EdgeMesh

https://edgemesh.netlify.app
Admin
EdgeMesh is a lightweight service mesh solution for edge computing that enables service-to-service...
Tokens:12,324
Snippets:125
Trust Score:7.6
Update:5 months ago
Show doc for...
Tokens:
Raw
### Check Manual Installation Status

Source: https://edgemesh.netlify.app/guide

Verify the deployment of the edgemesh-agent after manual installation by checking all resources in the kubeedge namespace.

```bash
$ kubectl get all -n kubeedge -o wide
NAME                       READY   STATUS    RESTARTS   AGE   IP              NODE         NOMINATED NODE   READINESS GATES
pod/edgemesh-agent-7gf7g   1/1     Running   0          39s   192.168.0.71    k8s-node1    <none>           <none>
pod/edgemesh-agent-fwf86   1/1     Running   0          39s   192.168.0.229   k8s-master   <none>           <none>
pod/edgemesh-agent-twm6m   1/1     Running   0          39s   192.168.5.121   ke-edge2     <none>           <none>
pod/edgemesh-agent-xwxlp   1/1     Running   0          39s   192.168.5.187   ke-edge1     <none>           <none>

NAME                            DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE   CONTAINERS       IMAGES                           SELECTOR
daemonset.apps/edgemesh-agent   4         4         4       4            4           <none>          39s   edgemesh-agent   kubeedge/edgemesh-agent:latest   k8s-app=kubeedge,kubeedge=edgemesh-agent
```

--------------------------------

### Install HTTPS Application and Service

Source: https://edgemesh.netlify.app/guide/test-case.html

Install a HTTPS container application and its associated Kubernetes service using a provided script.

```bash
$ ./examples/nginx-https/tools.sh install
...
Getting Private key
Getting CA Private Key
secret/nginxsecret created
configmap/nginxconfigmap created
deployment.apps/nginx-https created
service/nginx-https created
create https example success!
```

--------------------------------

### Get All Resources in KubeEdge Namespace

Source: https://edgemesh.netlify.app/

Check the status and details of all Kubernetes resources within the 'kubeedge' namespace after installation. This includes pods and daemonsets.

```bash
$ kubectl get all -n kubeedge -o wide
```

--------------------------------

### List Deployed Helm Charts

Source: https://edgemesh.netlify.app/guide/edge-gateway.html

Verify the deployment of the edgemesh-gateway using Helm. Ensure Helm 3 is installed.

```bash
$ helm ls -A
NAME                    NAMESPACE       REVISION        UPDATED                                 STATUS          CHART                   APP VERSION
edgemesh-gateway        kubeedge        1               2022-09-18 12:56:29.062456383 +0800 CST deployed        edgemesh-gateway-0.1.0  latest

```

--------------------------------

### Enable Socks5 Proxy via Helm

Source: https://edgemesh.netlify.app/guide/ssh.html

Enable the Socks5 proxy module for EdgeMesh agent using Helm's --set parameter during installation.

```bash
$ helm install edgemesh --namespace kubeedge \
--set agent.modules.edgeProxy.socks5Proxy.enable=true ...
```

--------------------------------

### Clone EdgeMesh Repository

Source: https://edgemesh.netlify.app/

Download the EdgeMesh source code from GitHub and navigate into the project directory to begin the manual installation process.

```bash
$ git clone https://github.com/kubeedge/edgemesh.git
$ cd edgemesh
```

--------------------------------

### EdgeMesh Helm Install - Two-Way Authentication

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

Install EdgeMesh using Helm with two-way authentication enabled. This requires the metaserver-certs secret.

```bash
helm install edgemesh --namespace kubeedge \
--set agent.kubeAPIConfig.metaServer.security.requireAuthorization=true \
--set agent.metaServerSecret=metaserver-certs \
...
```

--------------------------------

### EdgeMesh Helm Install - One-Way Authentication

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

Install EdgeMesh using Helm with one-way authentication enabled. This configuration skips TLS verification.

```bash
helm install edgemesh --namespace kubeedge \
--set agent.kubeAPIConfig.metaServer.security.requireAuthorization=true \
--set agent.kubeAPIConfig.metaServer.security.insecureSkipTLSVerify=true \
...
```

--------------------------------

### Check Helm Installation Status

Source: https://edgemesh.netlify.app/guide

Verify the status of the EdgeMesh Helm installation by listing deployed charts and checking the status of the edgemesh-agent DaemonSet.

```bash
$ helm ls -A
NAME            NAMESPACE       REVISION        UPDATED                                 STATUS          CHART           APP VERSION
edgemesh        kubeedge        1               2022-09-18 12:21:47.097801805 +0800 CST deployed        edgemesh-0.1.0  latest
```

```bash
$ kubectl get all -n kubeedge -o wide
NAME                       READY   STATUS    RESTARTS   AGE   IP              NODE         NOMINATED NODE   READINESS GATES
pod/edgemesh-agent-7gf7g   1/1     Running   0          39s   192.168.0.71    k8s-node1    <none>           <none>
pod/edgemesh-agent-fwf86   1/1     Running   0          39s   192.168.0.229   k8s-master   <none>           <none>
pod/edgemesh-agent-twm6m   1/1     Running   0          39s   192.168.5.121   ke-edge2     <none>           <none>
pod/edgemesh-agent-xwxlp   1/1     Running   0          39s   192.168.5.187   ke-edge1     <none>           <none>

NAME                            DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE   CONTAINERS       IMAGES                           SELECTOR
daemonset.apps/edgemesh-agent   4         4         4       4            4           <none>          39s   edgemesh-agent   kubeedge/edgemesh-agent:latest   k8s-app=kubeedge,kubeedge=edgemesh-agent
```

