[stable/kong] misc improvements (#17852)

- Unify controller and proxy deployment together to simplify the
- Deployment is available under apps/v1 apiVersion since Kubernetes 1.9
  (almost 2 years ago).
  Deployments under extensions/v1beta1 apiVersion are no longer served by
  default from kubernetes 1.16 onwards.
  deployment and debugging
- Fix bug in readiness probe of the controller
- Fix bug in configuring readiness/liveness/resources for controller
- reduce initialprobedelays to 10seconds; the init-container makes sure
  that the db connectivity is correctly established
- Fix smpt_password_secret typo

Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>

stable/kong/Chart.yaml

@@ -12,5 +12,5 @@ maintainers:
 name: kong
 sources:
 - https://github.com/Kong/kong
-version: 0.19.2
+version: 0.20.0
 appVersion: 1.3

stable/kong/ci/ingressController-dbless.yaml

@@ -0,0 +1,7 @@
+# CI test for Ingress controller basic installation
+ingressController:
+  enabled: true
+env:
+  database: "off"
+postgresql:
+  enabled: false

stable/kong/templates/_helpers.tpl

@@ -192,27 +192,12 @@ Create the ingress servicePort value string
         fieldPath: metadata.namespace
   image: "{{ .Values.ingressController.image.repository }}:{{ .Values.ingressController.image.tag }}"
   imagePullPolicy: {{ .Values.image.pullPolicy }}
-  livenessProbe:
-    failureThreshold: 3
-    httpGet:
-      path: /healthz
-      port: 10254
-      scheme: HTTP
-    initialDelaySeconds: 30
-    periodSeconds: 10
-    successThreshold: 1
-    timeoutSeconds: 1
   readinessProbe:
-    failureThreshold: 3
-    httpGet:
-      path: /healthz
-      port: 10254
-      scheme: HTTP
-    periodSeconds: 10
-    successThreshold: 1
-    timeoutSeconds: 1
+{{ toYaml .Values.ingressController.readinessProbe | indent 4 }}
+  livenessProbe:
+{{ toYaml .Values.ingressController.livenessProbe | indent 4 }}
   resources:
-{{ toYaml .Values.ingressController.resources | indent 10 }}
+{{ toYaml .Values.ingressController.resources | indent 4 }}
 {{- end -}}
 
 {{/*

stable/kong/templates/controller-deployment.yaml

@@ -1,108 +0,0 @@
-{{- if (and (.Values.ingressController.enabled) (not (eq .Values.env.database "off"))) }}
-apiVersion: apps/v1beta2
-kind: Deployment
-metadata:
-  name: "{{ template "kong.fullname" . }}-controller"
-  labels:
-    app: "{{ template "kong.name" . }}"
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-    component: "controller"
-spec:
-  replicas: {{ .Values.ingressController.replicaCount }}
-  selector:
-    matchLabels:
-      app: {{ template "kong.name" . }}
-      release: {{ .Release.Name }}
-      component: "controller"
-  template:
-    metadata:
-    {{- if .Values.podAnnotations }}
-      annotations:
-{{ toYaml .Values.podAnnotations | indent 8 }}
-    {{- end }}
-      labels:
-        app: {{ template "kong.name" . }}
-        release: {{ .Release.Name }}
-        component: "controller"
-    spec:
-      serviceAccountName: {{ template "kong.serviceAccountName" . }}
-      {{- if .Values.image.pullSecrets }}
-      imagePullSecrets:
-      {{- range .Values.image.pullSecrets }}
-        - name: {{ . }}
-      {{- end }}
-      {{- end }}
-      initContainers:
-      {{- include "kong.wait-for-db" . | nindent 6 }}
-      containers:
-      - name: admin-api
-        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-        imagePullPolicy: {{ .Values.image.pullPolicy }}
-        env:
-        - name: KONG_NGINX_HTTP_INCLUDE
-          value: /kong/servers.conf
-        - name: KONG_PROXY_LISTEN
-          value: 'off'
-        {{- if .Values.enterprise.enabled }}
-        {{- if .Values.enterprise.rbac.enabled }}
-        # TODO: uncomment this once we have a means of securely providing the
-        # controller its token using a secret.
-        #- name: KONG_ENFORCE_RBAC
-        #  value: "on"
-        {{- end }}
-        # the controller admin API should not receive requests to create admins or developers
-        # never enable SMTP on it as such
-        {{- if .Values.enterprise.smtp.enabled }}
-        - name: KONG_SMTP_MOCK
-          value: "on"
-        {{- else }}
-        - name: KONG_SMTP_MOCK
-          value: "on"
-        {{- end }}
-        {{- include "kong.license" . | nindent 8 }}
-        {{- end }}
-        {{- if .Values.admin.useTLS }}
-        - name: KONG_ADMIN_LISTEN
-          value: "0.0.0.0:{{ .Values.admin.containerPort }} ssl"
-        {{- else }}
-        - name: KONG_ADMIN_LISTEN
-          value: 0.0.0.0:{{ .Values.admin.containerPort }}
-        {{- end }}
-        {{- if .Values.postgresql.enabled }}
-        - name: KONG_PG_HOST
-          value: {{ template "kong.postgresql.fullname" . }}
-        - name: KONG_PG_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "kong.postgresql.fullname" . }}
-              key: postgresql-password
-        {{- end }}
-        {{- if .Values.cassandra.enabled }}
-        - name: KONG_CASSANDRA_CONTACT_POINTS
-          value: {{ template "kong.cassandra.fullname" . }}
-        {{- end }}
-        {{- include "kong.env" .  | indent 8 }}
-        ports:
-        - name: metrics
-          containerPort: 9542
-          protocol: TCP
-        - name: admin
-          containerPort: {{ .Values.admin.containerPort }}
-          protocol: TCP
-        volumeMounts:
-          - name: custom-nginx-template-volume
-            mountPath: /kong
-        readinessProbe:
-{{ toYaml .Values.readinessProbe | indent 10 }}
-        livenessProbe:
-{{ toYaml .Values.livenessProbe | indent 10 }}
-        resources:
-{{ toYaml .Values.resources | indent 10 }}
-      {{- include "kong.controller-container" . | nindent 6 }}
-      volumes:
-        - name: custom-nginx-template-volume
-          configMap:
-            name: {{ template "kong.fullname" . }}-default-custom-server-blocks
-{{- end -}}

