Challenge - Expert project

Set up a project combining CRD, Operator and Istio.

Challenge: the expert project

In the final challenge you'll combine the pieces of the expert section. For the magaza application:

a nightly database backup with the Yedek CRD and its operator,
mandatory mTLS and canary routing with Istio,
mandatory labels and the latest ban with Gatekeeper,
a namespace backup and a restore drill with Velero.

magaza namespace
 ├─ istio-injection=enabled   + PeerAuthentication STRICT
 ├─ Yedek magaza-db           (operator -> CronJob)
 ├─ Constraints               (takim/ortam labels, latest ban)
 └─ Velero schedule gece      (720h)

Exercise Mesh and mTLS

First write two commands that add the istio-injection=enabled label to the magaza namespace and restart the deployments (kubectl rollout restart deploy -n magaza). Then write a PeerAuthentication YAML: security.istio.io/v1; name default, namespace magaza; spec.mtls.mode: STRICT.

Show example solution

kubectl label namespace magaza istio-injection=enabled
kubectl rollout restart deploy -n magaza

apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  namespace: magaza
spec:
  mtls:
    mode: STRICT

Exercise Checklist

Write four commands verifying the setup: list the Yedek objects in magaza (kubectl get yd -n magaza); list all Constraints; list the Velero schedules; analyse the Istio configuration of the magaza namespace (istioctl analyze -n magaza).

Show example solution

kubectl get yd -n magaza
kubectl get constraints
velero schedule get
istioctl analyze -n magaza

Test yourself

After adding the istio-injection label, how is the sidecar added to existing pods?
- By restarting the deployments (rollout restart)
- It's added immediately on its own
- With istioctl delete
- It can't be added
Show answer

By restarting the deployments (rollout restart) — Injection happens when the pod is created.

Enable sidecar injection in the namespace.

kubectl label namespace magaza ____=enabled

Show answer

kubectl label namespace magaza istio-injection=enabled

Match.

PeerAuthentication

mTLS requirement
Yedek

Database backup request
Constraint

Policy enforcement
velero schedule

Namespace backup

Next lesson: Expert section exam

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies