Scripts and manifests reference¶
All scripts live in scripts/ and read their settings from config/lab.env
(copy config/lab.env.example). Exercise scripts are step-based:
scripts/<script> help lists the steps in order.
Setup scripts¶
| Script | What it does | Gate | Changes Azure? |
|---|---|---|---|
| 00-check-local-tools.sh | Local tools and versions, with macOS/Linux install hints | none | No |
| 01-preflight-azure.sh | Region lists, CIDR plan, preview state, AKS/AppNet versions, SKU, quota, roles, policies | none | No (read-only) |
| 02-register-preview.sh | Registers Microsoft.AppLink/PublicPreview and the provider |
G1_PREVIEW | Subscription-wide registration |
| 03-create-network.sh | Resource groups, VNets, subnets, bidirectional peering | G2_FOUNDATION | Yes |
| 04-create-identities.sh | User-assigned identities + subnet-scoped Network Contributor | G2_FOUNDATION | Yes |
| 05-create-clusters.sh | Two AKS clusters (Overlay + Cilium, Entra ID, OIDC, Gateway API) + your AKS RBAC roles | G3_CLUSTERS | Yes (billable) |
| 06-get-credentials.sh | Dedicated kubeconfig, kubelogin conversion, context checks | none | No |
| 07-verify-clusters.sh | Proves cluster configuration; records Cilium ambient-relevant settings | none | No |
| 08-install-istioctl.sh | istioctl ISTIO_VERSION into .tools/ |
none | No |
Exercise scripts¶
| Script | Steps (in order) | Gates |
|---|---|---|
| ex03-netpol-baseline.sh | deploy, baseline, deny, allow, egress-deny, egress-allow, evidence, reset, teardown | none |
| ex04-appnet-onboard.sh | acknowledge, create, join, verify, underlay, enroll, no-sidecars | G4_EXPERIMENTAL, G5_APPNET |
| ex05-cross-cluster-discovery.sh | deploy, waypoint, global, discovery, remote-only, global-mix, productpage, not-global, evidence | none |
| ex06-mtls-identity.sh | deploy-outside, identity, permissive, strict, test-strict, reset | none |
| ex07-ingress.sh | deploy, nsg-evidence, test-http, https, test-https, teardown | G6_INGRESS |
| ex08-l4-authz.sh | precheck, doc-policy, l4lab-deploy, l4lab-baseline, l4lab-policy, cross-cluster, reset | none |
| ex09-l7-authz.sh | attach, apply, test-direct, ingress-gap, close-gap, reset | none |
| ex10-layered-netpol.sh | precheck, discover, deny, probes, allow, impostor, remote, cluster2, reset | none |
| ex11-traffic-management.sh | jwt-deploy, jwt-test, jwt-require, jwt-reset, shift, shift-reset, fault-setup, fault-delay-7s, fault-delay-1s, fault-abort, fault-reset | none |
| ex12-observability.sh | traffic, waypoint-stats, access-logs, enable-metrics, enable-logs, queries, lifecycle, maintenance-window, upgrade-member, monitoring-disable, reset | G7_MONITORING, G8_LIFECYCLE |
| ex13-safe-failure.sh | precheck, remove-remote, restore-remote, remove-local, restore-local, restore | none |
Verification and cleanup¶
| Script | What it does | Gate |
|---|---|---|
| verify-lab-state.sh | Read-only snapshot: Azure resources, members, enrolled namespaces, policies, LBs, unhealthy pods | none |
| validate-lab-files.sh | Offline: bash -n, shellcheck, render templates, yamllint, kubeconform | none |
| cleanup-1-kubernetes.sh | Un-enroll from ambient, delete lab objects and namespaces, restore the monitoring ConfigMap | G9_CLEANUP_K8S |
| cleanup-2-azure.sh | Preview IDs → remove members → delete Application Network → delete lab RGs | G9_DELETE_AZURE |
| cleanup-3-leftovers.sh | Read-only leftover scan; --local removes local artifacts |
G9_DELETE_LOCAL (local only) |
Shared library¶
scripts/lib/common.sh provides:
- configuration loading and Azure context checks
- approval gates (
LAB_APPROVE_<GATE>=yesfor unattended runs) - bounded waits
- explicit-context
kubectl/istioctlwrappers - template rendering (
${VAR}→ value, failing on anything unresolved) - evidence capture into
out/evidence/ - the request classifier used by every exercise
Manifests¶
| Folder | Contents |
|---|---|
| manifests/ex03/ | NetworkPolicy baseline: backend, clients, deny/allow/egress policies (cluster 1, not in mesh) |
| manifests/ex05/ | App namespace, test clients, reviews-local / reviews-remote global services |
| manifests/ex06/ | Namespace-scoped STRICT PeerAuthentication; non-mesh client and echo |
| manifests/ex07/ | Bookinfo Gateway (IP-restricted), local/remote HTTPRoutes, HTTPS listener |
| manifests/ex08/ | Doc L4 policy; l4-lab namespace, echo, identity policy |
| manifests/ex09/ | Waypoint L7 policy, updated L4 policy, ingress-gateway deny-writes policy |
| manifests/ex10/ | Templates rendered from live selectors: scoped deny, probe SNAT allow, mesh sources, east-west source; impostor |
| manifests/ex11/ | JWT gateway (internal LB), RequestAuthentication + claim routing, require-token, traffic shift, fault injection |
| manifests/ex12/ | Managed Prometheus scrape ConfigMap, Telemetry access logs |
Configuration¶
Every setting is documented inline in config/lab.env.example:
- subscription and tenant
- region
- naming prefix and tags
- VNet, subnet, pod and Service CIDRs
- Kubernetes version, VM size and node count
- Application Network upgrade mode and version
- Istio tooling version
- kubeconfig contexts and app namespace
- ingress allowed CIDR and TLS host
- monitoring names
- wait timeouts