mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
add contour chart (#17603)
Signed-off-by: pegrant <9246508+pickledrick@users.noreply.github.com>
This commit is contained in:
Peter Grant
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
ebcfe54386
commit
3c92eb19ca
@@ -0,0 +1,22 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: v1
|
||||
appVersion: "v0.15.0"
|
||||
description: Contour Ingress controller for Kubernetes
|
||||
name: contour
|
||||
version: 0.1.0
|
||||
home: https://projectcontour.io
|
||||
keywords:
|
||||
- ingress
|
||||
- envoy
|
||||
- contour
|
||||
maintainers:
|
||||
- name: pickledrick
|
||||
email: pegrant@vmware.com
|
||||
@@ -0,0 +1,6 @@
|
||||
approvers:
|
||||
- pickledrick
|
||||
- boluisa
|
||||
reviewers:
|
||||
- pickledrick
|
||||
- boluisa
|
||||
@@ -0,0 +1,118 @@
|
||||
# Contour
|
||||
|
||||
[Contour](https://github.com/heptio/contour) is an Ingress controller for Kubernetes that works by deploying the Envoy proxy as a reverse proxy and load balancer. Unlike other Ingress controllers, Contour supports dynamic configuration updates out of the box while maintaining a lightweight profile.
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-release`:
|
||||
|
||||
```bash
|
||||
$ helm install --name my-release stable/contour
|
||||
```
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `my-release` deployment:
|
||||
|
||||
```bash
|
||||
$ helm delete my-release --purge
|
||||
```
|
||||
## Upgrading the Chart
|
||||
To upgrade the `my-release` deployment:
|
||||
|
||||
```bash
|
||||
$ helm upgrade --install my-release stable/contour
|
||||
```
|
||||
|
||||
|
||||
## Configuration
|
||||
|
||||
The default configuration values for this chart are listed in `values.yaml`.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|---------------------------------------|------------------------------------- |---------------------------------------------------|
|
||||
| `contour.image.registry` | Registry for the contour container image | `gcr.io/heptio-images/contour` |
|
||||
| `contour.image.tag` | Contour image tag | `v0.15.0` |
|
||||
| `contour.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `contour.replicas` | Replica count for the contour deployment | `2` |
|
||||
| `contour.resources` | Resource definitions for the contour pods | `{}` |
|
||||
| `customResourceDefinitions.create` | Wether the release should install CRDs | `true` |
|
||||
| `envoy.image.registry` | Registry for envoy container image | `docker.io/envoyproxy/envoy-alpine` |
|
||||
| `envoy.image.tag` | Envoy image tag | `v1.11.1` |
|
||||
| `envoy.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `envoy.resources` | Resource definitions for the envoy pods | `{}` |
|
||||
| `hpa.create` | Create hpa for contour | `false` |
|
||||
| `hpa.minReplicas` | Autoscaling minimum replicaset count | `2` |
|
||||
| `hpa.maxReplicas` | Autoscaling maximum replicaset count | `15` |
|
||||
| `hpa.targetCPUUtilizationPercentage` | Threshold cpu usage | `70`
|
||||
| `init.image.registry` | Registry for the contour init container image | `gcr.io/heptio-images/contour` |
|
||||
| `init.image.tag` | Init image tag | `v0.15.0` |
|
||||
| `init.image.pullPolicy` | Image pull policy | `IfNotPresent` | |
|
||||
| `init.resources` | Resource definitions for the init pods | `{}` |
|
||||
| `rbac.create` | Wether the release should create RBAC objects | `true` |
|
||||
| `serviceType` | The type of Service Contour will use | `LoadBalancer` |
|
||||
| `service.nodePorts.http` | Desired nodePort for service of type NodePort used for http requests | nil `""` - will assign a dynamic node port |
|
||||
| `service.nodePorts.https` | Desired nodePort for service of type NodePort used for https requests | nil `""` - will assign a dynamic node port |
|
||||
| `serviceAccounts.create` | Wether the release should create Service Account objects | `true` |
|
||||
|
||||
|
||||
## Example workload
|
||||
|
||||
Start a cluster using [Kind](https://github.com/kubernetes-sigs/kind) by running the below command:
|
||||
```
|
||||
kind create cluster --name=kind
|
||||
```
|
||||
Ensure kubectl configuration is set to the newly created Kind cluster
|
||||
```
|
||||
export KUBECONFIG="$(kind get kubeconfig-path --name="kind")"
|
||||
```
|
||||
Ensure tiller has permission to install (no recommended for production)
|
||||
```
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: tiller
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: tiller
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: tiller
|
||||
namespace: kube-system
|
||||
EOF
|
||||
```
|
||||
Install tiller
|
||||
```
|
||||
helm init --service-account tiller
|
||||
```
|
||||
Install or upgrade contour
|
||||
```
|
||||
helm upgrade --install contour --namespace contour --set service.loadBalancerType=ClusterIP .
