meshpaas

README

meshpaas

an opinionated graphQL/gRPC API for easily deploying applications & jobs on Istio service mesh

• API Documentation

Helpful Links

• Istio Docs

Command Line

meshpaas -h
Usage of meshpaas:
      --allow-jwt-issuer string   allowed jwt.claim.iss issuer (env: MESHPAAS_ALLOW_ISSUER)
      --debug                     enable debug logs (env: MESHPAAS_DEBUG)
      --jwks-uri string           remote json web key set uri for verifying authorization tokens (env: MESHPAAS_JWKS_URI)
      --listen-port int           serve gRPC & graphQL on this port (env: MESHPAAS_LISTEN_PORT) (default 8820)
      --namespace-claim string    the jwt attribute on the id token that returns the namespace the user is allowed access to (required) (env: MESHPAAS_NAMESPACE_CLAIM) (default "aud")
      --out-of-cluster            enable out of cluster k8s config discovery (env: MESHPAAS_OUT_OF_CLUSTER)

Notes

• the meshpaas API manages resources within the namespace matching the jwt.${namespace-claim} claim(see flags) of the identity token of the user making the request
  • this namespace is automatically created

Concepts

Gateway

A Gateway is a public Ingress or API-Gateway for traffic coming from the public internet.

Components:

• istio gateway

Application

An Application

Components:

• k8s namespace
• k8s deployment
• k8s service
• istio virtual service
• istio request authentication policy
• istio authorization policy

Task

Components:

• k8s namespace
• k8s cronjob

Secret

Components:

• k8s namespace
• k8s secret