github/container.training
1
0
Fork 0
mirror of https://github.com/jpetazzo/container.training.git synced 2026-07-18 04:19:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

🔧 Tweak Kyverno lab

Browse Source
This commit is contained in:
Jérôme Petazzoni
2026-05-05 23:05:28 +02:00
parent 21e57d94e6
commit e0ea352b29
1 changed files with 54 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
slides/exercises/kyverno-ingress-domain-name-details.md
View File

@@ -1,24 +1,63 @@
# Exercise — Generating Ingress With Kyverno
When a Service gets created...
User story:
*(for instance, Service `blue` in Namespace `rainbow`)*
...Automatically generate an Ingress.
*As a developer
<br/>
(who knows about Services, but not Ingresses),*
*(for instance, with host name `blue.rainbow.MYDOMAIN.COM`)*
*I want an Ingress to be created automatically
<br/>
(when I create a Service),*
*so that I can access my application on a simple URL
<br/>
(e.g. `http://<servicename>.<namespace>.<domain>`).*
---
## Goals
## First goals
- Step 1: expose all services with a hard-coded domain name
- Write a Kyverno policy to automatically generate Ingress resources from Services
- Step 2: only expose services that have a port named `http`
- Create a Deployment + Service for a simple app (e.g. `jpetazzo/color`)
- Step 3: configure the domain name with a per-namespace ConfigMap
- Make sure that a corresponding Ingress is created when the Service is created
(e.g. `kubectl create configmap ingress-domain-name --from-literal=domain=1.2.3.4.nip.io`)
- Bonus: if an Ingress controller is installed, make sure this actually works
(i.e. that the app can be accessed over e.g. http://blue.mynamespace.mydomain)
---
## Improving things
- What happens when deploying an app like DockerCoins? ([YAML][dockercoins-yaml])
- Improvements (in no specific order):
- only create Ingresses for Services on well-known ports
- or with specific labels / annotations
- use the label / annotation in the Ingress host part
- generate an HTTPRoute instead of (or in addition to) the Ingress resource
[dockercoins-yaml]: https://raw.githubusercontent.com/jpetazzo/container.training/refs/heads/main/k8s/dockercoins.yaml
---
## Stretch goals
- Implement a way to override the domain name in a specific Namespace
- with a ConfigMap in that Namespace
- or with a label or annotation on the Namespace
- Expose non-HTTP services with a TLSRoute
---
@@ -26,8 +65,10 @@ When a Service gets created...
- We want to use a Kyverno `generate` ClusterPolicy
- For step 1, check [Generate Resources](https://kyverno.io/docs/policy-types/cluster-policy/generate/) documentation
- Useful Kyverno documentation pages:
- For step 2, check [Preconditions](https://kyverno.io/docs/policy-types/cluster-policy/preconditions/) documentation
- For step 3, check [External Data Sources](https://kyverno.io/docs/policy-types/cluster-policy/external-data-sources/) documentation
[Generate Resources](https://kyverno.io/docs/policy-types/cluster-policy/generate/)
|
[Preconditions](https://kyverno.io/docs/policy-types/cluster-policy/preconditions/)
|
[External Data Sources](https://kyverno.io/docs/policy-types/cluster-policy/external-data-sources/)