Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds new manifest link #1384

Merged
merged 2 commits into from
May 7, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
156 changes: 81 additions & 75 deletions content/docs/deploy/k8s/quickstart.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -112,87 +112,93 @@ You should now be able to access `https://authenticate.pomerium.app` which, afte

## Test Service

1. Define a test service. We'll use the Pomerium Verify app:

```yaml title=verify-service.yaml
apiVersion: v1
kind: Service
metadata:
name: verify
labels:
app: verify
service: verify
spec:
ports:
- port: 8000
targetPort: 8000
name: http
selector:
app: pomerium-verify
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: verify
spec:
replicas: 1
selector:
matchLabels:
app: pomerium-verify
template:
metadata:
labels:
app: pomerium-verify
spec:
containers:
- image: docker.io/pomerium/verify
imagePullPolicy: IfNotPresent
name: httpbin
ports:
- containerPort: 8000
protocol: TCP
name: http
```
:::info

Deploy it with `kubectl apply -f verify-service.yaml`
See the [**Verify examples**](https://github.com/pomerium/verify/blob/main/examples/ingress.yaml) repository to review additional example manifests.

2. Define an Ingress for the new service:

```yaml title=verify-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: verify
annotations:
ingress.pomerium.io/allowed_domains: |
- example.com
ingress.pomerium.io/pass_identity_headers: 'true'
spec:
ingressClassName: pomerium
rules:
- host: 'verify.localhost.pomerium.io'
http:
paths:
- pathType: Prefix
path: /
backend:
service:
name: verify
port:
number: 8000
```

Note that we include the [annotation](/docs/deploy/k8s/ingress#supported-annotations) `ingress.pomerium.io/pass_identity_headers`, which provides a [JWT](/docs/internals/glossary#json-web-token) to the Verify service.

Deploy the service with `kubectl apply -f verify-ingress.yaml`, and visit the path in your browser:
:::

![The top of the Pomerium Verify page](./img/verify-app.png)
1. Define a test service. We'll use the Pomerium Verify app:

:::tip
```yaml title=verify-service.yaml
apiVersion: v1
kind: Service
metadata:
name: verify
labels:
app: verify
service: verify
spec:
ports:
- port: 8000
targetPort: 8000
name: http
selector:
app: pomerium-verify
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: verify
spec:
replicas: 1
selector:
matchLabels:
app: pomerium-verify
template:
metadata:
labels:
app: pomerium-verify
spec:
containers:
- image: docker.io/pomerium/verify
imagePullPolicy: IfNotPresent
name: httpbin
ports:
- containerPort: 8000
protocol: TCP
name: http
```

Deploy it with `kubectl apply -f verify-service.yaml`

Identity verification fails because we're using an untrusted test certificate. Updating your deployment with a trusted certificate solution like Let's Encrypt through [cert-manager] will resolve this error.
2. Define an Ingress for the new service:

:::
```yaml title=verify-ingress.yaml {8} showLineNumbers
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: verify
annotations:
ingress.pomerium.io/allowed_domains: |
- example.com
ingress.pomerium.io/pass_identity_headers: 'true'
spec:
ingressClassName: pomerium
rules:
- host: 'verify.localhost.pomerium.io'
http:
paths:
- pathType: Prefix
path: /
backend:
service:
name: verify
port:
number: 8000
```

Note that in **Line 8**, we include the [annotation](/docs/deploy/k8s/ingress#supported-annotations) `ingress.pomerium.io/pass_identity_headers`, which provides a [JWT](/docs/internals/glossary#json-web-token) to the Verify service.

Deploy the service with `kubectl apply -f verify-ingress.yaml`, and visit the path in your browser:

![The top of the Pomerium Verify page](./img/verify-app.png)

:::tip

Identity verification fails because we're using an untrusted test certificate. Updating your deployment with a trusted certificate solution like Let's Encrypt through [cert-manager] will resolve this error.

:::

## Next steps

Expand Down
Loading