Adding traefik sticky annotations to services

ref: FORGEOPS-6765

Author: damonconway

CHANGELOG.md

@@ -57,4 +57,19 @@ The `amster`, `ds-set-passwords`, and `keystore-create` Kubernetes job names in
 `identity-platform` Helm chart now include the Helm release revision as a suffix
 (e.g. `amster-3`, `ds-set-passwords-3`, `keystore-create-3`). This ensures each
 `helm upgrade` produces a distinct job name, preventing failures caused by Kubernetes'
-immutability constraint on existing jobs.
+immutability constraint on existing jobs.
+
+### Adding annotations for Traefik sticky sessions
+
+The `forgeops prereqs` command installs Traefik in Nginx compatibility mode.
+This was done to make it a more seamless transition from the old and
+unmaintained Nginx ingress. However, some users are installing Traefik manually
+and running into issues with sticky sessions not working. The traefik specific
+annotations for sticky sessions has been added.
+
+## How-tos
+
+The `custom-secrets.md` how-to has been modified to remove references to
+migrating to secret-generator. The references regarding migrating from
+secret-generator have been left in for any users that made the switch already.
+

charts/identity-platform/templates/admin-ui-service.yaml

@@ -3,6 +3,10 @@ apiVersion: v1
 kind: Service
 metadata:
   name: admin-ui
+  annotations:
+    {{- with .Values.platform.service.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
   labels:
     {{- include "identity-platform.labels" . | nindent 4 }}
     {{- with .Values.admin_ui.podLabels }}

charts/identity-platform/templates/am-service.yaml

@@ -3,6 +3,10 @@ apiVersion: v1
 kind: Service
 metadata:
   name: am
+  annotations:
+    {{- with .Values.platform.service.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
   labels:
     {{- include "identity-platform.labels" . | nindent 4 }}
     {{- with .Values.am.podLabels }}

charts/identity-platform/templates/end-user-ui-service.yaml

@@ -3,6 +3,10 @@ apiVersion: v1
 kind: Service
 metadata:
   name: end-user-ui
+  annotations:
+    {{- with .Values.platform.service.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
   labels:
     {{- include "identity-platform.labels" . | nindent 4 }}
     {{- with .Values.end_user_ui.podLabels }}

charts/identity-platform/templates/idm-service.yaml

@@ -3,6 +3,10 @@ apiVersion: v1
 kind: Service
 metadata:
   name: idm
+  annotations:
+    {{- with .Values.platform.service.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
   labels:
     {{- include "identity-platform.labels" . | nindent 4 }}
     {{- with .Values.idm.podLabels }}

charts/identity-platform/templates/login-ui-service.yaml

@@ -3,6 +3,10 @@ apiVersion: v1
 kind: Service
 metadata:
   name: login-ui
+  annotations:
+    {{- with .Values.platform.service.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
   labels:
     {{- include "identity-platform.labels" . | nindent 4 }}
     {{- with .Values.login_ui.podLabels }}

charts/identity-platform/values.yaml

@@ -83,6 +83,11 @@ platform:
       #    crt: # base64 encoded string (Ex: base64 -w 0 <domain-file>.pem)
       #    key: # base64 encoded string (Ex: base64 -w 0 <domain-file>.key)
 
+  service:
+    annotations:
+      traefik.ingress.kubernetes.io/service.sticky.cookie: "true"
+      traefik.ingress.kubernetes.io/service.sticky.cookie.name: "route"
+
   notes:
     enabled: true
   storage:

kustomize/base/admin-ui/admin-ui-service.yaml

@@ -4,6 +4,9 @@ apiVersion: v1
 kind: Service
 metadata:
   name: admin-ui
+  annotations:
+    traefik.ingress.kubernetes.io/service.sticky.cookie: "true"
+    traefik.ingress.kubernetes.io/service.sticky.cookie.name: "route"
   labels:
     helm.sh/chart: identity-platform-1.0.0
     app.kubernetes.io/name: identity-platform

kustomize/base/am/secret-agent/am-service.yaml

@@ -4,6 +4,9 @@ apiVersion: v1
 kind: Service
 metadata:
   name: am
+  annotations:
+    traefik.ingress.kubernetes.io/service.sticky.cookie: "true"
+    traefik.ingress.kubernetes.io/service.sticky.cookie.name: "route"
   labels:
     helm.sh/chart: identity-platform-1.0.0
     app.kubernetes.io/name: identity-platform

kustomize/base/am/secret-generator/am-service.yaml

@@ -4,6 +4,9 @@ apiVersion: v1
 kind: Service
 metadata:
   name: am
+  annotations:
+    traefik.ingress.kubernetes.io/service.sticky.cookie: "true"
+    traefik.ingress.kubernetes.io/service.sticky.cookie.name: "route"
   labels:
     helm.sh/chart: identity-platform-1.0.0
     app.kubernetes.io/name: identity-platform