diff --git a/k8s/M6-ingress-nginx-cm-patch.yaml b/k8s/M6-ingress-nginx-cm-patch.yaml new file mode 100644 index 00000000..37d14632 --- /dev/null +++ b/k8s/M6-ingress-nginx-cm-patch.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: ingress-nginx-controller + namespace: ingress-nginx +data: + use-forwarded-headers: true + compute-full-forwarded-for: true + use-proxy-protocol: true diff --git a/k8s/M6-ingress-nginx-components.yaml b/k8s/M6-ingress-nginx-components.yaml new file mode 100644 index 00000000..e1b18021 --- /dev/null +++ b/k8s/M6-ingress-nginx-components.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + pod-security.kubernetes.io/warn: restricted + pod-security.kubernetes.io/warn-version: latest + name: ingress-nginx diff --git a/k8s/M6-ingress-nginx-kustomization.yaml b/k8s/M6-ingress-nginx-kustomization.yaml new file mode 100644 index 00000000..70c8929c --- /dev/null +++ b/k8s/M6-ingress-nginx-kustomization.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- M6-ingress-nginx-components.yaml +- sync.yaml +patches: + - path: M6-ingress-nginx-cm-patch.yaml + target: + kind: ConfigMap + - path: M6-ingress-nginx-svc-patch.yaml + target: + kind: Service diff --git a/k8s/M6-ingress-nginx-svc-patch.yaml b/k8s/M6-ingress-nginx-svc-patch.yaml new file mode 100644 index 00000000..93d5e717 --- /dev/null +++ b/k8s/M6-ingress-nginx-svc-patch.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Service +metadata: + name: ingress-nginx-controller + namespace: ingress-nginx + annotations: + service.beta.kubernetes.io/scw-loadbalancer-proxy-protocol-v2: true + service.beta.kubernetes.io/scw-loadbalancer-use-hostname: true diff --git a/k8s/M6-rocky-ingress.yaml b/k8s/M6-rocky-ingress.yaml new file mode 100644 index 00000000..1009d513 --- /dev/null +++ b/k8s/M6-rocky-ingress.yaml @@ -0,0 +1,19 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: rocky + namespace: rocky-test +spec: + ingressClassName: "nginx" + rules: + - host: rocky.test.mybestdomain.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: web + port: + number: 80 + diff --git a/slides/images/M6-ingress-nginx-scaleway-lb.png b/slides/images/M6-ingress-nginx-scaleway-lb.png new file mode 100644 index 00000000..e2bfd79e Binary files /dev/null and b/slides/images/M6-ingress-nginx-scaleway-lb.png differ diff --git a/slides/images/M6-rocky-app-screenshot.png b/slides/images/M6-rocky-app-screenshot.png new file mode 100644 index 00000000..62be052d Binary files /dev/null and b/slides/images/M6-rocky-app-screenshot.png differ diff --git a/slides/k8s/M6-T05-ingress-config.md b/slides/k8s/M6-T05-ingress-config.md new file mode 100644 index 00000000..e313a7ef --- /dev/null +++ b/slides/k8s/M6-T05-ingress-config.md @@ -0,0 +1,240 @@ +# T05- Configuring ingress for **_🎸ROCKY_** app + +🍾 **_🎸ROCKY_** team has just deployed its `v1.0.0` + +We would like to reach it from our workstations +The regular way to do it in Kubernetes is to configure an `Ingress` resource. + +- `Ingress` is an abstract resource that manages how services are exposed outside of the Kubernetes cluster (Layer 7). +- It relies on `ingress-controller`(s) that are technical solutions to handle all the rules related to ingress. + +- Available features vary, depending on the `ingress-controller`: load-balancing, networking, firewalling, API management, throttling, TLS encryption, etc. +- `ingress-controller` may provision Cloud _IaaS_ network resources such as load-balancer, persistent IPs, etc. + +--- + +## 🔍 Ingress -- for more info + +Please, refer to the [`Ingress` chapter in the High Five M2 module](./2.yml.html#toc-exposing-http-services-with-ingress-resources) + +--- + +## Installing `ingress-nginx` as our `ingress-controller` + +We'll use `ingress-nginx` (relying on `NGinX`), quite a popular choice. + +- It is able to provision IaaS load-balancer in ScaleWay Cloud services +- As a reverse-proxy, it is able to balance HTTP connections on an on-premises cluster + +**_⚙️OPS_** Team add this new install to its `Flux` config. repo + +--- + +### Creating a `Github` source in Flux for `ingress-nginx` + +.lab[ + +```bash +k8s@shpod:~/fleet-config-using-flux-XXXXX$ \ + mkdir -p ./clusters/CLOUDY/ingress-nginx && \ + flux create source git ingress-nginx \ + --namespace=ingress-nginx \ + --url=https://github.com/kubernetes/ingress-nginx/ \ + --branch=release-1.12 \ + --export > ./clusters/CLOUDY/ingress-nginx/sync.yaml +``` + +] + +--- + +### Creating `kustomization` in Flux for `ingress-nginx` + +.lab[ + +```bash +k8s@shpod:~/fleet-config-using-flux-XXXXX$ flux create kustomization ingress-nginx \ + --namespace=ingress-nginx \ + --source=GitRepository/ingress-nginx \ + --path="./deploy/static/provider/scw/" \ + --export >> ./clusters/CLOUDY/ingress-nginx/sync.yaml + +k8s@shpod:~/fleet-config-using-flux-XXXXX$ \ + cp -p ~/container.training/k8s/M6-ingress-nginx-kustomization.yaml \ + ./clusters/CLOUDY/ingress-nginx/kustomization.yaml && \ + cp -p ~/container.training/k8s/M6-ingress-nginx-components.yaml \ + ~/container.training/k8s/M6-ingress-nginx-*-patch.yaml \ + ./clusters/CLOUDY/ingress-nginx/ +``` + +] + +--- + +### Applying the new config + +.lab[ + +```bash +k8s@shpod:~/fleet-config-using-flux-XXXXX$ \ + git add ./clusters/CLOUDY/ingress-nginx && \ + git commit -m':wrench: :rocket: add Ingress-controller' && \ + git push +``` + +] + +--- + +class: pic + +![Ingress-nginx provisionned a IaaS load-balancer in Scaleway Cloud services](images/M6-ingress-nginx-scaleway-lb.png) + +--- + +class: extra-details + +### Using external Git source + +💡 Note that you can directly use pubilc `Github` repository (not maintained by your company). + +- If you have to alter the configuration, `Kustomize` patching capabilities might help. + +- Depending on the _gitflow_ this repository uses, updates will be deployed automatically to your cluster (here we're using a `release` branch). + +- This repo exposes a `kustomization.yaml`. Well done! + +--- + +## Adding the `ingress` resource to ROCKY app + +.lab[ + +- Add the new manifest to our kustomization bunch + +```bash +k8s@shpod:~/fleet-config-using-flux-XXXXX$ \ + cp -pr ~/container.training/k8s/M6-rocky-ingress.yaml ./tenants/base/rocky && \ + echo '- M6-rocky-ingress.yaml' >> ./tenants/base/rocky/kustomization.yaml +``` + +- Commit and its done + +```bash +k8s@shpod:~/fleet-config-using-flux-XXXXX$ \ + git add . && \ + git commit -m':wrench: :rocket: add Ingress' && \ + git push +``` + +] + +--- + +### Here is the result! + +After Flux reconciled the whole bunch of sources and kustomizations, you should see + +- `Ingress-NGinX` controller components in `ingress-nginx` namespace +- A new `Ingress` in `rocky-test` namespace + +.lab[ + +```bash +k8s@shpod:~$ kubectl get all -n ingress-nginx && \ + kubectl get ingress -n rocky-test + +k8s@shpod:~$ \ + PublicIP=$(kubectl get ingress rocky -n rocky-test \ + -o jsonpath='{.status.loadBalancer.ingress[0].ip}') + +k8s@shpod:~$ \ + curl --header 'rocky.test.mybestdomain.com' http://$PublicIP/ +``` + +] + +--- + +class: pic + +![Rocky application screenshot](images/M6-rocky-app-screenshot.png) + +--- + +## Few considerations + +- **_⚙️OPS_** team has to decide how to manage name resolution for public IPs + - Scaleway propose to expose a wildcard domain for its Kubernetes clusters + +- Here, we chose that `Ingress-controller` (that makes sense) but `Ingress` as well were managed by **_⚙️OPS_** team. + - It might have been done in many different ways! + +--- + +### 🗺️ Where are we in our scenario? + +
+%%{init:
+    {
+      "theme": "default",
+      "gitGraph": {
+        "mainBranchName": "OPS",
+        "mainBranchOrder": 0
+      }
+    }
+}%%
+gitGraph
+    commit id:"0" tag:"start"
+    branch ROCKY order:3
+    branch MOVY order:4
+    branch YouRHere order:5
+
+    checkout OPS
+    commit id:'Flux install on CLOUDY cluster' tag:'T01'
+    branch TEST-env order:1
+    commit id:'FLUX install on TEST' tag:'T02' type: HIGHLIGHT
+
+    checkout OPS
+    commit id:'ROCKY config.' tag:'T03'
+    commit id:'namespace isolation by RBAC'
+    checkout TEST-env
+    merge OPS id:'ROCKY tenant creation' tag:'T04'
+
+    checkout OPS
+    commit id:'ROCKY deploy. config.' tag:'R01'
+
+    checkout TEST-env
+    merge OPS id:'FLUX ready to deploy ROCKY' type: HIGHLIGHT tag:'R02'
+
+    checkout ROCKY
+    commit id:'ROCKY' tag:'v1.0.0'
+
+    checkout TEST-env
+    merge ROCKY tag:'ROCKY v1.0.0'
+
+    checkout OPS
+    commit id:'Ingress-controller config.' tag:'T05'
+    checkout TEST-env
+    merge OPS id:'Ingress-controller install' type: HIGHLIGHT tag:'T06'
+
+    checkout OPS
+    commit id:'ROCKY patch for ingress config.' tag:'R03'
+    checkout TEST-env
+    merge OPS id:'ingress config. for ROCKY app'
+
+    checkout YouRHere
+    commit id:'x'
+    checkout OPS
+    merge YouRHere id:'YOU ARE HERE'
+
+    checkout ROCKY
+    commit id:'blue color' tag:'v1.0.1'
+    checkout TEST-env
+    merge ROCKY tag:'ROCKY v1.0.1'
+
+    checkout ROCKY
+    commit id:'pink color' tag:'v1.0.2'
+    checkout TEST-env
+    merge ROCKY tag:'ROCKY v1.0.2'
+
diff --git a/slides/m6.yml b/slides/m6.yml index 385c37ba..262900c1 100644 --- a/slides/m6.yml +++ b/slides/m6.yml @@ -20,5 +20,6 @@ content: - k8S/M6-T02-flux-install.md - k8s/M6-T03-installing-tenants.md - k8s/M6-R01-flux_configure-ROCKY-deployment.md + - k8s/M6-T05-ingress-config.md # - k8S/M6-T01-TEST-cluster-creation.md # - k8S/M6-T02-1-flux-overview.md