--------------------------------

### Install EdgeMesh with HA Enabled

Source: https://edgemesh.netlify.app/guide/ha.html

Enable the HA feature during EdgeMesh installation using Helm. Configure relay nodes by specifying their Kubernetes node name and advertise IP address.

```bash
# Enable high availability
helm install edgemesh --namespace kubeedge \
--set agent.relayNodes[0].nodeName=k8s-master,agent.relayNodes[0].advertiseAddress="{1.1.1.1}" \
https://raw.githubusercontent.com/kubeedge/edgemesh/main/build/helm/edgemesh.tgz

```

--------------------------------

### Update CloudCore ConfigMap for dynamicController

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

For Helm installations, update the cloudcore ConfigMap to enable the dynamicController module. Restart the cloudcore pod after changes.

```yaml
$ kubectl edit cm cloudcore -n kubeedge
modules:
  ...
  dynamicController:
    enable: true
...
```

--------------------------------

### Create HTTP Gateway and VirtualService

Source: https://edgemesh.netlify.app/guide/edge-gateway.html

Apply the Gateway and VirtualService configurations for HTTP access. This sets up the routing rules for the edge gateway.

```bash
$ kubectl apply -f examples/hostname-lb-random-gateway.yaml
deployment.apps/hostname-lb-edge created
service/hostname-lb-svc created
gateway.networking.istio.io/edgemesh-gateway created
destinationrule.networking.istio.io/hostname-lb-svc created
virtualservice.networking.istio.io/edgemesh-gateway-svc created

```

--------------------------------

### Enable dynamicController using keadm

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

If using keadm, enable the dynamicController module via the keadm init command with the --set flag. Ensure to replace THE-EXPOSED-IP with your actual IP address.

```bash
keadm init --advertise-address="THE-EXPOSED-IP" --profile version=v1.12.1 --kube-config=/root/.kube/config --set cloudCore.modules.dynamicController.enable=true

```

--------------------------------

### Deploy Test Pods

Source: https://edgemesh.netlify.app/guide/test-case.html

Apply the Kubernetes configuration to deploy test pods for network testing.

```bash
$ kubectl apply -f examples/test-pod.yaml
pod/alpine-test created
pod/websocket-test created
```

--------------------------------

### Enable Socks5 Proxy via Manual Configuration

Source: https://edgemesh.netlify.app/guide/ssh.html

Manually enable the Socks5 proxy module by editing the agent configuration file.

```yaml
modules:
    ...
    edgeProxy:
      ...
      socks5Proxy:
        enable: true
    ...
```

--------------------------------

### Deploy HTTP Application and Service

Source: https://edgemesh.netlify.app/guide/test-case.html

Deploy a HTTP container application and its associated Kubernetes service.

```bash
$ kubectl apply -f examples/hostname.yaml
deployment.apps/hostname-edge created
service/hostname-svc created
```

--------------------------------

### Deploy UDP Application and Service

Source: https://edgemesh.netlify.app/guide/test-case.html

Deploy a UDP container application and its associated Kubernetes service.

```bash
$ kubectl apply -f examples/hostname-udp.yaml
deployment.apps/hostname-edge created
service/hostname-udp-svc created
```

--------------------------------

### Test Edge to Cloud Communication

Source: https://edgemesh.netlify.app/guide/test-case.html

From a pod in the edge zone, use telnet to access a service deployed in the cloud zone.

```bash
$ BUSYBOX_CID=$(docker ps | grep k8s_busybox_busybox-sleep-edge | awk '{print $1}')
$ docker exec -it $BUSYBOX_CID sh
$ telnet tcp-echo-cloud-svc.cloudzone 2701
Welcome, you are connected to node k8s-master.
Running on Pod tcp-echo-cloud.
In namespace cloudzone.
With IP address 10.244.0.8.
Service default.
Hello Cloud, I am Edge.
Hello Cloud, I am Edge.

