pkg/internal/controller/controller.go:266
19sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
20        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.11.0/pkg/internal/controller/controller.go:227
21postBody, _ := json.Marshal(map[string]string{
22    "name":     username,
23    "password": password,
24})
25responseBody := bytes.NewBuffer(postBody)
26
27resp, err := http.Post("http://my-etcd-cluster.my-etcd-namespace.svc.cluster.local:2379/v3/auth/authenticate", "application/json", responseBody)
28if err != nil {
29    return ctrl.Result{}, fmt.Errorf("an error occured %w", err)
30}
31l.Info(fmt.Sprintf("code: %d", resp.StatusCode))
32defer resp.Body.Close()
33

1cli, err := clientv3.New(clientv3.Config{
2    Endpoints:   []string{"http://my-etcd-cluster.my-etcd-namespace.svc.cluster.local:2379"},
3    DialTimeout: 5 * time.Second,
4    Username:    username,
5    Password:    password,
6})
7
8if err != nil {
9    return nil, fmt.Errorf("opening ETCD client failed: %v", err)
10}
11{"level":"warn","ts":"2022-03-16T23:37:42.174Z","logger":"etcd-client","caller":"v3@v3.5.0/retry_interceptor.go:62","msg":"retrying of unary invoker failed",
12"target":"etcd-endpoints://0xc00057f500/#initially=[http://my-etcd-cluster.my-etcd-namespace.svc.cluster.local:2379]","attempt":0,
13"error":"rpc error: code = Unavailable desc = error reading from server: EOF"}
14...
151.647473862175209e+09   INFO    controller.etcdclient   Finish reconcile loop for some-service/test-svc-client  {"reconciler group": "my-controller.something.io", "reconciler kind": "ETCDClient", "name": "test-svc-client", "namespace": "some-service", "reconcile-etcd-client": "some-service/test-svc-client"}
161.6474738621752858e+09  ERROR   controller.etcdclient   Reconciler error        {"reconciler group": "my-controller.something.io", "reconciler kind": "ETCDClient", "name": "test-svc-client", "namespace": "some-service", "error": "opening ETCD client failed: rpc error: code = Unavailable desc = error reading from server: EOF"}
17sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
18        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.11.0/pkg/internal/controller/controller.go:266
19sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
20        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.11.0/pkg/internal/controller/controller.go:227
21postBody, _ := json.Marshal(map[string]string{
22    "name":     username,
23    "password": password,
24})
25responseBody := bytes.NewBuffer(postBody)
26
27resp, err := http.Post("http://my-etcd-cluster.my-etcd-namespace.svc.cluster.local:2379/v3/auth/authenticate", "application/json", responseBody)
28if err != nil {
29    return ctrl.Result{}, fmt.Errorf("an error occured %w", err)
30}
31l.Info(fmt.Sprintf("code: %d", resp.StatusCode))
32defer resp.Body.Close()
33apiVersion: v1
34kind: Pod
35metadata:
36  name: test-pod
37  namespace: my-controller-namespace
38spec:
39  containers:
40  - name: etcdctl
41    image: bitnami/etcd
42    command:
43    - sleep
44    - infinity
45

1cli, err := clientv3.New(clientv3.Config{
2    Endpoints:   []string{"http://my-etcd-cluster.my-etcd-namespace.svc.cluster.local:2379"},
3    DialTimeout: 5 * time.Second,
4    Username:    username,
5    Password:    password,
6})
7
8if err != nil {
9    return nil, fmt.Errorf("opening ETCD client failed: %v", err)
10}
11{"level":"warn","ts":"2022-03-16T23:37:42.174Z","logger":"etcd-client","caller":"v3@v3.5.0/retry_interceptor.go:62","msg":"retrying of unary invoker failed",
12"target":"etcd-endpoints://0xc00057f500/#initially=[http://my-etcd-cluster.my-etcd-namespace.svc.cluster.local:2379]","attempt":0,
13"error":"rpc error: code = Unavailable desc = error reading from server: EOF"}
14...
151.647473862175209e+09   INFO    controller.etcdclient   Finish reconcile loop for some-service/test-svc-client  {"reconciler group": "my-controller.something.io", "reconciler kind": "ETCDClient", "name": "test-svc-client", "namespace": "some-service", "reconcile-etcd-client": "some-service/test-svc-client"}
161.6474738621752858e+09  ERROR   controller.etcdclient   Reconciler error        {"reconciler group": "my-controller.something.io", "reconciler kind": "ETCDClient", "name": "test-svc-client", "namespace": "some-service", "error": "opening ETCD client failed: rpc error: code = Unavailable desc = error reading from server: EOF"}
17sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
18        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.11.0/pkg/internal/controller/controller.go:266
19sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
20        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.11.0/pkg/internal/controller/controller.go:227
21postBody, _ := json.Marshal(map[string]string{
22    "name":     username,
23    "password": password,
24})
25responseBody := bytes.NewBuffer(postBody)
26
27resp, err := http.Post("http://my-etcd-cluster.my-etcd-namespace.svc.cluster.local:2379/v3/auth/authenticate", "application/json", responseBody)
28if err != nil {
29    return ctrl.Result{}, fmt.Errorf("an error occured %w", err)
30}
31l.Info(fmt.Sprintf("code: %d", resp.StatusCode))
32defer resp.Body.Close()
33apiVersion: v1
34kind: Pod
35metadata:
36  name: test-pod
37  namespace: my-controller-namespace
38spec:
39  containers:
40  - name: etcdctl
41    image: bitnami/etcd
42    command:
43    - sleep
44    - infinity
45$ etcdctl --endpoints=my-etcd-cluster.my-etcd-namespace.svc.cluster.local:2379 --user="user" --password="password" put foo bob
46OK
47

1network {
2  mode = "bridge"
3}
4
5service {
6  name = "api"
7  port = "9966"
8
9  connect {
10    sidecar_service {}
11  }
12}
13

1network {
2  mode = "bridge"
3}
4
5service {
6  name = "api"
7  port = "9966"
8
9  connect {
10    sidecar_service {}
11  }
12}
13- job_name: 'actuator'
14    metrics_path: /api/actuator/prometheus
15    consul_sd_configs:
16    - server: '{{ env "NOMAD_IP_prometheus_ui" }}:8500'
17      services: ['api']
18

1apiVersion: networking.istio.io/v1alpha3
2kind: DestinationRule
3metadata:
4  name: httpbin
5spec:
6  host: httpbin
7  trafficPolicy:
8    connectionPool:
9      tcp:
10        maxConnections: 1
11      http:
12        http1MaxPendingRequests: 1
13        maxRequestsPerConnection: 1
14

1apiVersion: networking.istio.io/v1alpha3
2kind: DestinationRule
3metadata:
4  name: httpbin
5spec:
6  host: httpbin
7  trafficPolicy:
8    connectionPool:
9      tcp:
10        maxConnections: 1
11      http:
12        http1MaxPendingRequests: 1
13        maxRequestsPerConnection: 1
14yunoMacBook-Air:labo8 yu$ kubectl exec "$FORTIO_POD" -c fortio -- /usr/bin/fortio load -c 5 -qps 0 -n 1000 -loglevel Error http://httpbin:8000/get
1507:12:01 I logger.go:127> Log level is now 4 Error (was 2 Info)
16Fortio 1.11.3 running at 0 queries per second, 2->2 procs, for 1000 calls: http://httpbin:8000/get
17Aggregated Function Time : count 1000 avg 0.0036879818 +/- 0.004588 min 0.000379697 max 0.034176044 sum 3.68798183
18# target 50% 0.00234783
19# target 75% 0.0032551
20# target 90% 0.008
21# target 99% 0.025
22# target 99.9% 0.032784
23Sockets used: 876 (for perfect keepalive, would be 5)
24Jitter: false
25Code 200 : 126 (12.6 %)
26Code 503 : 874 (87.4 %)
27All done 1000 calls (plus 0 warmup) 3.688 ms avg, 1170.1 qps
28yunoMacBook-Air:labo8 yu$
29

