Add Test to Gateway Setup

content/en/docs/setup/additional-setup/gateway/index.md

@@ -4,7 +4,7 @@ description: Install and customize Istio Gateways.
 weight: 40
 keywords: [install,gateway,kubernetes]
 owner: istio/wg-environments-maintainers
-test: no
+test: yes
 ---
 
 Along with creating a service mesh, Istio allows you to manage [gateways](/docs/concepts/traffic-management/#gateways),

content/en/docs/setup/additional-setup/gateway/snips.sh

@@ -0,0 +1,167 @@
+#!/bin/bash
+# shellcheck disable=SC2034,SC2153,SC2155,SC2164
+
+# Copyright Istio Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+####################################################################################################
+# WARNING: THIS IS AN AUTO-GENERATED FILE, DO NOT EDIT. PLEASE MODIFY THE ORIGINAL MARKDOWN FILE:
+#          docs/setup/additional-setup/gateway/index.md
+####################################################################################################
+
+! read -r -d '' snip_deploying_a_gateway_1 <<\ENDSNIP
+apiVersion: install.istio.io/v1alpha1
+kind: IstioOperator
+metadata:
+  name: ingress
+spec:
+  profile: empty # Do not install CRDs or the control plane
+  components:
+    ingressGateways:
+    - name: ingressgateway
+      namespace: istio-ingress
+      enabled: true
+      label:
+        # Set a unique label for the gateway. This is required to ensure Gateways
+        # can select this workload
+        istio: ingressgateway
+  values:
+    gateways:
+      istio-ingressgateway:
+        # Enable gateway injection
+        injectionTemplate: gateway
+ENDSNIP
+
+snip_deploying_a_gateway_2() {
+kubectl create namespace istio-ingress
+istioctl install -f ingress.yaml
+}
+
+snip_deploying_a_gateway_3() {
+kubectl create namespace istio-ingress
+helm install istio-ingress istio/gateway -n istio-ingress
+}
+
+! read -r -d '' snip_deploying_a_gateway_4 <<\ENDSNIP
+apiVersion: v1
+kind: Service
+metadata:
+  name: istio-ingressgateway
+  namespace: istio-ingress
+spec:
+  type: LoadBalancer
+  selector:
+    istio: ingressgateway
+  ports:
+  - port: 80
+    name: http
+  - port: 443
+    name: https
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: istio-ingressgateway
+  namespace: istio-ingress
+spec:
+  selector:
+    matchLabels:
+      istio: ingressgateway
+  template:
+    metadata:
+      annotations:
+        # Select the gateway injection template (rather than the default sidecar template)
+        inject.istio.io/templates: gateway
+      labels:
+        # Set a unique label for the gateway. This is required to ensure Gateways can select this workload
+        istio: ingressgateway
+        # Enable gateway injection. If connecting to a revisioned control plane, replace with "istio.io/rev: revision-name"
+        sidecar.istio.io/inject: "true"
+    spec:
+      containers:
+      - name: istio-proxy
+        image: auto # The image will automatically update each time the pod starts.
+---
+# Set up roles to allow reading credentials for TLS
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: istio-ingressgateway-sds
+  namespace: istio-ingress
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "watch", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: istio-ingressgateway-sds
+  namespace: istio-ingress
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: istio-ingressgateway-sds
+subjects:
+- kind: ServiceAccount
+  name: default
+ENDSNIP
+
+snip_deploying_a_gateway_5() {
+kubectl create namespace istio-ingress
+kubectl apply -f ingress.yaml
+}
+
+! read -r -d '' snip_gateway_selectors_1 <<\ENDSNIP
+apiVersion: networking.istio.io/v1beta1
+kind: Gateway
+metadata:
+  name: gateway
+spec:
+  selector:
+    istio: ingressgateway
+...
+ENDSNIP
+
+! read -r -d '' snip_canary_upgrade_advanced_1 <<\ENDSNIP
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: istio-ingressgateway-canary
+  namespace: istio-ingress
+spec:
+  selector:
+    matchLabels:
+      istio: ingressgateway
+  template:
+    metadata:
+      annotations:
+        inject.istio.io/templates: gateway
+      labels:
+        istio: ingressgateway
+        istio.io/rev: canary # Set to the control plane revision you want to deploy
+    spec:
+      containers:
+      - name: istio-proxy
+        image: auto
+ENDSNIP
+
+snip_canary_upgrade_advanced_2() {
+kubectl get endpoints -o "custom-columns=NAME:.metadata.name,PODS:.subsets[*].addresses[*].targetRef.name"
+}
+
+! read -r -d '' snip_canary_upgrade_advanced_2_out <<\ENDSNIP
+NAME                   PODS
+istio-ingressgateway   istio-ingressgateway-788854c955-8gv96,istio-ingressgateway-canary-b78944cbd-mq2qf
+ENDSNIP

content/en/docs/setup/additional-setup/gateway/test.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# Copyright Istio Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -e
+set -u
+
+set -o pipefail
+
+# @setup profile=none
+function rebuild() {
+    istioctl x uninstall --purge --skip-confirmation
+    kubectl delete namespace istio-ingress
+    istioctl install --skip-confirmation --set profile=minimal
+}
+
+# rewrite-repo invokes bash make to rewrite a snippet to avoid installing from a real helm repository, and instead uses
+# local files
+# shellcheck disable=SC2001
+function rewrite-repo() {
+  # get function definition: https://stackoverflow.com/a/6916952/374797
+  cmd="$(type "${1:?snip}" | sed '1,3d;$d')"
+  cmd="$(echo "${cmd}" | sed 's|istio/base|manifests/charts/base|')"
+  cmd="$(echo "${cmd}" | sed 's|istio/istiod|manifests/charts/istio-control/istio-discovery|')"
+  cmd="$(echo "${cmd}" | sed 's|istio/gateway|manifests/charts/gateway|')"
+  eval "${cmd} --set global.tag=${ISTIO_IMAGE_VERSION=SHOULD_BE_SET}.${ISTIO_LONG_SHA=latest} --wait"
+}
+
+istioctl install --skip-confirmation --set profile=minimal
+_wait_for_deployment istio-system istiod
+
+# shellcheck disable=SC2154
+cat <<EOF >ingress.yaml
+$snip_deploying_a_gateway_1
+EOF
+
+echo y | snip_deploying_a_gateway_2
+_wait_for_deployment istio-ingress ingressgateway
+
+rebuild
+rewrite-repo snip_deploying_a_gateway_3
+_wait_for_deployment istio-ingress istio-ingress
+
+rebuild
+# shellcheck disable=SC2154
+cat <<EOF >ingress.yaml
+$snip_deploying_a_gateway_4
+EOF
+snip_deploying_a_gateway_5
+_wait_for_deployment istio-ingress istio-ingressgateway
+
+# @cleanup
+
+istioctl x uninstall --purge --skip-confirmation
+kubectl delete namespace istio-system
+kubectl delete namespace istio-ingress