From e0ea352b296091ac843fb1ca9cc8e4ae6b9aed59 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Petazzoni?= Date: Tue, 5 May 2026 23:05:28 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7=20Tweak=20Kyverno=20lab?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../kyverno-ingress-domain-name-details.md | 67 +++++++++++++++---- 1 file changed, 54 insertions(+), 13 deletions(-) diff --git a/slides/exercises/kyverno-ingress-domain-name-details.md b/slides/exercises/kyverno-ingress-domain-name-details.md index 7b352911..09a20099 100644 --- a/slides/exercises/kyverno-ingress-domain-name-details.md +++ b/slides/exercises/kyverno-ingress-domain-name-details.md @@ -1,24 +1,63 @@ # Exercise — Generating Ingress With Kyverno -When a Service gets created... +User story: -*(for instance, Service `blue` in Namespace `rainbow`)* -...Automatically generate an Ingress. +*As a developer +
+(who knows about Services, but not Ingresses),* -*(for instance, with host name `blue.rainbow.MYDOMAIN.COM`)* +*I want an Ingress to be created automatically +
+(when I create a Service),* + +*so that I can access my application on a simple URL +
+(e.g. `http://..`).* --- -## Goals +## First goals -- Step 1: expose all services with a hard-coded domain name +- Write a Kyverno policy to automatically generate Ingress resources from Services -- Step 2: only expose services that have a port named `http` +- Create a Deployment + Service for a simple app (e.g. `jpetazzo/color`) -- Step 3: configure the domain name with a per-namespace ConfigMap +- Make sure that a corresponding Ingress is created when the Service is created - (e.g. `kubectl create configmap ingress-domain-name --from-literal=domain=1.2.3.4.nip.io`) +- Bonus: if an Ingress controller is installed, make sure this actually works + + (i.e. that the app can be accessed over e.g. http://blue.mynamespace.mydomain) + +--- + +## Improving things + +- What happens when deploying an app like DockerCoins? ([YAML][dockercoins-yaml]) + +- Improvements (in no specific order): + + - only create Ingresses for Services on well-known ports + + - or with specific labels / annotations + + - use the label / annotation in the Ingress host part + + - generate an HTTPRoute instead of (or in addition to) the Ingress resource + +[dockercoins-yaml]: https://raw.githubusercontent.com/jpetazzo/container.training/refs/heads/main/k8s/dockercoins.yaml + +--- + +## Stretch goals + +- Implement a way to override the domain name in a specific Namespace + + - with a ConfigMap in that Namespace + + - or with a label or annotation on the Namespace + +- Expose non-HTTP services with a TLSRoute --- @@ -26,8 +65,10 @@ When a Service gets created... - We want to use a Kyverno `generate` ClusterPolicy -- For step 1, check [Generate Resources](https://kyverno.io/docs/policy-types/cluster-policy/generate/) documentation +- Useful Kyverno documentation pages: -- For step 2, check [Preconditions](https://kyverno.io/docs/policy-types/cluster-policy/preconditions/) documentation - -- For step 3, check [External Data Sources](https://kyverno.io/docs/policy-types/cluster-policy/external-data-sources/) documentation + [Generate Resources](https://kyverno.io/docs/policy-types/cluster-policy/generate/) + | + [Preconditions](https://kyverno.io/docs/policy-types/cluster-policy/preconditions/) + | + [External Data Sources](https://kyverno.io/docs/policy-types/cluster-policy/external-data-sources/)