Updated to follow frontend/backend structure

Author: sshver

walkthroughs/howto-tls-file-provided/README.md

@@ -24,7 +24,7 @@ export ENVIRONMENT_NAME="AppMeshTLSExample"
 export MESH_NAME="ColorApp-TLS"
 export ENVOY_IMAGE=<get the latest from https://docs.aws.amazon.com/app-mesh/latest/userguide/envoy.html>
 export SERVICES_DOMAIN="default.svc.cluster.local"
-export GATEWAY_IMAGE_NAME="gateway"
+export FRONTEND_IMAGE_NAME="frontend"
 export COLOR_TELLER_IMAGE_NAME="colorteller"
 export COLOR_APP_ENVOY_IMAGE_NAME="colorapp-envoy"
 ```
@@ -63,14 +63,14 @@ Next, build and deploy the color app images.
 
 ```bash
 ./src/colorteller/deploy.sh
-./src/gateway/deploy.sh
+./src/frontend/deploy.sh
 ```
 
 Note that the example apps use go modules. If you have trouble accessing https://proxy.golang.org during the deployment you can override the GOPROXY by setting `GO_PROXY=direct`
 
 ```bash
 GO_PROXY=direct ./src/colorteller/deploy.sh
-GO_PROXY=direct ./src/gateway/deploy.sh
+GO_PROXY=direct ./src/frontend/deploy.sh
 ```
 
 ## Step 2: Generate the Certficates
@@ -161,7 +161,7 @@ Now with the mesh defined, we can deploy our service to ECS and test it out.
 ./infrastructure/ecs-service.sh
 ```
 
-Let's issue a request to the color gateway.
+Let's issue a request to the frontend.
 
 ```bash
 COLORAPP_ENDPOINT=$(aws cloudformation describe-stacks \
@@ -182,13 +182,13 @@ ssh -i ~/.ssh/$KEY_PAIR_NAME.pem ec2-user@$BASTION_IP
 curl -s http://colorteller.default.svc.cluster.local:9901/stats | grep ssl.handshake
 ```
 
-You should see output similar to: `listener.0.0.0.0_15000.ssl.handshake: 1`, indicating a successful SSL handshake was achieved between gateway and color teller.
+You should see output similar to: `listener.0.0.0.0_15000.ssl.handshake: 1`, indicating a successful SSL handshake was achieved between frontend and color teller.
 
 Check out the [TLS Encryption](https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual-node-tls.html) documentation for more information on enabling encryption between services in App Mesh.
 
 ## Client TLS Validation Tutorial
 
-Enabling TLS communication from your virtual node is the first step to securing your traffic. In a zero trust system, the Color Gateway should also be responsible for defining what certificate authorities are trusted. App Mesh allows you to configure Envoy with information on what CAs you trust to vend certificates. We will demonstrate this by adding a new color teller to our service that has a TLS certificate vended from a different CA than the first.
+Enabling TLS communication from your virtual node is the first step to securing your traffic. In a zero trust system, the frontend should also be responsible for defining what certificate authorities are trusted. App Mesh allows you to configure Envoy with information on what CAs you trust to vend certificates. We will demonstrate this by adding a new color teller to our service that has a TLS certificate vended from a different CA than the first.
 
 ## Step 6: Add the Green Color Teller
 
@@ -227,15 +227,15 @@ After a couple seconds, when you hit the service, you should see both green and
 curl "${COLORAPP_ENDPOINT}/color"
 ```
 
-### Step 7: Add TLS Validation to the Gateway
+### Step 7: Add TLS Validation to the Frontend
 
-As you just saw, we were able to add a new Virtual Node with TLS to our mesh and the Color Gateway was able to communicate with it no problem.  
+As you just saw, we were able to add a new Virtual Node with TLS to our mesh and the Frontend was able to communicate with it no problem.  
 
 In the client/server relationship, if the server decides to turn on TLS, App Mesh configures the client Envoys to accept the certificate offered. However, clients should also validate that the certificate offered by the server is from a certificate authority they trust. App Mesh allows you to define a client policy for TLS validation to ensure that the certificate is valid and issued from a trustworthy source.
 
 If you recall, the Green Color Teller certificates were signed by a different CA than the White Color Teller certificates.  Perhaps this is not the intended behavior and we want to reject certificates from any CA that is not CA 1.
 
-We are going to update the Color Gateway backend to have this configuration:
+We are going to update the Frontend's backend to have this configuration:
 
