Skip to content

Commit b9038a4

Browse files
matheuscscpzirain
matheuscscp
authored and
zirain
committed
Add Flux installation guide
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
1 parent 8fa767a commit b9038a4

45 files changed

Lines changed: 949 additions & 157 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎charts/gateway-helm/templates/certgen-rbac.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ metadata:
1010
{{- end }}
1111
annotations:
1212
"helm.sh/hook": pre-install, pre-upgrade
13-
"helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD.
13+
"helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux.
1414
{{- if .Values.certgen.rbac.annotations }}
1515
{{- toYaml .Values.certgen.rbac.annotations | nindent 4 -}}
1616
{{- end }}
@@ -27,7 +27,7 @@ metadata:
2727
{{- end }}
2828
annotations:
2929
"helm.sh/hook": pre-install, pre-upgrade
30-
"helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD.
30+
"helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux.
3131
{{- if .Values.certgen.rbac.annotations }}
3232
{{- toYaml .Values.certgen.rbac.annotations | nindent 4 -}}
3333
{{- end }}
@@ -53,7 +53,7 @@ metadata:
5353
{{- end }}
5454
annotations:
5555
"helm.sh/hook": pre-install, pre-upgrade
56-
"helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD.
56+
"helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux.
5757
{{- if .Values.certgen.rbac.annotations }}
5858
{{- toYaml .Values.certgen.rbac.annotations | nindent 4 -}}
5959
{{- end }}
@@ -78,7 +78,7 @@ metadata:
7878
{{- end }}
7979
annotations:
8080
"helm.sh/hook": pre-install, pre-upgrade
81-
"helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD.
81+
"helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux.
8282
{{- if .Values.certgen.rbac.annotations }}
8383
{{- toYaml .Values.certgen.rbac.annotations | nindent 4 -}}
8484
{{- end }}
@@ -112,7 +112,7 @@ metadata:
112112
{{- end }}
113113
annotations:
114114
"helm.sh/hook": pre-install, pre-upgrade
115-
"helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD.
115+
"helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD or Flux.
116116
{{- if .Values.certgen.rbac.annotations }}
117117
{{- toYaml .Values.certgen.rbac.annotations | nindent 4 -}}
118118
{{- end }}

‎site/content/en/latest/install/install-flux.md‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
+++
2+
title = "Install with Flux CD"
3+
weight = -98
4+
+++
5+
6+
[Flux](https://fluxcd.io) is a CNCF-graduated, GitOps-based continuous delivery tool for Kubernetes that reconciles cluster state from a Git repository or OCI registry.
7+
Flux can be used to manage the deployment of Envoy Gateway on Kubernetes clusters.
8+
9+
## Before you begin
10+
11+
{{% alert title="Compatibility Matrix" color="warning" %}}
12+
Refer to the [Version Compatibility Matrix](/news/releases/matrix) to learn more.
13+
{{% /alert %}}
14+
15+
{{< boilerplate kind-cluster >}}
16+
17+
Flux must be installed in your Kubernetes cluster.
18+
If you haven't set it up yet, follow the [Flux installation guide](https://fluxcd.io/flux/installation/).
19+
You can use the `flux` CLI, the [Flux Operator](https://fluxoperator.dev/), or any other supported method.
20+
21+
## Install with Flux
22+
23+
The Envoy Gateway Helm chart is published as an OCI artifact at `oci://docker.io/envoyproxy/gateway-helm`.
24+
Create an `OCIRepository` source and a `HelmRelease` that installs the chart into the `envoy-gateway-system` namespace.
25+
26+
```shell
27+
cat <<EOF | kubectl apply -f -
28+
apiVersion: v1
29+
kind: Namespace
30+
metadata:
31+
name: envoy-gateway-system
32+
---
33+
apiVersion: source.toolkit.fluxcd.io/v1
34+
kind: OCIRepository
35+
metadata:
36+
name: gateway-helm
37+
namespace: envoy-gateway-system
38+
spec:
39+
interval: 1h
40+
url: oci://docker.io/envoyproxy/gateway-helm
41+
layerSelector:
42+
mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
43+
operation: copy
44+
ref:
45+
tag: {{< helm-version >}}
46+
---
47+
apiVersion: helm.toolkit.fluxcd.io/v2
48+
kind: HelmRelease
49+
metadata:
50+
name: envoy-gateway
51+
namespace: envoy-gateway-system
52+
spec:
53+
interval: 5m
54+
releaseName: eg
55+
chartRef:
56+
kind: OCIRepository
57+
name: gateway-helm
58+
upgrade:
59+
strategy:
60+
name: RetryOnFailure
61+
retryInterval: 5m
62+
EOF
63+
```
64+
65+
**Note**: For simplicity, we apply these manifests directly to the cluster.
66+
In a production environment, it's recommended to store this configuration in a Git or OCI source that Flux reconciles, following a GitOps workflow.
67+
68+
Wait for Envoy Gateway to become available:
69+
70+
```shell
71+
kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for=condition=Available
72+
```
73+
74+
Install the GatewayClass, Gateway, HTTPRoute and example app:
75+
76+
```shell
77+
kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml -n default
78+
```
79+
80+
**Note**: [`quickstart.yaml`] defines that Envoy Gateway will listen for
81+
traffic on port 80 on its globally-routable IP address, to make it easy to use
82+
browsers to test Envoy Gateway. When Envoy Gateway sees that its Listener is
83+
using a privileged port (<1024), it will map this internally to an
84+
unprivileged port, so that Envoy Gateway doesn't need additional privileges.
85+
It's important to be aware of this mapping, since you may need to take it into
86+
consideration when debugging.
87+
88+
[`quickstart.yaml`]: https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml
89+
90+
91+
## Helm chart customizations
92+
93+
You can customize the Envoy Gateway installation by setting Helm chart values on the `HelmRelease`.
94+
95+
{{% alert title="Helm Chart Values" color="primary" %}}
96+
If you want to know all the available fields inside the values.yaml file, please see the [Helm Chart Values](./gateway-helm-api).
97+
{{% /alert %}}
98+
99+
Below is an example of how to customize the Envoy Gateway installation by using the `values` field on the `HelmRelease`.
100+
101+
```yaml
102+
apiVersion: helm.toolkit.fluxcd.io/v2
103+
kind: HelmRelease
104+
metadata:
105+
name: envoy-gateway
106+
namespace: envoy-gateway-system
107+
spec:
108+
interval: 5m
109+
releaseName: eg
110+
chartRef:
111+
kind: OCIRepository
112+
name: gateway-helm
113+
upgrade:
114+
strategy:
115+
name: RetryOnFailure
116+
retryInterval: 5m
117+
values:
118+
deployment:
119+
envoyGateway:
120+
resources:
121+
limits:
122+
cpu: 700m
123+
memory: 256Mi
124+
```
125+
126+
For values stored in a `ConfigMap` or `Secret`, or for advanced merge strategies, see the [Flux HelmRelease values reference](https://fluxcd.io/flux/components/helm/helmreleases/#values).
127+
128+
{{< boilerplate open-ports >}}
129+
130+
{{% alert title="Next Steps" color="warning" %}}
131+
Envoy Gateway should now be successfully installed and running. To experience more abilities of Envoy Gateway, refer to [Tasks](../tasks).
132+
{{% /alert %}}

