* [stable/kong] mark the chart as deprecated
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* remove tetsts
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
- Add an admission webhook config checksum as an annotation in the
Deployment so that the pods can be redeployed by K8s when the config
changes during redeployments
Signed-off-by: Krish <kriiyer@cisco.com>
* [stable/kong] add sideEffects and admissionReviewVersions
These are required fields for v1 and we operate on v1beta but support
the v1 resources as well.
Also removed the sym link to default values and introduced a blank file.
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] use service type NodePort for CI testing
kind doesn't support services of type LoadBalancer and the CI test fail
on kind.
This is part of the effort to move the chart under Kong's Github
organization and deprecate it from `helm/charts` repo on Github.
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] 0.36.2 admission webhook fixes
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] bump up timeouts to 5 seconds
On constrained hardware and especially Minikube, 1 second timeouts are
common. Possibly, due to triple scheduling going on.
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] add rainest as a maintainer
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] update CRDs to Ingress Controller 0.7
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] standardize and optimize readiness and liveness probes
- Initial delay has been lowered to 5 seconds for increased responsiveness
- Frequency is now 10 seconds, again for reponsiveness
- timeout has been standardized to 1s
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] 0.35.1 changelog
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] remove the extra space in NOTES.txt
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] fix values.yalm ingress tls section
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
The following document describes all the standard labels that charts
should include:
https://v2.helm.sh/docs/chart_best_practices/#standard-labels
Kong's chart already had these but the keys were outdated.
This commit also de-duplicates these data to further DRY out these
labels.
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] typos in readme and change Kong Enterprise section
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* remove ci test, it is a duplicate of defautl-values.yaml
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* remove ci test, it is another duplicate of defautl-values.yaml
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] consolidate various CI tests
We get a lot of flaky tests. Some of those are likely cause by the CI
process itself but reducing the number of tests gives us a speedy test
and reduces the probability of flakiness.
There are no tests that are being skipped here, multipe unrelated tests
have been consolidated together.
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] draft changelog and version bump
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] elaborate on kong enterprise and fix typos
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] call out pre-reqs in install for enterprise
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] renam test files to run the tests
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* remove blank lines as lint barfs
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* remove blank lines as lint barfs
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* remove trailing white space
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] update changelog and version
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* specify pg details in ci test
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stabl/kong] de-duplicate test2 and test4
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
Add an additional level of indentation to Job securityContexts.
Previously, the context would render incorrectly, e.g.
securityContext:
runAsUser: 1000
It should now render as:
securityContext:
runAsUser: 1000
Signed-off-by: Travis Raines <traines@konghq.com>
Do not chomp leading whitespace prior to including kong.license within
the final_env helper. Doing so appends the license block immediately
after the preceding value, generating invalid YAML.
Prior to the creation of final_env, kong.license was injected directly
into Deployment and Job templates, using the nindent function to apply
indentation and add a newline. final_env instead places kong.license at
the correct indentation within the templated block, and does not use
nindent. As such, the include should not chomp leading whitespace before
it.
Signed-off-by: Travis Raines <traines@konghq.com>
* [stable/kong] consolidate all rbac resources into a single file
- Simplify and reduce number of ifs in our helm chart to reduce
maintainence burden
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] move all custom resources into a single file
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] remove podDistruption budget for ingressController
Ingress Controller has been consolidated into the Kong pod itself now
so this policy is not needed anymore.
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] refactor wait-for-postgres container into helpers for de-duplication
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] refactor env section of the deployment into a helper
In the next commit, we will use this same env section for the migration
containers as well to ensure consistency in Kong's configuration across
different pods.
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] use kong.final_env for migration containers
This ensures that the exact same configuration for kong is used across
containers of all types.
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] wait-for-postgres to be available
Previously, if the Postgres instance was managed externally, eg, like an
RDS instance, then the chart would fail to wait for it. The migrations
eventually succeeded but if the pod fails while connecting to Postgres,
it is more helpful as it highlights an issue with network itself.
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] use a hard-coded name for the container name
This allows us to have determisintic container names and makes writing
scripts easier. The name of the pod and deployment are still generated
by Helm.
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] bump up Postgresql sub-chart to 8.1.2
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] write changelog and bump chart for 0.33
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* fix: remove installCRDs since it is present twice
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] add content of FAQ doc
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] re-orgnize values.yaml
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] fix language in the FAQ
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] add security restrictions
This commit wraps up several security improvements:
* Create emptyDir volumes and mount them at /tmp and /kong_prefix.
Override the standard prefix setting (/usr/local/kong) to /kong_prefix.
Update the stock PSP to allow emptyDir access.
Kong writes runtime data (rendered configuration templates, temporary
request body files, etc.) to its prefix and also writes some temporary
files to /tmp. These are on the root container filesystem by default,
and are as such incompatible with Kubernetes policies that disallow root
filesystem writes.
It is not possible to mount a new emptyDir at /usr/local/kong, as that
location is also used to store some static files installed by Kong's
package.
* Set mounted plugin volumes to read-only. Previously, a malicious actor
with access to the container filesystem and the ability to send signals
could modify plugin code and have Kong reload it.
* Add injection points for Kong pod securityContexts, and default to
running as UID 1000. Kong should not need to run as root, and has a
dedicated user in stock container images.
* Fix a bug where disabling Vitals from values.yaml had no effect.
Signed-off-by: Travis Raines <traines@konghq.com>
* [stable/kong] fix custom plugin loader in init
Add automatically-generated KONG_PLUGINS to wait-for-db's environment
variables. Move KONG_LUA_PACKAGE_PATH outside the "Postgres enabled"
if-block.
Once a custom plugin has been configured, Kong must find that plugin in
both KONG_PLUGINS and on disk in order to start. Previously, the
wait-for-db initContainer did not populate KONG_PLUGINS using the helper
template added by eb2c69b757, preventing
any instance with a custom plugin configuration from starting. It
furthermore only set KONG_LUA_PACKAGE_PATH if the Postgres subchart was
enabled.
Signed-off-by: Travis Raines <traines@konghq.com>
To enable specification of wildcard hosts we need to ensure that the
host is quoted, otherwise we need to explicitly quote hosts of the form
`*.somedomain.tld`. Before this change, for something of the form `helm
install stable/kong kong --set-string='*.somedomain.tld'` we would
produce:
```
$ helm template ... --set-string='*.somedomain.tld'
...
- host: *.somedomain.tld
...
```
which results in something of the form "error converting YAML to JSON:
yaml: line 17: did not find expected alphabetic or numeric character".
With the quoting we end up with:
```
$ helm template ... --set-string='*.somedomain.tld'
...
- host: '*.somedomain.tld'
...
```
Some resources that I happened upon that provide some prior art and the
above solution:
1. https://github.com/helm/helm/issues/5080
2. https://github.com/jupyterhub/zero-to-jupyterhub-k8s/issues/1058
Signed-off-by: Harry Waye <harry@arachnys.com>
* [stable/kong] Allow admin_gui_auth_conf to be defined externally
This adds support for providing a secret name rather than the contents of admin_gui_auth_conf directly.
For LDAP authentication, the admin_gui_auth_conf contents include an LDAP password which would be in plaintext in the pod spec's environment variables.
This prevents the LDAP password from being exposed by keeping it in a secret defined outside of the helm chart, similar to other sensitive data.
Signed-off-by: Peter Rifel <pgrifel@gmail.com>
* [stable/kong] Fix readme typo in session_conf_secret value name
Signed-off-by: Peter Rifel <pgrifel@gmail.com>
* No unnecessary ServiceAccount creation
* when IngressController and podSecurityPolicy are disabled
Signed-off-by: Emeline Logeart <elogeart@talend.com>
* [stable/kong] create temporary pre-upgrade SA
Create a temporary ServiceAccount via pre-upgrade hooks if configuration
requires one.
The pre-upgrade migrations Job uses a ServiceAccount if the ingress
controller or PodSecurityPolicy are enabled, but the standard
ServiceAccount is not created until pre-upgrade hooks complete.
This creates a circular dependency if upgrading a release that did not
create the ServiceAccount during the initial install. This commit
addresses that by creating an additional pre-upgrade hook to create and
then delete an equivalent ServiceAccount.
Signed-off-by: Travis Raines <traines@konghq.com>
Retroactively update the changelog to include information on breaking
changes to ingress configuration in values.yaml.
Signed-off-by: Travis Raines <traines@konghq.com>
Reasons:
- Cassandra chart has been incubating for a very long time and we have
stability issues when Cassandra is running on k8s.