```

--------------------------------

### Manually Deploy Edge Gateway Resources

Source: https://edgemesh.netlify.app/guide/edge-gateway.html

Apply the necessary Kubernetes resources for the edgemesh-gateway using kubectl. Ensure relayNodes and nodeName are correctly configured in the YAML files.

```bash
$ kubectl apply -f build/gateway/resources
serviceaccount/edgemesh-gateway created
clusterrole.rbac.authorization.k8s.io/edgemesh-gateway created
clusterrolebinding.rbac.authorization.k8s.io/edgemesh-gateway created
configmap/edgemesh-gateway-cfg created
configmap/edgemesh-gateway-psk created
deployment.apps/edgemesh-gateway created

```

--------------------------------

### Access UDP Service from Test Pod

Source: https://edgemesh.netlify.app/guide/test-case.html

Exec into a test pod and use nc (netcat) to access the deployed UDP service.

```bash
$ kubectl exec -it alpine-test -- sh
(in the container environment)
/ # nc -u hostname-udp-svc 12345
hostname-edge-5cd47b65d5-8zg27
```

--------------------------------

### Create HTTPS Gateway and VirtualService

Source: https://edgemesh.netlify.app/guide/edge-gateway.html

Apply the Gateway and VirtualService configurations using the TLS secret for secure HTTPS access. This sets up routing rules for encrypted traffic.

```bash
$ kubectl apply -f examples/hostname-lb-random-gateway-tls.yaml
deployment.apps/hostname-lb-edge created
service/hostname-lb-svc created
gateway.networking.istio.io/edgemesh-gateway created
destinationrule.networking.istio.io/hostname-lb-svc created
virtualservice.networking.istio.io/edgemesh-gateway-svc created

```

--------------------------------

### Generate Self-Signed Certificates with certgen.sh

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

Use KubeEdge's certgen.sh script to generate self-signed certificates for the metaserver. Ensure the /etc/kubernetes/pki/ directory exists. Note: Do not use this method in production.

```bash
# 1. Confirm that the /etc/kubernetes/pki/ directory exists
$ ls /etc/kubernetes/pki/ 

# 2. Create a directory
$ mkdir -p /tmp/metaserver-certs
$ cd /tmp/metaserver-certs

# 3. Download certgen.sh
$ wget https://raw.githubusercontent.com/kubeedge/kubeedge/master/build/tools/certgen.sh
$ chmod u+x certgen.sh

# 4. Generate certificate file
$ CA_PATH=./ CERT_PATH=./ ./certgen.sh stream

# 5. rename the certificate file
$ mv streamCA.crt rootCA.crt; mv stream.crt server.crt; mv stream.key server.key

# 6. Create certificate secret
$ kubectl -n kubeedge create secret generic metaserver-certs --from-file=./rootCA.crt --from-file=./server.crt --from-file=./server.key
```

--------------------------------

### Deploy Cloud Zone Services

Source: https://edgemesh.netlify.app/guide/test-case.html

Apply the Kubernetes configuration to deploy services and deployments within the cloud zone.

```bash
$ kubectl apply -f examples/cloudzone.yaml
namespace/cloudzone created
deployment.apps/tcp-echo-cloud created
service/tcp-echo-cloud-svc created
deployment.apps/busybox-sleep-cloud created

```

--------------------------------

### Check Edge Gateway Creation

Source: https://edgemesh.netlify.app/guide/edge-gateway.html

Verify that the edgemesh-gateway has been successfully created in the cluster.

```bash
$ kubectl get gw
NAME               AGE
edgemesh-gateway   3m30s

```

--------------------------------

### Access Websocket Service from Test Pod

Source: https://edgemesh.netlify.app/guide/test-case.html

Exec into a websocket test pod and use the client to access the deployed websocket service.

```bash
$ kubectl exec -it websocket-test -- sh
(in the container environment)
/ # ./client --addr ws-svc:12348
connecting to ws://ws-svc.default:12348/echo
recv: 2021-12-02 03:42:20.191695384 +0000 UTC m=+1.004526202
recv: 2021-12-02 03:42:21.191724176 +0000 UTC m=+2.004554995
recv: 2021-12-02 03:42:22.191725321 +0000 UTC m=+3.004556159
```

--------------------------------

### Test Cloud to Edge Communication

Source: https://edgemesh.netlify.app/guide/test-case.html

From a pod in the cloud zone, use telnet to access a service deployed in the edge zone.

```bash
$ BUSYBOX_POD=$(kubectl get all -n cloudzone | grep pod/busybox | awk '{print $1}')
$ kubectl -n cloudzone exec $BUSYBOX_POD -c busybox -i -t -- sh
$ telnet tcp-echo-edge-svc.edgezone 2701
Welcome, you are connected to node ke-edge1.
Running on Pod tcp-echo-edge.
In namespace edgezone.
With IP address 172.17.0.2.
Service default.
Hello Edge, I am Cloud.
Hello Edge, I am Cloud.

```

--------------------------------

### Deploy Websocket Application and Service

Source: https://edgemesh.netlify.app/guide/test-case.html

Deploy a websocket container application and its associated Kubernetes service.

```bash
$ kubectl apply -f examples/websocket.yaml
deployment.apps/ws-edge created
service/ws-svc created
```

--------------------------------

### Configure EdgeMesh Gateway via Helm

Source: https://edgemesh.netlify.app/reference/config-items.html

Use Helm to set parameters for the edgemesh-gateway, including image, node name, PSK, and module configurations.

```bash
--set image=kubeedge/edgemesh-gateway:v1.12.0
```

```bash
--set nodeName=k8s-master
```

```bash
--set psk=123456
```

```bash
--set relayNodes[0].nodeName=k8s-master
```

```bash
--set metaServerSecret=metaserver-certs
```

```bash
--set kubeAPIConfig.master=https://1.1.1.1:6443
```

```bash
--set modules.edgeGateway.nic=eth0
```

