github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

[stable/ambassador] Major Release v3.0.0 (#15538)

Browse Source 
* Make ports configuration flexible to allow for TCPMapping ports

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* bump chart version

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* Update README and bump major version

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* Rename admin service to match YAML templates

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* Remove default annotation

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* .service.ports eliminates the need to `.additionalTCPPorts` as well

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* Create clusterrole for crds to solve issue with singlenamespaced config

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* rbac.namespaced was extraneous and has been replaced by scope.singleNamespace

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* Ambassador Pro will notice `AMBASSADOR_ID` in `.Values.env`

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* `crds.enabled` will flag that crds should be enabled in the release but not necessarily created

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* Update changelog

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* Fix trailing spaces

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* Bump pro version

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* Ambassador Pro will use {{ include "ambassador.fullname" . }}-pro-redis as redis server

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* Requested fixes

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* Forgot port on redis url change

Signed-off-by: Noah Krause <krausenoah@gmail.com>

* fix test

Signed-off-by: Noah Krause <krausenoah@gmail.com>
This commit is contained in:
Noah Krause
2019-07-29 19:36:50 -07:00
committed by Kubernetes Prow Robot
parent 052013155e
commit f5a544a4f7
12 changed files with 231 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/ambassador/CHANGELOG.md
+15
View File
@@ -3,6 +3,21 @@
This file documents all notable changes to Ambassador Helm Chart. The release
numbering uses [semantic versioning](http://semver.org).
## v3.0.0
### Breaking Changes
- The default annotation has been removed. The service port will be set dynamically to 8080 or 8443 for http and https respectively.
- `service.http`, `service.https`, and `additionalTCPPort` has been replaced with `service.ports`.
- `rbac.namespaced` has been removed. Use `scope.singleNamespace` instead.
### Minor Changes
- Ambassador Pro will pick up when `AMBASSADOR_ID` is set in `.Values.env` [[#15025]](https://github.com/helm/charts/issues/15025).
- `{{release name}}-admins` has been renamed to `{{release name}}-admin` to match YAML install templates
- RBAC configuration has been updated to allow for CRD use when `scope.singleNamespace: true`. [[ambassador/#1576]](https://github.com/datawire/ambassador/issues/1576)
- RBAC configuration now allows for multiple Ambassadors to use CRDs. Set `crds.enabled` in releases that expect CRDs [[ambassador/#1679]](https://github.com/datawire/ambassador/issues/1679)
## v2.6.0
### Minor Changes
stable/ambassador/Chart.yaml
+1 -1
View File
@@ -2,7 +2,7 @@ apiVersion: v1
appVersion: 0.73.0
description: A Helm chart for Datawire Ambassador
name: ambassador
version: 2.12.5
version: 3.0.0
icon: https://www.getambassador.io/images/logo.png
home: https://www.getambassador.io/
sources:
stable/ambassador/README.md
+69 -23
View File
@@ -38,6 +38,10 @@ $ helm delete --purge my-release
The command removes all the Kubernetes components associated with the chart and deletes the release.
## Changelog
Notable chart changes are listed in the [CHANGELOG](https://github.com/helm/charts/blob/master/stable/ambassador/CHANGELOG.md)