1apiVersion: networking.istio.io/v1alpha3
2kind: DestinationRule
3metadata:
4  name: httpbin
5spec:
6  host: httpbin
7  trafficPolicy:
8    connectionPool:
9      tcp:
10        maxConnections: 1
11      http:
12        http1MaxPendingRequests: 1
13        maxRequestsPerConnection: 1
14yunoMacBook-Air:labo8 yu$ kubectl exec "$FORTIO_POD" -c fortio -- /usr/bin/fortio load -c 5 -qps 0 -n 1000 -loglevel Error http://httpbin:8000/get
1507:12:01 I logger.go:127> Log level is now 4 Error (was 2 Info)
16Fortio 1.11.3 running at 0 queries per second, 2->2 procs, for 1000 calls: http://httpbin:8000/get
17Aggregated Function Time : count 1000 avg 0.0036879818 +/- 0.004588 min 0.000379697 max 0.034176044 sum 3.68798183
18# target 50% 0.00234783
19# target 75% 0.0032551
20# target 90% 0.008
21# target 99% 0.025
22# target 99.9% 0.032784
23Sockets used: 876 (for perfect keepalive, would be 5)
24Jitter: false
25Code 200 : 126 (12.6 %)
26Code 503 : 874 (87.4 %)
27All done 1000 calls (plus 0 warmup) 3.688 ms avg, 1170.1 qps
28yunoMacBook-Air:labo8 yu$
29apiVersion: networking.istio.io/v1alpha3
30kind: DestinationRule
31metadata:
32  name: httpbin
33spec:
34  (...)
35        maxRequestsPerConnection: 10
36

1apiVersion: networking.istio.io/v1alpha3
2kind: DestinationRule
3metadata:
4  name: httpbin
5spec:
6  host: httpbin
7  trafficPolicy:
8    connectionPool:
9      tcp:
10        maxConnections: 1
11      http:
12        http1MaxPendingRequests: 1
13        maxRequestsPerConnection: 1
14yunoMacBook-Air:labo8 yu$ kubectl exec "$FORTIO_POD" -c fortio -- /usr/bin/fortio load -c 5 -qps 0 -n 1000 -loglevel Error http://httpbin:8000/get
1507:12:01 I logger.go:127> Log level is now 4 Error (was 2 Info)
16Fortio 1.11.3 running at 0 queries per second, 2->2 procs, for 1000 calls: http://httpbin:8000/get
17Aggregated Function Time : count 1000 avg 0.0036879818 +/- 0.004588 min 0.000379697 max 0.034176044 sum 3.68798183
18# target 50% 0.00234783
19# target 75% 0.0032551
20# target 90% 0.008
21# target 99% 0.025
22# target 99.9% 0.032784
23Sockets used: 876 (for perfect keepalive, would be 5)
24Jitter: false
25Code 200 : 126 (12.6 %)
26Code 503 : 874 (87.4 %)
27All done 1000 calls (plus 0 warmup) 3.688 ms avg, 1170.1 qps
28yunoMacBook-Air:labo8 yu$
29apiVersion: networking.istio.io/v1alpha3
30kind: DestinationRule
31metadata:
32  name: httpbin
33spec:
34  (...)
35        maxRequestsPerConnection: 10
36yunoMacBook-Air:labo8 yu$ kubectl exec "$FORTIO_POD" -c fortio -- /usr/bin/fortio load -c 5 -qps 0 -n 1000 -loglevel Error http://httpbin:8000/get
3707:11:07 I logger.go:127> Log level is now 4 Error (was 2 Info)
38Fortio 1.11.3 running at 0 queries per second, 2->2 procs, for 1000 calls: http://httpbin:8000/get
39Aggregated Function Time : count 1000 avg 0.0039736575 +/- 0.004068 min 0.000404827 max 0.030141552 sum 3.97365754
40# target 50% 0.00231923
41# target 75% 0.00475
42# target 90% 0.0104667
43# target 99% 0.0192
44# target 99.9% 0.025
45Sockets used: 723 (for perfect keepalive, would be 5)
46Jitter: false
47Code 200 : 281 (28.1 %)
48Code 503 : 719 (71.9 %)
49All done 1000 calls (plus 0 warmup) 3.974 ms avg, 1098.3 qps
50yunoMacBook-Air:labo8 yu$
51

1apiVersion: networking.istio.io/v1beta1
2kind: ServiceEntry
3metadata:
4  name: smtp
5spec:
6  addresses:
7  - 192.168.8.45/32
8  hosts:
9  - smtp.example.com"
10  location: MESH_EXTERNAL
11  ports:
12    - name: tcp-smtp
13      number: 2255
14      protocol: TCP
15

1apiVersion: install.istio.io/v1alpha1
2kind: IstioOperator
3metadata:
4  namespace: istio-system
5  name: ground-zero-ingressgateway
6spec:
7  profile: empty
8  components:
9    ingressGateways:
10      - name: istio-ingressgateway
11        enabled: true
12      - name: istio-vpn-ingressgateway
13        label:
14          app: istio-vpn-ingressgateway
15          istio: vpn-ingressgateway
16        enabled: true
17        k8s:
18          serviceAnnotations:
19            ...
20          service:
21            loadBalancerSourceRanges:
22              - "x.x.x.x/x"
23

