📝 Add Ingress chapter

k8s/M6-ingress-nginx-cm-patch.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ingress-nginx-controller
+  namespace: ingress-nginx
+data:
+  use-forwarded-headers: true
+  compute-full-forwarded-for: true
+  use-proxy-protocol: true

k8s/M6-ingress-nginx-components.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/instance: flux-system
+    app.kubernetes.io/part-of: flux
+    app.kubernetes.io/version: v2.5.1
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: latest
+  name: ingress-nginx

k8s/M6-ingress-nginx-kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- M6-ingress-nginx-components.yaml
+- sync.yaml
+patches:
+  - path: M6-ingress-nginx-cm-patch.yaml 
+    target:
+      kind: ConfigMap
+  - path: M6-ingress-nginx-svc-patch.yaml 
+    target:
+      kind: Service

k8s/M6-ingress-nginx-svc-patch.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ingress-nginx-controller
+  namespace: ingress-nginx
+  annotations:
+    service.beta.kubernetes.io/scw-loadbalancer-proxy-protocol-v2: true
+    service.beta.kubernetes.io/scw-loadbalancer-use-hostname: true

k8s/M6-rocky-ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: rocky
+  namespace: rocky-test
+spec:
+  ingressClassName: "nginx"
+  rules:
+    - host: rocky.test.mybestdomain.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: web
+                port:
+                  number: 80
+

