diff --git a/k8s/M6-ingress-nginx-cm-patch.yaml b/k8s/M6-ingress-nginx-cm-patch.yaml new file mode 100644 index 00000000..37d14632 --- /dev/null +++ b/k8s/M6-ingress-nginx-cm-patch.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: ingress-nginx-controller + namespace: ingress-nginx +data: + use-forwarded-headers: true + compute-full-forwarded-for: true + use-proxy-protocol: true diff --git a/k8s/M6-ingress-nginx-components.yaml b/k8s/M6-ingress-nginx-components.yaml new file mode 100644 index 00000000..e1b18021 --- /dev/null +++ b/k8s/M6-ingress-nginx-components.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + pod-security.kubernetes.io/warn: restricted + pod-security.kubernetes.io/warn-version: latest + name: ingress-nginx diff --git a/k8s/M6-ingress-nginx-kustomization.yaml b/k8s/M6-ingress-nginx-kustomization.yaml new file mode 100644 index 00000000..70c8929c --- /dev/null +++ b/k8s/M6-ingress-nginx-kustomization.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- M6-ingress-nginx-components.yaml +- sync.yaml +patches: + - path: M6-ingress-nginx-cm-patch.yaml + target: + kind: ConfigMap + - path: M6-ingress-nginx-svc-patch.yaml + target: + kind: Service diff --git a/k8s/M6-ingress-nginx-svc-patch.yaml b/k8s/M6-ingress-nginx-svc-patch.yaml new file mode 100644 index 00000000..93d5e717 --- /dev/null +++ b/k8s/M6-ingress-nginx-svc-patch.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Service +metadata: + name: ingress-nginx-controller + namespace: ingress-nginx + annotations: + service.beta.kubernetes.io/scw-loadbalancer-proxy-protocol-v2: true + service.beta.kubernetes.io/scw-loadbalancer-use-hostname: true diff --git a/k8s/M6-rocky-ingress.yaml b/k8s/M6-rocky-ingress.yaml new file mode 100644 index 00000000..1009d513 --- /dev/null +++ b/k8s/M6-rocky-ingress.yaml @@ -0,0 +1,19 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: rocky + namespace: rocky-test +spec: + ingressClassName: "nginx" + rules: + - host: rocky.test.mybestdomain.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: web + port: + number: 80 + diff --git a/slides/images/M6-ingress-nginx-scaleway-lb.png b/slides/images/M6-ingress-nginx-scaleway-lb.png new file mode 100644 index 00000000..e2bfd79e Binary files /dev/null and b/slides/images/M6-ingress-nginx-scaleway-lb.png differ diff --git a/slides/images/M6-rocky-app-screenshot.png b/slides/images/M6-rocky-app-screenshot.png new file mode 100644 index 00000000..62be052d Binary files /dev/null and b/slides/images/M6-rocky-app-screenshot.png differ diff --git a/slides/k8s/M6-T05-ingress-config.md b/slides/k8s/M6-T05-ingress-config.md new file mode 100644 index 00000000..e313a7ef --- /dev/null +++ b/slides/k8s/M6-T05-ingress-config.md @@ -0,0 +1,240 @@ +# T05- Configuring ingress for **_🎸ROCKY_** app + +🍾 **_🎸ROCKY_** team has just deployed its `v1.0.0` + +We would like to reach it from our workstations +The regular way to do it in Kubernetes is to configure an `Ingress` resource. + +- `Ingress` is an abstract resource that manages how services are exposed outside of the Kubernetes cluster (Layer 7). +- It relies on `ingress-controller`(s) that are technical solutions to handle all the rules related to ingress. + +- Available features vary, depending on the `ingress-controller`: load-balancing, networking, firewalling, API management, throttling, TLS encryption, etc. +- `ingress-controller` may provision Cloud _IaaS_ network resources such as load-balancer, persistent IPs, etc. + +--- + +## 🔍 Ingress -- for more info + +Please, refer to the [`Ingress` chapter in the High Five M2 module](./2.yml.html#toc-exposing-http-services-with-ingress-resources) + +--- + +## Installing `ingress-nginx` as our `ingress-controller` + +We'll use `ingress-nginx` (relying on `NGinX`), quite a popular choice. + +- It is able to provision IaaS load-balancer in ScaleWay Cloud services +- As a reverse-proxy, it is able to balance HTTP connections on an on-premises cluster + +**_⚙️OPS_** Team add this new install to its `Flux` config. repo + +--- + +### Creating a `Github` source in Flux for `ingress-nginx` + +.lab[ + +```bash +k8s@shpod:~/fleet-config-using-flux-XXXXX$ \ + mkdir -p ./clusters/CLOUDY/ingress-nginx && \ + flux create source git ingress-nginx \ + --namespace=ingress-nginx \ + --url=https://github.com/kubernetes/ingress-nginx/ \ + --branch=release-1.12 \ + --export > ./clusters/CLOUDY/ingress-nginx/sync.yaml +``` + +] + +--- + +### Creating `kustomization` in Flux for `ingress-nginx` + +.lab[ + +```bash +k8s@shpod:~/fleet-config-using-flux-XXXXX$ flux