Skip to content

Commit 8fb9b3b

Browse files
author
Debakel Orakel
committed
Support configuring ingress
1 parent c370a32 commit 8fb9b3b

7 files changed

Lines changed: 326 additions & 10 deletions

File tree

‎class/defaults.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,19 @@ parameters:
9797
#increase if auth credentials change
9898
secretVersion: 0
9999

100+
ingress:
101+
enabled: false
102+
tls:
103+
enabled: true
104+
clusterIssuer: 'letsencrypt-production'
105+
key: null
106+
cert: null
107+
url: ''
108+
109+
basicAuth:
110+
enabled: false
111+
htpasswd: '?{vaultkv:${cluster:tenant}/${cluster:name}/${_instance}/htpasswd}'
112+
100113
monitoring: true
101114
alerts:
102115
additionalRules: {}

‎component/helm_values.jsonnet‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,35 @@ local loki = com.makeMergeable({
197197

198198
// Loki Config
199199
local ingress = com.makeMergeable({
200+
[if params.components.gateway.enabled then 'gateway']: {
201+
ingress: {
202+
enabled: params.ingress.enabled,
203+
[if params.ingress.tls.enabled && params.ingress.tls.clusterIssuer != null then 'annotations']: {
204+
'cert-manager.io/cluster-issuer': params.ingress.tls.clusterIssuer,
205+
} + if std.objectHas(params.ingress, 'annotations') then com.makeMergeable(params.ingress.annotations) else {},
206+
[if std.objectHas(params.ingress, 'labels') then 'labels']: params.ingress.labels,
207+
hosts: [ {
208+
host: params.ingress.url,
209+
paths: [
210+
{
211+
path: '/',
212+
pathType: 'Prefix',
213+
},
214+
],
215+
} ],
216+
[if params.ingress.tls.enabled then 'tls']: [ {
217+
hosts: [ params.ingress.url ],
218+
secretName: '%s-tls' % std.strReplace(params.ingress.url, '.', '-'),
219+
} ],
220+
},
221+
nginx: {
222+
basicAuth: {
223+
enabled: params.basicAuth.enabled,
224+
[if params.basicAuth.htpasswd != null && !std.objectHas(params.basicAuth, 'existingSecret') then 'existingSecret']: '%s-nginx-htpasswd' % inv.parameters._instance,
225+
[if std.objectHas(params.basicAuth, 'existingSecret') then 'existingSecret']: params.basicAuth.existingSecret,
226+
},
227+
},
228+
},
200229
});
201230

202231
// hardcoded removal of rollout-operator

‎component/main.jsonnet‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,19 @@ local params = inv.parameters.loki;
5050

5151
local secrets = com.generateResources(
5252
{
53+
[if params.ingress.tls.enabled && params.ingress.tls.key != null && params.ingress.tls.cert != null then '%s-tls' % std.strReplace(params.ingress.url, '.', '-')]:
54+
{
55+
stringData: {
56+
'tls.key': params.ingress.tls.key,
57+
'tls.cert': params.ingress.tls.cert,
58+
},
59+
},
60+
[if params.basicAuth.enabled && params.basicAuth.htpasswd != null then '%s-nginx-htpasswd' % inv.parameters._instance]:
61+
{
62+
stringData: {
63+
'.htpasswd': params.basicAuth.htpasswd,
64+
},
65+
},
5366
['%s-bucket-secret' % inv.parameters._instance]: {
5467
stringData: {
5568
S3_ACCESS_KEY_ID: params.s3.auth.accessKeyId,

‎docs/modules/ROOT/pages/references/parameters.adoc‎

Lines changed: 187 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -555,25 +555,181 @@ s3:
555555
Configure access- and secret key for the S3 storage.
556556

557557

558-
== `secrets`
558+
== `ingress`
559+
560+
Ingress configuration
561+
562+
=== `ingress.enabled`
563+
564+
[horizontal]
565+
type:: boolean
566+
default::
567+
+
568+
[source,yaml]
569+
----
570+
ingress:
571+
enabled: false
572+
----
573+
574+
Enables ingress.
575+
576+
=== `ingress.tls.enabled`
559577

560578
[horizontal]
561579
type:: dict
562-
default:: `{}`
580+
default::
581+
+
582+
[source,yaml]
583+
----
584+
ingress:
585+
tls:
586+
enabled: true
587+
----
588+
589+
Enables using TLS for ingress.
590+
591+
=== `ingress.tls.clusterIssuer`
592+
593+
[horizontal]
594+
type:: dict
595+
default::
596+
+
597+
[source,yaml]
598+
----
599+
ingress:
600+
tls:
601+
clusterIssuer: letsencrypt-production
602+
----
603+
604+
Configures the annotation for the cert-manager `ClusterIssuer`, this component assumes cert-manager is installed.
605+
606+
=== `ingress.tls.key` and `ingress.tls.cert`
607+
608+
[horizontal]
609+
type:: dict
610+
default::
611+
+
612+
[source,yaml]
613+
----
614+
ingress:
615+
tls:
616+
key: null
617+
cert: null
618+
----
619+
default::
620+
+
621+
[source,yaml]
622+
----
623+
ingress:
624+
tls:
625+
clusterIssuer: null
626+
key: |
627+
-----BEGIN PRIVATE KEY-----
628+
...
629+
-----END PRIVATE KEY-----
630+
cert: |
631+
-----BEGIN CERTIFICATE-----
632+
...
633+
-----END CERTIFICATE-----
634+
----
635+
636+
Configures private key and certificate for TLS.
637+
The secret will automatically be created.
638+
639+
[TIP]
640+
====
641+
This requires `ingress.tls.clusterIssuer` to be null.
642+
If both are enabled, `ingress.tls.clusterIssuer` takes precedence.
643+
====
644+
645+
=== `ingress.url`
646+
647+
[horizontal]
648+
type:: dict
649+
default::
650+
+
651+
[source,yaml]
652+
----
653+
ingress:
654+
url: ''
655+
----
656+
657+
The URL for witch the ingress is configured.
658+
659+
=== `ingress.annotations` and `ingress.labels`
660+
661+
[horizontal]
662+
type:: dict
663+
default::
664+
+
665+
[source,yaml]
666+
----
667+
ingress:
668+
annotations: {}
669+
labels: {}
670+
----
563671
example::
564672
+
565673
[source,yaml]
566674
----
567-
secrets:
568-
loki-bucket-secret:
569-
stringData:
570-
S3_ACCESS_KEY_ID: null
571-
S3_SECRET_ACCESS_KEY: null
572-
S3_ENDPOINT: null
675+
ingress:
676+
annotations:
677+
cert-manager.io/cluster-issuer: letsencrypt-staging
573678
----
574679