slides/k8s/M6-T05-ingress-config.md

@@ -0,0 +1,240 @@
+# T05- Configuring ingress for **_🎸ROCKY_** app
+
+🍾 **_🎸ROCKY_** team has just deployed its `v1.0.0`
+
+We would like to reach it from our workstations  
+The regular way to do it in Kubernetes is to configure an `Ingress` resource.
+
+- `Ingress` is an abstract resource that manages how services are exposed outside of the Kubernetes cluster (Layer 7).  
+- It relies on `ingress-controller`(s) that are technical solutions to handle all the rules related to ingress.
+
+- Available features vary, depending on the `ingress-controller`: load-balancing, networking, firewalling, API management, throttling, TLS encryption, etc.
+- `ingress-controller` may provision Cloud _IaaS_ network resources such as load-balancer, persistent IPs, etc.
+
+---
+
+## 🔍 Ingress -- for more info
+
+Please, refer to the [`Ingress` chapter in the High Five M2 module](./2.yml.html#toc-exposing-http-services-with-ingress-resources)
+
+---
+
+## Installing `ingress-nginx` as our `ingress-controller`
+
+We'll use `ingress-nginx` (relying on `NGinX`), quite a popular choice.
+
+- It is able to provision IaaS load-balancer in ScaleWay Cloud services
+- As a reverse-proxy, it is able to balance HTTP connections on an on-premises cluster
+
+**_⚙️OPS_** Team add this new install to its `Flux` config. repo
+
+---
+
+### Creating a `Github` source in Flux for `ingress-nginx`
+
+.lab[
+
+```bash
+k8s@shpod:~/fleet-config-using-flux-XXXXX$             \
+    mkdir -p ./clusters/CLOUDY/ingress-nginx &&        \
+    flux create source git ingress-nginx               \
+    --namespace=ingress-nginx                          \
+    --url=https://github.com/kubernetes/ingress-nginx/ \
+    --branch=release-1.12                              \
+    --export > ./clusters/CLOUDY/ingress-nginx/sync.yaml
+```
+
+]
+
+---
+
+### Creating `kustomization` in Flux for `ingress-nginx`
+
+.lab[
+
+```bash
+k8s@shpod:~/fleet-config-using-flux-XXXXX$ flux create kustomization ingress-nginx \
+    --namespace=ingress-nginx                                                      \
+    --source=GitRepository/ingress-nginx                                           \
+    --path="./deploy/static/provider/scw/"                                         \
+    --export >> ./clusters/CLOUDY/ingress-nginx/sync.yaml
+
+k8s@shpod:~/fleet-config-using-flux-XXXXX$ \
+    cp -p ~/container.training/k8s/M6-ingress-nginx-kustomization.yaml    \
+                    ./clusters/CLOUDY/ingress-nginx/kustomization.yaml && \
+    cp -p ~/container.training/k8s/M6-ingress-nginx-components.yaml       \
+          ~/container.training/k8s/M6-ingress-nginx-*-patch.yaml          \
+                    ./clusters/CLOUDY/ingress-nginx/
+```
+
+]
+
+---
+
+### Applying the new config
+
+.lab[
+
+```bash
+k8s@shpod:~/fleet-config-using-flux-XXXXX$ \
+    git add ./clusters/CLOUDY/ingress-nginx && \
+    git commit -m':wrench: :rocket: add Ingress-controller' && \
+    git push
+```
+
+]
+
+---
+
+class: pic
+
+![Ingress-nginx provisionned a IaaS load-balancer in Scaleway Cloud services](images/M6-ingress-nginx-scaleway-lb.png)
+
+---
+
+class: extra-details
+
+### Using external Git source
+
+💡 Note that you can directly use pubilc `Github` repository (not maintained by your company).  
+
+- If you have to alter the configuration, `Kustomize` patching capabilities might help.
+
+- Depending on the _gitflow_ this repository uses, updates will be deployed automatically to your cluster (here we're using a `release` branch).
+
+- This repo exposes a `kustomization.yaml`. Well done!
+
+---
+
+## Adding the `ingress` resource to ROCKY app
+
+.lab[
+
+- Add the new manifest to our kustomization bunch
+
+```bash
+k8s@shpod:~/fleet-config-using-flux-XXXXX$ \
+    cp -pr ~/container.training/k8s/M6-rocky-ingress.yaml ./tenants/base/rocky && \
+    echo '- M6-rocky-ingress.yaml' >> ./tenants/base/rocky/kustomization.yaml
+```
+
+- Commit and its done
+
+```bash
+k8s@shpod:~/fleet-config-using-flux-XXXXX$ \
+    git add . && \
+    git commit -m':wrench: :rocket: add Ingress' && \
+    git push
+```
+
+]
+
+---
+
+### Here is the result!
+
+After Flux reconciled the whole bunch of sources and kustomizations, you should see
+
+- `Ingress-NGinX` controller components in `ingress-nginx` namespace
+- A new `Ingress` in `rocky-test` namespace
+
+.lab[
+
+```bash
+k8s@shpod:~$ kubectl get all -n ingress-nginx && \
+             kubectl get ingress -n rocky-test
+
+k8s@shpod:~$ \
+    PublicIP=$(kubectl get ingress rocky -n rocky-test \
+                -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
+
+k8s@shpod:~$ \
+    curl --header 'rocky.test.mybestdomain.com' http://$PublicIP/
+```
+
+]
+
+---
+
+class: pic
+
+![Rocky application screenshot](images/M6-rocky-app-screenshot.png)
+
+---
+
+## Few considerations
+
+- **_⚙️OPS_** team has to decide how to manage name resolution for public IPs
+  - Scaleway propose to expose a wildcard domain for its Kubernetes clusters
+
+- Here, we chose that `Ingress-controller` (that makes sense) but `Ingress` as well were managed by **_⚙️OPS_** team.
+  - It might have been done in many different ways!
+
+---
+
+### 🗺️ Where are we in our scenario?
+
+<pre class="mermaid">
+%%{init:
+    {
+      "theme": "default",
+      "gitGraph": {
+        "mainBranchName": "OPS",
+        "mainBranchOrder": 0
+      }
+    }
+}%%
+gitGraph
+    commit id:"0" tag:"start"
+    branch ROCKY order:3
+    branch MOVY order:4
+    branch YouRHere order:5
+
+    checkout OPS
+    commit id:'Flux install on CLOUDY cluster' tag:'T01'
+    branch TEST-env order:1
+    commit id:'FLUX install on TEST' tag:'T02' type: HIGHLIGHT
+
+    checkout OPS
+    commit id:'ROCKY config.' tag:'T03'
+    commit id:'namespace isolation by RBAC'
+    checkout TEST-env
+    merge OPS id:'ROCKY tenant creation' tag:'T04'
+
+    checkout OPS
+    commit id:'ROCKY deploy. config.' tag:'R01'
+
+    checkout TEST-env
+    merge OPS id:'FLUX ready to deploy ROCKY' type: HIGHLIGHT tag:'R02'
+
+    checkout ROCKY
+    commit id:'ROCKY' tag:'v1.0.0'
+
+    checkout TEST-env
+    merge ROCKY tag:'ROCKY v1.0.0'
+
+    checkout OPS
+    commit id:'Ingress-controller config.' tag:'T05'
+    checkout TEST-env
+    merge OPS id:'Ingress-controller install' type: HIGHLIGHT tag:'T06'
+
+    checkout OPS
+    commit id:'ROCKY patch for ingress config.' tag:'R03'
+    checkout TEST-env
+    merge OPS id:'ingress config. for ROCKY app'
+
+    checkout YouRHere
+    commit id:'x'
+    checkout OPS
+    merge YouRHere id:'YOU ARE HERE'
+
+    checkout ROCKY
+    commit id:'blue color' tag:'v1.0.1'
+    checkout TEST-env
+    merge ROCKY tag:'ROCKY v1.0.1'
+
+    checkout ROCKY
+    commit id:'pink color' tag:'v1.0.2'
+    checkout TEST-env
+    merge ROCKY tag:'ROCKY v1.0.2'
+</pre>

slides/m6.yml

@@ -20,5 +20,6 @@ content:
   - k8S/M6-T02-flux-install.md
   - k8s/M6-T03-installing-tenants.md
   - k8s/M6-R01-flux_configure-ROCKY-deployment.md
+  - k8s/M6-T05-ingress-config.md
   # - k8S/M6-T01-TEST-cluster-creation.md
   # - k8S/M6-T02-1-flux-overview.md