Layer5 Image Hub

If you’re using the Image Hub or if you like other Layer5 projects, please ★ star this repository to show your support! 🤩

Image Hub

Image Hub is a sample application written to run on Consul for exploring WebAssembly modules used as Envoy filters. This demo application has been enabled by experimental works of Nic Jackson of HashiCorp, and Kanishkar J, Lee Calcote, and other contributors of Layer5.

Deployment Instructions

Image Hub supports Envoy-based data planes. Deployment instructions for each supported service mesh are below.

Using Istio (pending PR #196+release; clone and do make run for now):

1. Use Meshery to deploy istio and the Image Hub sample application (Management > Istio > Manage Sample Application Lifecycle > Image-Hub ) onto the Istio service mesh.

2. To map imagehub.meshery.io to the appropriate IP, run the following command to add the appropriate entry in the "\etc\hosts" file:

   echo $(kubectl get nodes --selector=kubernetes.io/role!=master -o jsonpath={.items[0].status.addresses[?\(@.type==\"InternalIP\"\)].address})'    'imagehub.meshery.io | sudo tee -a /etc/hosts
   

3. To get the environment port, run the following command:

   echo $(kubectl get svc istio-ingressgateway -n istio-system -o jsonpath='{.spec.ports[1].nodePort}')
   

4. Access the web UI using:

   http://imagehub.meshery.io:<environment port>
   

Using Consul:

1. Deploy the latest Consul:

   helm repo add hashicorp https://helm.releases.hashicorp.com # Adds helm hashicorp repo
   helm install consul hashicorp/consul -f config/consul-values.yaml # Setup custom Consul with support for WASM
   

2. Use Meshery to deploy the Image Hub sample application onto the Consul service mesh.

3. Find the port assigned to the ingess service:

   kubectl get svc ingess
   NAME     TYPE       CLUSTER-IP    EXTERNAL-IP   PORT(S)        AGE
   ingess   NodePort   10.97.34.25   <none>        80:31118/TCP   27m
   

4. Open http://localhost:31118 (where 31118 is your environment’s port number).

Use Image Hub

1. Upon visiting the image-hub homepage, we would need to signup for an account! Go ahead and click the “Sign Up” button in the top right.
2. Enter the login details, and select a plan; Personal gives you 10 pulls per minute, Team gives you 100 pulls per minute, and Enterprise will give you 1000 pulls per minute.
3. After signing up, you should be redirected to the login page, where you can log in and start using the sample app.
4. On the main page, open up the network tab, and reload the page. This will allow you to see the request-response of the app.
5. Go ahead and click the download button a couple of times. You’ll notice that there is nothing actually limiting you from crossing the number of pulls according to the plan you chose!
6. Alternatively, you could test the above by navigating to http://imagehub.meshery.io:/pull and then looking at the request-responses.

Deploying the Rate Limiter WASM Filter for Envoy

1. Go back to Management > Istio and under “Apply Service Mesh Configuration” make sure to apply “Automatic Sidecar Injection”
2. Open up a terminal, and run kubectl get pods to get a list of running pods. You should be able to see 2 pods, web and api. Now run
   the command kubectl delete pods <exact web pod name> <exact api pod name>. This will cause kubernetes to respawn them with the updated configuration.
3. Go back to Management > Istio and under “Apply Service Mesh Configuration”, select the Envoy Filter for Image Hub option, and wait for a few seconds.

Use Image hub with a WASM filter

1. Test your ability to “pull” an image (images are not in fact pulled, but an HTTP request is sent to the backend api). You would not be able to pull an image, and the response would say “unauthorized”.
2. Sign up a new user and select a subscription plan.
3. Log in as that user.
4. Test your ability to “pull” an image. You should be able to pull an image.
5. Open Meshery’s performance management page (http://localhost:9081/performance)
6. Configure a performance test against http://x.x.x.x:31118/api/pull (where x.x.x.x is your machine’s host IP address, not “localhost”)
7. Enter { "authorization" : "<your user's token>" }
8. Run the performance test. See that your subscription plan limit is enforced accordingly.
9. Change your subscription plan and retest.

Architecture

Consul Service Mesh Architecture w/WebAssembly

Image Hub deployed on Consul

Presentations

• DockerCon 2020 | deck | (video

Join the Community!

Our projects are community-built and welcome collaboration. 👍 Be sure to see the Layer5 Community Welcome Guide for a tour of resources available to you and jump into our Slack!

✔️ Join any or all of the weekly meetings on the community calendar.
✔️ Watch community meeting recordings.
✔️ Fill-in a community member form to gain access to community resources.
✔️ Discuss in the Community Forum.

Not sure where to start? Grab an open issue with the help-wanted label.

About Layer5

Layer5’s cloud native application and infrastructure management software enables organizations to expect more from their infrastructure. We embrace developer-defined infrastructure. We empower engineer to change how they write applications, support operators in rethinking how they run modern infrastructure and enable product owners to regain full control over their product portfolio.

License

This repository and site are available as open source under the terms of the Apache 2.0 License.