Skip to content
This repository was archived by the owner on Oct 21, 2020. It is now read-only.

Commit f7dc46e

Browse files
author
pilillo
committed
added traefik and utility to create ingress functions
1 parent 71e09f9 commit f7dc46e

11 files changed

Lines changed: 662 additions & 28 deletions

File tree

‎infrastructure/components/ambassador/README.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Ambassador
2+
Ambassador is an open source API gateway for Kubernetes, built on the Envoy proxy.
3+
4+
## 1. Installation
5+
This component uses Helm to install Ambassador.
6+
Ambassador is exposed by default as LoadBalancer service. While this resource can be requested on a cloud-provided cluster, this is generally not available on bare metal clusters (since LoadBalancers are lower-level network resources), such as minikube and
7+
microk8s. For those, Ambassador can be set to use NodePort. Alternatively, the component [metallb](https://github.com/data-mill-cloud/data-mill/tree/master/infrastructure/components/metallb) can be installed to allocate a local IP and a load balancer as requested
8+
by Ambassador.
9+
10+
## 2. Getting started
11+
A getting started guide to Ambassador is provided [here](https://www.getambassador.io/user-guide/getting-started/).
12+
As mentioned in the example, every service that wants to be accessible through Ambassador from outside the cluster needs to define an annotation of kind:
13+
```
14+
apiVersion: v1
15+
kind: Service
16+
metadata:
17+
name: qotm
18+
annotations:
19+
getambassador.io/config: |
20+
---
21+
apiVersion: ambassador/v0
22+
kind: Mapping
23+
name: qotm_mapping
24+
prefix: /qotm/
25+
service: qotm
26+
spec:
27+
selector:
28+
app: qotm
29+
ports:
30+
- port: 80
31+
name: http-qotm
32+
targetPort: http-api
33+
```
34+
Ambassador continuously monitors the cluster for those annotations and is able to add or change routing rules for annotated services.
35+
36+
## 3. Ingress controllers Vs. Ambassador
37+
Distributing routing rules on the individual components as opposed to a centralised configuration, is in fact similar to the concept of [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/), where a central [Ingress
38+
controller](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-controllers) seeks for Ingress Resources, i.e. a Kubernetes resource that wraps a Service to specify its routing information.
39+
Although still in Beta, Ingress is a core Kubernetes concept, and as such it can benefit of kubectl and all other typical K8s resource management tools.
40+
In addition, certain cloud providers such as GCE/GKE deploy an Ingress controller on the master, while on on-premise clusters a controller should be explicitly deployed.
41+
42+
There exist multiple Ingress controllers, such as based on [Istio](https://istio.io/docs/tasks/traffic-management/ingress/), [nginx](https://www.nginx.com/products/nginx/kubernetes-ingress-controller) and [Traefik](https://docs.traefik.io/user-guide/kubernetes/).
43+
As mentioned in the Ingress documentation, we can easily add an Ingress resource for a Service:
44+
```
45+
apiVersion: extensions/v1beta1
46+
kind: Ingress
47+
metadata:
48+
name: test-ingress
49+
annotations:
50+
nginx.ingress.kubernetes.io/rewrite-target: /
51+
spec:
52+
rules:
53+
- http:
54+
paths:
55+
- path: /testpath
56+
backend:
57+
serviceName: test
58+
servicePort: 80
59+
```
60+
61+
A cluster can simultaneously run multiple ingress controllers. In this case, when creating an ingress the target ingress controller has to be specified using the specific `ingress.class`, or a default one may be used otherwise.
62+
Ideally, all Ingress controllers should respect the basic ingress resource definition, though they may operate slightly differently for certain functionalities.
63+
64+
If you are looking for an Ingress controller, mind that Ambassador provides a superset of a typical controller's functionalities.
65+
[This blog post](https://blog.getambassador.io/kubernetes-ingress-nodeport-load-balancers-and-ingress-controllers-6e29f1c44f2d) explains differences, while [this section](https://www.getambassador.io/concepts/developers/#ingress-resources) of Ambassador
66+
documentation explains why Ambassador does not support Ingress resources.
67+
68+
Among others, Ambassador is [used in the Kubeflow project](https://kubernetes.io/blog/2018/06/07/dynamic-ingress-in-kubernetes/) to manage routing with Kubernetes annotations. This way, Kubeflow redirects all external traffic to Ambassador that does forward to the
69+
individual service for each request.