 ```yaml
 Backends:
@@ -254,7 +254,7 @@ BackendDefaults:
 In this situation, we add a backend default for the Client Policy that instructs Envoy to only allow certificates signed by CA 1 to be accepted. If we had a separate backend with a `ClientPolicy` defined for `TLS`, then the default policy would not be applied for `TLS`.
 
 ```bash
-./mesh/mesh.sh updateGateway
+./mesh/mesh.sh updateFrontend
 ```  
 
 Now when call the service, you will see `white` is working properly, but you will start to see `upstream connect error or disconnect/reset before headers. reset reason: connection failure` from the Green Colorteller.
@@ -268,7 +268,7 @@ curl "${COLORAPP_ENDPOINT}/color"
 We can restore communication by changing the `certificateChain` in the backend group to be `ca_1_ca_2_bundle.pem`. This contains both the public certificates for CA 1 and CA 2, which will instructs Envoy to accept certificates signed by both CA 1 and CA 2.
 
 ```bash
-./mesh/mesh.sh updateGateway2
+./mesh/mesh.sh updateFrontend2
 ```
 
 Now when you call the service, you will see both `white` and `green` again.
@@ -292,7 +292,7 @@ Run the following commands to clean up and tear down the resources that we’ve
 aws cloudformation delete-stack --stack-name $ENVIRONMENT_NAME-ecs-service
 aws cloudformation delete-stack --stack-name $ENVIRONMENT_NAME-ecs-cluster
 aws ecr delete-repository --force --repository-name $COLOR_TELLER_IMAGE_NAME
-aws ecr delete-repository --force --repository-name $GATEWAY_IMAGE_NAME
+aws ecr delete-repository --force --repository-name $FRONTEND_IMAGE_NAME
 aws ecr delete-repository --force --repository-name $COLOR_APP_ENVOY_IMAGE_NAME
 aws cloudformation delete-stack --stack-name $ENVIRONMENT_NAME-ecr-repositories
 aws cloudformation delete-stack --stack-name $ENVIRONMENT_NAME-vpc

walkthroughs/howto-tls-file-provided/infrastructure/ecr-repositories.sh

@@ -10,6 +10,6 @@ aws --profile "${AWS_PROFILE}" --region "${AWS_DEFAULT_REGION}" \
     --capabilities CAPABILITY_IAM \
     --template-file "${DIR}/ecr-repositories.yaml" \
     --parameter-overrides \
-    GatewayImageName="${GATEWAY_IMAGE_NAME}" \
+    FrontendImageName="${FRONTEND_IMAGE_NAME}" \
     ColorTellerImageName="${COLOR_TELLER_IMAGE_NAME}" \
     ColorAppEnvoyImageName="${COLOR_APP_ENVOY_IMAGE_NAME}"

walkthroughs/howto-tls-file-provided/infrastructure/ecr-repositories.yaml

@@ -1,22 +1,22 @@
 Parameters:
 
-  GatewayImageName:
-    Description: The name for the gateway image
+  FrontendImageName:
+    Description: The name for the Frontend image
     Type: String
 
   ColorTellerImageName:
-    Description: The name for the color teller image
+    Description: The name for the color teller backend image
     Type: String
 
   ColorAppEnvoyImageName:
     Description: The name for the color app envoy image
     Type: String
 
 Resources:
-  GatewayRepository:
+  FrontendRepository:
     Type: AWS::ECR::Repository
     Properties:
-      RepositoryName: !Ref GatewayImageName
+      RepositoryName: !Ref FrontendImageName
 
   ColorTellerRepository:
     Type: AWS::ECR::Repository

walkthroughs/howto-tls-file-provided/infrastructure/ecs-service.sh

@@ -14,7 +14,7 @@ aws --profile "${AWS_PROFILE}" --region "${AWS_DEFAULT_REGION}" \
     ECSServicesDomain="${SERVICES_DOMAIN}" \
     AppMeshMeshName="${MESH_NAME}" \
     EnvoyImage="${ENVOY_IMAGE}" \
-    GatewayImageName="${GATEWAY_IMAGE_NAME}" \
+    FrontendImageName="${FRONTEND_IMAGE_NAME}" \
     ColorTellerImageName="${COLOR_TELLER_IMAGE_NAME}" \
     ColorAppEnvoyImageName="${COLOR_APP_ENVOY_IMAGE_NAME}"
 

walkthroughs/howto-tls-file-provided/infrastructure/ecs-service.yaml

@@ -16,8 +16,8 @@ Parameters:
     Type: String
     Description: The image to use for the Envoy container
 
-  GatewayImageName:
-    Description: The name for the gateway image
+  FrontendImageName:
+    Description: The name for the frontend image
     Type: String
 
   ColorTellerImageName:
@@ -280,11 +280,11 @@ Resources:
             - 'Fn::ImportValue': !Sub "${EnvironmentName}:PrivateSubnet2"
       TaskDefinition: { Ref: ColorTellerGreenTaskDefinition }
 
-  ### colorgateway.default.svc.cluster.local
-  ColorGatewayServiceDiscoveryRecord:
+  ### frontend.default.svc.cluster.local
+  FrontendServiceDiscoveryRecord:
     Type: 'AWS::ServiceDiscovery::Service'
     Properties:
-      Name: "colorgateway"
+      Name: "frontend"
       DnsConfig:
         NamespaceId:
           'Fn::ImportValue': !Sub "${EnvironmentName}:ECSServiceDiscoveryNamespace"
@@ -294,12 +294,12 @@ Resources:
       HealthCheckCustomConfig:
         FailureThreshold: 1
 
-  ColorGatewayTaskDefinition:
+  FrontendTaskDefinition:
     Type: AWS::ECS::TaskDefinition
     Properties:
       RequiresCompatibilities:
         - 'FARGATE'
-      Family: 'gateway'
+      Family: 'frontend'
       NetworkMode: 'awsvpc'
       Cpu: 256
       Memory: 512
@@ -323,7 +323,7 @@ Resources:
             Value: '169.254.170.2,169.254.169.254'
       ContainerDefinitions:
         - Name: 'app'
-          Image: !Sub '${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${GatewayImageName}'
+          Image: !Sub '${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${FrontendImageName}'
           Essential: true
           DependsOn:
             - ContainerName: 'envoy'
@@ -334,7 +334,7 @@ Resources:
               awslogs-group:
                 Fn::ImportValue: !Sub "${EnvironmentName}:ECSServiceLogGroup"
               awslogs-region: !Ref AWS::Region
-              awslogs-stream-prefix: 'gateway'
+              awslogs-stream-prefix: 'frontend'
           PortMappings:
             - ContainerPort: 80
               Protocol: 'http'
@@ -373,14 +373,14 @@ Resources:
               awslogs-group:
                 Fn::ImportValue: !Sub "${EnvironmentName}:ECSServiceLogGroup"
               awslogs-region: !Ref AWS::Region
-              awslogs-stream-prefix: 'gateway-envoy'
+              awslogs-stream-prefix: 'frontend-envoy'
           Environment:
             - Name: 'APPMESH_VIRTUAL_NODE_NAME'
-              Value: !Sub 'mesh/${AppMeshMeshName}/virtualNode/ColorGateway'
+              Value: !Sub 'mesh/${AppMeshMeshName}/virtualNode/Frontend'
             - Name: CERTIFICATE_NAME
-              Value: 'colorgateway'
+              Value: 'frontend'
 
-  ColorGatewayService:
+  FrontendService:
     Type: 'AWS::ECS::Service'
     DependsOn:
       - WebLoadBalancerRule
@@ -394,7 +394,7 @@ Resources:
       LaunchType: FARGATE
       ServiceRegistries:
         - RegistryArn:
-            'Fn::GetAtt': ColorGatewayServiceDiscoveryRecord.Arn
+            'Fn::GetAtt': FrontendServiceDiscoveryRecord.Arn
       NetworkConfiguration:
         AwsvpcConfiguration:
           AssignPublicIp: DISABLED
@@ -403,7 +403,7 @@ Resources:
           Subnets: 
             - 'Fn::ImportValue': !Sub "${EnvironmentName}:PrivateSubnet1"
             - 'Fn::ImportValue': !Sub "${EnvironmentName}:PrivateSubnet2"
-      TaskDefinition: { Ref: ColorGatewayTaskDefinition }
+      TaskDefinition: { Ref: FrontendTaskDefinition }
       LoadBalancers:
         - ContainerName: app
           ContainerPort: 80
@@ -419,7 +419,7 @@ Resources:
           - CidrIp: 0.0.0.0/0
             IpProtocol: -1
 
