googlecloudplatform/apigee-anthos-service-mesh-demo

This demo extends the existing GCP Boutique Shop Microservices demo to show how to use Apigee for exposing internal gRPC services (inside the mesh) as RESTful API to external consumers (outside the mesh).

API Management + Microservices Demo

This demo extends the existing GCP Boutique Shop Microservices demo to show how to use Apigee for exposing internal gRPC services (inside the mesh) as RESTful APIs to external consumers (outside the mesh).

When exposing APIs to external consumers, there are key challenges that arise due to the nature of external consumption. Here are a few of them from the point of view of both the API producer, and the API consumer.

API Producer challenges

• How do you expose a cohesive and consistent RESTful API surface (from disparate underlying services)?
  • Consistent & RESTful URL paths
  • Consistent & RESTful HTTP status codes
  • Consistent & RESTful error message formats
  • Consistent & RESTful request & response payloads
  • Consistent & RESTful authentication mechanisms
• How do you measure engagement and get key usage / business insights for the APIs being exposed?
• How do you monetize the APIs being exposed?

API Consumer challenges

• How do you discover APIs available?
• How do you learn to use the APIs available?
• How do you sign-up (get credentials) to use the APIs available?

While this demo does not address every single use-case listed above, it does show the core components and concepts needed to use Apigee in this context.

Demo Architecture

The demo assumes you are deploying all components in GCP, and that you are using Apigee X in combination with GKE + Anthos Service Mesh.

Prerequisites

1. Provision Apigee X
2. Configure external access for API traffic to your Apigee X instance
3. Make sure the following tools are available in your terminal's $PATH (Cloud Shell has these preconfigured)
   • gcloud SDK
   • kubectl
   • wget
   • unzip
   • curl
   • jq

(QuickStart) Demo CloudShell setup tutorial

Use the following GCP CloudShell tutorial, and follow the instructions.

Demo instructions

1. Clone this repo, and switch the main directory

git clone https://github.com/GoogleCloudPlatform/apigee-anthos-service-mesh-demo.git
cd apigee-anthos-service-mesh-demo

2. Edit the env.sh and configure the ENV vars

• PROJECT the project where you want to create the GKE cluster with ASM
• NETWORK the network you have peered with Apigee and where you want the GKE cluster to be created
• SUBNETWORK the subnetwork where the GKE cluster should be created
• LOCATION the location for the GKE cluster
• CLUSTER_NAME the name for the GKE demo cluster
• UI_GATEWAY_NAMESPACE the kubernetes namespace for the UI ingress gateway
• API_GATEWAY_NAMESPACE the kubernetes namespace for the API ingress gateway
• APIGEE_HOST the externally reachable hostname of the Apigee environment group that contains APIGEE_ENV
• APIGEE_ENV the Apigee environment where the demo resources should be created

Now source the env.sh file

source ./env.sh

3. Run script to create a GKE cluster

./create-gke-cluster.sh

4. Run script to deploy ASM and the Online Boutique Shop demo

./deploy-asm.sh

The script will provide the URL of the deployed application in the console. Open the URL in a new browser tab to access the application.

5. Run script to create a private API ingress (for Apigee to hit) & gRPC transcoding service

./deploy-gateway.sh

6. Deploy Apigee API proxies, target server, products, apps

./deploy-apigee.sh

7. (Optional) deploy monetization artifacts

Note: This step requires your organization to have the monetization addon enabled. See the Apigee docs for instructions on how to enable monetization on your paid or eval organization.

./deploy-mint.sh

Testing the Apigee RESTful API proxies

The script that deploys the Apigee API proxies prints a few sample cURL commands that you can use to test.

Those sample cURL commands already have the necessary API key for each of the API calls.

curl https://{APIGEE_HOST}/v1/productservices/products?apikey=API_KEY_FROM_APIGEE_DEVELOPER_APP
curl https://{APIGEE_HOST}/v1/currencyservices/currencies?apikey=API_KEY_FROM_APIGEE_DEVELOPER_APP

Troubleshooting

1. Apigee is not able to reach the API private ingress

   You can use a GCE VM within the same VPC Network and try using cURL to test for connectivity.

   First, get the IP address of the API ingress load balancer

   export ILB_IP=$(kubectl get services api-ingressgateway -n $API_GATEWAY_NAMESPACE -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
   echo "ILB_IP=${ILB_IP}"

   Then, from within the GCE VM, run the following curl command to get product catalog data

   curl http://$ILB_IP/products

   If this works, but Apigee is still not able to reach this endpoint, verify that the Apigee Target Server has the right IP address.

Cleanup

For each of the "deploy" scripts, there is an equivalent "cleanup" script you can run. If you want to clean the entire setup, first source your env.sh script, and then run the scripts in the following order

./cleanup-mint.sh # if applicable
./cleanup-apigee.sh
./cleanup-gateway.sh
./cleanup-asm.sh

Then, finally you can remove the GKE cluster with

./delete-gke-cluster.sh

Not Google Product Clause

This is not an officially supported Google product, nor is it part of an official Google product.

Support

If you need support or assistance using the tool, you can try inquiring on Google Cloud Community forum dedicated to Apigee. There is no service-level guarantee for responses to inquiries regarding this tool.

License

This material is Copyright 2022 Google LLC and is licensed under the Apache 2.0 License.

apigee-anthos-service-mesh-demo's Issues

deploy-wait is deprecated

apigee/apigeecli@afc64fd

deploy-wait is deprecated in version v1.111. The code in deploy-apigee.sh need a fix.

Security Policy violation Binary Artifacts

This issue was automatically created by Allstar.

Security Policy Violation
Project is out of compliance with Binary Artifacts policy: binaries present in source code

Rule Description
Binary Artifacts are an increased security risk in your repository. Binary artifacts cannot be reviewed, allowing the introduction of possibly obsolete or maliciously subverted executables. For more information see the Security Scorecards Documentation for Binary Artifacts.

Remediation Steps
To remediate, remove the generated executable artifacts from the repository.

Artifacts Found

• orderservice/dist/Linux/orderservice

Additional Information
This policy is drawn from Security Scorecards, which is a tool that scores a project's adherence to security best practices. You may wish to run a Scorecards scan directly on this repository for more details.

---

Allstar has been installed on all Google managed GitHub orgs. Policies are gradually being rolled out and enforced by the GOSST and OSPO teams. Learn more at http://go/allstar

This issue will auto resolve when the policy is in compliance.

Issue created by Allstar. See https://github.com/ossf/allstar/ for more information. For questions specific to the repository, please contact the owner or maintainer.

simplify apigeecli installation

there's a convenience function to install the latest version: https://github.com/apigee/apigeecli/blob/master/downloadLatest.sh

clean ASM script error

The clean-asm.sh still uses the asm install directories.

Portal

Steps/instructions for setting up integrated portal

Apigee assets are not deploying due to apigeecli changes