From 900d6a5e33b59fbe0bdb22e3e722df05bf77d044 Mon Sep 17 00:00:00 2001 From: Markus Maga Date: Tue, 21 May 2019 02:14:41 +0200 Subject: [PATCH] [stable/ambassador] add ambassador crds and bump version to 0.70.0 (#13993) * feat: add ambassador crds and bump version to 0.70.0 Signed-off-by: Markus Maga * chore: add some changelog Signed-off-by: Markus Maga * fix: correct ci values Signed-off-by: Markus Maga * fix: only create crd in one of the tests Signed-off-by: Markus Maga * fix: update rbac so ambassador can see ambassador crds Signed-off-by: Markus Maga --- stable/ambassador/CHANGELOG.md | 150 +++++++++++++++++++ stable/ambassador/Chart.yaml | 4 +- stable/ambassador/README.md | 136 ++++++++--------- stable/ambassador/ci/ci-values.yaml | 4 + stable/ambassador/ci/default-values.yaml | 3 + stable/ambassador/templates/crds.yaml | 180 +++++++++++++++++++++++ stable/ambassador/templates/rbac.yaml | 9 +- stable/ambassador/values.yaml | 6 +- 8 files changed, 415 insertions(+), 77 deletions(-) create mode 100644 stable/ambassador/CHANGELOG.md create mode 100644 stable/ambassador/templates/crds.yaml diff --git a/stable/ambassador/CHANGELOG.md b/stable/ambassador/CHANGELOG.md new file mode 100644 index 0000000000..f8e57d314b --- /dev/null +++ b/stable/ambassador/CHANGELOG.md @@ -0,0 +1,150 @@ +# Change Log + +This file documents all notable changes to Ambassador Helm Chart. The release +numbering uses [semantic versioning](http://semver.org). + +## v2.6.0 + +### Minor Changes + +- Add ambassador CRDs! +- Update ambassador to 0.70.0 + +## v2.5.1 + +### Minor Changes + +- Update ambassador to 0.61.1 + +## v2.5.0 + +### Minor Changes + +- Add support for autoscaling using HPA, see `autoscaling` values. + +## v2.4.1 + +### Minor Changes + +- Update ambassador to 0.61.0 + +## v2.4.0 + +### Minor Changes + +- Allow configuring `hostNetwork` and `dnsPolicy` + +## v2.3.1 + +### Minor Changes + +- Adds HOST_IP environment variable + +## v2.3.0 + +### Minor Changes + +- Adds support for init containers using `initContainers` and pod labels `podLabels` + +## v2.2.5 + +### Minor Changes + +- Update ambassador to 0.60.3 + +## v2.2.4 + +### Minor Changes + +- Add support for Ambassador PRO [see readme](https://github.com/helm/charts/blob/master/stable/ambassador/README.md#ambassador-pro) + +## v2.2.3 + +### Minor Changes + +- Update ambassador to 0.60.2 + +## v2.2.2 + +### Minor Changes + +- Update ambassador to 0.60.1 + +## v2.2.1 + +### Minor Changes + +- Fix RBAC for ambassador 0.60.0 + +## v2.2.0 + +### Minor Changes + +- Update ambassador to 0.60.0 + +## v2.1.0 + +### Minor Changes + +- Added `scope.singleNamespace` for configuring ambassador to run in single namespace + +## v2.0.2 + +### Minor Changes + +- Update ambassador to 0.53.1 + +## v2.0.1 + +### Minor Changes + +- Update ambassador to 0.52.0 + +## v2.0.0 + +### Major Changes + +- Removed `ambassador.id` and `namespace.single` in favor of setting environment variables. + +## v1.1.5 + +### Minor Changes + +- Update ambassador to 0.50.3 + +## v1.1.4 + +### Minor Changes + +- support targetPort specification + +## v1.1.3 + +### Minor Changes + +- Update ambassador to 0.50.2 + +## v1.1.2 + +### Minor Changes + +- Add additional chart maintainer + +## v1.1.1 + +### Minor Changes + +- Default replicas -> 3 + +## v1.1.0 + +### Minor Changes + +- Allow RBAC to be namespaced (`rbac.namespaced`) + +## v1.0.0 + +### Major Changes + +- First release of Ambassador Helm Chart in helm/charts +- For migration see [Migrating from datawire/ambassador chart](https://github.com/helm/charts/tree/master/stable/ambassador#migrating-from-datawireambassador-chart-chart-version-0400-or-0500) diff --git a/stable/ambassador/Chart.yaml b/stable/ambassador/Chart.yaml index 4771021078..1bc1ae7a95 100644 --- a/stable/ambassador/Chart.yaml +++ b/stable/ambassador/Chart.yaml @@ -1,8 +1,8 @@ apiVersion: v1 -appVersion: 0.61.1 +appVersion: 0.70.0 description: A Helm chart for Datawire Ambassador name: ambassador -version: 2.5.1 +version: 2.6.0 icon: https://www.getambassador.io/images/logo.png home: https://www.getambassador.io/ sources: diff --git a/stable/ambassador/README.md b/stable/ambassador/README.md index e2eb882758..bf6607ff93 100755 --- a/stable/ambassador/README.md +++ b/stable/ambassador/README.md @@ -42,63 +42,65 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the