1apiVersion: install.istio.io/v1alpha1
2kind: IstioOperator
3metadata:
4  namespace: istio-system
5  name: ground-zero-ingressgateway
6spec:
7  profile: empty
8  components:
9    ingressGateways:
10      - name: istio-ingressgateway
11        enabled: true
12      - name: istio-vpn-ingressgateway
13        label:
14          app: istio-vpn-ingressgateway
15          istio: vpn-ingressgateway
16        enabled: true
17        k8s:
18          serviceAnnotations:
19            ...
20          service:
21            loadBalancerSourceRanges:
22              - "x.x.x.x/x"
23apiVersion: networking.k8s.io/v1
24kind: Ingress
25metadata:
26  name: my-ingress
27  annotations:
28    kubernetes.io/ingress.class: istio
29spec:
30   ...
31

1NAMESPACE        NAME                                            READY   STATUS    RESTARTS   AGE
2appmesh-system   appmesh-controller-847f957bc8-s2k7l             1/1     Running   0          57m
3

1NAMESPACE        NAME                                            READY   STATUS    RESTARTS   AGE
2appmesh-system   appmesh-controller-847f957bc8-s2k7l             1/1     Running   0          57m
3apiVersion: v1
4kind: Namespace
5metadata:
6  name: example
7  labels:
8    mesh: v-mesh
9    gateway: ingress-gw
10    appmesh.k8s.aws/sidecarInjectorWebhook: enabled
11---
12apiVersion: appmesh.k8s.aws/v1beta2
13kind: Mesh
14metadata:
15  name: v-mesh
16spec:
17  namespaceSelector:
18    matchLabels:
19      mesh: v-mesh
20  egressFilter:
21    type: ALLOW_ALL
22

1NAMESPACE        NAME                                            READY   STATUS    RESTARTS   AGE
2appmesh-system   appmesh-controller-847f957bc8-s2k7l             1/1     Running   0          57m
3apiVersion: v1
4kind: Namespace
5metadata:
6  name: example
7  labels:
8    mesh: v-mesh
9    gateway: ingress-gw
10    appmesh.k8s.aws/sidecarInjectorWebhook: enabled
11---
12apiVersion: appmesh.k8s.aws/v1beta2
13kind: Mesh
14metadata:
15  name: v-mesh
16spec:
17  namespaceSelector:
18    matchLabels:
19      mesh: v-mesh
20  egressFilter:
21    type: ALLOW_ALL
22Name:                example-svc-acct
23Namespace:           example
24Labels:              <none>
25Annotations:         eks.amazonaws.com/role-arn: arn:aws:iam::xxxxxxxx:role/eksctl-eks-addon-iamserviceaccount-example-Role1
26Image pull secrets:  <none>
27Mountable secrets:   example-svc-acct-token-lgrs2
28Tokens:              example-svc-acct-token-lgrs2
29Events:              <none>
30

1NAMESPACE        NAME                                            READY   STATUS    RESTARTS   AGE
2appmesh-system   appmesh-controller-847f957bc8-s2k7l             1/1     Running   0          57m
3apiVersion: v1
4kind: Namespace
5metadata:
6  name: example
7  labels:
8    mesh: v-mesh
9    gateway: ingress-gw
10    appmesh.k8s.aws/sidecarInjectorWebhook: enabled
11---
12apiVersion: appmesh.k8s.aws/v1beta2
13kind: Mesh
14metadata:
15  name: v-mesh
16spec:
17  namespaceSelector:
18    matchLabels:
19      mesh: v-mesh
20  egressFilter:
21    type: ALLOW_ALL
22Name:                example-svc-acct
23Namespace:           example
24Labels:              <none>
25Annotations:         eks.amazonaws.com/role-arn: arn:aws:iam::xxxxxxxx:role/eksctl-eks-addon-iamserviceaccount-example-Role1
26Image pull secrets:  <none>
27Mountable secrets:   example-svc-acct-token-lgrs2
28Tokens:              example-svc-acct-token-lgrs2
29Events:              <none>
30NAME                      READY   STATUS    RESTARTS   AGE
31svc1-5d4b4d6485-m7t7g      1/2     Running   0          7s
32svc2-76cb5fd545-nqgx5      2/3     Running   0          7s
33svc2-76cb5fd545-vsbnj      2/3     Running   0          7s
34svc3-84f97bd64f-q9hjx      1/2     Running   0          7s
35