|
||||
```
|
||||
|
||||
If you don't have an application ready to run with Contour, you can explore with [kuard](https://github.com/kubernetes-up-and-running/kuard).
|
||||
|
||||
```
|
||||
kubectl apply -f https://projectcontour.io/examples/kuard.yaml
|
||||
```
|
||||
|
||||
This example specifies a default backend for all hosts, so that you can test your Contour install. It's recommended for exploration and testing only, however, because it responds to all requests regardless of the incoming DNS that is mapped. You probably want to run with specific Ingress rules for specific hostnames.
|
||||
|
||||
Get the Contour ClusterIP
|
||||
|
||||
```
|
||||
$ CLUSTER_IP=$(kubectl -n contour get svc | grep contour | awk '{print $3}')
|
||||
```
|
||||
|
||||
Access Kuard application via internal Contour Service ClusterIP
|
||||
```
|
||||
docker exec -ti kind-control-plane curl $CLUSTER_IP
|
||||
```
|
||||
@@ -0,0 +1 @@
|
||||
serviceType: NodePort
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- if eq .Values.serviceType "LoadBalancer" }}
|
||||
1. Get Contours's load balancer IP/hostname:
|
||||
|
||||
NOTE: It may take a few minutes for this to become available.
|
||||
|
||||
You can watch the status by running:
|
||||
|
||||
$ kubectl get svc {{ template "contour.fullname" . }} --namespace {{ .Release.Namespace }} -w
|
||||
|
||||
Once 'EXTERNAL-IP' is no longer '<pending>':
|
||||
|
||||
$ kubectl describe svc {{ template "contour.fullname" . }} --namespace {{ .Release.Namespace }} | grep Ingress | awk '{print $3}'
|
||||
|
||||
2. Configure DNS records corresponding to Kubernetes ingress resources to point to the load balancer IP/hostname found in step 1
|
||||
{{- end }}
|
||||
{{- if eq .Values.serviceType "NodePort" }}
|
||||
{{- if (and (not (empty .Values.service.nodePorts.https)) (not (empty .Values.service.nodePorts.http)))}}
|
||||
1. Contour is listening on the following ports on the host machine:
|
||||
|
||||
http - {{ .Values.service.nodePorts.http }}
|
||||
https - {{ .Values.service.nodePorts.https }}
|
||||
{{- else }}
|
||||
1. Contour has been started. You can find out the port numbers being used by Contour by running:
|
||||
|
||||
$ kubectl describe svc {{ template "contour.fullname" . }} --namespace {{ .Release.Namespace }}
|
||||
|
||||
{{- end }}
|
||||
|
||||
2. Configure DNS records corresponding to Kubernetes ingress resources to point to the NODE_IP/NODE_HOST
|
||||
{{- end }}
|
||||
@@ -0,0 +1,49 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "contour.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "Release.Heritage" -}}
|
||||
{{- default .Release.Service .Values.heritage }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "contour.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "contour.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "contour.labels" -}}
|
||||
app.kubernetes.io/name: {{ include "contour.name" . }}
|
||||
helm.sh/chart: {{ include "contour.chart" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,63 @@
|
||||
{{- if .Values.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "contour.fullname" . }}
|
||||
labels:
|
||||
app.kubernetes.io/name: contour
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
helm.sh/chart: {{ include "contour.chart" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- endpoints
|
||||
- nodes
|
||||
- pods
|
||||
- secrets
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups: ["contour.heptio.com"]
|
||||
resources: ["ingressroutes", "tlscertificatedelegations"]
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- put
|
||||
- post
|
||||
- patch
|
||||
- apiGroups: ["projectcontour.io"]
|
||||
resources: ["httpproxies", "tlscertificatedelegations"]
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- put
|
||||
- post
|
||||
- patch
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,19 @@
|
||||
{{- if .Values.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "contour.fullname" . }}
|
||||
labels:
|
||||
app.kubernetes.io/name: contour
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
helm.sh/chart: {{ include "contour.chart" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "contour.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "contour.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,26 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "contour.fullname" . }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ template "contour.fullname" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
helm.sh/chart: {{ include "contour.chart" . }}
|
||||
data:
|
||||
contour.yaml: |
|
||||
# should contour expect to be running inside a k8s cluster
|
||||
# incluster: true
|
||||
#
|
||||
# path to kubeconfig (if not running inside a k8s cluster)
|
||||
# kubeconfig: /path/to/.kube/config
|
||||
#
|
||||
# disable ingressroute permitInsecure field
|
||||
# disablePermitInsecure: false
|
||||
tls:
|
||||
# minimum TLS version that Contour will negotiate
|
||||
# minimum-protocol-version: "1.1"
|
||||
# The following config shows the defaults for the leader election.
|
||||
# leaderelection:
|
||||
# configmap-name: contour
|
||||
# configmap-namespace: leader-elect
|
||||
@@ -0,0 +1,139 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "contour.fullname" . }}
|
||||
app.kubernetes.io/name: contour
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
helm.sh/chart: {{ include "contour.chart" . }}
|
||||
name: {{ template "contour.fullname" . }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "contour.fullname" . }}
|
||||
replicas: 2
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "contour.fullname" . }}
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: "8002"
|
||||
prometheus.io/path: "/stats/prometheus"
|
||||
spec:
|
||||
containers:
|
||||
- image: "{{ .Values.contour.image.registry }}:{{ .Values.contour.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.contour.image.pullPolicy }}
|
||||
resources:
|
||||
{{ toYaml .Values.contour.resources | indent 10 }}
|
||||
name: contour
|
||||
command: ["contour"]
|
||||
args:
|
||||
- serve
|
||||
- --incluster
|
||||
- --insecure
|
||||
- --envoy-service-http-port=8080
|
||||
- --envoy-service-https-port=8443
|
||||
- --config-path=/config/contour.yaml
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8000
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8000
|
||||
volumeMounts:
|
||||
- name: contour-config
|
||||
mountPath: /config
|
||||
readOnly: true
|
||||
- image: "{{ .Values.envoy.image.registry }}:{{ .Values.envoy.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.envoy.image.pullPolicy }}
|
||||
resources:
|
||||
{{ toYaml .Values.envoy.resources | indent 10 }}
|
||||
name: envoy
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
- containerPort: 8443
|
||||
name: https
|
||||
command: ["envoy"]
|
||||
args:
|
||||
- --config-path /config/envoy.json
|
||||
- --service-cluster $(CONTOUR_NAMESPACE)
|
||||
- --service-node $(ENVOY_POD_NAME)
|
||||
- --log-level info
|
||||
env:
|
||||
- name: CONTOUR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: ENVOY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8002
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 3
|
||||
volumeMounts:
|
||||
- name: envoy-config
|
||||
mountPath: /config
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -c
|
||||
- --
|
||||
- echo
|
||||
- -ne
|
||||
- "POST /healthcheck/fail HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n"
|
||||
- '>/dev/tcp/localhost/9001'
|
||||
initContainers:
|
||||
- image: "{{ .Values.init.image.registry }}:{{ .Values.init.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.init.image.pullPolicy }}
|
||||
resources:
|
||||
{{ toYaml .Values.init.resources | indent 10 }}
|
||||
name: envoy-initconfig
|
||||
command: ["contour"]
|
||||
args:
|
||||
- bootstrap
|
||||
- /config/envoy.json
|
||||
volumeMounts:
|
||||
- name: envoy-config
|
||||
mountPath: /config
|
||||
env:
|
||||
- name: CONTOUR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
volumes:
|
||||
- name: envoy-config
|
||||
emptyDir: {}
|
||||
- name: contour-config
|
||||
configMap:
|
||||
name: {{ template "contour.fullname" . }}
|
||||
defaultMode: 0643
|
||||
items:
|
||||
- key: contour.yaml
|
||||
path: contour.yaml
|
||||
dnsPolicy: ClusterFirst
|
||||
serviceAccountName: {{ template "contour.fullname" . }}
|
||||
terminationGracePeriodSeconds: 30
|
||||
# The affinity stanza below tells Kubernetes to try hard not to place 2 of
|
||||
# these pods on the same node.
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app: contour
|
||||
topologyKey: kubernetes.io/hostname
|
||||
@@ -0,0 +1,20 @@
|
||||
{{- if .Values.hpa.create -}}
|
||||
apiVersion: autoscaling/v1
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "contour.fullname" . }}
|
||||
app.kubernetes.io/name: {{ template "contour.fullname" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
helm.sh/chart: {{ include "contour.chart" . }}
|
||||
name: {{ template "contour.fullname" . }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ template "contour.fullname" . }}
|
||||
minReplicas: {{ .Values.hpa.minReplicas }}
|
||||
maxReplicas: {{ .Values.hpa.maxReplicas }}
|
||||
targetCPUUtilizationPercentage: {{ .Values.hpa.targetCPUUtilizationPercentage }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,220 @@
|
||||
{{- if .Values.customResourceDefinitions.create -}}
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: httpproxies.projectcontour.io
|
||||
labels:
|
||||
component: httpproxy
|
||||
app.kubernetes.io/name: contour
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
helm.sh/chart: {{ include "contour.chart" . }}
|
||||
spec:
|
||||
group: projectcontour.io
|
||||
version: v1alpha1
|
||||
scope: Namespaced
|
||||
names:
|
||||
plural: httpproxies
|
||||
kind: HTTPProxy
|
||||
additionalPrinterColumns:
|
||||
- name: FQDN
|
||||
type: string
|
||||
description: Fully qualified domain name
|
||||
JSONPath: .spec.virtualhost.fqdn
|
||||
- name: TLS Secret
|
||||
type: string
|
||||
description: Secret with TLS credentials
|
||||
JSONPath: .spec.virtualhost.tls.secretName
|
||||
- name: First route
|
||||
type: string
|
||||
description: First routes defined
|
||||
JSONPath: .spec.routes[0].match
|
||||
- name: Status
|
||||
type: string
|
||||
description: The current status of the IngressRoute
|
||||
JSONPath: .status.currentStatus
|
||||
- name: Status Description
|
||||
type: string
|
||||
description: Description of the current status
|
||||
JSONPath: .status.description
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
spec:
|
||||
properties:
|
||||
virtualhost:
|
||||
properties:
|
||||
fqdn:
|
||||
type: string
|
||||
# This regex handles two cases:
|
||||
# 1. A reasonably well-formed FQDN, which is allowed
|
||||
# a hyphen in the top-level label (not usually
|
||||
# the case for TLDs.) This fixes https://github.com/projectcontour/contour/issues/1117
|
||||
# This is the first option in the regex.
|
||||
# 2. A bareword containing a hyphen, no periods. This fixes
|
||||
# https://github.com/projectcontour/contour/issues/755 and is the
|
||||
# second option in the regex
|
||||
pattern: ^([a-zA-Z0-9]+(-[a-zA-Z0-9]+)*\.)+[\-a-z0-9]{2,}|[\-a-z0-9]+$
|
||||
tls:
|
||||
properties:
|
||||
secretName:
|
||||
type: string
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?([\.\/][a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
minimumProtocolVersion:
|
||||
type: string
|
||||
enum:
|
||||
- "1.3"
|
||||
- "1.2"
|
||||
- "1.1"
|
||||
strategy:
|
||||
type: string
|
||||
enum:
|
||||
- RoundRobin
|
||||
- WeightedLeastRequest
|
||||
- Random
|
||||
- Cookie
|
||||
healthCheck:
|
||||
type: object
|
||||
required:
|
||||
- path
|
||||
properties:
|
||||
path:
|
||||
type: string
|
||||
pattern: ^\/.*$
|
||||
intervalSeconds:
|
||||
type: integer
|
||||
timeoutSeconds:
|
||||
type: integer
|
||||
unhealthyThresholdCount:
|
||||
type: integer
|
||||
healthyThresholdCount:
|
||||
type: integer
|
||||
tcpproxy:
|
||||
type: object
|
||||
properties:
|
||||
services:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
required:
|
||||
- name
|
||||
- port
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$ # DNS-1035 label
|
||||
port:
|
||||
type: integer
|
||||
weight:
|
||||
type: integer
|
||||
strategy:
|
||||
type: string
|
||||
enum:
|
||||
- RoundRobin
|
||||
- WeightedLeastRequest
|
||||
- Random
|
||||
- Cookie
|
||||
healthCheck:
|
||||
type: object
|
||||
required:
|
||||
