docs/en-jupyter_notebook/azure_aks/01_start_pods.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# 1 start business logic pods on Azure AKS"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "change ${CORE_ROOT} to your path of `core`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "export CORE_ROOT=\"${HOME}/core\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "change ${PJ_ROOT} to your path of `example-turtlebot3`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "export PJ_ROOT=\"${HOME}/example-turtlebot3\"\n",
    "cd ${PJ_ROOT};pwd"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "example)\n",
    "```\n",
    "/Users/user/example-turtlebot3\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## load environment variables"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "load from `core`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "source ${CORE_ROOT}/docs/environments/azure_aks/env"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "load from `example-turtlebot3`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "source ${PJ_ROOT}/docs/environments/azure_aks/env"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## setup alias"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "if [ \"$(uname)\" == 'Darwin' ]; then\n",
    "  alias randomstr8='cat /dev/urandom | LC_CTYPE=C tr -dc 'a-zA-Z0-9' | head -c 8'\n",
    "  alias randomstr16='cat /dev/urandom | LC_CTYPE=C tr -dc 'a-zA-Z0-9' | head -c 16'\n",
    "  alias randomstr32='cat /dev/urandom | LC_CTYPE=C tr -dc 'a-zA-Z0-9' | head -c 32'\n",
    "elif [ \"$(expr substr $(uname -s) 1 5)\" == 'Linux' ]; then\n",
    "  alias randomstr8='cat /dev/urandom 2>/dev/null | head -n 40 | tr -cd 'a-zA-Z0-9' | head -c 8'\n",
    "  alias randomstr16='cat /dev/urandom 2>/dev/null | head -n 40 | tr -cd 'a-zA-Z0-9' | head -c 16'\n",
    "  alias randomstr32='cat /dev/urandom 2>/dev/null | head -n 40 | tr -cd 'a-zA-Z0-9' | head -c 32'\n",
    "else\n",
    "  echo \"Your platform ($(uname -a)) is not supported.\"\n",
    "  exit 1\n",
    "fi"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## add auth tokens for the web app of example-turtlebot3"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### create new `secrets/auth-tokens.json`"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "example)\n",
    "```json\n",
    "[\n",
    "  {\n",
    "    \"host\": \"api\\\\..+$\",\n",
    "    \"settings\": {\n",
    "      \"bearer_tokens\": [\n",
    "        {\n",
    "          \"token\": \"nrWtb8sS0MmwlkhHXv0DC6orPMpFFbni\",\n",
    "          \"allowed_paths\": [\"^/orion/.*$\", \"^/idas/.*$\", \"^/comet/.*$\"]\n",
    "        }\n",
    "      ],\n",
    "      \"basic_auths\": [],\n",
    "      \"no_auths\": {}\n",
    "    }\n",
    "  },\n",
    "  {\n",
    "    \"host\": \"kibana\\\\..+$\",\n",
    "    \"settings\": {\n",
    "      \"bearer_tokens\": [],\n",
    "      \"basic_auths\": [\n",
    "        {\n",
    "          \"username\": \"yW7FvSGD\",\n",
    "          \"password\": \"6BoTFE5xfUlX3ssV\",\n",
    "          \"allowed_paths\": [\"^.*$\"]\n",
    "        }\n",
    "      ],\n",
    "      \"no_auths\": {\n",
    "        \"allowed_paths\": []\n",
    "      }\n",
    "    }\n",
    "  },\n",
    "  {\n",
    "    \"host\": \"grafana\\\\..+$\",\n",
    "    \"settings\": {\n",
    "      \"bearer_tokens\": [],\n",
    "      \"basic_auths\": [],\n",
    "      \"no_auths\": {\n",
    "        \"allowed_paths\": [\"^.*$\"]\n",
    "      }\n",
    "    }\n",
    "  },\n",
    "  {\n",
    "    \"host\": \"web\\\\..+$\",\n",
    "    \"settings\": {\n",
    "      \"bearer_tokens\": [\n",
    "        {\n",
    "          \"token\": \"Udgzdg6xMD5ymtQlInFHsM5UVD9OA2Wi\",\n",
    "          \"allowed_paths\": [\n",
    "            \"^/visualizer/positions/$\"\n",
    "          ]\n",
    "        }\n",
    "      ],\n",
    "      \"basic_auths\": [\n",
    "        {\n",
    "          \"username\": \"1JMF6D46\",\n",
    "          \"password\": \"6u5M0bUhfjj7wMdM\",\n",
    "          \"allowed_paths\": [\n",
    "            \"/controller/web/\",\n",
    "            \"/visualizer/locus/\"\n",
    "          ]\n",
    "        }\n",
    "      ],\n",
    "      \"no_auths\": {\n",
    "        \"allowed_paths\": [\n",
    "          \"^.*/static/.*$\"\n",
    "        ]\n",
    "      }\n",
    "    }\n",
    "  }\n",
    "]\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "cat ${CORE_ROOT}/secrets/auth-tokens.json | jq '.|=.+[{\n",
    "  \"host\": \"web\\\\..+$\",\n",
    "  \"settings\": {\n",
    "    \"bearer_tokens\": [\n",
    "      {\n",
    "        \"token\": \"'$(randomstr32)'\",\n",
    "        \"allowed_paths\": [\"^/visualizer/positions/$\"]\n",
    "      }\n",
    "    ],\n",
    "    \"basic_auths\": [\n",
    "      {\n",
    "        \"username\": \"'$(randomstr8)'\",\n",
    "        \"password\": \"'$(randomstr16)'\",\n",
    "        \"allowed_paths\": [\"/controller/web/\", \"/visualizer/locus/\"]\n",
    "      }\n",
    "    ],\n",
    "    \"no_auths\": {\n",
    "      \"allowed_paths\": [\"^.*/static/.*$\"]\n",
    "    }\n",
    "  }\n",
    "}]' | tee /tmp/auth-tokens.json\n",
    "mv ${CORE_ROOT}/secrets/auth-tokens.json ${CORE_ROOT}/secrets/auth-tokens.json.back\n",
