From d2268926d2a90ab08dd922665ede4c960bd8fbbd Mon Sep 17 00:00:00 2001 From: nbkrause Date: Wed, 1 May 2019 10:23:00 -0400 Subject: [PATCH] [stable/ambassador] Make ambassador pro installable from helm chart (#13434) * Make ambassador pro installable from helm chart Signed-off-by: Noah Krause * Bump chart version Signed-off-by: Noah Krause * Fix whitespace issue Signed-off-by: Noah Krause * whitespace issue Signed-off-by: Noah Krause * No NeW lInE aT eNd Of FiLe Signed-off-by: Noah Krause --- stable/ambassador/Chart.yaml | 2 +- stable/ambassador/README.md | 94 +++++++++++-------- .../templates/ambassador-pro-crd.yaml | 58 ++++++++++++ .../ambassador-pro-license-key-secret.yaml | 9 ++ .../templates/ambassador-pro-redis.yaml | 45 +++++++++ .../templates/ambassador-pro-service.yaml | 37 ++++++++ stable/ambassador/templates/deployment.yaml | 33 +++++++ stable/ambassador/templates/rbac.yaml | 8 ++ stable/ambassador/values.yaml | 14 +++ 9 files changed, 260 insertions(+), 40 deletions(-) create mode 100644 stable/ambassador/templates/ambassador-pro-crd.yaml create mode 100644 stable/ambassador/templates/ambassador-pro-license-key-secret.yaml create mode 100644 stable/ambassador/templates/ambassador-pro-redis.yaml create mode 100644 stable/ambassador/templates/ambassador-pro-service.yaml diff --git a/stable/ambassador/Chart.yaml b/stable/ambassador/Chart.yaml index 7d8011c035..e8691efd32 100644 --- a/stable/ambassador/Chart.yaml +++ b/stable/ambassador/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v1 appVersion: 0.60.2 description: A Helm chart for Datawire Ambassador name: ambassador -version: 2.2.3 +version: 2.2.4 icon: https://www.getambassador.io/images/logo.png home: https://www.getambassador.io/ sources: diff --git a/stable/ambassador/README.md b/stable/ambassador/README.md index 7b95c1584e..69a59d6984 100755 --- a/stable/ambassador/README.md +++ b/stable/ambassador/README.md @@ -44,45 +44,53 @@ The following tables lists the configurable parameters of the Ambassador chart a | Parameter | Description | Default | | ---------------------------------- | ------------------------------------------------------------------------------- | ----------------------------- | -| `adminService.create` | If `true`, create a service for Ambassador's admin UI | `true` | -| `adminService.nodePort` | If explicit NodePort for admin service is required | `true` | -| `adminService.type` | Ambassador's admin service type to be used | `ClusterIP` | -| `ambassadorConfig` | Config thats mounted to `/ambassador/ambassador-config` | `""` | -| `daemonSet` | If `true`, Create a daemonSet. By default Deployment controller will be created | `false` | -| `env` | Any additional environment variables for ambassador pods | `{}` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.repository` | Image | `quay.io/datawire/ambassador` | -| `image.tag` | Image tag | `0.60.2` | -| `imagePullSecrets` | Image pull secrets | `[]` | -| `namespace.name` | Set the `AMBASSADOR_NAMESPACE` environment variable | `metadata.namespace` | -| `scope.singleNamespace` | Set the `AMBASSADOR_SINGLE_NAMESPACE` environment variable | `false` | -| `podAnnotations` | Additional annotations for ambassador pods | `{}` | -| `prometheusExporter.enabled` | Prometheus exporter side-car enabled | `false` | -| `prometheusExporter.pullPolicy` | Image pull policy | `IfNotPresent` | -| `prometheusExporter.repository` | Prometheus exporter image | `prom/statsd-exporter` | -| `prometheusExporter.tag` | Prometheus exporter image | `v0.8.1` | -| `rbac.create` | If `true`, create and use RBAC resources | `true` | -| `rbac.namespaced` | If `true`, permissions are namespace-scoped rather than cluster-scoped | `false` | -| `replicaCount` | Number of Ambassador replicas | `3` | -| `resources` | CPU/memory resource requests/limits | `{}` | -| `securityContext` | Set security context for pod | `{ "runAsUser": "8888" }` | -| `service.annotations` | Annotations to apply to Ambassador service | See "Annotations" below | -| `service.externalTrafficPolicy` | Sets the external traffic policy for the service | `""` | -| `service.http.enabled` | if port 80 should be opened for service | `true` | -| `service.http.nodePort` | If explicit NodePort is required | None | -| `service.http.port` | if port 443 should be opened for service | `true` | -| `service.http.targetPort` | Sets the targetPort that maps to the service's cleartext port | `8080` | -| `service.https.enabled` | if port 443 should be opened for service | `true` | -| `service.https.nodePort` | If explicit NodePort is required | None | -| `service.https.port` | if port 443 should be opened for service | `true` | -| `service.https.targetPort` | Sets the targetPort that maps to the service's TLS port | `8443` | -| `service.loadBalancerIP` | IP address to assign (if cloud provider supports it) | `""` | -| `service.loadBalancerSourceRanges` | Passed to cloud provider load balancer if created (e.g: AWS ELB) | None | -| `service.type` | Service type to be used | `LoadBalancer` | -| `serviceAccount.create` | If `true`, create a new service account | `true` | -| `serviceAccount.name` | Service account to be used | `ambassador` | -| `volumeMounts` | Volume mounts for the ambassador service | `[]` | -| `volumes` | Volumes for the ambassador service | `[]` | +| `adminService.create` | If `true`, create a service for Ambassador's admin UI | `true` | +| `adminService.nodePort` | If explicit NodePort for admin service is required | `true` | +| `adminService.type` | Ambassador's admin service type to be used | `ClusterIP` | +| `ambassadorConfig` | Config thats mounted to `/ambassador/ambassador-config` | `""` | +| `daemonSet` | If `true`, Create a daemonSet. By default Deployment controller will be created | `false` | +| `env` | Any additional environment variables for ambassador pods | `{}` | +| `image.pullPolicy` | Ambassador image pull policy | `IfNotPresent` | +| `image.repository` | Ambassador image | `quay.io/datawire/ambassador` | +| `image.tag` | Ambassador image tag | `0.60.1` | +| `imagePullSecrets` | Image pull secrets | `[]` | +| `namespace.name` | Set the `AMBASSADOR_NAMESPACE` environment variable | `metadata.namespace` | +| `scope.singleNamespace` | Set the `AMBASSADOR_SINGLE_NAMESPACE` environment variable | `false` | +| `podAnnotations` | Additional annotations for ambassador pods | `{}` | +| `prometheusExporter.enabled` | Prometheus exporter side-car enabled | `false` | +| `prometheusExporter.pullPolicy` | Image pull policy | `IfNotPresent` | +| `prometheusExporter.repository` | Prometheus exporter image | `prom/statsd-exporter` | +| `prometheusExporter.tag` | Prometheus exporter image | `v0.8.1` | +| `rbac.create` | If `true`, create and use RBAC resources | `true` | +| `rbac.namespaced` | If `true`, permissions are namespace-scoped rather than cluster-scoped | `false` | +| `replicaCount` | Number of Ambassador replicas | `3` | +| `resources` | CPU/memory resource requests/limits | `{}` | +| `securityContext` | Set security context for pod | `{ "runAsUser": "8888" }` | +| `service.annotations` | Annotations to apply to Ambassador service | See "Annotations" below | +| `service.externalTrafficPolicy` | Sets the external traffic policy for the service | `""` | +| `service.http.enabled` | if port 80 should be opened for service | `true` | +| `service.http.nodePort` | If explicit NodePort is required | None | +| `service.http.port` | if port 443 should be opened for service | `true` | +| `service.http.targetPort` | Sets the targetPort that maps to the service's cleartext port | `8080` | +| `service.https.enabled` | if port 443 should be opened for service | `true` | +| `service.https.nodePort` | If explicit NodePort is required | None | +| `service.https.port` | if port 443 should be opened for service | `true` | +| `service.https.targetPort` | Sets the targetPort that maps to the service's TLS port | `8443` | +| `service.loadBalancerIP` | IP address to assign (if cloud provider supports it) | `""` | +| `service.loadBalancerSourceRanges` | Passed to cloud provider load balancer if created (e.g: AWS ELB) | None | +| `service.type` | Service type to be used | `LoadBalancer` | +| `serviceAccount.create` | If `true`, create a new service account | `true` | +| `serviceAccount.name` | Service account to be used | `ambassador` | +| `volumeMounts` | Volume mounts for the ambassador service | `[]` | +| `volumes` | Volumes for the ambassador service | `[]` | +| `pro.enabled` | Installs