‎site/content/en/latest/tasks/security/threat-model.md‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎site/content/en/v1.0/tasks/security/threat-model.md‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎site/content/en/v1.1/tasks/security/threat-model.md‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎site/content/en/v1.2/tasks/security/threat-model.md‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎site/content/en/v1.3/install/install-flux.md‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
+++
2+
title = "Install with Flux CD"
3+
weight = -98
4+
+++
5+
6+
[Flux](https://fluxcd.io) is a CNCF-graduated, GitOps-based continuous delivery tool for Kubernetes that reconciles cluster state from a Git repository or OCI registry.
7+
Flux can be used to manage the deployment of Envoy Gateway on Kubernetes clusters.
8+
9+
## Before you begin
10+
11+
{{% alert title="Compatibility Matrix" color="warning" %}}
12+
Refer to the [Version Compatibility Matrix](/news/releases/matrix) to learn more.
13+
{{% /alert %}}
14+
15+
{{< boilerplate kind-cluster >}}
16+
17+
Flux must be installed in your Kubernetes cluster.
18+
If you haven't set it up yet, follow the [Flux installation guide](https://fluxcd.io/flux/installation/).
19+
You can use the `flux` CLI, the [Flux Operator](https://fluxoperator.dev/), or any other supported method.
20+
21+
## Install with Flux
22+
23+
The Envoy Gateway Helm chart is published as an OCI artifact at `oci://docker.io/envoyproxy/gateway-helm`.
24+
Create an `OCIRepository` source and a `HelmRelease` that installs the chart into the `envoy-gateway-system` namespace.
25+
26+
```shell
27+
cat <<EOF | kubectl apply -f -
28+
apiVersion: v1
29+
kind: Namespace
30+
metadata:
31+
name: envoy-gateway-system
32+
---
33+
apiVersion: source.toolkit.fluxcd.io/v1
34+
kind: OCIRepository
35+
metadata:
36+
name: gateway-helm
37+
namespace: envoy-gateway-system
38+
spec:
39+
interval: 1h
40+
url: oci://docker.io/envoyproxy/gateway-helm
41+
layerSelector:
42+
mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
43+
operation: copy
44+
ref:
45+
tag: {{< helm-version >}}
46+
---
47+
apiVersion: helm.toolkit.fluxcd.io/v2
48+
kind: HelmRelease
49+
metadata:
50+
name: envoy-gateway
51+
namespace: envoy-gateway-system
52+
spec:
53+
interval: 5m
54+
releaseName: eg
55+
chartRef:
56+
kind: OCIRepository
57+
name: gateway-helm
58+
upgrade:
59+
strategy:
60+
name: RetryOnFailure
61+
retryInterval: 5m
62+
EOF
63+
```
64+
65+
**Note**: For simplicity, we apply these manifests directly to the cluster.
66+
In a production environment, it's recommended to store this configuration in a Git or OCI source that Flux reconciles, following a GitOps workflow.
67+
68+
Wait for Envoy Gateway to become available:
69+
70+
```shell
71+
kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for=condition=Available
72+
```
73+
74+
Install the GatewayClass, Gateway, HTTPRoute and example app:
75+
76+
```shell
77+
kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml -n default
78+
```
79+
80+
**Note**: [`quickstart.yaml`] defines that Envoy Gateway will listen for
81+
traffic on port 80 on its globally-routable IP address, to make it easy to use
82+
browsers to test Envoy Gateway. When Envoy Gateway sees that its Listener is
83+
using a privileged port (<1024), it will map this internally to an
84+
unprivileged port, so that Envoy Gateway doesn't need additional privileges.
85+
It's important to be aware of this mapping, since you may need to take it into
86+
consideration when debugging.
87+
88+
[`quickstart.yaml`]: https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml
89+
90+
91+
## Helm chart customizations
92+
93+
You can customize the Envoy Gateway installation by setting Helm chart values on the `HelmRelease`.
94+
95+
{{% alert title="Helm Chart Values" color="primary" %}}
96+
If you want to know all the available fields inside the values.yaml file, please see the [Helm Chart Values](./gateway-helm-api).
97+
{{% /alert %}}
98+
99+
Below is an example of how to customize the Envoy Gateway installation by using the `values` field on the `HelmRelease`.
100+
101+
```yaml
102+
apiVersion: helm.toolkit.fluxcd.io/v2
103+
kind: HelmRelease
104+
metadata:
105+
name: envoy-gateway
106+
namespace: envoy-gateway-system
107+
spec:
108+
interval: 5m
109+
releaseName: eg
110+
chartRef:
111+
kind: OCIRepository
112+
name: gateway-helm
113+
upgrade:
114+
strategy:
115+
name: RetryOnFailure
116+
retryInterval: 5m
117+
values:
118+
deployment:
119+
envoyGateway:
120+
resources:
121+
limits:
122+
cpu: 700m
123+
memory: 256Mi
124+
```
125+
126+
For values stored in a `ConfigMap` or `Secret`, or for advanced merge strategies, see the [Flux HelmRelease values reference](https://fluxcd.io/flux/components/helm/helmreleases/#values).
127+
128+
{{< boilerplate open-ports >}}
129+
130+
{{% alert title="Next Steps" color="warning" %}}
131+
Envoy Gateway should now be successfully installed and running. To experience more abilities of Envoy Gateway, refer to [Tasks](../tasks).
132+
{{% /alert %}}

0 commit comments

Comments
 (0)