Ambassador chart and their default values. -| Parameter | Description | Default | -| ---------------------------------- | ------------------------------------------------------------------------------- | ----------------------------- | -| `adminService.create` | If `true`, create a service for Ambassador's admin UI | `true` | -| `adminService.nodePort` | If explicit NodePort for admin service is required | `true` | -| `adminService.type` | Ambassador's admin service type to be used | `ClusterIP` | -| `ambassadorConfig` | Config thats mounted to `/ambassador/ambassador-config` | `""` | -| `daemonSet` | If `true`, Create a daemonSet. By default Deployment controller will be created | `false` | -| `hostNetwork` | If `true`, uses the host network, useful for on-premise setups | `false` | -| `dnsPolicy` | Dns policy, when hostNetwork set to ClusterFirstWithHostNet | `ClusterFirst` | -| `env` | Any additional environment variables for ambassador pods | `{}` | -| `image.pullPolicy` | Ambassador image pull policy | `IfNotPresent` | -| `image.repository` | Ambassador image | `quay.io/datawire/ambassador` | -| `image.tag` | Ambassador image tag | `0.61.1` | -| `imagePullSecrets` | Image pull secrets | `[]` | -| `namespace.name` | Set the `AMBASSADOR_NAMESPACE` environment variable | `metadata.namespace` | -| `scope.singleNamespace` | Set the `AMBASSADOR_SINGLE_NAMESPACE` environment variable | `false` | -| `podAnnotations` | Additional annotations for ambassador pods | `{}` | -| `podLabels` | Additional labels for ambassador pods | | -| `prometheusExporter.enabled` | Prometheus exporter side-car enabled | `false` | -| `prometheusExporter.pullPolicy` | Image pull policy | `IfNotPresent` | -| `prometheusExporter.repository` | Prometheus exporter image | `prom/statsd-exporter` | -| `prometheusExporter.tag` | Prometheus exporter image | `v0.8.1` | -| `rbac.create` | If `true`, create and use RBAC resources | `true` | -| `rbac.namespaced` | If `true`, permissions are namespace-scoped rather than cluster-scoped | `false` | -| `replicaCount` | Number of Ambassador replicas | `3` | -| `resources` | CPU/memory resource requests/limits | `{}` | -| `securityContext` | Set security context for pod | `{ "runAsUser": "8888" }` | -| `initContainers` | Containers used to initialize context for pods | `[]` | -| `service.annotations` | Annotations to apply to Ambassador service | See "Annotations" below | -| `service.externalTrafficPolicy` | Sets the external traffic policy for the service | `""` | -| `service.http.enabled` | if port 80 should be opened for service | `true` | -| `service.http.nodePort` | If explicit NodePort is required | None | -| `service.http.port` | if port 443 should be opened for service | `true` | -| `service.http.targetPort` | Sets the targetPort that maps to the service's cleartext port | `8080` | -| `service.https.enabled` | if port 443 should be opened for service | `true` | -| `service.https.nodePort` | If explicit NodePort is required | None | -| `service.https.port` | if port 443 should be opened for service | `true` | -| `service.https.targetPort` | Sets the targetPort that maps to the service's TLS port | `8443` | -| `service.loadBalancerIP` | IP address to assign (if cloud provider supports it) | `""` | -| `service.loadBalancerSourceRanges` | Passed to cloud provider load balancer if created (e.g: AWS ELB) | None | -| `service.type` | Service type to be used | `LoadBalancer` | -| `serviceAccount.create` | If `true`, create a new service account | `true` | -| `serviceAccount.name` | Service account to be used | `ambassador` | -| `volumeMounts` | Volume mounts for the ambassador service | `[]` | -| `volumes` | Volumes for the ambassador service | `[]` | -| `pro.enabled` | Installs the Ambassador Pro container as a sidecar to Ambassador | `false` | -| `pro.image.repository` | Ambassador Pro image | `quay.io/datawire/ambassador_pro` | -| `pro.image.tag` | Ambassador Pro image tag | `amb-sidecar-0.4.0` | -| `pro.ports.auth` | Ambassador Pro authentication port | `8500` | -| `pro.ports.ratelimit` | Ambassador Pro ratelimit port | `8501` | -| `pro.ports.ratelimitDebug` | Debug port for Ambassador Pro ratelimit | `8502` | -| `pro.licenseKey.value` | License key for Ambassador Pro | "" | -| `pro.licenseKey.secret` | Stores the license key