create kustomization ingress-nginx \ + --namespace=ingress-nginx \ + --source=GitRepository/ingress-nginx \ + --path="./deploy/static/provider/scw/" \ + --export >> ./clusters/CLOUDY/ingress-nginx/sync.yaml + +k8s@shpod:~/fleet-config-using-flux-XXXXX$ \ + cp -p ~/container.training/k8s/M6-ingress-nginx-kustomization.yaml \ + ./clusters/CLOUDY/ingress-nginx/kustomization.yaml && \ + cp -p ~/container.training/k8s/M6-ingress-nginx-components.yaml \ + ~/container.training/k8s/M6-ingress-nginx-*-patch.yaml \ + ./clusters/CLOUDY/ingress-nginx/ +``` + +] + +--- + +### Applying the new config + +.lab[ + +```bash +k8s@shpod:~/fleet-config-using-flux-XXXXX$ \ + git add ./clusters/CLOUDY/ingress-nginx && \ + git commit -m':wrench: :rocket: add Ingress-controller' && \ + git push +``` + +] + +--- + +class: pic + + + +--- + +class: extra-details + +### Using external Git source + +💡 Note that you can directly use pubilc `Github` repository (not maintained by your company). + +- If you have to alter the configuration, `Kustomize` patching capabilities might help. + +- Depending on the _gitflow_ this repository uses, updates will be deployed automatically to your cluster (here we're using a `release` branch). + +- This repo exposes a `kustomization.yaml`. Well done! + +--- + +## Adding the `ingress` resource to ROCKY app + +.lab[ + +- Add the new manifest to our kustomization bunch + +```bash +k8s@shpod:~/fleet-config-using-flux-XXXXX$ \ + cp -pr ~/container.training/k8s/M6-rocky-ingress.yaml ./tenants/base/rocky && \ + echo '- M6-rocky-ingress.yaml' >> ./tenants/base/rocky/kustomization.yaml +``` + +- Commit and its done + +```bash +k8s@shpod:~/fleet-config-using-flux-XXXXX$ \ + git add . && \ + git commit -m':wrench: :rocket: add Ingress' && \ + git push +``` + +] + +--- + +### Here is the result! + +After Flux reconciled the whole bunch of sources and kustomizations, you should see + +- `Ingress-NGinX` controller components in `ingress-nginx` namespace +- A new `Ingress` in `rocky-test` namespace + +.lab[ + +```bash +k8s@shpod:~$ kubectl get all -n ingress-nginx && \ + kubectl get ingress -n rocky-test + +k8s@shpod:~$ \ + PublicIP=$(kubectl get ingress rocky -n rocky-test \ + -o jsonpath='{.status.loadBalancer.ingress[0].ip}') + +k8s@shpod:~$ \ + curl --header 'rocky.test.mybestdomain.com' http://$PublicIP/ +``` + +] + +--- + +class: pic + + + +--- + +## Few considerations + +- **_⚙️OPS_** team has to decide how to manage name resolution for public IPs + - Scaleway propose to expose a wildcard domain for its Kubernetes clusters + +- Here, we chose that `Ingress-controller` (that makes sense) but `Ingress` as well were managed by **_⚙️OPS_** team. + - It might have been done in many different ways! + +--- + +### 🗺️ Where are we in our scenario? + +
+%%{init:
+ {
+ "theme": "default",
+ "gitGraph": {
+ "mainBranchName": "OPS",
+ "mainBranchOrder": 0
+ }
+ }
+}%%
+gitGraph
+ commit id:"0" tag:"start"
+ branch ROCKY order:3
+ branch MOVY order:4
+ branch YouRHere order:5
+
+ checkout OPS
+ commit id:'Flux install on CLOUDY cluster' tag:'T01'
+ branch TEST-env order:1
+ commit id:'FLUX install on TEST' tag:'T02' type: HIGHLIGHT
+
+ checkout OPS
+ commit id:'ROCKY config.' tag:'T03'
+ commit id:'namespace isolation by RBAC'
+ checkout TEST-env
+ merge OPS id:'ROCKY tenant creation' tag:'T04'
+
+ checkout OPS
+ commit id:'ROCKY deploy. config.' tag:'R01'
+
+ checkout TEST-env
+ merge OPS id:'FLUX ready to deploy ROCKY' type: HIGHLIGHT tag:'R02'
+
+ checkout ROCKY
+ commit id:'ROCKY' tag:'v1.0.0'
+
+ checkout TEST-env
+ merge ROCKY tag:'ROCKY v1.0.0'
+
+ checkout OPS
+ commit id:'Ingress-controller config.' tag:'T05'
+ checkout TEST-env
+ merge OPS id:'Ingress-controller install' type: HIGHLIGHT tag:'T06'
+
+ checkout OPS
+ commit id:'ROCKY patch for ingress config.' tag:'R03'
+ checkout TEST-env
+ merge OPS id:'ingress config. for ROCKY app'
+
+ checkout YouRHere
+ commit id:'x'
+ checkout OPS
+ merge YouRHere id:'YOU ARE HERE'
+
+ checkout ROCKY
+ commit id:'blue color' tag:'v1.0.1'
+ checkout TEST-env
+ merge ROCKY tag:'ROCKY v1.0.1'
+
+ checkout ROCKY
+ commit id:'pink color' tag:'v1.0.2'
+ checkout TEST-env
+ merge ROCKY tag:'ROCKY v1.0.2'
+
diff --git a/slides/m6.yml b/slides/m6.yml
index 385c37ba..262900c1 100644
--- a/slides/m6.yml
+++ b/slides/m6.yml
@@ -20,5 +20,6 @@ content:
- k8S/M6-T02-flux-install.md
- k8s/M6-T03-installing-tenants.md
- k8s/M6-R01-flux_configure-ROCKY-deployment.md
+ - k8s/M6-T05-ingress-config.md
# - k8S/M6-T01-TEST-cluster-creation.md
# - k8S/M6-T02-1-flux-overview.md