- Any serious user who is backing Kong with Cassandra, should be running
and maintaining cassandra on their own any ways (outside k8s as well).
- Running Kong on k8s with Cassandra buys little. We would like to push
users to use DB-less mode or use Postgres.
- We still support running Kong with Cassandra on k8s, only the
sub-chart is being removed, (intentionally) increasing the friction when
trying to use Kong with Cassandra on k8s.
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* [stable/kong] limit non-proxy ingresses to one host
Modify ingress configuration for services other than the proxy to
support a single hostname only.
Update proxy ingress TLS comments to reflect the actual expected value.
Signed-off-by: Travis Raines <traines@konghq.com>
* [stable/kong] add URL generation helper
Add a helper define to generate an appropriate external URL based on the
service's ingress configuration.
Signed-off-by: Travis Raines <traines@konghq.com>
* [stable/kong] populate service URLs automatically
Populate service URL hint settings based on ingress configuration.
Signed-off-by: Travis Raines <traines@konghq.com>
* [stable/kong] simplify Ingress generation
Generate Ingresses using a simplified, single-hostname and single-secret
configuration. Proxy Ingress generation remains unchanged to continue
support for multi-hostname proxy Ingresses.
Signed-off-by: Travis Raines <traines@konghq.com>
* [stable/kong] custom plugins support
- Refactor out volumes and volumeMounts into helpers
- Allow users to easily mount custom plugins via secrets and configmaps
- Custom plugins containing custom DAOs are allowed as well
A guide will be published in near future on how to exactly use this
feature.
In a subsequent PR, we will de-duplicate env and initContainer sections
in the migrations jobs to reduce duplication.
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* automatically populate KONG_PLUGINS
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* fix typo
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* fix typos
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
Forcibly closing connections can result in 500s for in-flight requests.
Adding a preStop hook gives time for active requests to complete and
cleanly shutdown active TCP connections.
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
- Unify controller and proxy deployment together to simplify the
- Deployment is available under apps/v1 apiVersion since Kubernetes 1.9
(almost 2 years ago).
Deployments under extensions/v1beta1 apiVersion are no longer served by
default from kubernetes 1.16 onwards.
deployment and debugging
- Fix bug in readiness probe of the controller
- Fix bug in configuring readiness/liveness/resources for controller
- reduce initialprobedelays to 10seconds; the init-container makes sure
that the db connectivity is correctly established
- Fix smpt_password_secret typo
Signed-off-by: Harry Bagdi <harrybagdi@gmail.com>
* Kong - prometheus-operator service monitor selector addition
Signed-off-by: garland <garlandk@gmail.com>
* Kong - bumping chart version for the prometheus-operator selector update
Signed-off-by: garland <garlandk@gmail.com>
* bumping chart version number
Signed-off-by: garland <garlandk@gmail.com>
* Kong - simplifying variable name
Signed-off-by: garland <garlandk@gmail.com>
* Add ability to add secrets as a volume in Kong. This is useful to override default ADMIN and Proxy certs and keys.
Signed-off-by: sukrit007 <sukrit007@gmail.com>
* Add ability to mount multiple volume in kong
Signed-off-by: sukrit007 <sukrit007@gmail.com>
* fix service account name reference
Signed-off-by: Jan Schumann <js@schumann-it.com>
* bunp chart version
Signed-off-by: Jan Schumann <js@schumann-it.com>
* Allow hosts to be optional for kong ingress resources
Signed-off-by: Mark Freebairn <mark_freebairn@hotmail.com>
* Bump chart version and add ci tests
Signed-off-by: Mark Freebairn <mark_freebairn@rapid7.com>
* Add access to work on api group networking.k8s.io when acessing ingress and ingress/status resources. Not only the extensions api group.
Signed-off-by: Hans Kristian Nordengen <hans.kristian.nordengen@gmail.com>
* Bump up chart version
Signed-off-by: Hans Kristian Nordengen <hans.kristian.nordengen@gmail.com>
Matt Farina
Harry
Krish
jlentzfl
Peter Rifel
Travis Raines
Marc Campbell
Harry Waye
Steffen F. Qvistgaard
elogeart
Samu Toimela
Fernando Ripoll
sekka1
Kevin Lefevre
Sukrit Khera
Peter Bouwdewijn
Jan Schumann
MarkFreebairn
HansK-p