‎infrastructure/components/ambassador/ambassador_config.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,6 @@ service:
4040
diagnostics:
4141
# NB. set to false to remove diagnostic on a production setup
4242
enabled: true
43-
# added for test
44-
redirect_cleartext_from: 80
45-
service_port: 443
4643
# loadBalancerSourceRanges:
4744
# - YOUR_IP_RANGE
4845

infrastructure/components/grafana/grafana_config_template.yaml renamed to infrastructure/components/grafana/grafana_config.yaml

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -74,15 +74,15 @@ chownDataImage:
7474
service:
7575
type: ClusterIP
7676
port: 80
77-
annotations:
78-
getambassador.io/config: |
79-
---
80-
apiVersion: ambassador/v0
81-
kind: Mapping
82-
name: release-name_mapping
83-
prefix: /release-name
84-
service: release-name
85-
#.k8s-namespace:80
77+
annotations: {}
78+
# getambassador.io/config: |
79+
# ---
80+
# apiVersion: ambassador/v1
81+
# kind: Mapping
82+
# name: release-name_mapping
83+
# #host: release-name.k8s-namespace.local
84+
# prefix: /release-name
85+
# service: release-name
8686
# {}
8787
labels: {}
8888

@@ -92,7 +92,7 @@ ingress:
9292
# kubernetes.io/ingress.class: nginx
9393
# kubernetes.io/tls-acme: "true"
9494
labels: {}
95-
path: /
95+
path: /release-name
9696
hosts:
9797
- chart-example.local
9898
tls: []

‎infrastructure/components/grafana/setup.sh‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,16 @@ if [ -z "$ACTION" ] || [ "$ACTION" != "install" ] && [ "$ACTION" != "delete" ];t
1515
echo "usage: $0 {'install' | 'delete'}";
1616
exit 1
1717
elif [ "$ACTION" = "install" ]; then
18-
# replace release name to map to the right service
19-
sed -e "s/release-name/${cfg__grafana__release}/g" -e "s/k8s-namespace/${cfg__project__k8s_namespace}/g" $file_folder/${cfg__grafana__config_file/.yaml/_template.yaml} > $file_folder/$cfg__grafana__config_file
18+
#sed -e "s/release-name/${cfg__grafana__release}/g" \
19+
# -e "s/k8s-namespace/${cfg__project__k8s_namespace}/g" \
20+
#$file_folder/${cfg__grafana__config_file/.yaml/_template.yaml} > $file_folder/$cfg__grafana__config_file
2021

2122
helm upgrade $cfg__grafana__release stable/grafana \
2223
--namespace $cfg__project__k8s_namespace \
2324
--values $file_folder/$cfg__grafana__config_file \
2425
--install --force
2526

26-
rm $file_folder/$cfg__grafana__config_file
27+
#rm $file_folder/$cfg__grafana__config_file
2728
else
2829
helm delete $cfg__grafana__release --purge
2930
fi

infrastructure/components/kibana/kibana_config_template.yaml renamed to infrastructure/components/kibana/kibana_config.yaml

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -48,17 +48,16 @@ service:
4848
## Default: nil
4949
##
5050
# loadBalancerIP: 10.2.2.2
51-
annotations:
51+
annotations: {}
5252
# Annotation example: setup ssl with aws cert when service.type is LoadBalancer
5353
# service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-1:EXAMPLE_CERT
54-
getambassador.io/config: |
55-
---
56-
apiVersion: ambassador/v0
57-
kind: Mapping
58-
name: release-name_mapping
59-
prefix: /release-name
60-
service: release-name
61-
#.k8s-namespace:443
54+
#getambassador.io/config: |
55+
# ---
56+
# apiVersion: ambassador/v1
57+
# kind: Mapping
58+
# name: release-name_mapping
59+
# prefix: /release-name
60+
# service: release-name:443
6261
labels: {}
6362
## Label example: show service URL in `kubectl cluster-info`
6463
# kubernetes.io/cluster-service: "true"

‎infrastructure/components/kibana/setup.sh‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,18 @@ if [ -z "$ACTION" ] || [ "$ACTION" != "install" ] && [ "$ACTION" != "delete" ];t
1515
echo "usage: $0 {'install' | 'delete'}";
1616
exit 1
1717
elif [ "$ACTION" = "install" ]; then
18-
# installing a standalone kibana component
19-
sed -e "s/release-name/${cfg__kibana__release}/g" -e "s/k8s-namespace/${cfg__project__k8s_namespace}/g" $file_folder/${cfg__kibana__config_file/.yaml/_template.yaml} > $file_folder/$cfg__kibana__config_file
18+
# to be used to define an annotation for Ambassador
19+
#sed -e "s/release-name/${cfg__kibana__release}/g" \
20+
#-e "s/k8s-namespace/${cfg__project__k8s_namespace}/g" \
21+
#$file_folder/${cfg__kibana__config_file/.yaml/_template.yaml} > $file_folder/$cfg__kibana__config_file
2022