1NAMESPACE        NAME                                            READY   STATUS    RESTARTS   AGE
2appmesh-system   appmesh-controller-847f957bc8-s2k7l             1/1     Running   0          57m
3apiVersion: v1
4kind: Namespace
5metadata:
6  name: example
7  labels:
8    mesh: v-mesh
9    gateway: ingress-gw
10    appmesh.k8s.aws/sidecarInjectorWebhook: enabled
11---
12apiVersion: appmesh.k8s.aws/v1beta2
13kind: Mesh
14metadata:
15  name: v-mesh
16spec:
17  namespaceSelector:
18    matchLabels:
19      mesh: v-mesh
20  egressFilter:
21    type: ALLOW_ALL
22Name:                example-svc-acct
23Namespace:           example
24Labels:              <none>
25Annotations:         eks.amazonaws.com/role-arn: arn:aws:iam::xxxxxxxx:role/eksctl-eks-addon-iamserviceaccount-example-Role1
26Image pull secrets:  <none>
27Mountable secrets:   example-svc-acct-token-lgrs2
28Tokens:              example-svc-acct-token-lgrs2
29Events:              <none>
30NAME                      READY   STATUS    RESTARTS   AGE
31svc1-5d4b4d6485-m7t7g      1/2     Running   0          7s
32svc2-76cb5fd545-nqgx5      2/3     Running   0          7s
33svc2-76cb5fd545-vsbnj      2/3     Running   0          7s
34svc3-84f97bd64f-q9hjx      1/2     Running   0          7s
35kubectl exec -n example svc3-84f97bd64f-q9hjx -c envoy env | grep AWS
36AWS_REGION=us-east-2
37

1NAMESPACE        NAME                                            READY   STATUS    RESTARTS   AGE
2appmesh-system   appmesh-controller-847f957bc8-s2k7l             1/1     Running   0          57m
3apiVersion: v1
4kind: Namespace
5metadata:
6  name: example
7  labels:
8    mesh: v-mesh
9    gateway: ingress-gw
10    appmesh.k8s.aws/sidecarInjectorWebhook: enabled
11---
12apiVersion: appmesh.k8s.aws/v1beta2
13kind: Mesh
14metadata:
15  name: v-mesh
16spec:
17  namespaceSelector:
18    matchLabels:
19      mesh: v-mesh
20  egressFilter:
21    type: ALLOW_ALL
22Name:                example-svc-acct
23Namespace:           example
24Labels:              <none>
25Annotations:         eks.amazonaws.com/role-arn: arn:aws:iam::xxxxxxxx:role/eksctl-eks-addon-iamserviceaccount-example-Role1
26Image pull secrets:  <none>
27Mountable secrets:   example-svc-acct-token-lgrs2
28Tokens:              example-svc-acct-token-lgrs2
29Events:              <none>
30NAME                      READY   STATUS    RESTARTS   AGE
31svc1-5d4b4d6485-m7t7g      1/2     Running   0          7s
32svc2-76cb5fd545-nqgx5      2/3     Running   0          7s
33svc2-76cb5fd545-vsbnj      2/3     Running   0          7s
34svc3-84f97bd64f-q9hjx      1/2     Running   0          7s
35kubectl exec -n example svc3-84f97bd64f-q9hjx -c envoy env | grep AWS
36AWS_REGION=us-east-2
37[2021-08-02 22:07:12.516][1][warning][config] [bazel-out/k8-opt/bin/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:101] StreamAggregatedResources gRPC config stream closed: 7, Unauthorized to perform appmesh:StreamAggregatedResources for arn:aws:appmesh:us-east-2:xxxxx:mesh/v-mesh/virtualNode/svc3-vn_example.
38[2021-08-02 22:07:16.268][1][warning][config] [bazel-out/k8-opt/bin/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:101] StreamAggregatedResources gRPC config stream closed: 7, Unauthorized to perform appmesh:StreamAggregatedResources for arn:aws:appmesh:us-east-2:xxxxx:mesh/v-mesh/virtualNode/svc3-vn_example
39[2021-08-02 22:07:21.402][1][warning][config] [bazel-out/k8-opt/bin/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:101] StreamAggregatedResources gRPC config stream closed: 7, Unauthorized to perform appmesh:StreamAggregatedResources for arn:aws:appmesh:us-east-2:xxxxx:mesh/v-mesh/virtualNode/svc3-vn_example.
40[2021-08-02 22:07:42.125][1][warning][config] [bazel-out/k8-opt/bin/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:101] StreamAggregatedResources gRPC config stream closed: 7, Unauthorized to perform appmesh:StreamAggregatedResources for arn:aws:appmesh:us-east-2:xxxxx:mesh/v-mesh/virtualNode/svc3-vn_example.
41

1NAMESPACE        NAME                                            READY   STATUS    RESTARTS   AGE
2appmesh-system   appmesh-controller-847f957bc8-s2k7l             1/1     Running   0          57m
3apiVersion: v1
4kind: Namespace
5metadata:
6  name: example
7  labels:
8    mesh: v-mesh
9    gateway: ingress-gw
10    appmesh.k8s.aws/sidecarInjectorWebhook: enabled
11---
12apiVersion: appmesh.k8s.aws/v1beta2
13kind: Mesh
14metadata:
15  name: v-mesh
16spec:
17  namespaceSelector:
18    matchLabels:
19      mesh: v-mesh
20  egressFilter:
21    type: ALLOW_ALL
22Name:                example-svc-acct
23Namespace:           example
24Labels:              <none>
25Annotations:         eks.amazonaws.com/role-arn: arn:aws:iam::xxxxxxxx:role/eksctl-eks-addon-iamserviceaccount-example-Role1
26Image pull secrets:  <none>
27Mountable secrets:   example-svc-acct-token-lgrs2
28Tokens:              example-svc-acct-token-lgrs2
29Events:              <none>
30NAME                      READY   STATUS    RESTARTS   AGE
31svc1-5d4b4d6485-m7t7g      1/2     Running   0          7s
32svc2-76cb5fd545-nqgx5      2/3     Running   0          7s
33svc2-76cb5fd545-vsbnj      2/3     Running   0          7s
34svc3-84f97bd64f-q9hjx      1/2     Running   0          7s
35kubectl exec -n example svc3-84f97bd64f-q9hjx -c envoy env | grep AWS
36AWS_REGION=us-east-2
37[2021-08-02 22:07:12.516][1][warning][config] [bazel-out/k8-opt/bin/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:101] StreamAggregatedResources gRPC config stream closed: 7, Unauthorized to perform appmesh:StreamAggregatedResources for arn:aws:appmesh:us-east-2:xxxxx:mesh/v-mesh/virtualNode/svc3-vn_example.
38[2021-08-02 22:07:16.268][1][warning][config] [bazel-out/k8-opt/bin/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:101] StreamAggregatedResources gRPC config stream closed: 7, Unauthorized to perform appmesh:StreamAggregatedResources for arn:aws:appmesh:us-east-2:xxxxx:mesh/v-mesh/virtualNode/svc3-vn_example
39[2021-08-02 22:07:21.402][1][warning][config] [bazel-out/k8-opt/bin/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:101] StreamAggregatedResources gRPC config stream closed: 7, Unauthorized to perform appmesh:StreamAggregatedResources for arn:aws:appmesh:us-east-2:xxxxx:mesh/v-mesh/virtualNode/svc3-vn_example.
40[2021-08-02 22:07:42.125][1][warning][config] [bazel-out/k8-opt/bin/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:101] StreamAggregatedResources gRPC config stream closed: 7, Unauthorized to perform appmesh:StreamAggregatedResources for arn:aws:appmesh:us-east-2:xxxxx:mesh/v-mesh/virtualNode/svc3-vn_example.
41$ eksctl version
420.42.0
43$ kubectl version
44Client Version: version.Info{Major:"1", Minor:"17+", GitVersion:"v1.17.11-eks-cfdc40", GitCommit:"cfdc40d4c1b7d14eb60152107963ae41aa2e4804", GitTreeState:"clean", BuildDate:"2020-09-17T17:10:39Z", GoVersion:"go1.13.15", Compiler:"gc", Platform:"linux/amd64"}
45Server Version: version.Info{Major:"1", Minor:"19+", GitVersion:"v1.19.8-eks-96780e", GitCommit:"96780e1b30acbf0a52c38b6030d7853e575bcdf3", GitTreeState:"clean", BuildDate:"2021-03-10T21:32:29Z", GoVersion:"go1.15.8", Compiler:"gc", Platform:"linux/amd64"}
46