-  # public ALB for color gateway
+  # public ALB for frontend
   PublicLoadBalancer:
     Type: AWS::ElasticLoadBalancingV2::LoadBalancer
     Properties:

walkthroughs/howto-tls-file-provided/mesh/mesh.sh

@@ -23,7 +23,7 @@ sanity_check() {
 
 # $1 ColorTellerGreenRouteWeight
 # $2 EnableClientValidationFlag
-# $3 ColorGatewayTlsValidationPath
+# $3 FrontendTlsValidationPath
 callCloudformation() {
     aws --profile "${AWS_PROFILE}" --region "${AWS_DEFAULT_REGION}" \
         cloudformation deploy \
@@ -35,15 +35,15 @@ callCloudformation() {
         ServicesDomain="${SERVICES_DOMAIN}" \
         ColorTellerGreenRouteWeight=$1 \
         EnableClientValidationFlag=$2 \
-        ColorGatewayTlsValidationPath=$3
+        FrontendTlsValidationPath=$3
 }
 
 
 main() {
     action="$1"
     if [ -z "$action" ]; then
         echo "Usage:"
-        echo "mesh.sh [up|addGreen|updateGateway|updateGateway2]"
+        echo "mesh.sh [up|addGreen|updateFrontend|updateFrontend2]"
     fi
     sanity_check
 
@@ -54,10 +54,10 @@ main() {
     addGreen)
         callCloudformation 1 "false"
         ;;
-    updateGateway)
+    updateFrontend)
         callCloudformation 1 "true" "/keys/ca_1_cert.pem"
         ;;
-    updateGateway2)
+    updateFrontend2)
         callCloudformation 1 "true" "/keys/ca_1_ca_2_bundle.pem"
         ;;    
     *)

walkthroughs/howto-tls-file-provided/mesh/mesh.yaml

@@ -17,8 +17,8 @@ Parameters:
     AllowedValues: [0, 1]
     Default: 0
 
-  ColorGatewayTlsValidationPath:
-    Description: The path to use for TLS client validation on the Color Gateway
+  FrontendTlsValidationPath:
+    Description: The path to use for TLS client validation on the Frontend
     Type: String
     Default: ""
 
@@ -29,7 +29,7 @@ Parameters:
 
 Conditions:
   EnableClientValidation: !Equals [!Ref EnableClientValidationFlag, "true"]
-  ColorGatewayTlsValidationPathPresent: !Not [!Equals [!Ref ColorGatewayTlsValidationPath, ""]]
+  FrontendTlsValidationPathPresent: !Not [!Equals [!Ref FrontendTlsValidationPath, ""]]
 
 
 Resources:
@@ -39,11 +39,11 @@ Resources:
     Properties:
       MeshName: !Ref MeshName
 
-  ColorGatewayVirtualNode:
+  FrontendVirtualNode:
     Type: AWS::AppMesh::VirtualNode
     Properties:
       MeshName: !GetAtt Mesh.MeshName
-      VirtualNodeName: ColorGateway
+      VirtualNodeName: Frontend
       Spec:
         Backends:
           - VirtualService:
@@ -52,20 +52,20 @@ Resources:
           ClientPolicy:
             TLS:
               Fn::If: 
-              - ColorGatewayTlsValidationPathPresent
+              - FrontendTlsValidationPathPresent
               - Enforce: !If [EnableClientValidation, True, False]
                 Validation:
                   Trust:
                     File: 
-                      CertificateChain: !Ref ColorGatewayTlsValidationPath
+                      CertificateChain: !Ref FrontendTlsValidationPath
               - !Ref AWS::NoValue
         Listeners:
           - PortMapping:
               Port: 80
               Protocol: http
         ServiceDiscovery:
           DNS:
-            Hostname: !Sub "colorgateway.${ServicesDomain}"
+            Hostname: !Sub "Frontend.${ServicesDomain}"
 
   ColorTellerWhiteVirtualNode:
     Type: AWS::AppMesh::VirtualNode

walkthroughs/howto-tls-file-provided/src/customEnvoyImage/entryPoint.sh

@@ -7,7 +7,7 @@ getSecret() {
 }
 
 getCertificates() {
-    if [[ $CERTIFICATE_NAME = "colorgateway" ]];
+    if [[ $CERTIFICATE_NAME = "frontend" ]];
     then
         getSecret "ca_1_cert"
         getSecret "ca_2_cert"