Labels and annotations for Airlock Microgateway

Label to inject Microgateway Engine in application Pods

The Microgateway Operator injects the Microgateway Engine containers to the upstream application Pods triggered by the label following label:

 
Example
sidecar.microgateway.airlock.com/inject: "true"

See also example manifests w/o Istio mesh configuration at the end of this article.

 
Notice

Adding the label to an existing, running Pod has no effect. Use kubectl apply -f <deployment.yaml> to apply the configuration changes and to have the Microgateway Engine injected with a Deployment.

Annotations for the Microgateway Operator

Annotations can be added to configure some general behavior of the container. The table below lists and explains the annotations the Microgateway Operator is aware of.

Annotation

Default

Possible values

Description

sidecar.microgateway.airlock.com/excludeInboundPorts

“”

“<int>, ...”

Comma-separated list of inbound ports to be excluded from redirection to the Microgateway Engine by the Microgateway CNI plugin.

 
Notice

The Istio default ports for the Istio sidecar proxy are automatically excluded when setting the annotation sidecar.microgateway.airlock.com/serviceMesh: istio.

This means ports:

  • 15000, 15001
  • 15004
  • 15006
  • 15008, 15009
  • 15020, 15021
  • 15053
  • 15090

sidecar.microgateway.airlock.com/serviceMesh

none

none, istio

Annotation to set which service mesh should be used. This annotation is relevant info for the Microgateway CNI plugin to configure the redirection of the traffic to the Microgateway Engine correctly.

sidecar.microgateway.airlock.com/engineLogLevel

info

trace, debug, info, warn, error, critical, off

Annotation to set the Microgateway Engine log level.

sidecar.microgateway.airlock.com/engineCpuRequests

By default, no engine resource requirements are set.

Engine resources can be set via annotation or Helm values. If both are set, annotations take precedence.

1, 100m, 0.5, ...

Overrides resources.requests.cpu for the Microgateway engine sidecar container.

sidecar.microgateway.airlock.com/engineCpuLimits

By default, no engine resource requirements are set.

Engine resources can be set via annotation or Helm values. If both are set, annotations take precedence.

1, 100m, 0.5, ...

Any CPU resource unit can be used.

Overrides resources.limits.cpu for the Microgateway engine sidecar container.

sidecar.microgateway.airlock.com/engineMemoryRequests

By default, no engine resource requirements are set.

Engine resources can be set via annotation or Helm values. If both are set, annotations take precedence.

64Mi, 1G, ...

Any Kubernetes memory resource unit can be used.

Overrides resources.requests.memory for the Microgateway engine sidecar container.

sidecar.microgateway.airlock.com/engineMemoryLimits

By default, no engine resource requirements are set.

Engine resources can be set via annotation or Helm values. If both are set, annotations take precedence.

128Mi, 1G, ...

Any Kubernetes memory resource unit can be used.

Overrides resources.limits.memory for the Microgateway engine sidecar container.

Example configuration for a web application without Istio

The following example Kubernetes manifest file contains annotations to protect the web application with Airlock Microgateway.

 
Example
apiVersion: apps/v1  
kind: Deployment  
metadata:  
  labels:  
    app: echo-server  
  name: echo-server  
spec:  
  selector:  
    matchLabels:  
      app: echo-server  
  template:  
    metadata:  
      annotations:  
        sidecar.microgateway.airlock.com/excludeInboundPorts: "9998,9999" 
        sidecar.microgateway.airlock.com/serviceMesh: "none" 
       labels:  
        sidecar.microgateway.airlock.com/inject: "true"  
        app: echo-server  
        version: 1.0.0
    spec: 
      containers: 
        - image: ealen/echo-server:latest 
          name: echo-server 
          ports: 
            - containerPort: 5051

Ensure that in such a setup the annotation sidecar.microgateway.airlock.com/serviceMesh is set to none or not set at all.

SidecarGateway configuration to protect a web application:

  • Our example uses a simple web application Pod with the label app: example-app.
  • The spec.applications.containerPort is the container port of the web application that has to be secured by Airlock Microgateway. The default 8080 can be overridden to connect to the application's HTTP port. In our example, the example-app Pod listens for requests on port 5051.
  • The security settings to be applied are referenced in the CR ContentSecurity named content-security-example.
 
Notice

This setup is still possible if Istio is deployed in your Kubernetes cluster. The important thing is, that the web application Pod does not have Istio injected. Neither through labeling the namespace nor with the corresponding annotation. For more information consult (Istio) Sidecar injection.

Example for a web application with Istio

The following example Kubernetes manifest file contains annotations to protect the web application with Airlock Microgateway alongside Istio service mesh:

 
Example
apiVersion: apps/v1  
kind: Deployment  
metadata:  
  labels:  
    app: echo-server  
  name: echo-server  
spec:  
  selector:  
    matchLabels:  
      app: echo-server  
  template:  
    metadata:  
      annotations:  
        sidecar.microgateway.airlock.com/excludeInboundPorts: "9998,9999" 
        sidecar.microgateway.airlock.com/serviceMesh: "istio" 
        sidecar.istio.io/inject: "true"  
      labels:  
        sidecar.microgateway.airlock.com/inject: "true"  
        app: echo-server  
        version: 1.0.0
    spec: 
      containers: 
        - image: ealen/echo-server:latest 
          name: echo-server 
          ports: 
            - containerPort: 5051

Ensure that in such a setup the annotation sidecar.microgateway.airlock.com/serviceMesh is set to istio.

SidecarGateway configuration to protect a web application:

  • Our example uses a simple web application Pod with the label app: example-app.
  • The spec.applications.containerPort is the container port of the web application that has to be secured by Airlock Microgateway. The default 8080 can be overridden to connect to the application's HTTP port. In our example, the example-app Pod listens for requests on port 5051.
  • The security settings to be applied are referenced in the CR ContentSecurity named content-security-example.
 
Notice

The web application Pod has Istio injected. The example illustrates the way by annotating the Pod. For more information consult (Istio) Sidecar injection.

Further information and links

Internal links: