Merge pull request #18 from projectsyn/feat/additional-config-rendering

Refactor additional config rendering

Author: DebakelOrakel

class/defaults.yml

@@ -97,12 +97,26 @@ parameters:
         #increase if auth credentials change
         secretVersion: 0
 
-    secrets: {}
+    ingress:
+      enabled: false
+      tls:
+        enabled: true
+        clusterIssuer: 'letsencrypt-production'
+        key: null
+        cert: null
+      url: ''
+
+    basicAuth:
+      enabled: false
+      htpasswd: '?{vaultkv:${cluster:tenant}/${cluster:name}/${_instance}/htpasswd}'
 
+    monitoring: true
     alerts:
       additionalRules: {}
       patchRules:
         ignoreNames: []
         patches: {}
 
+    secrets: {}
+
     helm_values: {}

component/helm_values.jsonnet

@@ -10,7 +10,12 @@ local hasRolloutOperator = std.member(inv.applications, 'rollout-operator');
 // Global Params and Zone Aware Replication
 local globalConfig = params.global + com.makeMergeable({
   nodeSelector: std.get(params, 'globalNodeSelector', params.global.nodeSelector),
-  zoneAwareReplication: if hasRolloutOperator then params.global.zoneAwareReplication else std.trace('rollout-operator must be installed', {}),
+  zoneAwareReplication: params.global.zoneAwareReplication {
+    enabled: if params.global.zoneAwareReplication.enabled then
+      // Assert that zone aware replication is only enabled if rollout-operator is installed
+      if hasRolloutOperator then true else error 'rollout-operator must be installed for zone-aware replication'
+    else false,
+  },
 });
 
 local components = com.makeMergeable({
@@ -85,6 +90,39 @@ local openshift = if isOpenshift then com.makeMergeable({
     dnsService: 'dns-default',
     dnsNamespace: 'openshift-dns',
   },
+  loki: {
+    podSecurityContext: {
+      fsGroup: null,
+      runAsGroup: null,
+      runAsNonRoot: true,
+      runAsUser: null,
+    },
+  },
+  gateway: {
+    podSecurityContext: {
+      fsGroup: null,
+      runAsGroup: null,
+      runAsNonRoot: true,
+      runAsUser: null,
+    },
+    metrics: {
+      containerSecurityContext: {
+        privileged: null,
+        runAsGroup: null,
+        runAsNonRoot: null,
+        runAsUser: null,
+      },
+    },
+  },
+  rbac: {
+    sccEnabled: false,
+  },
+  memcached: {
+    podSecurityContext: null,
+  },
+  lokiCanary: {
+    podSecurityContext: null,
+  },
 }) else {};
 
 local images = com.makeMergeable({
@@ -131,6 +169,14 @@ local global = com.makeMergeable({
       bucketSecretVersion: '%s' % params.s3.auth.secretVersion,
     },
   },
+  [if params.monitoring then 'monitoring']: {
+    serviceMonitor: {
+      enabled: params.monitoring,
+    },
+    rules: {
+      enabled: params.monitoring,
+    },
+  },
   lokiCanary: {
     enabled: false,
   },
@@ -188,6 +234,33 @@ local loki = com.makeMergeable({
 
 // Loki Config
 local ingress = com.makeMergeable({
+  [if params.components.gateway.enabled then 'gateway']: {
+    ingress: {
+      enabled: params.ingress.enabled,
+      [if params.ingress.tls.enabled && params.ingress.tls.clusterIssuer != null then 'annotations']: {
+        'cert-manager.io/cluster-issuer': params.ingress.tls.clusterIssuer,
+      } + if std.objectHas(params.ingress, 'annotations') then com.makeMergeable(params.ingress.annotations) else {},
+      [if std.objectHas(params.ingress, 'labels') then 'labels']: params.ingress.labels,
+      hosts: [ {
+        host: params.ingress.url,
+        paths: [
+          {
+            path: '/',
+            pathType: 'Prefix',
+          },
+        ],
+      } ],
+      [if params.ingress.tls.enabled then 'tls']: [ {
+        hosts: [ params.ingress.url ],
+        secretName: '%s-tls' % std.strReplace(params.ingress.url, '.', '-'),
+      } ],
+    },
+    basicAuth: {
+      enabled: params.basicAuth.enabled,
+      [if params.basicAuth.htpasswd != null && !std.objectHas(params.basicAuth, 'existingSecret') then 'existingSecret']: '%s-nginx-htpasswd' % inv.parameters._instance,
+      [if std.objectHas(params.basicAuth, 'existingSecret') then 'existingSecret']: params.basicAuth.existingSecret,
+    },
+  },
 });
 
 // hardcoded removal of rollout-operator
@@ -199,6 +272,11 @@ local hardRestrictions = com.makeMergeable({
     enabled: false,
   },
   [if !std.member([ 'none', 'legacy' ], params.preset) then 'deploymentMode']: 'Distributed',
+  ingester: {
+    zoneAwareReplication: {
+      enabled: if hasRolloutOperator && params.global.zoneAwareReplication.enabled then true else false,
+    },
+  },
 });
 
 {

component/main.jsonnet

@@ -50,6 +50,19 @@ local params = inv.parameters.loki;
 
 local secrets = com.generateResources(
   {
+    [if params.ingress.tls.enabled && params.ingress.tls.key != null && params.ingress.tls.cert != null then '%s-tls' % std.strReplace(params.ingress.url, '.', '-')]:
+      {
+        stringData: {
+          'tls.key': params.ingress.tls.key,
+          'tls.cert': params.ingress.tls.cert,
+        },
+      },
+    [if params.basicAuth.enabled && params.basicAuth.htpasswd != null then '%s-nginx-htpasswd' % inv.parameters._instance]:
+      {
+        stringData: {
+          '.htpasswd': params.basicAuth.htpasswd,
+        },
+      },
     ['%s-bucket-secret' % inv.parameters._instance]: {
       stringData: {
         S3_ACCESS_KEY_ID: params.s3.auth.accessKeyId,

docs/modules/ROOT/pages/how-tos/upgrade-loki-v0-v1.adoc

@@ -41,6 +41,18 @@ helm_values:
 
 Remove the parameters from "Step 1" and deploy again.
 
+=== (Optional) Consider disabling Zone Aware Replication
+
+[IMPORTANT]
+====
+This version of the component disables zone aware replication by default, because the rollout-operator in this version of the component *installs CRDs* for certain functionalities.
+
+That can be a problem, when more than 1 instance of this component is installed.
+We recommend disabling zone aware replication, unless you need this feature and have a cluster that actually has multiple availability zones enabled.
+====
+
+See xref:references/parameters.adoc#_global[global configuration] for reference.
+
 === New Default Resource Requests
 
 [IMPORTANT]