github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

[stable/ambassador] Make ambassador pro installable from helm chart (#13434)

Browse Source 
* Make ambassador pro installable from helm chart

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* Bump chart version

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* Fix whitespace issue

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* whitespace issue

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* No NeW lInE aT eNd Of FiLe

Signed-off-by: Noah Krause <krausenoah@gmail.com>
This commit is contained in:
nbkrause
2019-05-01 07:23:00 -07:00
committed by Kubernetes Prow Robot
parent 4cf31427ec
commit d2268926d2
9 changed files with 260 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/ambassador/Chart.yaml
+1 -1
View File
@@ -2,7 +2,7 @@ apiVersion: v1
appVersion: 0.60.2
description: A Helm chart for Datawire Ambassador
name: ambassador
version: 2.2.3
version: 2.2.4
icon: https://www.getambassador.io/images/logo.png
home: https://www.getambassador.io/
sources:
stable/ambassador/README.md
+55 -39
View File
@@ -44,45 +44,53 @@ The following tables lists the configurable parameters of the Ambassador chart a
| Parameter | Description | Default |
| ---------------------------------- | ------------------------------------------------------------------------------- | ----------------------------- |
| `adminService.create` | If `true`, create a service for Ambassador's admin UI | `true` |
| `adminService.nodePort` | If explicit NodePort for admin service is required | `true` |
| `adminService.type` | Ambassador's admin service type to be used | `ClusterIP` |
| `ambassadorConfig` | Config thats mounted to `/ambassador/ambassador-config` | `""` |
| `daemonSet` | If `true`, Create a daemonSet. By default Deployment controller will be created | `false` |
| `env` | Any additional environment variables for ambassador pods | `{}` |
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
| `image.repository` | Image | `quay.io/datawire/ambassador` |
| `image.tag` | Image tag | `0.60.2` |
| `imagePullSecrets` | Image pull secrets | `[]` |
| `namespace.name` | Set the `AMBASSADOR_NAMESPACE` environment variable | `metadata.namespace` |
| `scope.singleNamespace` | Set the `AMBASSADOR_SINGLE_NAMESPACE` environment variable | `false` |
| `podAnnotations` | Additional annotations for ambassador pods | `{}` |
| `prometheusExporter.enabled` | Prometheus exporter side-car enabled | `false` |
| `prometheusExporter.pullPolicy` | Image pull policy | `IfNotPresent` |
| `prometheusExporter.repository` | Prometheus exporter image | `prom/statsd-exporter` |
| `prometheusExporter.tag` | Prometheus exporter image | `v0.8.1` |
| `rbac.create` | If `true`, create and use RBAC resources | `true` |
| `rbac.namespaced` | If `true`, permissions are namespace-scoped rather than cluster-scoped | `false` |
| `replicaCount` | Number of Ambassador replicas | `3` |
| `resources` | CPU/memory resource requests/limits | `{}` |
| `securityContext` | Set security context for pod | `{ "runAsUser": "8888" }` |
| `service.annotations` | Annotations to apply to Ambassador service | See "Annotations" below |
| `service.externalTrafficPolicy` | Sets the external traffic policy for the service | `""` |
| `service.http.enabled` | if port 80 should be opened for service | `true` |
| `service.http.nodePort` | If explicit NodePort is required | None |
| `service.http.port` | if port 443 should be opened for service | `true` |
| `service.http.targetPort` | Sets the targetPort that maps to the service's cleartext port | `8080` |
| `service.https.enabled` | if port 443 should be opened for service | `true` |
| `service.https.nodePort` | If explicit NodePort is required | None |
| `service.https.port` | if port 443 should be opened for service | `true` |
| `service.https.targetPort` | Sets the targetPort that maps to the service's TLS port | `8443` |
| `service.loadBalancerIP` | IP address to assign (if cloud provider supports it) | `""` |
| `service.loadBalancerSourceRanges` | Passed to cloud provider load balancer if created (e.g: AWS ELB) | None |
| `service.type` | Service type to be used | `LoadBalancer` |
| `serviceAccount.create` | If `true`, create a new service account | `true` |
| `serviceAccount.name` | Service account to be used | `ambassador` |
| `volumeMounts` | Volume mounts for the ambassador service | `[]` |
| `volumes` | Volumes for the ambassador service | `[]` |
| `adminService.create` | If `true`, create a service for Ambassador's admin UI | `true` |
| `adminService.nodePort` | If explicit NodePort for admin service is required | `true` |
| `adminService.type` | Ambassador's admin service type to be used | `ClusterIP` |
| `ambassadorConfig` | Config thats mounted to `/ambassador/ambassador-config` | `""` |
| `daemonSet` | If `true`, Create a daemonSet. By default Deployment controller will be created | `false` |
| `env` | Any additional environment variables for ambassador pods | `{}` |
| `image.pullPolicy` | Ambassador image pull policy | `IfNotPresent` |
| `image.repository` | Ambassador image | `quay.io/datawire/ambassador` |
| `image.tag` | Ambassador image tag | `0.60.1` |
| `imagePullSecrets` | Image pull secrets | `[]` |
| `namespace.name` | Set the `AMBASSADOR_NAMESPACE` environment variable | `metadata.namespace` |
| `scope.singleNamespace` | Set the `AMBASSADOR_SINGLE_NAMESPACE` environment variable | `false` |
| `podAnnotations` | Additional annotations for ambassador pods | `{}` |
| `prometheusExporter.enabled` | Prometheus exporter side-car enabled | `false` |
| `prometheusExporter.pullPolicy` | Image pull policy | `IfNotPresent` |
| `prometheusExporter.repository` | Prometheus exporter image | `prom/statsd-exporter` |
| `prometheusExporter.tag` | Prometheus exporter image | `v0.8.1` |
| `rbac.create` | If `true`, create and use RBAC resources | `true` |
| `rbac.namespaced` | If `true`, permissions are namespace-scoped rather than cluster-scoped | `false` |
| `replicaCount` | Number of Ambassador replicas | `3` |
| `resources` | CPU/memory resource requests/limits | `{}` |
| `securityContext` | Set security context for pod | `{ "runAsUser": "8888" }` |
| `service.annotations` | Annotations to apply to Ambassador service | See "Annotations" below |
| `service.externalTrafficPolicy` | Sets the external traffic policy for the service | `""` |
| `service.http.enabled` | if port 80 should be opened for service | `true` |
| `service.http.nodePort` | If explicit NodePort is required | None |
| `service.http.port` | if port 443 should be opened for service | `true` |
| `service.http.targetPort` | Sets the targetPort that maps to the service's cleartext port | `8080` |
| `service.https.enabled` | if port 443 should be opened for service | `true` |
| `service.https.nodePort` | If explicit NodePort is required | None |
| `service.https.port` | if port 443 should be opened for service | `true` |
| `service.https.targetPort` | Sets the targetPort that maps to the service's TLS port | `8443` |
| `service.loadBalancerIP` | IP address to assign (if cloud provider supports it) | `""` |
| `service.loadBalancerSourceRanges` | Passed to cloud provider load balancer if created (e.g: AWS ELB) | None |