the Ambassador Pro container as a sidecar to Ambassador | `false` | +| `pro.image.repository` | Ambassador Pro image | `quay.io/datawire/ambassador_pro` | +| `pro.image.tag` | Ambassador Pro image tag | `amb-sidecar-0.4.0` | +| `pro.ports.auth` | Ambassador Pro authentication port | `8500` | +| `pro.ports.ratelimit` | Ambassador Pro ratelimit port | `8501` | +| `pro.ports.ratelimitDebug` | Debug port for Ambassador Pro ratelimit | `8502` | +| `pro.licenseKey.value` | License key for Ambassador Pro | "" | +| `pro.licenseKey.secret` | Stores the license key as a base64-encoded string in a Kubernetes secret | `false` | **NOTE:** Make sure the configured `service.http.targetPort` and `service.https.targetPort` ports match your [Ambassador Module's](https://www.getambassador.io/reference/modules/#the-ambassador-module) `service_port` and `redirect_cleartext_from` configurations. @@ -108,6 +116,14 @@ and remember that you'll have to escape newlines. For example, the annotation ab service.annotations: { "getambassador.io/config": "---\napiVersion: ambassador/v1\nkind: Module\nname: ambassador\nconfig:\n service_port: 8080" } ``` +### Ambassador Pro + +Setting `pro.enabled: true` will install Ambassador Pro as a sidecar to Ambassador with the required CRDs and redis instance. + +You must set the `pro.licenseKey.value` to the license key issued to you. Sign up for a [free trial](https://www.getambassador.io/pro/free-trial) of Ambassador Pro or [contact](https://www.getambassador.io/contact) our sales team to obtain a license key. + +For most use cases, `pro.image` and `pro.ports` can be left as default. + ### Specifying Values Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, diff --git a/stable/ambassador/templates/ambassador-pro-crd.yaml b/stable/ambassador/templates/ambassador-pro-crd.yaml new file mode 100644 index 0000000000..1e5300c4d0 --- /dev/null +++ b/stable/ambassador/templates/ambassador-pro-crd.yaml @@ -0,0 +1,58 @@ +{{- if .Values.pro.enabled -}} +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: filterpolicies.getambassador.io +spec: + group: getambassador.io + version: v1beta2 + versions: + - name: v1beta2 + served: true + storage: true + scope: Namespaced + names: + plural: filterpolicies + singular: filterpolicy + kind: FilterPolicy + shortNames: + - fp +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: filters.getambassador.io +spec: + group: getambassador.io + version: v1beta2 + versions: + - name: v1beta2 + served: true + storage: true + scope: Namespaced + names: + plural: filters + singular: filter + kind: Filter + shortNames: + - fil +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: ratelimits.getambassador.io +spec: + group: getambassador.io + version: v1beta1 + versions: + - name: v1beta1 + served: true + storage: true + scope: Namespaced + names: + plural: ratelimits + singular: ratelimit + kind: RateLimit + shortNames: + - rl +{{- end -}} diff --git a/stable/ambassador/templates/ambassador-pro-license-key-secret.yaml b/stable/ambassador/templates/ambassador-pro-license-key-secret.yaml new file mode 100644 index 0000000000..05e59843c9 --- /dev/null +++ b/stable/ambassador/templates/ambassador-pro-license-key-secret.yaml @@ -0,0 +1,9 @@ +{{- if .Values.pro.licenseKey.secret -}} +apiVersion: v1 +kind: Secret +metadata: + name: ambassador-pro-license-key +type: Opaque +data: + key: {{ .Values.pro.licenseKey.value | b64enc }} +{{- end -}} diff --git a/stable/ambassador/templates/ambassador-pro-redis.yaml b/stable/ambassador/templates/ambassador-pro-redis.yaml new file mode 100644 index 0000000000..3f02ba0db8 --- /dev/null +++ b/stable/ambassador/templates/ambassador-pro-redis.yaml @@ -0,0 +1,45 @@ +{{- if .Values.pro.enabled -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "ambassador.fullname" . }}-pro-redis + labels: + app.kubernetes.io/name: {{ include "ambassador.name" . }}-pro-redis + helm.sh/chart: {{ include "ambassador.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +spec: + type: ClusterIP + ports: + - port: 6379 + targetPort: 6379 + selector: + app.kubernetes.io/name: {{ include "ambassador.fullname" . }}-pro-redis + app.kubernetes.io/instance: {{ .Release.Name }} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "ambassador.fullname" . }}-pro-redis + labels: + app.kubernetes.io/name: {{ include "ambassador.name" . }}-pro-redis + helm.sh/chart: {{ include "ambassador.