From 3c92eb19ca198b406dae9e9e0a2edbcd3d33263a Mon Sep 17 00:00:00 2001 From: Peter Grant <9246508+pickledrick@users.noreply.github.com> Date: Sat, 16 Nov 2019 04:50:32 +1000 Subject: [PATCH] add contour chart (#17603) Signed-off-by: pegrant <9246508+pickledrick@users.noreply.github.com> --- stable/contour/.helmignore | 22 ++ stable/contour/Chart.yaml | 13 ++ stable/contour/OWNERS | 6 + stable/contour/README.md | 118 ++++++++++ stable/contour/ci/nodeport-values.yaml | 1 + stable/contour/templates/NOTES.txt | 30 +++ stable/contour/templates/_helpers.tpl | 49 ++++ stable/contour/templates/clusterrole.yaml | 63 +++++ .../contour/templates/clusterrolebinding.yaml | 19 ++ stable/contour/templates/configmap.yaml | 26 +++ stable/contour/templates/deployment.yaml | 139 +++++++++++ stable/contour/templates/hpa.yaml | 20 ++ stable/contour/templates/httpproxies.yaml | 220 ++++++++++++++++++ stable/contour/templates/ingressroutes.yaml | 40 ++++ stable/contour/templates/role.yaml | 24 ++ stable/contour/templates/rolebinding.yaml | 19 ++ stable/contour/templates/service.yaml | 34 +++ stable/contour/templates/serviceaccount.yaml | 11 + .../templates/tlscertificatedelegations.yaml | 36 +++ stable/contour/tests/test-connection.yaml | 15 ++ stable/contour/values.yaml | 50 ++++ 21 files changed, 955 insertions(+) create mode 100644 stable/contour/.helmignore create mode 100644 stable/contour/Chart.yaml create mode 100644 stable/contour/OWNERS create mode 100644 stable/contour/README.md create mode 100644 stable/contour/ci/nodeport-values.yaml create mode 100644 stable/contour/templates/NOTES.txt create mode 100644 stable/contour/templates/_helpers.tpl create mode 100644 stable/contour/templates/clusterrole.yaml create mode 100644 stable/contour/templates/clusterrolebinding.yaml create mode 100644 stable/contour/templates/configmap.yaml create mode 100644 stable/contour/templates/deployment.yaml create mode 100644 stable/contour/templates/hpa.yaml create mode 100644 stable/contour/templates/httpproxies.yaml create mode 100644 stable/contour/templates/ingressroutes.yaml create mode 100644 stable/contour/templates/role.yaml create mode 100644 stable/contour/templates/rolebinding.yaml create mode 100644 stable/contour/templates/service.yaml create mode 100644 stable/contour/templates/serviceaccount.yaml create mode 100644 stable/contour/templates/tlscertificatedelegations.yaml create mode 100644 stable/contour/tests/test-connection.yaml create mode 100644 stable/contour/values.yaml diff --git a/stable/contour/.helmignore b/stable/contour/.helmignore new file mode 100644 index 0000000000..50af031725 --- /dev/null +++ b/stable/contour/.helmignore @@ -0,0 +1,22 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/stable/contour/Chart.yaml b/stable/contour/Chart.yaml new file mode 100644 index 0000000000..47c0e8c28f --- /dev/null +++ b/stable/contour/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +appVersion: "v0.15.0" +description: Contour Ingress controller for Kubernetes +name: contour +version: 0.1.0 +home: https://projectcontour.io +keywords: + - ingress + - envoy + - contour +maintainers: + - name: pickledrick + email: pegrant@vmware.com diff --git a/stable/contour/OWNERS b/stable/contour/OWNERS new file mode 100644 index 0000000000..943615e638 --- /dev/null +++ b/stable/contour/OWNERS @@ -0,0 +1,6 @@ +approvers: +- pickledrick +- boluisa +reviewers: +- pickledrick +- boluisa diff --git a/stable/contour/README.md b/stable/contour/README.md new file mode 100644 index 0000000000..048d9e2a5c --- /dev/null +++ b/stable/contour/README.md @@ -0,0 +1,118 @@ +# Contour + +[Contour](https://github.com/heptio/contour) is an Ingress controller for Kubernetes that works by deploying the Envoy proxy as a reverse proxy and load balancer. Unlike other Ingress controllers, Contour supports dynamic configuration updates out of the box while maintaining a lightweight profile. + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```bash +$ helm install --name my-release stable/contour +``` + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```bash +$ helm delete my-release --purge +``` +## Upgrading the Chart +To upgrade the `my-release` deployment: + +```bash +$ helm upgrade --install my-release stable/contour +``` + + +## Configuration + +The default configuration values for this chart are listed in `values.yaml`. + +| Parameter | Description | Default | +|---------------------------------------|------------------------------------- |---------------------------------------------------| +| `contour.image.registry` | Registry for the contour container image | `gcr.io/heptio-images/contour` | +| `contour.image.tag` | Contour image tag | `v0.15.0` | +| `contour.