- path
|
||||
properties:
|
||||
path:
|
||||
type: string
|
||||
pattern: ^\/.*$
|
||||
intervalSeconds:
|
||||
type: integer
|
||||
timeoutSeconds:
|
||||
type: integer
|
||||
unhealthyThresholdCount:
|
||||
type: integer
|
||||
healthyThresholdCount:
|
||||
type: integer
|
||||
delegate:
|
||||
type: object
|
||||
required:
|
||||
- name
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ # DNS-1123 subdomain
|
||||
namespace:
|
||||
type: string
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ # DNS-1123 label
|
||||
includes:
|
||||
type: array
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ # DNS-1123 subdomain
|
||||
namespace:
|
||||
type: string
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ # DNS-1123 label
|
||||
conditions:
|
||||
type: array
|
||||
items:
|
||||
prefix:
|
||||
type: string
|
||||
pattern: ^\/.*$
|
||||
headersMatch:
|
||||
items:
|
||||
routes:
|
||||
type: array
|
||||
items:
|
||||
required:
|
||||
- match
|
||||
properties:
|
||||
match:
|
||||
type: string
|
||||
pattern: ^\/.*$
|
||||
delegate:
|
||||
type: object
|
||||
required:
|
||||
- name
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ # DNS-1123 subdomain
|
||||
namespace:
|
||||
type: string
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ # DNS-1123 label
|
||||
services:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
required:
|
||||
- name
|
||||
- port
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$ # DNS-1035 label
|
||||
port:
|
||||
type: integer
|
||||
weight:
|
||||
type: integer
|
||||
strategy:
|
||||
type: string
|
||||
enum:
|
||||
- RoundRobin
|
||||
- WeightedLeastRequest
|
||||
- Random
|
||||
- Cookie
|
||||
healthCheck:
|
||||
type: object
|
||||
required:
|
||||
- path
|
||||
properties:
|
||||
path:
|
||||
type: string
|
||||
pattern: ^\/.*$
|
||||
intervalSeconds:
|
||||
type: integer
|
||||
timeoutSeconds:
|
||||
type: integer
|
||||
unhealthyThresholdCount:
|
||||
type: integer
|
||||
healthyThresholdCount:
|
||||
type: integer
|
||||
{{- end }}
|
||||
@@ -0,0 +1,40 @@
|
||||
{{- if .Values.customResourceDefinitions.create -}}
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: ingressroutes.contour.heptio.com
|
||||
labels:
|
||||
component: ingressroute
|
||||
app.kubernetes.io/name: contour
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
helm.sh/chart: {{ include "contour.chart" . }}
|
||||
spec:
|
||||
group: contour.heptio.com
|
||||
version: v1beta1
|
||||
scope: Namespaced
|
||||
names:
|
||||
plural: ingressroutes
|
||||
kind: IngressRoute
|
||||
additionalPrinterColumns:
|
||||
- name: FQDN
|
||||
type: string
|
||||
description: Fully qualified domain name
|
||||
JSONPath: .spec.virtualhost.fqdn
|
||||
- name: TLS Secret
|
||||
type: string
|
||||
description: Secret with TLS credentials
|
||||
JSONPath: .spec.virtualhost.tls.secretName
|
||||
- name: First route
|
||||
type: string
|
||||
description: First routes defined
|
||||
JSONPath: .spec.routes[0].match
|
||||
- name: Status
|
||||
type: string
|
||||
description: The current status of the IngressRoute
|
||||
JSONPath: .status.currentStatus
|
||||
- name: Status Description
|
||||
type: string
|
||||
description: Description of the current status
|
||||
JSONPath: .status.description
|
||||
{{- end }}
|
||||
@@ -0,0 +1,24 @@
|
||||
{{- if .Values.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "contour.fullname" . }}-certgen
|
||||
labels:
|
||||
app.kubernetes.io/name: contour
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
helm.sh/chart: {{ include "contour.chart" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- get
|
||||
- put
|
||||
- post
|
||||
- patch
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,19 @@
|
||||
{{- if .Values.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "contour.fullname" . }}-certgen
|
||||
labels:
|
||||
app.kubernetes.io/name: contour
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
helm.sh/chart: {{ include "contour.chart" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "contour.fullname" . }}-certgen
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "contour.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,34 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "contour.fullname" . }}
|
||||
annotations:
|
||||
# This annotation puts the AWS ELB into "TCP" mode so that it does not
|
||||
# do HTTP negotiation for HTTPS connections at the ELB edge.
|
||||
# The downside of this is the remote IP address of all connections will
|
||||
# appear to be the internal address of the ELB. See docs/proxy-proto.md
|
||||
# for information about enabling the PROXY protocol on the ELB to recover
|
||||
# the original remote IP address.
|
||||
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
|
||||
|
||||
# Scrape metrics for the contour container
|
||||
# The envoy container is scraped by annotations on the pod spec
|
||||
prometheus.io/port: "8000"
|
||||
prometheus.io/scrape: "true"
|
||||
spec:
|
||||
ports:
|
||||
- port: 80
|
||||
name: http
|
||||
{{- if (and (eq .Values.serviceType "NodePort") (not (empty .Values.service.nodePorts.http)))}}
|
||||
nodePort: {{ .Values.service.nodePorts.http }}
|
||||
{{- end }}
|
||||
targetPort: http
|
||||
- port: 443
|
||||
name: https
|
||||
{{- if (and (eq .Values.serviceType "NodePort") (not (empty .Values.service.nodePorts.https)))}}
|
||||
nodePort: {{ .Values.service.nodePorts.https }}
|
||||
{{- end }}
|
||||
targetPort: https
|
||||
selector:
|
||||
app: {{ template "contour.fullname" . }}
|
||||
type: {{ .Values.serviceType }}
|
||||
@@ -0,0 +1,11 @@
|
||||
{{- if .Values.serviceAccounts.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ template "contour.fullname" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
helm.sh/chart: {{ include "contour.chart" . }}
|
||||
name: {{ template "contour.fullname" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,36 @@
|
||||
{{- if .Values.customResourceDefinitions.create -}}
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: tlscertificatedelegations.projectcontour.io
|
||||
labels:
|
||||
component: tlscertificatedelegation
|
||||
app.kubernetes.io/name: contour
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
helm.sh/chart: {{ include "contour.chart" . }}
|
||||
spec:
|
||||
group: projectcontour.io
|
||||
version: v1alpha1
|
||||
scope: Namespaced
|
||||
names:
|
||||
plural: tlscertificatedelegations
|
||||
kind: TLSCertificateDelegation
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
spec:
|
||||
properties:
|
||||
delegations:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
required:
|
||||
- secretName
|
||||
- targetNamespaces
|
||||
properties:
|
||||
match:
|
||||
type: string
|
||||
targetNamespaces:
|
||||
type: array
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ include "contour.fullname" . }}-test-connection"
|
||||
labels:
|
||||
{{ include "contour.labels" . | indent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": test-success
|
||||
spec:
|
||||
containers:
|
||||
- name: wget
|
||||
image: busybox
|
||||
command: ['wget']
|
||||
args: ['{{ include "contour.fullname" . }}:{{ .Values.service.port }}']
|
||||
restartPolicy: Never
|
||||
@@ -0,0 +1,50 @@
|
||||
contour:
|
||||
image:
|
||||
registry: gcr.io/heptio-images/contour
|
||||
tag: v0.15.0
|
||||
pullPolicy: IfNotPresent
|
||||
replicas: 2
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: "400m"
|
||||
# requests:
|
||||
# cpu: "200m"
|
||||
customResourceDefinitions:
|
||||
create: true
|
||||
envoy:
|
||||
image:
|
||||
registry: docker.io/envoyproxy/envoy
|
||||
tag: v1.11.1
|
||||
pullPolicy: IfNotPresent
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: "400m"
|
||||
# requests:
|
||||
# cpu: "200m"
|
||||
hpa:
|
||||
create: false
|
||||
# minReplicas: 2
|
||||
# maxReplicas: 15
|
||||
# targetCPUUtilizationPercentage: 70
|
||||
init:
|
||||
image:
|
||||
registry: gcr.io/heptio-images/contour
|
||||
tag: v0.15.0
|
||||
pullPolicy: IfNotPresent
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: "400m"
|
||||
# requests:
|
||||
# cpu: "200m"
|
||||
rbac:
|
||||
create: true
|
||||
serviceType: LoadBalancer
|
||||
service:
|
||||
## Further config for service of type NodePort
|
||||
## Default config with empty string "" will assign a dynamic
|
||||
## nodePort to http and https ports
|
||||
nodePorts:
|
||||
http: ""
|
||||
https: ""
|
||||
serviceAccounts:
|
||||
create: true
|
||||
Reference in New Issue
Block a user