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: {{ include "ambassador.name" . }}-pro-redis + app.kubernetes.io/instance: {{ .Release.Name }} + template: + metadata: + labels: + app.kubernetes.io/name: {{ include "ambassador.name" . }}-pro-redis + app.kubernetes.io/instance: {{ .Release.Name }} + spec: + containers: + - name: redis + image: redis:5.0.1 + restartPolicy: Always +{{- end -}} diff --git a/stable/ambassador/templates/ambassador-pro-service.yaml b/stable/ambassador/templates/ambassador-pro-service.yaml new file mode 100644 index 0000000000..9fa98e618f --- /dev/null +++ b/stable/ambassador/templates/ambassador-pro-service.yaml @@ -0,0 +1,37 @@ +{{- if .Values.pro.enabled -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "ambassador.fullname" . }}-pro + labels: + service: ambassador-pro + app.kubernetes.io/name: {{ include "ambassador.name" . }} + helm.sh/chart: {{ include "ambassador.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + annotations: + getambassador.io/config: | + --- + apiVersion: ambassador/v1 + kind: AuthService + name: ambassador-pro-auth + proto: grpc + auth_service: 127.0.0.1:{{ .Values.pro.ports.auth }} + allow_request_body: false # setting this to 'true' allows Plugin and External filters to access the body, but has performance overhead + --- + # This mapping needs to exist, but is never actually followed. + apiVersion: ambassador/v1 + kind: Mapping + name: callback_mapping + prefix: /callback + service: NoTaReAlSeRvIcE + --- + apiVersion: ambassador/v1 + kind: RateLimitService + name: ambassador-pro-ratelimit + service: 127.0.0.1:{{ .Values.pro.ports.ratelimit }} +spec: + ports: + - name: ratelimit-grpc + port: 80 +{{- end -}} diff --git a/stable/ambassador/templates/deployment.yaml b/stable/ambassador/templates/deployment.yaml index 0443532b55..4a934ff023 100644 --- a/stable/ambassador/templates/deployment.yaml +++ b/stable/ambassador/templates/deployment.yaml @@ -136,6 +136,39 @@ spec: {{- end }} resources: {{- toYaml .Values.resources | nindent 12 }} + {{- if .Values.pro.enabled }} + - name: ambassador-pro + image: "{{ .Values.pro.image.repository }}:{{ .Values.pro.image.tag }}" + ports: + - name: grpc-auth + containerPort: {{ .Values.pro.ports.auth }} + - name: grpc-ratelimit + containerPort: {{ .Values.pro.ports.ratelimit }} + - name: http-debug + containerPort: {{ .Values.pro.ports.ratelimitDebug }} + env: + - name: REDIS_SOCKET_TYPE + value: tcp + - name: REDIS_URL + value: ambassador-pro-redis:6379 + - name: APRO_AUTH_PORT + value: "{{ .Values.pro.ports.auth }}" + - name: GRPC_PORT + value: "{{ .Values.pro.ports.ratelimit }}" + - name: DEBUG_PORT + value: "{{ .Values.pro.ports.ratelimitDebug }}" + - name: APP_LOG_LEVEL + value: "{{ .Values.pro.logLevel }}" + - name: AMBASSADOR_LICENSE_KEY + {{- if .Values.pro.licenseKey.secret }} + valueFrom: + secretKeyRef: + name: ambassador-pro-license-key + key: key + {{ else }} + value: {{ .Values.pro.licenseKey.value }} + {{- end }} + {{- end }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/stable/ambassador/templates/rbac.yaml b/stable/ambassador/templates/rbac.yaml index ace02c202b..788cb080c1 100644 --- a/stable/ambassador/templates/rbac.yaml +++ b/stable/ambassador/templates/rbac.yaml @@ -20,6 +20,14 @@ rules: - secrets - endpoints verbs: ["get", "list", "watch"] + {{- if .Values.pro.enabled }} + - apiGroups: ["getambassador.io"] + resources: + - filters + - ratelimits + - filterpolicies + verbs: ["get", "list", "watch"] + {{- end}} --- apiVersion: rbac.authorization.k8s.io/v1beta1 {{- if .Values.rbac.namespaced }} diff --git a/stable/ambassador/values.yaml b/stable/ambassador/values.yaml index bc30e42114..410d9693ca 100644 --- a/stable/ambassador/values.yaml +++ b/stable/ambassador/values.yaml @@ -136,3 +136,17 @@ prometheusExporter: # cluster_name: "$1" ambassadorConfig: "" + +pro: + enabled: false + image: + repository: quay.io/datawire/ambassador_pro + tag: amb-sidecar-0.4.0 + ports: + auth: 8500 + ratelimit: 8501 + ratelimitDebug: 8502 + logLevel: info + licenseKey: + value: + secret: false