as a base64-encoded string in a Kubernetes secret | `false` | -| `autoscaling.enabled` | If true, creates Horizontal Pod Autoscaler | `false` | -| `autoscaling.minReplica` | If autoscaling enabled, this field sets minimum replica count | `2` | -| `autoscaling.maxReplica` | If autoscaling enabled, this field sets maximum replica count | `5` | -| `autoscaling.metrics` | If autoscaling enabled, configure hpa metrics | | +| Parameter | Description | Default | +| ---------------------------------- | ------------------------------------------------------------------------------- | --------------------------------- | +| `adminService.create` | If `true`, create a service for Ambassador's admin UI | `true` | +| `adminService.nodePort` | If explicit NodePort for admin service is required | `true` | +| `adminService.type` | Ambassador's admin service type to be used | `ClusterIP` | +| `ambassadorConfig` | Config thats mounted to `/ambassador/ambassador-config` | `""` | +| `crds.create` | If `true`, Creates CRD resources | `true` | +| `crds.keep` | If `true`, if the ambassador CRDs should be kept when the chart is deleted | `true` | +| `daemonSet` | If `true`, Create a daemonSet. By default Deployment controller will be created | `false` | +| `hostNetwork` | If `true`, uses the host network, useful for on-premise setups | `false` | +| `dnsPolicy` | Dns policy, when hostNetwork set to ClusterFirstWithHostNet | `ClusterFirst` | +| `env` | Any additional environment variables for ambassador pods | `{}` | +| `image.pullPolicy` | Ambassador image pull policy | `IfNotPresent` | +| `image.repository` | Ambassador image | `quay.io/datawire/ambassador` | +| `image.tag` | Ambassador image tag | `0.70.0` | +| `imagePullSecrets` | Image pull secrets | `[]` | +| `namespace.name` | Set the `AMBASSADOR_NAMESPACE` environment variable | `metadata.namespace` | +| `scope.singleNamespace` | Set the `AMBASSADOR_SINGLE_NAMESPACE` environment variable | `false` | +| `podAnnotations` | Additional annotations for ambassador pods | `{}` | +| `podLabels` | Additional labels for ambassador pods | | +| `prometheusExporter.enabled` | Prometheus exporter side-car enabled | `false` | +| `prometheusExporter.pullPolicy` | Image pull policy | `IfNotPresent` | +| `prometheusExporter.repository` | Prometheus exporter image | `prom/statsd-exporter` | +| `prometheusExporter.tag` | Prometheus exporter image | `v0.8.1` | +| `rbac.create` | If `true`, create and use RBAC resources | `true` | +| `rbac.namespaced` | If `true`, permissions are namespace-scoped rather than cluster-scoped | `false` | +| `replicaCount` | Number of Ambassador replicas | `3` | +| `resources` | CPU/memory resource requests/limits | `{}` | +| `securityContext` | Set security context for pod | `{ "runAsUser": "8888" }` | +| `initContainers` | Containers used to initialize context for pods | `[]` | +| `service.annotations` | Annotations to apply to Ambassador service | See "Annotations" below | +| `service.externalTrafficPolicy` | Sets the external traffic policy for the service | `""` | +| `service.http.enabled` | if port 80 should be opened for service | `true` | +| `service.http.nodePort` | If explicit NodePort is required | None | +| `service.http.port` | if port 443 should be opened for service | `true` | +| `service.http.targetPort` | Sets the targetPort that maps to the service's cleartext port | `8080` | +| `service.https.enabled` | if port 443 should be opened for service | `true` | +| `service.https.nodePort` | If explicit NodePort is required | None | +| `service.https.port` | if port 443 should be opened for service | `true` | +| `service.https.targetPort` | Sets the targetPort that maps to the service's TLS port | `8443` | +| `service.loadBalancerIP` | IP address to assign (if cloud provider supports it) | `""` | +| `service.loadBalancerSourceRanges` | Passed to cloud provider load balancer if created (e.g: AWS ELB) | None | +| `service.type` | Service type to be used | `LoadBalancer` | +| `serviceAccount.create` | If `true`, create a new service account | `true` | +| `serviceAccount.name` | Service account to be used | `ambassador` | +| `volumeMounts` | Volume mounts for the ambassador service | `[]` | +| `volumes` | Volumes for the ambassador service | `[]` | +| `pro.enabled` | Installs the Ambassador Pro container as a sidecar