23+
# installing a standalone kibana component
2124
helm upgrade $cfg__kibana__release stable/kibana \
2225
--namespace $cfg__project__k8s_namespace \
2326
--values $file_folder/$cfg__kibana__config_file \
2427
--install --force
2528

26-
rm $file_folder/$cfg__kibana__config_file
29+
#rm $file_folder/$cfg__kibana__config_file
2730
else
2831
helm delete --purge $cfg__kibana__release
2932
fi

‎infrastructure/components/traefik/README.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Traefik
2+
[Traefik](https://docs.traefik.io/) is an HTTP reverse proxy, load balancer and Ingress Controller for Kubernetes.
3+
4+
![](https://docs.traefik.io/img/architecture.png)
5+
6+
# 1. Installation
7+
This component installs Traefik using the community provided [Helm chart](https://github.com/helm/charts/tree/master/stable/traefik).
8+
9+
# 2. Writing an Ingress
10+
Traefik can be used as Ingress controller to expose cluster services (typically HTTP and HTTPS) to the outside.
11+
12+
As defined in the [official Traefik documentation](https://docs.traefik.io/user-guide/kubernetes/),
13+
a basic Ingress can be defined for a Service as:
14+
```
15+
apiVersion: v1
16+
kind: Service
17+
metadata:
18+
name: traefik-web-ui
19+
namespace: kube-system
20+
spec:
21+
selector:
22+
k8s-app: traefik-ingress-lb
23+
ports:
24+
- name: web
25+
port: 80
26+
targetPort: 8080
27+
---
28+
apiVersion: extensions/v1beta1
29+
kind: Ingress
30+
metadata:
31+
name: traefik-web-ui
32+
namespace: kube-system
33+
annotations:
34+
kubernetes.io/ingress.class: traefik
35+
spec:
36+
rules:
37+
- host: traefik-ui.minikube
38+
http:
39+
paths:
40+
- path: /
41+
backend:
42+
serviceName: traefik-web-ui
43+
servicePort: 80
44+
```
45+
The example exposes the traefik web UI adding a route for `/`.
46+
For it is possible to run multiple ingress controllers on the same cluster, the annotation `kubernetes.io/ingress.class: traefik` specifies which one to use.
47+
48+
Also, if you restrict access to the resource from a specific host, i.e. traefik-ui.minikube, you have to make sure the host is reachable from DNS.
49+
For a local cluster such as minikube and microk8s one can do:
50+
* *minikube* - `echo "$(minikube ip) traefik-ui.minikube" | sudo tee -a /etc/hosts`
51+
* *microk8s* - `microk8s.kubectl config view | grep server: | awk 'print $2' | sudo tee -a /etc/hosts`
52+
* *any* - `kubectl config view | grep server: | awk 'print $2' | sudo tee -a /etc/hosts`

‎infrastructure/components/traefik/config.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
traefik:
2+
release: traefik
3+
config_file: traefik_config.yaml
4+
# if set use this namespace instead of the application default one
5+
#k8s_namespace: kube-system
6+
# if no host is set, then $(hostname --long) is used
7+
#host:

‎infrastructure/components/traefik/setup.sh‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/usr/bin/env bash
2+
3+
fullpath=$(readlink --canonicalize --no-newline $BASH_SOURCE)
4+
file_folder=$(dirname $fullpath)
5+
6+
# load local yaml config
7+
# if -f was given and the file exists use it, otherwise fallback to the specified component default config
8+
COMPONENT_CONFIG=$(file_exists "$file_folder/$CONFIG_FILE" "$file_folder/$cfg__project__component_default_config")
9+
eval $(parse_yaml $COMPONENT_CONFIG "cfg__")
10+
11+
# use if set or a string argument otherwise
12+
ACTION=${ACTION:=$1}
13+
14+
if [ -z "$ACTION" ] || [ "$ACTION" != "install" ] && [ "$ACTION" != "delete" ];then
15+
echo "usage: $0 {'install' | 'delete'}";
16+
exit 1
17+
elif [ "$ACTION" = "install" ]; then
18+
helm repo update
19+
20+
# use the global namespace if no specific one is set
21+
traefik_ns=${cfg__traefik__k8s_namespace:=$cfg__project__k8s_namespace}
22+
23+
# use the local hostname if no host is set
24+
app_host=$(hostname --long)
25+
app_host=${cfg__traefik__host:=$app_host}
26+
27+
# install traefik chart
28+
helm upgrade $cfg__traefik__release stable/traefik \
29+
--namespace $traefik_ns \
30+
--values $file_folder/$cfg__traefik__config_file \
31+
--install --force
32+
33+
# unset vars
34+
unset traefik_ns
35+
unset app_host
36+
else
37+
helm delete $cfg__traefik__release --purge
38+
fi

0 commit comments

Comments
 (0)