| `service.type` | Service type to be used | `LoadBalancer` |
| `serviceAccount.create` | If `true`, create a new service account | `true` |
| `serviceAccount.name` | Service account to be used | `ambassador` |
| `volumeMounts` | Volume mounts for the ambassador service | `[]` |
| `volumes` | Volumes for the ambassador service | `[]` |
| `pro.enabled` | Installs the Ambassador Pro container as a sidecar to Ambassador | `false` |
| `pro.image.repository` | Ambassador Pro image | `quay.io/datawire/ambassador_pro` |
| `pro.image.tag` | Ambassador Pro image tag | `amb-sidecar-0.4.0` |
| `pro.ports.auth` | Ambassador Pro authentication port | `8500` |
| `pro.ports.ratelimit` | Ambassador Pro ratelimit port | `8501` |
| `pro.ports.ratelimitDebug` | Debug port for Ambassador Pro ratelimit | `8502` |
| `pro.licenseKey.value` | License key for Ambassador Pro | "" |
| `pro.licenseKey.secret` | Stores the license key as a base64-encoded string in a Kubernetes secret | `false` |
**NOTE:** Make sure the configured `service.http.targetPort` and `service.https.targetPort` ports match your [Ambassador Module's](https://www.getambassador.io/reference/modules/#the-ambassador-module) `service_port` and `redirect_cleartext_from` configurations.
@@ -108,6 +116,14 @@ and remember that you'll have to escape newlines. For example, the annotation ab
service.annotations: { "getambassador.io/config": "---\napiVersion: ambassador/v1\nkind: Module\nname: ambassador\nconfig:\n service_port: 8080" }
```
### Ambassador Pro
Setting `pro.enabled: true` will install Ambassador Pro as a sidecar to Ambassador with the required CRDs and redis instance.
You must set the `pro.licenseKey.value` to the license key issued to you. Sign up for a [free trial](https://www.getambassador.io/pro/free-trial) of Ambassador Pro or [contact](https://www.getambassador.io/contact) our sales team to obtain a license key.
For most use cases, `pro.image` and `pro.ports` can be left as default.
### Specifying Values
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
stable/ambassador/templates/ambassador-pro-crd.yaml
+58
View File
@@ -0,0 +1,58 @@
{{- if .Values.pro.enabled -}}
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: filterpolicies.getambassador.io
spec:
group: getambassador.io
version: v1beta2
versions:
- name: v1beta2
served: true
storage: true
scope: Namespaced
names:
plural: filterpolicies
singular: filterpolicy
kind: FilterPolicy
shortNames:
- fp
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: filters.getambassador.io
spec:
group: getambassador.io
version: v1beta2
versions:
- name: v1beta2
served: true
storage: true
scope: Namespaced
names:
plural: filters
singular: filter
kind: Filter
shortNames:
- fil
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ratelimits.getambassador.io
spec:
group: getambassador.io
version: v1beta1
versions:
- name: v1beta1
served: true
storage: true
scope: Namespaced
names:
plural: ratelimits
singular: ratelimit
kind: RateLimit
shortNames:
- rl
{{- end -}}
stable/ambassador/templates/ambassador-pro-license-key-secret.yaml
+9
View File
@@ -0,0 +1,9 @@
{{- if .Values.pro.licenseKey.secret -}}
apiVersion: v1
kind: Secret
metadata:
name: ambassador-pro-license-key
type: Opaque
data:
key: {{ .Values.pro.licenseKey.value | b64enc }}
{{- end -}}
stable/ambassador/templates/ambassador-pro-redis.yaml
+45
View File
@@ -0,0 +1,45 @@
{{- if .Values.pro.enabled -}}
apiVersion: v1
kind: Service
metadata:
name: {{ include "ambassador.fullname" . }}-pro-redis
labels:
app.kubernetes.io/name: {{ include "ambassador.name" . }}-pro-redis
helm.sh/chart: {{ include "ambassador.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