    "mv /tmp/auth-tokens.json ${CORE_ROOT}/secrets/auth-tokens.json"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## change the auth-tokens to kubernetes secrets"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### watch `auth` log"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "_Outside of this notebook_\n",
    "1. open a ternminal.\n",
    "1. run a command displayed below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "echo \"kubectl logs -f -lapp=auth --all-containers=true\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### delete and re-register auth-tokens to kubernetes secrets"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl delete secret auth-tokens"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl create secret generic auth-tokens --from-file=${CORE_ROOT}/secrets/auth-tokens.json"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### confirm the token will be reloaded"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**wait a few minutes until the change of secret is detected by Kubernetes.**  \n",
    "When the new secret is detected, the tokens of auth will be reloaded automatically."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "log messages like below will be shown after tokens is reloaded.\n",
    "\n",
    "```\n",
    "...\n",
    "--------\n",
    "2019/05/21 01:51:07 hosts: [api\\..+$ kibana\\..+$ grafana\\..+$ web\\..+$]\n",
    "--------\n",
    "2019/05/21 01:51:07 bearerTokenAllowedPaths: map[api\\..+$:map[XbZX1LpVv7DG9fu1X3WUq5kiqZyF34zI:[^/orion/.*$ ^/idas/.*$ ^/comet/.*$]] web\\..+$:map[Udgzdg6xMD5ymtQlInFHsM5UVD9OA2Wi:[^/visualizer/positions/$]]]\n",
    "--------\n",
    "2019/05/21 01:51:07 basicAuthPaths, map[kibana\\..+$:map[^.*$:map[1IGQBVF5:zRa2mxZVdBOyO6Zd]] web\\..+$:map[/controller/web/:map[1JMF6D46:6u5M0bUhfjj7wMdM] /visualizer/locus/:map[1JMF6D46:6u5M0bUhfjj7wMdM]]]\n",
    "--------\n",
    "2019/05/21 01:51:07 noAuthPaths, map[grafana\\..+$:[^.*$] web\\..+$:[^.*/static/.*$] api\\..+$:[] kibana\\..+$:[]]\n",
    "--------\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## start command proxy service on Azure AKS"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl apply -f controller/cmd-proxy-service.yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "envsubst < controller/cmd-proxy-deployment.yaml | kubectl apply -f -"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl get pods -l app=cmd-proxy"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "example)\n",
    "```\n",
    "NAME                        READY     STATUS    RESTARTS   AGE\n",
    "cmd-proxy-d7cbc6dfb-6hnsp   1/1       Running   0          46s\n",
    "cmd-proxy-d7cbc6dfb-v6rrx   1/1       Running   0          46s\n",
    "cmd-proxy-d7cbc6dfb-zf2fd   1/1       Running   0          46s\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl get services -l app=cmd-proxy"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "example)\n",
    "```\n",
    "NAME        TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)    AGE\n",
    "cmd-proxy   ClusterIP   10.0.172.56   <none>        8888/TCP   1m\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## start robot visualization service on Azure AKS"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl apply -f controller/robot-visualization-service.yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "env BEARER_AUTH=$(cat ${CORE_ROOT}/secrets/auth-tokens.json | jq '.[]|select(.host == \"web\\\\..+$\")|.settings.bearer_tokens | map(select(.allowed_paths[] | contains(\"^/visualizer/positions/$\"))) | .[0].token' -r) envsubst < controller/robot-visualization-deployment.yaml | kubectl apply -f -"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl get pods -l app=robot-visualization"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "example)\n",
    "```\n",
    "NAME                                   READY     STATUS    RESTARTS   AGE\n",
    "robot-visualization-7d69bcdff7-g7p98   1/1       Running   0          13m\n",
    "robot-visualization-7d69bcdff7-k6mb9   1/1       Running   0          13m\n",
    "robot-visualization-7d69bcdff7-txsqn   1/1       Running   0          13m\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl get services -l app=robot-visualization"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "example)\n",
    "```\n",
    "NAME                  TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)    AGE\n",
    "robot-visualization   ClusterIP   10.0.112.72   <none>        8888/TCP   13m\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### register DNS A Record for business logic"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "HTTPS_IPADDR=$(kubectl get services -l app=ambassador -o json | jq '.items[0].status.loadBalancer.ingress[0].ip' -r)\n",
    "az network dns record-set a add-record --resource-group ${DNS_ZONE_RG} --zone-name \"${DOMAIN}\" --record-set-name \"web\" --ipv4-address \"${HTTPS_IPADDR}\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "curl -i https://web.${DOMAIN}/controller/web/"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "example)\n",
    "```\n",
    "HTTP/1.1 401 Unauthorized\n",
    "www-authenticate: Basic realm=\"basic authentication required\"\n",
    "content-length: 0\n",
    "date: Tue, 18 Jun 2019 05:01:31 GMT\n",
    "server: envoy\n",
    "```"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Bash",
   "language": "bash",
   "name": "bash"
  },
  "language_info": {
   "codemirror_mode": "shell",
   "file_extension": ".sh",
   "mimetype": "text/x-sh",
   "name": "bash"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}