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `contour.replicas` | Replica count for the contour deployment | `2` | +| `contour.resources` | Resource definitions for the contour pods | `{}` | +| `customResourceDefinitions.create` | Wether the release should install CRDs | `true` | +| `envoy.image.registry` | Registry for envoy container image | `docker.io/envoyproxy/envoy-alpine` | +| `envoy.image.tag` | Envoy image tag | `v1.11.1` | +| `envoy.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `envoy.resources` | Resource definitions for the envoy pods | `{}` | +| `hpa.create` | Create hpa for contour | `false` | +| `hpa.minReplicas` | Autoscaling minimum replicaset count | `2` | +| `hpa.maxReplicas` | Autoscaling maximum replicaset count | `15` | +| `hpa.targetCPUUtilizationPercentage` | Threshold cpu usage | `70` +| `init.image.registry` | Registry for the contour init container image | `gcr.io/heptio-images/contour` | +| `init.image.tag` | Init image tag | `v0.15.0` | +| `init.image.pullPolicy` | Image pull policy | `IfNotPresent` | | +| `init.resources` | Resource definitions for the init pods | `{}` | +| `rbac.create` | Wether the release should create RBAC objects | `true` | +| `serviceType` | The type of Service Contour will use | `LoadBalancer` | +| `service.nodePorts.http` | Desired nodePort for service of type NodePort used for http requests | nil `""` - will assign a dynamic node port | +| `service.nodePorts.https` | Desired nodePort for service of type NodePort used for https requests | nil `""` - will assign a dynamic node port | +| `serviceAccounts.create` | Wether the release should create Service Account objects | `true` | + + +## Example workload + +Start a cluster using [Kind](https://github.com/kubernetes-sigs/kind) by running the below command: +``` +kind create cluster --name=kind +``` +Ensure kubectl configuration is set to the newly created Kind cluster +``` +export KUBECONFIG="$(kind get kubeconfig-path --name="kind")" +``` +Ensure tiller has permission to install (no recommended for production) +``` +cat <': + + $ kubectl describe svc {{ template "contour.fullname" . }} --namespace {{ .Release.Namespace }} | grep Ingress | awk '{print $3}' + +2. Configure DNS records corresponding to Kubernetes ingress resources to point to the load balancer IP/hostname found in step 1 +{{- end }} +{{- if eq .Values.serviceType "NodePort" }} +{{- if (and (not (empty .Values.service.nodePorts.https)) (not (empty .Values.service.nodePorts.http)))}} +1. Contour is listening on the following ports on the host machine: + + http - {{ .Values.service.nodePorts.http }} + https - {{ .Values.service.nodePorts.https }} +{{- else }} +1. Contour has been started. You can find out the port numbers being used by Contour by running: + + $ kubectl describe svc {{ template "contour.fullname" . }} --namespace {{ .Release.Namespace }} + +{{- end }} + +2. Configure DNS records corresponding to Kubernetes ingress resources to point to the NODE_IP/NODE_HOST +{{- end }} \ No newline at end of file diff --git a/stable/contour/templates/_helpers.tpl b/stable/contour/templates/_helpers.tpl new file mode 100644 index 0000000000..64c15c9a86 --- /dev/null +++ b/stable/contour/templates/_helpers.tpl @@ -0,0 +1,49 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "contour.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- define "Release.Heritage" -}} +{{- default .Release.Service .Values.heritage }} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "contour.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "contour.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Common labels +*/}} +{{- define "contour.labels" -}} +app.kubernetes.io/name: {{ include "contour.name" . }} +helm.sh/chart: {{ include "contour.chart" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} diff --git a/stable/contour/templates/clusterrole.yaml b/stable/contour/templates/clusterrole.yaml new file mode 100644 index 0000000000..980e5e8da6 --- /dev/null +++ b/stable/contour/templates/clusterrole.yaml @@ -0,0 +1,63 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: {{ template "contour.fullname" . }} + labels: + app.kubernetes.io/name: contour + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + helm.sh/chart: {{ include "contour.chart" . }} +rules: +- apiGroups: + - "" + resources: + - configmaps + - endpoints + - nodes + - pods + - secrets + verbs: + - list + - watch +- apiGroups: + - "" + resources: + - nodes + verbs: + - get +- apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch +- apiGroups: + - extensions + resources: + - ingresses + verbs: + - get + - list + - watch +- apiGroups: ["contour.heptio.com"] + resources: ["ingressroutes", "tlscertificatedelegations"] + verbs: + - get + - list + - watch + - put + - post + - patch +- apiGroups: ["projectcontour.io"] + resources: ["httpproxies", "tlscertificatedelegations"] + verbs: + - get + - list + - watch + - put + - post + - patch +{{- end -}} diff --git a/stable/contour/templates/clusterrolebinding.yaml b/stable/contour/templates/clusterrolebinding.yaml new file mode 100644 index 0000000000..2f3ab64966 --- /dev/null +++ b/stable/contour/templates/clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: {{ template "contour.fullname" . }} + labels: + app.kubernetes.io/name: contour + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + helm.sh/chart: {{ include "contour.chart" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "contour.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ template "contour.fullname" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/stable/contour/templates/configmap.yaml b/stable/contour/templates/configmap.yaml new file mode 100644 index 0000000000..979d9746ce --- /dev/null +++ b/stable/contour/templates/configmap.yaml @@ -0,0 +1,26 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "contour.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "contour.fullname" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + helm.sh/chart: {{ include "contour.chart" . }} +data: + contour.yaml: | + # should contour expect to be running inside a k8s cluster + # incluster: true + # + # path to kubeconfig (if not running inside a k8s cluster) + # kubeconfig: /path/to/.kube/config + # + # disable ingressroute permitInsecure field + # disablePermitInsecure: false + tls: + # minimum TLS version that Contour will negotiate + # minimum-protocol-version: "1.1" + # The following config shows the defaults for the leader election. + # leaderelection: + # configmap-name: contour + # configmap-namespace: leader-elect diff --git a/stable/contour/templates/deployment.yaml b/stable/contour/templates/deployment.yaml new file mode 100644 index 0000000000..0e8bafcfa0 --- /dev/null +++ b/stable/contour/templates/deployment.yaml @@ -0,0 +1,139 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: {{ template "contour.fullname" . }} + app.kubernetes.io/name: contour + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + helm.sh/chart: {{ include "contour.chart" . }} + name: {{ template "contour.fullname" . }} +spec: + selector: + matchLabels: + app: {{ template "contour.fullname" . }} + replicas: 2 + template: + metadata: + labels: + app: {{ template "contour.fullname" . }} + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "8002" + prometheus.io/path: "/stats/prometheus" + spec: + containers: + - image: "{{ .Values.contour.image.registry }}:{{ .Values.contour.image.tag }}" + imagePullPolicy: {{ .Values.contour.image.pullPolicy }} + resources: +{{ toYaml .Values.contour.resources | indent 10 }} + name: contour + command: ["contour"] + args: + - serve + - --incluster + - --insecure + - --envoy-service-http-port=8080 + - --envoy-service-https-port=8443 + - --config-path=/config/contour.yaml + livenessProbe: + httpGet: + path: /healthz + port: 8000 + readinessProbe: + httpGet: + path: /healthz + port: 8000 + volumeMounts: + - name: contour-config + mountPath: /config + readOnly: true + - image: "{{ .Values.envoy.image.registry }}:{{ .Values.envoy.image.tag }}" + imagePullPolicy: {{ .Values.envoy.image.pullPolicy }} + resources: +{{ toYaml .Values.envoy.resources | indent 10 }} + name: envoy + ports: + - containerPort: 8080 + name: http + - containerPort: 8443 + name: https + command: ["envoy"] + args: + - --config-path /config/envoy.json + - --service-cluster $(CONTOUR_NAMESPACE) + - --service-node $(ENVOY_POD_NAME) + - --log-level info + env: + - name: CONTOUR_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: ENVOY_POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + readinessProbe: + httpGet: + path: /healthz + port: 8002 + initialDelaySeconds: 3 + periodSeconds: 3 + volumeMounts: + - name: envoy-config + mountPath: /config + lifecycle: + preStop: + exec: + command: + - bash + - -c + - -- + - echo + - -ne + - "POST /healthcheck/fail HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n" + - '>/dev/tcp/localhost/9001' + initContainers: + - image: "{{ .Values.init.image.registry }}:{{ .Values.init.image.tag }}" + imagePullPolicy: {{ .Values.init.image.pullPolicy }} + resources: +{{ toYaml .Values.init.resources | indent 10 }} + name: envoy-initconfig + command: ["contour"] + args: + - bootstrap + - /config/envoy.json + volumeMounts: + - name: envoy-config + mountPath: /config + env: + - name: CONTOUR_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + volumes: + - name: envoy-config + emptyDir: {} + - name: contour-config + configMap: + name: {{ template "contour.fullname" . }} + defaultMode: 0643 + items: + - key: contour.yaml + path: contour.yaml + dnsPolicy: ClusterFirst + serviceAccountName: {{ template "contour.fullname" . }} + terminationGracePeriodSeconds: 30 + # The affinity stanza below tells Kubernetes to try hard not to place 2 of + # these pods on the same node. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 100 + podAffinityTerm: + labelSelector: + matchLabels: + app: contour + topologyKey: kubernetes.io/hostname diff --git a/stable/contour/templates/hpa.yaml b/stable/contour/templates/hpa.yaml new file mode 100644 index 0000000000..941b4db403 --- /dev/null +++ b/stable/contour/templates/hpa.yaml @@ -0,0 +1,20 @@ +{{- if .Values.hpa.create -}} +apiVersion: autoscaling/v1 +kind: HorizontalPodAutoscaler +metadata: + labels: + app: {{ template "contour.fullname" . }} + app.kubernetes.io/name: {{ template "contour.fullname" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + helm.sh/chart: {{ include "contour.chart" . }} + name: {{ template "contour.fullname" . }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ template "contour.fullname" . }} + minReplicas: {{ .Values.hpa.minReplicas }} + maxReplicas: {{ .Values.hpa.maxReplicas }} + targetCPUUtilizationPercentage: {{ .Values.hpa.targetCPUUtilizationPercentage }} +{{- end -}} diff --git a/stable/contour/templates/httpproxies.yaml b/stable/contour/templates/httpproxies.yaml new file mode 100644 index 0000000000..d3c7dc18b4 --- /dev/null +++ b/stable/contour/templates/httpproxies.yaml @@ -0,0 +1,220 @@ +{{- if .Values.customResourceDefinitions.create -}} +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: httpproxies.projectcontour.io + labels: + component: httpproxy + app.kubernetes.io/name: contour + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + helm.sh/chart: {{ include "contour.chart" . }} +spec: + group: projectcontour.io + version: v1alpha1 + scope: Namespaced + names: + plural: httpproxies + kind: HTTPProxy + additionalPrinterColumns: + - name: FQDN + type: string + description: Fully qualified domain name + JSONPath: .spec.virtualhost.fqdn + - name: TLS Secret + type: string + description: Secret with TLS credentials + JSONPath: .spec.virtualhost.tls.secretName + - name: First route + type: string + description: First routes defined + JSONPath: .spec.routes[0].match + - name: Status + type: string + description: The current status of the IngressRoute + JSONPath: .status.currentStatus + - name: Status Description + type: string + description: Description of the current status + JSONPath: .status.description + validation: + openAPIV3Schema: + properties: + spec: + properties: + virtualhost: + properties: + fqdn: + type: string + # This regex handles two cases: + # 1. A reasonably well-formed FQDN, which is allowed + # a hyphen in the top-level label (not usually + # the case for TLDs.) This fixes https://github.com/projectcontour/contour/issues/1117 + # This is the first option in the regex. + # 2. A bareword containing a hyphen, no periods. This fixes + # https://github.com/projectcontour/contour/issues/755 and is the + # second option in the regex + pattern: ^([a-zA-Z0-9]+(-[a-zA-Z0-9]+)*\.)+[\-a-z0-9]{2,}|[\-a-z0-9]+$ + tls: + properties: + secretName: + type: string + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?([\.\/][a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + minimumProtocolVersion: + type: string + enum: + - "1.3" + - "1.2" + - "1.1" + strategy: + type: string + enum: + - RoundRobin + - WeightedLeastRequest + - Random + - Cookie + healthCheck: + type: object + required: + - path + properties: + path: + type: string + pattern: ^\/.*$ + intervalSeconds: + type: integer + timeoutSeconds: + type: integer + unhealthyThresholdCount: + type: integer + healthyThresholdCount: + type: integer + tcpproxy: + type: object + properties: + services: + type: array + items: + type: object + required: + - name + - port + properties: + name: + type: string + pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$ # DNS-1035 label + port: + type: integer + weight: + type: integer + strategy: + type: string + enum: + - RoundRobin + - WeightedLeastRequest + - Random + - Cookie + healthCheck: + type: object + required: + - path + properties: + path: + type: string + pattern: ^\/.*$ + intervalSeconds: + type: integer + timeoutSeconds: + type: integer + unhealthyThresholdCount: + type: integer + healthyThresholdCount: + type: integer + delegate: + type: object + required: + - name + properties: + name: + type: string + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ # DNS-1123 subdomain + namespace: + type: string + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ # DNS-1123 label + includes: + type: array + items: + properties: + name: + type: string + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ # DNS-1123 subdomain + namespace: + type: string + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ # DNS-1123 label + conditions: + type: array + items: + prefix: + type: string + pattern: ^\/.*$ + headersMatch: + items: + routes: + type: array + items: + required: + - match + properties: + match: + type: string + pattern: ^\/.*$ + delegate: + type: object + required: + - name + properties: + name: + type: string + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ # DNS-1123 subdomain + namespace: + type: string + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ # DNS-1123 label + services: + type: array + items: + type: object + required: + - name + - port + properties: + name: + type: string + pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$ # DNS-1035 label + port: + type: integer + weight: + type: integer + strategy: + type: string + enum: + - RoundRobin + - WeightedLeastRequest + - Random + - Cookie + healthCheck: + type: object + required: + - path + properties: + path: + type: string + pattern: ^\/.*$ + intervalSeconds: + type: integer + timeoutSeconds: + type: integer + unhealthyThresholdCount: + type: integer + healthyThresholdCount: + type: integer +{{- end }} diff --git a/stable/contour/templates/ingressroutes.yaml b/stable/contour/templates/ingressroutes.yaml new file mode 100644 index 0000000000..f8a054f098 --- /dev/null +++ b/stable/contour/templates/ingressroutes.yaml @@ -0,0 +1,40 @@ +{{- if .Values.customResourceDefinitions.create -}} +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: ingressroutes.contour.heptio.com + labels: + component: ingressroute + app.kubernetes.io/name: contour + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + helm.sh/chart: {{ include "contour.chart" . }} +spec: + group: contour.heptio.com + version: v1beta1 + scope: Namespaced + names: + plural: ingressroutes + kind: IngressRoute + additionalPrinterColumns: + - name: FQDN + type: string + description: Fully qualified domain name + JSONPath: .spec.virtualhost.fqdn + - name: TLS Secret + type: string + description: Secret with TLS credentials + JSONPath: .spec.virtualhost.tls.secretName + - name: First route + type: string + description: First routes defined + JSONPath: .spec.routes[0].match + - name: Status + type: string + description: The current status of the IngressRoute + JSONPath: .status.currentStatus + - name: Status Description + type: string + description: Description of the current status + JSONPath: .status.description +{{- end }} diff --git a/stable/contour/templates/role.yaml b/stable/contour/templates/role.yaml new file mode 100644 index 0000000000..15f8835776 --- /dev/null +++ b/stable/contour/templates/role.yaml @@ -0,0 +1,24 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + name: {{ template "contour.fullname" . }}-certgen + labels: + app.kubernetes.io/name: contour + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + helm.sh/chart: {{ include "contour.chart" . }} +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - list + - watch + - create + - get + - put + - post + - patch +{{- end -}} diff --git a/stable/contour/templates/rolebinding.yaml b/stable/contour/templates/rolebinding.yaml new file mode 100644 index 0000000000..5b7647a3ea --- /dev/null +++ b/stable/contour/templates/rolebinding.yaml @@ -0,0 +1,19 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + name: {{ template "contour.fullname" . }}-certgen + labels: + app.kubernetes.io/name: contour + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + helm.sh/chart: {{ include "contour.chart" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "contour.fullname" . }}-certgen +subjects: +- kind: ServiceAccount + name: {{ template "contour.fullname" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/stable/contour/templates/service.yaml b/stable/contour/templates/service.yaml new file mode 100644 index 0000000000..d26870d0b3 --- /dev/null +++ b/stable/contour/templates/service.yaml @@ -0,0 +1,34 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "contour.fullname" . }} + annotations: + # This annotation puts the AWS ELB into "TCP" mode so that it does not + # do HTTP negotiation for HTTPS connections at the ELB edge. + # The downside of this is the remote IP address of all connections will + # appear to be the internal address of the ELB. See docs/proxy-proto.md + # for information about enabling the PROXY protocol on the ELB to recover + # the original remote IP address. + service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp + + # Scrape metrics for the contour container + # The envoy container is scraped by annotations on the pod spec + prometheus.io/port: "8000" + prometheus.io/scrape: "true" +spec: + ports: + - port: 80 + name: http + {{- if (and (eq .Values.serviceType "NodePort") (not (empty .Values.service.nodePorts.http)))}} + nodePort: {{ .Values.service.nodePorts.http }} + {{- end }} + targetPort: http + - port: 443 + name: https + {{- if (and (eq .Values.serviceType "NodePort") (not (empty .Values.service.nodePorts.https)))}} + nodePort: {{ .Values.service.nodePorts.https }} + {{- end }} + targetPort: https + selector: + app: {{ template "contour.fullname" . }} + type: {{ .Values.serviceType }} \ No newline at end of file diff --git a/stable/contour/templates/serviceaccount.yaml b/stable/contour/templates/serviceaccount.yaml new file mode 100644 index 0000000000..9d9e1f8b02 --- /dev/null +++ b/stable/contour/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +{{- if .Values.serviceAccounts.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/name: {{ template "contour.fullname" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + helm.sh/chart: {{ include "contour.chart" . }} + name: {{ template "contour.fullname" . }} +{{- end }} diff --git a/stable/contour/templates/tlscertificatedelegations.yaml b/stable/contour/templates/tlscertificatedelegations.yaml new file mode 100644 index 0000000000..2fd06b2f3b --- /dev/null +++ b/stable/contour/templates/tlscertificatedelegations.yaml @@ -0,0 +1,36 @@ +{{- if .Values.customResourceDefinitions.create -}} +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: tlscertificatedelegations.projectcontour.io + labels: + component: tlscertificatedelegation + app.kubernetes.io/name: contour + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + helm.sh/chart: {{ include "contour.chart" . }} +spec: + group: projectcontour.io + version: v1alpha1 + scope: Namespaced + names: + plural: tlscertificatedelegations + kind: TLSCertificateDelegation + validation: + openAPIV3Schema: + properties: + spec: + properties: + delegations: + type: array + items: + type: object + required: + - secretName + - targetNamespaces + properties: + match: + type: string + targetNamespaces: + type: array +{{- end }} diff --git a/stable/contour/tests/test-connection.yaml b/stable/contour/tests/test-connection.yaml new file mode 100644 index 0000000000..fe19d81d96 --- /dev/null +++ b/stable/contour/tests/test-connection.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "contour.fullname" . }}-test-connection" + labels: +{{ include "contour.labels" . | indent 4 }} + annotations: + "helm.sh/hook": test-success +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['{{ include "contour.fullname" . }}:{{ .Values.service.port }}'] + restartPolicy: Never diff --git a/stable/contour/values.yaml b/stable/contour/values.yaml new file mode 100644 index 0000000000..d380768aee --- /dev/null +++ b/stable/contour/values.yaml @@ -0,0 +1,50 @@ +contour: + image: + registry: gcr.io/heptio-images/contour + tag: v0.15.0 + pullPolicy: IfNotPresent + replicas: 2 + resources: {} + # limits: + # cpu: "400m" + # requests: + # cpu: "200m" +customResourceDefinitions: + create: true +envoy: + image: + registry: docker.io/envoyproxy/envoy + tag: v1.11.1 + pullPolicy: IfNotPresent + resources: {} + # limits: + # cpu: "400m" + # requests: + # cpu: "200m" +hpa: + create: false + # minReplicas: 2 + # maxReplicas: 15 + # targetCPUUtilizationPercentage: 70 +init: + image: + registry: gcr.io/heptio-images/contour + tag: v0.15.0 + pullPolicy: IfNotPresent + resources: {} + # limits: + # cpu: "400m" + # requests: + # cpu: "200m" +rbac: + create: true +serviceType: LoadBalancer +service: + ## Further config for service of type NodePort + ## Default config with empty string "" will assign a dynamic + ## nodePort to http and https ports + nodePorts: + http: "" + https: "" +serviceAccounts: + create: true