spec:
type: ClusterIP
ports:
- port: 6379
targetPort: 6379
selector:
app.kubernetes.io/name: {{ include "ambassador.fullname" . }}-pro-redis
app.kubernetes.io/instance: {{ .Release.Name }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "ambassador.fullname" . }}-pro-redis
labels:
app.kubernetes.io/name: {{ include "ambassador.name" . }}-pro-redis
helm.sh/chart: {{ include "ambassador.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: {{ include "ambassador.name" . }}-pro-redis
app.kubernetes.io/instance: {{ .Release.Name }}
template:
metadata:
labels:
app.kubernetes.io/name: {{ include "ambassador.name" . }}-pro-redis
app.kubernetes.io/instance: {{ .Release.Name }}
spec:
containers:
- name: redis
image: redis:5.0.1
restartPolicy: Always
{{- end -}}
stable/ambassador/templates/ambassador-pro-service.yaml
+37
View File
@@ -0,0 +1,37 @@
{{- if .Values.pro.enabled -}}
apiVersion: v1
kind: Service
metadata:
name: {{ include "ambassador.fullname" . }}-pro
labels:
service: ambassador-pro
app.kubernetes.io/name: {{ include "ambassador.name" . }}
helm.sh/chart: {{ include "ambassador.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
annotations:
getambassador.io/config: |
---
apiVersion: ambassador/v1
kind: AuthService
name: ambassador-pro-auth
proto: grpc
auth_service: 127.0.0.1:{{ .Values.pro.ports.auth }}
allow_request_body: false # setting this to 'true' allows Plugin and External filters to access the body, but has performance overhead
---
# This mapping needs to exist, but is never actually followed.
apiVersion: ambassador/v1
kind: Mapping
name: callback_mapping
prefix: /callback
service: NoTaReAlSeRvIcE
---
apiVersion: ambassador/v1
kind: RateLimitService
name: ambassador-pro-ratelimit
service: 127.0.0.1:{{ .Values.pro.ports.ratelimit }}
spec:
ports:
- name: ratelimit-grpc
port: 80
{{- end -}}
stable/ambassador/templates/deployment.yaml
+33
View File
@@ -136,6 +136,39 @@ spec:
{{- end }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- if .Values.pro.enabled }}
- name: ambassador-pro
image: "{{ .Values.pro.image.repository }}:{{ .Values.pro.image.tag }}"
ports:
- name: grpc-auth
containerPort: {{ .Values.pro.ports.auth }}
- name: grpc-ratelimit
containerPort: {{ .Values.pro.ports.ratelimit }}
- name: http-debug
containerPort: {{ .Values.pro.ports.ratelimitDebug }}
env:
- name: REDIS_SOCKET_TYPE
value: tcp
- name: REDIS_URL
value: ambassador-pro-redis:6379
- name: APRO_AUTH_PORT
value: "{{ .Values.pro.ports.auth }}"
- name: GRPC_PORT
value: "{{ .Values.pro.ports.ratelimit }}"
- name: DEBUG_PORT
value: "{{ .Values.pro.ports.ratelimitDebug }}"
- name: APP_LOG_LEVEL
value: "{{ .Values.pro.logLevel }}"
- name: AMBASSADOR_LICENSE_KEY
{{- if .Values.pro.licenseKey.secret }}
valueFrom:
secretKeyRef:
name: ambassador-pro-license-key
key: key
{{ else }}
value: {{ .Values.pro.licenseKey.value }}
{{- end }}
{{- end }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
stable/ambassador/templates/rbac.yaml
+8
View File
@@ -20,6 +20,14 @@ rules:
- secrets
- endpoints
verbs: ["get", "list", "watch"]
{{- if .Values.pro.enabled }}
- apiGroups: ["getambassador.io"]
resources:
- filters
- ratelimits
- filterpolicies
verbs: ["get", "list", "watch"]
{{- end}}
---
apiVersion: rbac.authorization.k8s.io/v1beta1
{{- if .Values.rbac.namespaced }}
stable/ambassador/values.yaml
+14
View File
@@ -136,3 +136,17 @@ prometheusExporter:
# cluster_name: "$1"
ambassadorConfig: ""
pro:
enabled: false
image:
repository: quay.io/datawire/ambassador_pro
tag: amb-sidecar-0.4.0
ports:
auth: 8500
ratelimit: 8501
ratelimitDebug: 8502
logLevel: info
licenseKey:
value:
secret: false