--------------------------------

### Configure Edgecore Certificate Path for MetaServer

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

Update edgecore.yaml to specify the certificate paths for the metaServer. Restart edgecore after applying the changes.

```yaml
modules:
  ...
  metaManager:
    metaServer:
      enable: true
      server: https://127.0.0.1:10550
      tlsCaFile: /tmp/metaserver-certs/rootCA.crt
      tlsCertFile: /tmp/metaserver-certs/server.crt
      tlsPrivateKeyFile: /tmp/metaserver-certs/server.key
...
```

--------------------------------

### Deploy Hostname Load Balancer

Source: https://edgemesh.netlify.app/guide/test-case.html

Apply the Kubernetes configuration for a hostname-based random load balancing strategy. Ensure the DestinationRule name matches the Service name.

```bash
$ kubectl apply -f examples/hostname-lb-random.yaml
deployment.apps/hostname-lb-edge created
service/hostname-lb-svc created
destinationrule.networking.istio.io/hostname-lb-svc created

```

--------------------------------

### Enable KubeEdge requireAuthorization Feature Gate

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

Configure cloudcore.yaml and edgecore.yaml to enable the requireAuthorization feature gate. Restart cloudcore and edgecore after configuration.

```yaml
kind: CloudCore
featureGates:
  requireAuthorization: true
modules:
  ...
```

```yaml
kind: EdgeCore
featureGates:
  requireAuthorization: true
modules:
  ...
```

--------------------------------

### Deploy TCP Application and Service

Source: https://edgemesh.netlify.app/guide/test-case.html

Deploy a TCP container application and its associated Kubernetes service.

```bash
$ kubectl apply -f examples/tcp-echo-service.yaml
deployment.apps/tcp-echo-deployment created
service/tcp-echo-service created
```

--------------------------------

### Access TCP Service from Test Pod

Source: https://edgemesh.netlify.app/guide/test-case.html

Exec into a test pod and use telnet to access the deployed TCP service.

```bash
$ kubectl exec -it alpine-test -- sh
(in the container environment)
/ # telnet tcp-echo-service 2701
Welcome, you are connected to node ke-edge1.
Running on Pod tcp-echo-deployment-66457b769-7zgqb.
In namespace default.
With IP address 172.17.0.2.
Service default.
```

--------------------------------

### Test Random Load Balancing

Source: https://edgemesh.netlify.app/guide/test-case.html

Access the service multiple times from a test pod to observe the random distribution of requests across different hostnames.

```bash
$ kubectl exec -it alpine-test -- sh
(in the container environment)
/ # curl hostname-lb-svc:12345
hostname-lb-edge-7898fff5f9-w82nw
/ # curl hostname-lb-svc:12345
hostname-lb-edge-7898fff5f9-xjp86
/ # curl hostname-lb-svc:12345
hostname-lb-edge-7898fff5f9-xjp86
/ # curl hostname-lb-svc:12345
hostname-lb-edge-7898fff5f9-iq39z

```

--------------------------------

### Configure metaServer and disable edgeMesh

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

On the edge node, enable the metaServer module and disable the old edgeMesh module if using KubeEdge < 1.8.0. Restart edgecore after configuration.

```yaml
$ vim /etc/kubeedge/config/edgecore.yaml
modules:
  ...
  edgeMesh:
    enable: false
  ...
  metaManager:
    metaServer:
      enable: true
...

```

--------------------------------

### Access HTTP Service from Test Pod

Source: https://edgemesh.netlify.app/guide/test-case.html

Exec into a test pod and use curl to access the deployed HTTP service.

```bash
$ kubectl exec -it alpine-test -- sh
(in the container environment)
/ # curl hostname-svc:12345
hostname-edge-5c75d56dc4-rq57t
```

--------------------------------

### Enable dynamicController Module in CloudCore

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

Enable the dynamicController module in cloudcore.yaml to manage edge resources. Restart cloudcore after configuration.

```yaml
$ vim /etc/kubeedge/config/cloudcore.yaml
modules:
  ...
  dynamicController:
    enable: true
...
```

--------------------------------

### Deploy Edge Zone Services

Source: https://edgemesh.netlify.app/guide/test-case.html

Apply the Kubernetes configuration to deploy services and deployments within the edge zone.

```bash
$ kubectl apply -f examples/edgezone.yaml
namespace/edgezone created
deployment.apps/tcp-echo-edge created
service/tcp-echo-edge-svc created
deployment.apps/busybox-sleep-edge created

```

--------------------------------

### Check Node Status with kubectl

Source: https://edgemesh.netlify.app/guide/ha.html

Verify that newly added nodes, such as R2, are recognized and running correctly within the Kubernetes cluster after configuration.

```bash
# Check whether the node is running
kubectl get nodes
NAME         STATUS   ROLES                  AGE    VERSION
k8s-master   Ready    control-plane,master   249d   v1.21.8
k8s-node1    Ready    <none>                 249d   v1.21.8
ke-edge1     Ready    agent,edge             234d   v1.19.3-kubeedge-v1.8.2
ke-edge2     Ready    agent,edge             5d     v1.19.3-kubeedge-v1.8.2
R2           Ready    agent,edge             1d     v1.19.3-kubeedge-v1.8.2 <------ New Node
```