## Configuration
The following tables lists the configurable parameters of the Ambassador chart and their default values.
@@ -48,6 +52,7 @@ The following tables lists the configurable parameters of the Ambassador chart a
| `adminService.nodePort` | If explicit NodePort for admin service is required | `true` |
| `adminService.type` | Ambassador's admin service type to be used | `ClusterIP` |
| `ambassadorConfig` | Config thats mounted to `/ambassador/ambassador-config` | `""` |
| `crds.enabled` | If `true`, enables CRD resources for the installation. | `true` |
| `crds.create` | If `true`, Creates CRD resources | `true` |
| `crds.keep` | If `true`, if the ambassador CRDs should be kept when the chart is deleted | `true` |
| `daemonSet` | If `true`, Create a DaemonSet. By default Deployment controller will be created | `false` |
@@ -59,7 +64,7 @@ The following tables lists the configurable parameters of the Ambassador chart a
| `image.tag` | Ambassador image tag | `0.72.0` |
| `imagePullSecrets` | Image pull secrets | `[]` |
| `namespace.name` | Set the `AMBASSADOR_NAMESPACE` environment variable | `metadata.namespace` |
| `scope.singleNamespace` | Set the `AMBASSADOR_SINGLE_NAMESPACE` environment variable | `false` |
| `scope.singleNamespace` | Set the `AMBASSADOR_SINGLE_NAMESPACE` environment variable and create namespaced RBAC if `rbac.enabled: true` | `false` |
| `podAnnotations` | Additional annotations for ambassador pods | `{}` |
| `deploymentAnnotations` | Additional annotations for ambassador DaemonSet/Deployment | `{}` |
| `podLabels` | Additional labels for ambassador pods | |
@@ -70,22 +75,14 @@ The following tables lists the configurable parameters of the Ambassador chart a
| `prometheusExporter.tag` | Prometheus exporter image | `v0.8.1` |
| `prometheusExporter.resources` | CPU/memory resource requests/limits | `{}` |
| `rbac.create` | If `true`, create and use RBAC resources | `true` |
| `rbac.namespaced` | If `true`, permissions are namespace-scoped rather than cluster-scoped | `false` |
| `rbac.podSecurityPolicies` | pod security polices to bind to | |
| `replicaCount` | Number of Ambassador replicas | `3` |
| `resources` | CPU/memory resource requests/limits | `{}` |
| `securityContext` | Set security context for pod | `{ "runAsUser": "8888" }` |
| `initContainers` | Containers used to initialize context for pods | `[]` |
| `service.annotations` | Annotations to apply to Ambassador service | See "Annotations" below |
| `service.annotations` | Annotations to apply to Ambassador service | `""` |
| `service.externalTrafficPolicy` | Sets the external traffic policy for the service | `""` |
| `service.http.enabled` | if port 80 should be opened for service | `true` |
| `service.http.nodePort` | If explicit NodePort is required | None |
| `service.http.port` | if port 443 should be opened for service | `true` |
| `service.http.targetPort` | Sets the targetPort that maps to the service's cleartext port | `8080` |
| `service.https.enabled` | if port 443 should be opened for service | `true` |
| `service.https.nodePort` | If explicit NodePort is required | None |
| `service.https.port` | if port 443 should be opened for service | `true` |
| `service.https.targetPort` | Sets the targetPort that maps to the service's TLS port | `8443` |
| `service.ports` | List of ports Ambassador is listening on | `[{"name": "http","port": 80,"targetPort": 8080},{"name": "https","port": 443,"targetPort": 8443}]` |
| `service.loadBalancerIP` | IP address to assign (if cloud provider supports it) | `""` |
| `service.loadBalancerSourceRanges` | Passed to cloud provider load balancer if created (e.g: AWS ELB) | None |
| `service.type` | Service type to be used | `LoadBalancer` |
@@ -105,23 +102,12 @@ The following tables lists the configurable parameters of the Ambassador chart a
| `autoscaling.minReplica` | If autoscaling enabled, this field sets minimum replica count | `2` |