stable/kong/templates/deployment.yaml

@@ -1,4 +1,4 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: "{{ template "kong.fullname" . }}"
@@ -36,7 +36,7 @@ spec:
         release: {{ .Release.Name }}
         component: app
     spec:
-      {{- if (and (.Values.ingressController.enabled) (eq .Values.env.database "off")) }}
+      {{- if .Values.ingressController.enabled }}
       serviceAccountName: {{ template "kong.serviceAccountName" . }}
       {{ end }}
       {{- if .Values.image.pullSecrets }}
@@ -50,7 +50,7 @@ spec:
       {{- include "kong.wait-for-db" . | nindent 6 }}
       {{ end }}
       containers:
-      {{- if (and (.Values.ingressController.enabled) (eq .Values.env.database "off")) }}
+      {{- if .Values.ingressController.enabled }}
       {{- include "kong.controller-container" . | nindent 6 }}
       {{ end }}
       - name: {{ template "kong.name" . }}
@@ -136,7 +136,7 @@ spec:
         - name: KONG_SMTP_PASSWORD
           valueFrom:
             secretKeyRef:
-              name: {{ .Values.enterprise.smtp.auth.smtp_password }}
+              name: {{ .Values.enterprise.smtp.auth.smtp_password_secret }}
               key: smtp_password
         {{- end }}
         {{- else }}

stable/kong/values.yaml

@@ -294,7 +294,7 @@ readinessProbe:
     path: "/status"
     port: metrics
     scheme: HTTP
-  initialDelaySeconds: 30
+  initialDelaySeconds: 10
   timeoutSeconds: 1
   periodSeconds: 10
   successThreshold: 1
@@ -307,7 +307,7 @@ livenessProbe:
     path: "/status"
     port: metrics
     scheme: HTTP
-  initialDelaySeconds: 30
+  initialDelaySeconds: 10
   timeoutSeconds: 5
   periodSeconds: 30
   successThreshold: 1
@@ -373,7 +373,7 @@ ingressController:
       path: "/healthz"
       port: 10254
       scheme: HTTP
-    initialDelaySeconds: 30
+    initialDelaySeconds: 10
     periodSeconds: 10
     successThreshold: 1
     timeoutSeconds: 5
@@ -383,10 +383,11 @@ ingressController:
       path: "/healthz"
       port: 10254
       scheme: HTTP
-      initialDelaySeconds: 30
+    initialDelaySeconds: 10
     periodSeconds: 10
     successThreshold: 1
     timeoutSeconds: 5
+  resources: {}
 
   installCRDs: true