to Ambassador | `false` | +| `pro.image.repository` | Ambassador Pro image | `quay.io/datawire/ambassador_pro` | +| `pro.image.tag` | Ambassador Pro image tag | `amb-sidecar-0.4.0` | +| `pro.ports.auth` | Ambassador Pro authentication port | `8500` | +| `pro.ports.ratelimit` | Ambassador Pro ratelimit port | `8501` | +| `pro.ports.ratelimitDebug` | Debug port for Ambassador Pro ratelimit | `8502` | +| `pro.licenseKey.value` | License key for Ambassador Pro | "" | +| `pro.licenseKey.secret` | Stores the license key as a base64-encoded string in a Kubernetes secret | `false` | +| `autoscaling.enabled` | If true, creates Horizontal Pod Autoscaler | `false` | +| `autoscaling.minReplica` | If autoscaling enabled, this field sets minimum replica count | `2` | +| `autoscaling.maxReplica` | If autoscaling enabled, this field sets maximum replica count | `5` | +| `autoscaling.metrics` | If autoscaling enabled, configure hpa metrics | | **NOTE:** Make sure the configured `service.http.targetPort` and `service.https.targetPort` ports match your [Ambassador Module's](https://www.getambassador.io/reference/modules/#the-ambassador-module) `service_port` and `redirect_cleartext_from` configurations. @@ -129,7 +131,7 @@ Setting `pro.enabled: true` will install Ambassador Pro as a sidecar to Ambassad You must set the `pro.licenseKey.value` to the license key issued to you. Sign up for a [free trial](https://www.getambassador.io/pro/free-trial) of Ambassador Pro or [contact](https://www.getambassador.io/contact) our sales team to obtain a license key. -For most use cases, `pro.image` and `pro.ports` can be left as default. +For most use cases, `pro.image` and `pro.ports` can be left as default. ### Specifying Values @@ -186,15 +188,15 @@ Timings values have been removed in favor of setting the env variables using `en Service ports values have changed names and target ports have new defaults. | Previous parameter | New parameter | New default value | -| --------------------------- | -------------------------- | ---------- | -| `service.enableHttp` | `service.http.enabled` | | -| `service.httpPort` | `service.http.port` | | -| `service.httpNodePort` | `service.http.nodePort` | | -| `service.targetPorts.http` | `service.http.targetPort` | `8080` | -| `service.enableHttps` | `service.https.enabled` | | -| `service.httpsPort` | `service.https.port` | | -| `service.httpsNodePort` | `service.https.nodePort` | | -| `service.targetPorts.https` | `service.https.targetPort` | `8443` | +| --------------------------- | -------------------------- | ----------------- | +| `service.enableHttp` | `service.http.enabled` | | +| `service.httpPort` | `service.http.port` | | +| `service.httpNodePort` | `service.http.nodePort` | | +| `service.targetPorts.http` | `service.http.targetPort` | `8080` | +| `service.enableHttps` | `service.https.enabled` | | +| `service.httpsPort` | `service.https.port` | | +| `service.httpsNodePort` | `service.https.nodePort` | | +| `service.targetPorts.https` | `service.https.targetPort` | `8443` | ### Exporter sidecar diff --git a/stable/ambassador/ci/ci-values.yaml b/stable/ambassador/ci/ci-values.yaml index d1d42dd5c9..c3dacb2871 100644 --- a/stable/ambassador/ci/ci-values.yaml +++ b/stable/ambassador/ci/ci-values.yaml @@ -24,3 +24,7 @@ ambassadorConfig: | name: ambassador config: service_port: 8080 + +crds: + create: false + keep: false diff --git a/stable/ambassador/ci/default-values.yaml b/stable/ambassador/ci/default-values.yaml index 8fb6aad6a2..538beacf9e 100644 --- a/stable/ambassador/ci/default-values.yaml +++ b/stable/ambassador/ci/default-values.yaml @@ -7,3 +7,6 @@ ambassadorConfig: | name: ambassador config: service_port: 8080 + +crds: + keep: false diff --git a/stable/ambassador/templates/crds.yaml b/stable/ambassador/templates/crds.yaml new file mode 100644 index 0000000000..49e79adb11 --- /dev/null +++ b/stable/ambassador/templates/crds.yaml @@ -0,0 +1,180 @@ +{{- if .Values.crds.create }} +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: authservices.getambassador.io + labels: + app.kubernetes.io/name: {{ include "ambassador.name" . }} + helm.sh/chart: {{ include "ambassador.