| `autoscaling.maxReplica` | If autoscaling enabled, this field sets maximum replica count | `5` |
| `autoscaling.metrics` | If autoscaling enabled, configure hpa metrics | |
| `additionalTCPPorts` | List of additional TCP ports to be exposed by the container and service | `[]` |
**NOTE:** Make sure the configured `service.http.targetPort` and `service.https.targetPort` ports match your [Ambassador Module's](https://www.getambassador.io/reference/modules/#the-ambassador-module) `service_port` and `redirect_cleartext_from` configurations.
### Annotations
The default annotation applied to the Ambassador service is
```
getambassador.io/config: |
---
apiVersion: ambassador/v1
kind: Module
name: ambassador
config:
service_port: 8080
```
Ambassador configuration is done through annotations on Kubernetes services or Custom Resource Definitions (CRDs). The `service.annotations` section of the values file contains commented out examples of [Ambassador Module](https://www.getambassador.io/reference/core/ambassador) and a global [TLSContext](https://www.getambassador.io/reference/core/tls) configurations which are typically created in the Ambassador service.
If you intend to use `service.annotations`, remember to include the `getambassador.io/config` annotation key as above,
and remember that you'll have to escape newlines. For example, the annotation above could be defined as
@@ -158,6 +144,66 @@ $ helm upgrade --install --wait my-release -f values.yaml stable/ambassador
# Upgrading
## To 3.0.0
### Service Ports
The way ports are assigned has been changed for a more dynamic method.
Now, instead of setting the port assignments for only the http and https, any port can be open on the load balancer using a list like you would in a standard Kubernetes YAML manifest.
`pre-3.0.0`
```yaml
service:
http:
enabled: true
port: 80
targetPort: 8080
https:
enabled: true
port: 443
targetPort: 8443
```
`3.0.0`
```yaml
service:
ports:
- name: http
port: 80
targetPort: 8080
- name: https
port: 443
targetPort: 8443
```
This change has also replaced the `.additionalTCPPorts` configuration. Additional TCP ports can be created the same as the http and https ports above.
### Annotations and `service_port`
The below Ambassador `Module` annotation is no longer being applied by default.
```yaml
getambassador.io/config: |
---
apiVersion: ambassador/v1
kind: Module
name: ambassador
config:
service_port: 8080
```
This was causing confusion with the `service_port` being hard-coded when enabling TLS termination in Ambassador.
Ambassador has been listening on port 8080 for HTTP and 8443 for HTTPS by default since version `0.60.0` (chart version 2.2.0).
### RBAC and CRDs
A `ClusterRole` and `ClusterRoleBinding` named `{{release name}}-crd` will be created to watch for the Ambassador Custom Resource Definitions. This will be created regardless of the value of `scope.singleNamespace` since CRDs are created the cluster scope.
`rbac.namespaced` has been removed. For namespaced RBAC, set `scope.singleNamespace: true` and `rbac.enabled: true`.
`crds.enabled` will indicate that you are using CRDs and will create the rbac resources regardless of the value of `crds.create`. This allows for multiple deployments to use the CRDs.
## To 2.0.0
### Ambassador ID
stable/ambassador/templates/_helpers.tpl
+11
View File
@@ -41,3 +41,14 @@ Create the name of the service account to use
{{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Define the http port of the Ambassador service
*/}}
{{- define "ambassador.servicePort" -}}
{{- range .Values.service.ports -}}
{{- if (eq .name "http") -}}
{{ default .port }}
{{- end -}}
{{- end -}}
{{- end -}}
stable/ambassador/templates/admin-service.yaml
+1 -1
View File
@@ -2,7 +2,7 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "ambassador.fullname" . }}-admins
name: {{ include "ambassador.fullname" . }}-admin
labels:
app.kubernetes.io/name: {{ include "ambassador.name" . }}
helm.sh/chart: {{ include "ambassador.chart" . }}
stable/ambassador/templates/crds-rbac.yaml
+48
View File
@@ -0,0 +1,48 @@
{{- if .Values.crds.enabled }}
{{- if .Values.rbac.create }}
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: {{ include "ambassador.fullname" . }}-crds
labels:
app.kubernetes.io/name: {{ include "ambassador.name" . }}
helm.sh/chart: {{ include "ambassador.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
rules:
- apiGroups: [ "apiextensions.k8s.io" ]
resources:
- customresourcedefinitions
resourceNames:
- authservices.getambassador.io
- mappings.getambassador.io
- modules.getambassador.io
- ratelimitservices.getambassador.io
- tcpmappings.getambassador.io
- tlscontexts.getambassador.io
- tracingservices.getambassador.io
- kubernetesendpointresolvers.getambassador.io
- kubernetesserviceresolvers.getambassador.io
- consulresolvers.getambassador.io
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: {{ include "ambassador.fullname" . }}-crds
labels:
app.kubernetes.io/name: {{ include "ambassador.name" . }}
helm.sh/chart: {{ include "ambassador.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ include "ambassador.fullname" . }}-crds
subjects:
- name: {{ include "ambassador.serviceAccountName" . }}
namespace: {{ .Release.Namespace | quote }}
kind: ServiceAccount
{{- end }}
{{- end }}
stable/ambassador/templates/crds.yaml
+4
View File
@@ -145,6 +145,10 @@ metadata:
helm.sh/chart: {{ include "ambassador.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{ if .Values.crds.keep }}
annotations:
"helm.sh/resource-policy": keep
{{ end }}
spec:
group: getambassador.io
version: v1
stable/ambassador/templates/deployment.yaml
+16 -14
View File
@@ -96,21 +96,15 @@ spec:
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
ports:
{{- if .Values.service.http.enabled }}
- name: http
containerPort: {{ .Values.service.http.targetPort }}
{{- end }}
{{- if .Values.service.https.enabled }}
- name: https
containerPort: {{ .Values.service.https.targetPort }}
{{- end }}
{{- range .Values.service.ports }}
- name: {{ .name }}
containerPort: {{ .targetPort }}
{{- if .protocol }}
protocol: {{ .protocol }}
{{- end }}
{{- end}}
- name: admin
containerPort: 8877
{{- range $key := .Values.additionalTCPPorts }}
- name: "{{ $key }}-tcp"
containerPort: {{ $key }}
protocol: TCP
{{- end }}
env:
- name: HOST_IP
valueFrom:
@@ -177,7 +171,7 @@ spec:
- name: REDIS_SOCKET_TYPE
value: tcp
- name: REDIS_URL
value: ambassador-pro-redis:6379
value: {{ include "ambassador.fullname" . }}-pro-redis:6379
- name: APRO_AUTH_PORT
value: "{{ .Values.pro.ports.auth }}"
- name: GRPC_PORT
@@ -194,6 +188,14 @@ spec:
fieldRef:
fieldPath: metadata.namespace
{{- end }}
{{- if .Values.env }}
{{- range $key,$value := .Values.env }}
{{- if eq $key "AMBASSADOR_ID"}}
- name: {{ $key | upper | quote}}
value: {{ $value | quote}}
{{- end }}
{{- end }}
{{- end }}
- name: AMBASSADOR_LICENSE_KEY
{{- if .Values.pro.licenseKey.secret }}
valueFrom:
stable/ambassador/templates/rbac.yaml
+4 -4
View File
@@ -1,6 +1,6 @@
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1beta1
{{- if .Values.rbac.namespaced }}
{{- if .Values.scope.singleNamespace }}
kind: Role
{{- else }}
kind: ClusterRole
@@ -16,7 +16,7 @@ metadata:
rules:
- apiGroups: [""]
resources:
{{- if not .Values.rbac.namespaced }}
{{- if not .Values.scope.singleNamespace }}
- namespaces
{{- end }}
- services
@@ -46,7 +46,7 @@ rules:
{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1beta1
{{- if .Values.rbac.namespaced }}
{{- if .Values.scope.singleNamespace }}
kind: RoleBinding
{{- else }}
kind: ClusterRoleBinding
@@ -61,7 +61,7 @@ metadata:
app.kubernetes.io/managed-by: {{ .Release.Service }}
roleRef:
apiGroup: rbac.authorization.k8s.io
{{- if .Values.rbac.namespaced }}
{{- if .Values.scope.singleNamespace }}
kind: Role
{{- else }}
kind: ClusterRole