--------------------------------

### List Helm Releases

Source: https://edgemesh.netlify.app/

Verify the EdgeMesh Helm deployment by listing all releases across namespaces. This command checks for the 'edgemesh' release.

```bash
$ helm ls -A
```

--------------------------------

### Create TLS Key and Certificate

Source: https://edgemesh.netlify.app/guide/edge-gateway.html

Generate a self-signed TLS certificate and key for HTTPS access. This is a prerequisite for creating a secret-bound Gateway.

```bash
$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=kubeedge.io"
Generating a RSA private key
............+++++
....................................................................................+++++
writing new private key to 'tls.key'
-----

```

--------------------------------

### Deploy EdgeMesh Agent

Source: https://edgemesh.netlify.app/guide

Apply the necessary Kubernetes resources to deploy the edgemesh-agent, including ServiceAccount, ClusterRoles, ConfigMaps, and DaemonSet.

```bash
$ kubectl apply -f build/agent/resources/
serviceaccount/edgemesh-agent created
clusterrole.rbac.authorization.k8s.io/edgemesh-agent created
clusterrolebinding.rbac.authorization.k8s.io/edgemesh-agent created
configmap/edgemesh-agent-cfg created
configmap/edgemesh-agent-psk created
daemonset.apps/edgemesh-agent created
```

--------------------------------

### Configure clusterDNS and clusterDomain (KubeEdge >= v1.12.0)

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

For KubeEdge versions v1.12.0 and later, configure clusterDNS and clusterDomain within tailoredKubeletConfig in edgecore.yaml. Restart edgecore after configuration.

```yaml
$ vim /etc/kubeedge/config/edgecore.yaml
modules:
  ...
  edged:
    ...
    tailoredKubeletConfig:
      ...
      clusterDNS:
      - 169.254.96.16
      clusterDomain: cluster.local
...

```

--------------------------------

### Configure clusterDNS and clusterDomain (KubeEdge < v1.12.0)

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

Configure clusterDNS and clusterDomain in edgecore.yaml for edge applications to access the EdgeMesh DNS service. Restart edgecore after configuration.

```yaml
$ vim /etc/kubeedge/config/edgecore.yaml
modules:
  ...
  edged:
    clusterDNS: 169.254.96.16
    clusterDomain: cluster.local
...

```

--------------------------------

### Access HTTPS Service from Test Pod

Source: https://edgemesh.netlify.app/guide/test-case.html

Exec into a test pod and use curl to access the deployed HTTPS service, with and without external domain mapping.

```bash
$ kubectl exec -it alpine-test -- sh
(in the container environment)
/ # curl -k --cert client.crt --key client.key https://nginx-https
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
...

(you can also use external domain name to access related service)
/ # curl --cacert rootCA.crt --cert client.crt --key client.key https://my-nginx.com
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
...
```

--------------------------------

### Deploy EdgeMesh Agent Resources

Source: https://edgemesh.netlify.app/

Apply the Kubernetes resources for the EdgeMesh agent, including Service Accounts, RBAC roles, ConfigMaps, and the DaemonSet.

```bash
$ kubectl apply -f build/agent/resources/
```

--------------------------------

### Configure EdgeMesh Agent via Helm

Source: https://edgemesh.netlify.app/reference/config-items.html

Use Helm to set parameters for the edgemesh-agent, such as image, PSK, relay nodes, and metadata server secrets.

```bash
--set agent.image=kubeedge/edgemesh-agent:v1.12.0
```

```bash
--set agent.psk=123456
```

```bash
--set relayNodes[0].nodeName=k8s-master
```

```bash
--set agent.metaServerSecret=metaserver-certs
```

```bash
--set agent.kubeAPIConfig.master=https://1.1.1.1:6443
```

```bash
--set agent.commonConfig.bridgeDeviceIP=169.254.96.16
```

```bash
--set agent.modules.edgeProxy.socks5Proxy.enable=true
```

--------------------------------

### Access Service via HTTPS Gateway

Source: https://edgemesh.netlify.app/guide/edge-gateway.html

Use curl with the provided certificate and key to access the internal service over HTTPS. The '-k' flag bypasses certificate verification.

```bash
$ curl -k --cert ./tls.crt --key ./tls.key https://192.168.0.211:23333

```

--------------------------------

### Configure New Relay Node in edgemesh-agent.yaml

Source: https://edgemesh.netlify.app/guide/ha.html

Add new relay nodes by modifying the `relayNodes` parameter in the `edgemesh-agent.yaml` configuration file. Ensure `edgeProxy` and `edgeTunnel` modules are enabled.

```yaml
modules:
  edgeProxy:
    enable: true
  edgeTunnel:
    enable: true
    # Set to add or modify as a new relay node
    relayNodes:
    - nodeName: R1
      advertiseAddress:
      - 1.1.1.1
    - nodeName: R2   <------ Add new nodes here
      advertiseAddress:
      - 192.168.5.103
```

--------------------------------

### EdgeMesh Manual Config - Two-Way Authentication (DaemonSet)

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

Configure the EdgeMesh DaemonSet to mount the metaserver-certs secret for two-way authentication. This makes the certificates available at /etc/edgemesh/metaserver.

```yaml
        volumeMounts:
        ...
        - name: metaserver-certs
          mountPath: /etc/edgemesh/metaserver
        volumes:
        ...
        - secret:
          secretName: metaserver-certs
          defaultMode: 420
        name: metaserver-certs
        ...
```

--------------------------------

### Configure PSK Cipher with Helm

Source: https://edgemesh.netlify.app/guide/security.html

When deploying EdgeMesh or EdgeMesh-Gateway using Helm, set your custom PSK cipher using the `--set` parameter. Ensure that EdgeMesh and EdgeMesh-Gateway in the same cluster use the identical PSK cipher.

```bash
# When deploying EdgeMesh
$ helm install edgemesh --namespace kubeedge --set agent.psk=<your psk cipher> ...
```

```bash
# When deploying EdgeMesh-Gateway
$ helm install edgemesh-gateway --namespace kubeedge --set psk=<your psk cipher> ...
```

--------------------------------

### Convert Existing Node to Relay Node at Runtime

Source: https://edgemesh.netlify.app/guide/ha.html

Modify the `edgemesh-agent-cfg` configmap to convert existing nodes into relay nodes. This involves editing the `relayNodes` parameter within the `edgemesh-agent.yaml` section.

```bash
kubectl -n kubeedge edit configmap edgemesh-agent-cfg
```

```yaml
# Enter the config file to edit
apiVersion: v1
data:
 edgemesh-agent.yaml: |-
   modules:
     edgeProxy:
       enable: true
     edgeTunnel:
       enable: true
       # Set to add or modify as a new relay node
       relayNodes:
       - nodeName: R1
         advertiseAddress:
         - 1.1.1.1
       - nodeName: R2   <------ Configure new node information here
         advertiseAddress:
         - 192.168.5.103
```

--------------------------------

### View iptables NAT table rules

Source: https://edgemesh.netlify.app/advanced/hybird-proxy.html

Inspect the iptables NAT table rules to verify the order of KUBE-PORTALS-CONTAINER and KUBE-SERVICES chains. This helps diagnose traffic routing issues.

```bash
$ iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 1379K packets, 395M bytes)
 pkts bytes target     prot opt in  out     source               destination
   52 13980 KUBE-PORTALS-CONTAINER  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* handle ClusterIPs; NOTE: this must be before the NodePort rules */
1375K  394M KUBE-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes service portals */
...

Chain OUTPUT (policy ACCEPT 1317K packets, 79M bytes)
 pkts bytes target     prot opt in     out     source               destination
   51  3086 KUBE-PORTALS-HOST  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* handle ClusterIPs; NOTE: this must be before the NodePort rules */
1314K   79M KUBE-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes service portals */
...


```

--------------------------------

### Check edgemesh-agent Status on Relay Nodes

Source: https://edgemesh.netlify.app/guide/ha.html

Confirm that the `edgemesh-agent` pods are running as expected on all nodes, including the newly added relay node R2.

```bash
# Check whether the edgemesh-agent of the relay node is running normally
kubectl get all -n kubeedge -o wide
NAME                       READY   STATUS    RESTARTS   AGE   IP              NODE         NOMINATED NODE   READINESS GATES
pod/edgemesh-agent-59fzk   1/1     Running   0          10h   192.168.5.187   ke-edge1     <none>           <none>
pod/edgemesh-agent-hfsmz   1/1     Running   1          10h   192.168.0.229   k8s-master   <none>           <none>
pod/edgemesh-agent-tvhks   1/1     Running   0          10h   192.168.0.71    k8s-node1    <none>           <none>
pod/edgemesh-agent-tzntc   1/1     Running   0          10h   192.168.5.121   ke-edge2     <none>           <none>
pod/edgemesh-agent-kasju   1/1     Running   0          10h   192.168.5.103   R2           <none>           <none> <------ new edgemesh-agent running on R2
```

--------------------------------

### Generate PSK Cipher

Source: https://edgemesh.netlify.app/guide/security.html

Use this command to generate a random 32-byte base64 encoded string for your PSK cipher. It is recommended to change this cipher frequently for enhanced security.

```bash
$ openssl rand -base64 32
JugH9HP1XBouyO5pWGeZa8LtipDURrf17EJvUHcJGuQ=
```

--------------------------------

### Apply CRDs for Istio

Source: https://edgemesh.netlify.app/

Create the Custom Resource Definitions (CRDs) required for Istio networking components, such as DestinationRules, Gateways, and VirtualServices.

```bash
$ kubectl apply -f build/crds/istio/
```

--------------------------------

### Access Service via HTTP Gateway

Source: https://edgemesh.netlify.app/guide/edge-gateway.html

Use curl with the exposed IP and port of the Gateway to access the internal service over HTTP.

```bash
$ curl 192.168.0.211:23333