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + {{ if .Values.crds.keep }} + annotations: + "helm.sh/resource-policy": keep + {{ end }} +spec: + group: getambassador.io + version: v1 + versions: + - name: v1 + served: true + storage: true + scope: Namespaced + names: + plural: authservices + singular: authservice + kind: AuthService +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: mappings.getambassador.io + labels: + app.kubernetes.io/name: {{ include "ambassador.name" . }} + helm.sh/chart: {{ include "ambassador.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + {{ if .Values.crds.keep }} + annotations: + "helm.sh/resource-policy": keep + {{ end }} +spec: + group: getambassador.io + version: v1 + versions: + - name: v1 + served: true + storage: true + scope: Namespaced + names: + plural: mappings + singular: mapping + kind: Mapping +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: modules.getambassador.io + labels: + app.kubernetes.io/name: {{ include "ambassador.name" . }} + helm.sh/chart: {{ include "ambassador.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +spec: + group: getambassador.io + version: v1 + versions: + - name: v1 + served: true + storage: true + scope: Namespaced + names: + plural: modules + singular: module + kind: Module +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: ratelimitservices.getambassador.io + labels: + app.kubernetes.io/name: {{ include "ambassador.name" . }} + helm.sh/chart: {{ include "ambassador.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + {{ if .Values.crds.keep }} + annotations: + "helm.sh/resource-policy": keep + {{ end }} +spec: + group: getambassador.io + version: v1 + versions: + - name: v1 + served: true + storage: true + scope: Namespaced + names: + plural: ratelimitservices + singular: ratelimitservice + kind: RateLimitService +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: tcpmappings.getambassador.io + labels: + app.kubernetes.io/name: {{ include "ambassador.name" . }} + helm.sh/chart: {{ include "ambassador.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + {{ if .Values.crds.keep }} + annotations: + "helm.sh/resource-policy": keep + {{ end }} +spec: + group: getambassador.io + version: v1 + versions: + - name: v1 + served: true + storage: true + scope: Namespaced + names: + plural: tcpmappings + singular: tcpmapping + kind: TCPMapping +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: tlscontexts.getambassador.io + labels: + app.kubernetes.io/name: {{ include "ambassador.name" . }} + helm.sh/chart: {{ include "ambassador.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + {{ if .Values.crds.keep }} + annotations: + "helm.sh/resource-policy": keep + {{ end }} +spec: + group: getambassador.io + version: v1 + versions: + - name: v1 + served: true + storage: true + scope: Namespaced + names: + plural: tlscontexts + singular: tlscontext + kind: TLSContext +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: tracingservices.getambassador.io + labels: + app.kubernetes.io/name: {{ include "ambassador.name" . }} + helm.sh/chart: {{ include "ambassador.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + {{ if .Values.crds.keep }} + annotations: + "helm.sh/resource-policy": keep + {{ end }} +spec: + group: getambassador.io + version: v1 + versions: + - name: v1 + served: true + storage: true + scope: Namespaced + names: + plural: tracingservices + singular: tracingservice + kind: TracingService +{{- end }} diff --git a/stable/ambassador/templates/rbac.yaml b/stable/ambassador/templates/rbac.yaml index 788cb080c1..5c58cfcdbb 100644 --- a/stable/ambassador/templates/rbac.yaml +++ b/stable/ambassador/templates/rbac.yaml @@ -20,14 +20,9 @@ rules: - secrets - endpoints verbs: ["get", "list", "watch"] - {{- if .Values.pro.enabled }} - - apiGroups: ["getambassador.io"] - resources: - - filters - - ratelimits - - filterpolicies + - apiGroups: [ "getambassador.io" ] + resources: [ "*" ] verbs: ["get", "list", "watch"] - {{- end}} --- apiVersion: rbac.authorization.k8s.io/v1beta1 {{- if .Values.rbac.namespaced }} diff --git a/stable/ambassador/values.yaml b/stable/ambassador/values.yaml index 55e6fed798..3e5f02e047 100644 --- a/stable/ambassador/values.yaml +++ b/stable/ambassador/values.yaml @@ -46,7 +46,7 @@ securityContext: image: repository: quay.io/datawire/ambassador - tag: 0.61.1 + tag: 0.70.0 pullPolicy: IfNotPresent nameOverride: "" @@ -173,3 +173,7 @@ pro: licenseKey: value: secret: false + +crds: + create: true + keep: true