stable/ambassador/templates/service.yaml
+1 -24
View File
@@ -21,30 +21,7 @@ spec:
externalTrafficPolicy: "{{ .Values.service.externalTrafficPolicy }}"
{{- end }}
ports:
{{- if .Values.service.http.enabled }}
- port: {{ .Values.service.http.port }}
targetPort: {{ .Values.service.http.targetPort }}
protocol: TCP
name: http
{{- with .Values.service.http.nodePort }}
nodePort: {{ toYaml . }}
{{- end }}
{{- end }}
{{- if .Values.service.https.enabled }}
- port: {{ .Values.service.https.port }}
targetPort: {{ .Values.service.https.targetPort }}
protocol: TCP
name: https
{{- with .Values.service.https.nodePort }}
nodePort: {{ toYaml . }}
{{- end }}
{{- end }}
{{- range $key := .Values.additionalTCPPorts }}
- name: "{{ $key }}-tcp"
port: {{ $key }}
protocol: TCP
targetPort: "{{ $key }}-tcp"
{{- end }}
{{- toYaml .Values.service.ports | nindent 4 }}
selector:
app.kubernetes.io/name: {{ include "ambassador.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
stable/ambassador/templates/tests/test-ready.yaml
+1 -1
View File
@@ -15,6 +15,6 @@ spec:
- name: wget
image: busybox
command: ['wget']
args: ['{{ include "ambassador.fullname" . }}:{{ .Values.service.http.port }}/ambassador/v0/check_ready']
args: ['{{ include "ambassador.fullname" . }}:{{ include "ambassador.servicePort" . }}/ambassador/v0/check_ready']
restartPolicy: Never
{{- end }}
stable/ambassador/values.yaml
+60 -29
View File
@@ -27,7 +27,6 @@ autoscaling:
# Additional container environment variable
env:
{}
# Exposing statistics via StatsD
# STATSD_ENABLED: true
# STATSD_HOST: statsd-sink
@@ -60,32 +59,66 @@ service:
# Note that target http ports need to match your ambassador configurations service_port
# https://www.getambassador.io/reference/modules/#the-ambassador-module
http:
enabled: true
port: 80
targetPort: 8080
# nodePort: 30080
https:
enabled: true
port: 443
targetPort: 8443
# nodePort: 30443
ports:
- name: http
port: 80
targetPort: 8080
# protocol: TCP
# nodePort: 30080
- name: https
port: 443
targetPort: 8443
# protocol: TCP
# nodePort: 30443
# TCPMapping_Port
# port: 2222
# targetPort: 2222
# protocol: TCP
# nodePort: 30222
annotations:
getambassador.io/config: |
---
apiVersion: ambassador/v1
kind: Module
name: ambassador
config:
service_port: 8080
# diagnostics:
# enabled: false
# externalTrafficPolicy:
# loadBalancerSourceRanges:
# - YOUR_IP_RANGE
# Uncomment out fields you want to use.
# See https://www.getambassador.io/reference/core/ambassador and
# https://www.getambassador.io/reference/core/tls for more info
# getambassador.io/config: |
# ---
# apiVersion: ambassador/v1
# kind: TLSContext
# name: ambassador
# secret: ambassador-certs
# hosts: ["*"]
# ---
# apiVersion: ambassador/v1
# kind: Module
# name: ambassador
# config:
# admin_port: 8001
# diag_port: 8877
# diagnostics:
# enabled: true
# enable_grpc_http11_bridge: false
# enable_grpc_web: false
# enable_http10: false
# enable_ipv4: true
# enable_ipv6: false
# liveness_probe:
# enabled: true
# lua_scripts:
# readiness_probe:
# enabled: true
# server_name: envoy
# service_port: 8080
# use_proxy_proto: false
# use_remote_address: true
# xff_num_trusted_hops: 0
# x_forwarded_proto_redirect: false
# load_balancer:
# policy: round_robin
# circuit_breakers:
# max_connections: 2048
# retry_policy:
# retry_on: "5xx"
# cors:
adminService:
create: true
@@ -97,7 +130,6 @@ adminService:
rbac:
# Specifies whether RBAC resources should be created
create: true
namespaced: false
podSecurityPolicies:
{}
@@ -112,8 +144,6 @@ serviceAccount:
# If not set and create is true, a name is generated using the fullname template
name:
additionalTCPPorts: []
initContainers: []
volumes: []
@@ -184,7 +214,7 @@ pro:
enabled: false
image:
repository: quay.io/datawire/ambassador_pro
tag: amb-sidecar-0.4.0
tag: amb-sidecar-0.5.0
ports:
auth: 8500
ratelimit: 8501
@@ -195,5 +225,6 @@ pro:
secret: false
crds:
enabled: true
create: true
keep: true