```

--------------------------------

### Configure EdgeMesh Gateway

Source: https://edgemesh.netlify.app/reference/config-items.html

This is the main configuration file for the EdgeMesh Gateway. It specifies API connection details, module settings for edge gateway and edge tunnel, and load balancing parameters.

```yaml
apiVersion: gateway.edgemesh.config.kubeedge.io/v1alpha1
kind: EdgeMeshGateway
kubeAPIConfig:
  master: https://119.8.211.54:6443
  contentType: application/vnd.kubernetes.protobuf
  qps: 100
  burst: 200
  kubeConfig: /root/.kube/config
  metaServer:
    server: http://127.0.0.1:10550
    security:
      requireAuthorization: false
      insecureSkipTLSVerify: false
      tlsCaFile: /etc/edgemesh/metaserver/rootCA.crt
      tlsCertFile: /etc/edgemesh/metaserver/server.crt
      tlsPrivateKeyFile: /etc/edgemesh/metaserver/server.key
  deleteKubeConfig: false
modules:
  edgeGateway:
    enable: false
    nic: "lo,eth0",
    includeIP: "192.168.0.1,172.16.0.1",
    excludeIP: "10.0.0.1",
    loadBalancer:
      consistentHash:
        partitionCount: 100
        replicationFactor: 10
        load: 1.25
  edgeTunnel:
    enable: false
    listenPort: 20006
    transport: tcp
    rendezvous: EDGEMESH_PLAYGOUND
    relayNodes:
    - nodeName: k8s-master
      advertiseAddress:
      - 1.1.1.1
    - nodeName: ke-edge1
      advertiseAddress:
      - 2.2.2.2
      - 3.3.3.3
    enableIpfsLog: false
    maxCandidates: 5
    heartbeatPeriod: 120
    finderPeriod: 60
    psk:
      enable: true
      path: /etc/edgemesh/psk
    tunnelLimitConfig:
      enable: false
      tunnelBaseStreamIn: 10240
      tunnelBaseStreamOut: 10240
      TunnelPeerBaseStreamIn: 1024
      tunnelPeerBaseStreamOut: 1024

```

--------------------------------

### Create TLS Secret for Gateway

Source: https://edgemesh.netlify.app/guide/edge-gateway.html

Create a Kubernetes secret named 'gw-secret' using the generated TLS key and certificate. This secret will be used by the Gateway for HTTPS.

```bash
$ kubectl create secret tls gw-secret --key tls.key --cert tls.crt
secret/gw-secret created

```

--------------------------------

### Create CRDs for EdgeMesh

Source: https://edgemesh.netlify.app/guide

Apply the Custom Resource Definitions (CRDs) required for EdgeMesh, which include resources for Istio networking.

```bash
$ kubectl apply -f build/crds/istio/
customresourcedefinition.apiextensions.k8s.io/destinationrules.networking.istio.io created
customresourcedefinition.apiextensions.k8s.io/gateways.networking.istio.io created
customresourcedefinition.apiextensions.k8s.io/virtualservices.networking.istio.io created
```

--------------------------------

### Add New Relay Node at Runtime

Source: https://edgemesh.netlify.app/guide/ha.html

Add a new relay node to the cluster while using EdgeMesh's HA feature by editing the `edgemesh-agent-cfg` ConfigMap.

```bash
kubectl -n kubeedge edit configmap edgemesh-agent-cfg

```

--------------------------------

### EdgeMesh Manual Config - Two-Way Authentication (ConfigMap)

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

Configure EdgeMesh agent manually for two-way authentication by setting requireAuthorization to true in edgemesh-agent.yaml. This method assumes the metaserver-certs secret is available.

```yaml
data:
  edgemesh-agent.yaml: |
    kubeAPIConfig:
      metaServer:
        security:
          requireAuthorization: true
    ...
```

--------------------------------

### Add Filter Labels to Kubernetes API Services

Source: https://edgemesh.netlify.app/

Apply a filter label to the Kubernetes API service to prevent EdgeMesh from proxying it. Refer to Service Filter documentation for more details.

```bash
$ kubectl label services kubernetes service.edgemesh.kubeedge.io/service-proxy-name=""
```

--------------------------------

### EdgeMesh Agent ConfigMap

Source: https://edgemesh.netlify.app/reference/config-items.html

This ConfigMap defines the detailed configuration for the EdgeMesh agent, including API settings, common configurations, and module enablement.

```yaml
apiVersion: agent.edgemesh.config.kubeedge.io/v1alpha1
kind: EdgeMeshAgent
kubeAPIConfig:
  master: https://119.8.211.54:6443
  contentType: application/vnd.kubernetes.protobuf
  qps: 100
  burst: 200
  kubeConfig: /root/.kube/config
  metaServer:
    server: http://127.0.0.1:10550
    security:
      requireAuthorization: false
      insecureSkipTLSVerify: false
      tlsCaFile: /etc/edgemesh/metaserver/rootCA.crt
      tlsCertFile: /etc/edgemesh/metaserver/server.crt
      tlsPrivateKeyFile: /etc/edgemesh/metaserver/server.key
  deleteKubeConfig: false
commonConfig:
  bridgeDeviceName: edgemesh0
  bridgeDeviceIP: 169.254.96.16
modules:
  edgeDNS:
    enable: false
    listenPort: 53
    cacheDNS:
      enable: false
      autoDetect: true
      upstreamServers:
      - 10.96.0.10
      - 1.1.1.1
      cacheTTL: 30
  edgeProxy:
    enable: false
    socks5Proxy:
      enable: false
      listenPort: 10800
    loadBalancer:
      consistentHash:
        partitionCount: 100
        replicationFactor: 10
        load: 1.25
    serviceFilterMode: FilterIfLabelExists
  edgeTunnel:
    enable: false
    listenPort: 20006
    transport: tcp
    rendezvous: EDGEMESH_PLAYGOUND
    relayNodes:
    - nodeName: k8s-master
      advertiseAddress:
      - 1.1.1.1
    - nodeName: ke-edge1
      advertiseAddress:
      - 2.2.2.2
      - 3.3.3.3
    enableIpfsLog: false
    maxCandidates: 5
    heartbeatPeriod: 120
    finderPeriod: 60
    psk:
      enable: true
      path: /etc/edgemesh/psk
    tunnelLimitConfig:
      enable: false
      tunnelBaseStreamIn: 10240
      tunnelBaseStreamOut: 10240
      TunnelPeerBaseStreamIn: 1024
      TunnelPeerBaseStreamOut: 1024

```

--------------------------------

### SSH Connection via Socks5 Proxy

Source: https://edgemesh.netlify.app/guide/ssh.html

Connect to an edge node using SSH through a Socks5 proxy. Ensure the agent is restarted after configuration changes. Note that connection is only supported via node name.

```bash
$ ssh -o "ProxyCommand nc --proxy-type socks5 --proxy 169.254.96.16:10800 %h %p" root@edge-node-1002
```

--------------------------------

### Test Edge Kube-API Endpoint

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

Test the Edge Kube-API Endpoint functionality by curling the local endpoint. An empty list or slow response may indicate a configuration error.

```bash
$ curl 127.0.0.1:10550/api/v1/services
{"apiVersion":"v1","items":[{"apiVersion":"v1","kind":"Service","metadata":{"creationTimestamp":"2021-04-14T06:30:05Z","labels":{"component":"apiserver","provider":"kubernetes"},"name":"kubernetes","namespace":"default","resourceVersion":"147","selfLink":"default/services/kubernetes","uid":"55eeebea-08cf-4d1a-8b04-e85f8ae112a9"},"spec":{"clusterIP":"10.96.0.1","ports":[{"name":"https","port":443,"protocol":"TCP","targetPort":6443}],"sessionAffinity":"None","type":"ClusterIP"},"status":{"loadBalancer":{}}},{"apiVersion":"v1","kind":"Service","metadata":{"annotations":{"prometheus.io/port":"9153","prometheus.io/scrape":"true"},"creationTimestamp":"2021-04-14T06:30:07Z","labels":{"k8s-app":"kube-dns","kubernetes.io/cluster-service":"true","kubernetes.io/name":"KubeDNS"},"name":"kube-dns","namespace":"kube-system","resourceVersion":"203","selfLink":"kube-system/services/kube-dns","uid":"c221ac20-cbfa-406b-812a-c44b9d82d6dc"},"spec":{"clusterIP":"10.96.0.10","ports":[{"name":"dns","port":53,"protocol":"UDP","targetPort":53},{"name":"dns-tcp","port":53,"protocol":"TCP","targetPort":53},{"name":"metrics","port":9153,"protocol":"TCP","targetPort":9153}],"selector":{"k8s-app":"kube-dns"},"sessionAffinity":"None","type":"ClusterIP"},"status":{"loadBalancer":{}}}],"kind":"ServiceList","metadata":{"resourceVersion":"377360","selfLink":"/api/v1/services"}}

```

--------------------------------

### EdgeMesh Manual Config - One-Way Authentication

Source: https://edgemesh.netlify.app/guide/edge-kube-api.html

Configure EdgeMesh agent manually for one-way authentication by setting requireAuthorization and insecureSkipTLSVerify to true in the edgemesh-agent.yaml.

```yaml
data:
  edgemesh-agent.yaml: |
    kubeAPIConfig:
      metaServer:
        security:
          requireAuthorization: true
          insecureSkipTLSVerify: true
    ...
```

--------------------------------

### Remove Master Node Taint

Source: https://edgemesh.netlify.app/

This command removes the taint from Kubernetes master nodes. It can be omitted if the application is not deployed on master nodes.

```bash
$ kubectl taint nodes --all node-role.kubernetes.io/master-
```

--------------------------------

### Exclude Service from Edgemesh Proxying

Source: https://edgemesh.netlify.app/advanced/hybird-proxy.html

Add the `service.edgemesh.kubeedge.io/service-proxy-name: ""` label to a Kubernetes Service to prevent Edgemesh from proxying its traffic. This is useful for services that do not require edge access.

```yaml
apiVersion: v1
kind: Service
metadata:
  labels:
    service.edgemesh.kubeedge.io/service-proxy-name: ""  #<---- add this label to ignored by edgemesh-agent
    app.kubernetes.io/name: node-exporter
    app.kubernetes.io/version: v1.0.1
  name: node-exporter
  namespace: monitoring
spec:
  clusterIP: None
  ports:
  - name: https
    port: 9100
    targetPort: https
  selector:
    app.kubernetes.io/name: node-exporter


```
Tokens:
Raw