575-
A dict of secrets to create in the namespace. The key is the name of the secret, the value is the content of the secret.
576-
The value must be a dict with a key `stringData` which is a dict of key/value pairs to add to the secret.
680+
Add custom annotations and labels.
681+
682+
683+
== `basicAuth`
684+
685+
Configures basic authentication for nginx.
686+
687+
=== `basicAuth.enabled`
688+
689+
[horizontal]
690+
type:: boolean
691+
default::
692+
+
693+
[source,yaml]
694+
----
695+
basicAuth:
696+
enabled: false
697+
----
698+
699+
Enables basic authentication for nginx.
700+
701+
=== `basicAuth.htpasswd`
702+
703+
[horizontal]
704+
type:: boolean
705+
default::
706+
+
707+
[source,yaml]
708+
----
709+
basicAuth:
710+
htpasswd: '?{vaultkv:${cluster:tenant}/${cluster:name}/${_instance}/htpasswd}'
711+
----
712+
713+
The content of the `.htpasswd` file.
714+
715+
[TIP]
716+
====
717+
If you set the `basicAuth.htpasswd: null`, you can use the `basicAuth.existingSecret` to inlcude an existing secret.
718+
====
719+
720+
721+
== `monitoring`
722+
723+
[horizontal]
724+
type:: dict
725+
default::
726+
+
727+
[source,yaml]
728+
----
729+
monitoring: true
730+
----
731+
732+
Enable the service monitors, rules, and alerts from the Helm chart.
577733

578734

579735
== `alerts`
@@ -644,6 +800,27 @@ The component expects valid partial Prometheus alert rule objects as values.
644800
IMPORTANT: The provided values aren't validated, they're applied to the corresponding upstream alert as-is.
645801

646802

803+
== `secrets`
804+
805+
[horizontal]
806+
type:: dict
807+
default:: `{}`
808+
example::
809+
+
810+
[source,yaml]
811+
----
812+
secrets:
813+
loki-bucket-secret:
814+
stringData:
815+
S3_ACCESS_KEY_ID: null
816+
S3_SECRET_ACCESS_KEY: null
817+
S3_ENDPOINT: null
818+
----
819+
820+
A dict of secrets to create in the namespace. The key is the name of the secret, the value is the content of the secret.
821+
The value must be a dict with a key `stringData` which is a dict of key/value pairs to add to the secret.
822+
823+
647824
== `helm_values`
648825

649826
[horizontal]

‎tests/extra-config.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,4 +36,23 @@ parameters:
3636
endpoint: 's3.example.com'
3737
region: 'us-east-1'
3838

39+
ingress:
40+
enabled: true
41+
tls:
42+
clusterIssuer: null
43+
key: |
44+
-----BEGIN PRIVATE KEY-----
45+
...
46+
-----END PRIVATE KEY-----
47+
cert: |
48+
-----BEGIN CERTIFICATE-----
49+
...
50+
-----END CERTIFICATE-----
51+
url: metrics-receive.example.com
52+
labels:
53+
custom-label: my-label
54+
55+
basicAuth:
56+
enabled: true
57+
3958
monitoring: false

‎tests/golden/extra-config/loki/loki/01_secrets.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,40 @@ stringData:
1313
S3_ACCESS_KEY_ID: t-silent-test-1234/c-green-test-1234/loki/s3_access_key
1414
S3_SECRET_ACCESS_KEY: t-silent-test-1234/c-green-test-1234/loki/s3_secret_key
1515
type: Opaque
16+
---
17+
apiVersion: v1
18+
data: {}
19+
kind: Secret
20+
metadata:
21+
annotations: {}
22+
labels:
23+
app.kubernetes.io/managed-by: commodore
24+
app.kubernetes.io/name: loki-nginx-htpasswd
25+
name: loki-nginx-htpasswd
26+
name: loki-nginx-htpasswd
27+
namespace: syn-loki
28+
stringData:
29+
.htpasswd: t-silent-test-1234/c-green-test-1234/loki/htpasswd
30+
type: Opaque
31+
---
32+
apiVersion: v1
33+
data: {}
34+
kind: Secret
35+
metadata:
36+
annotations: {}
37+
labels:
38+
app.kubernetes.io/managed-by: commodore
39+
app.kubernetes.io/name: metrics-receive-example-com-tls
40+
name: metrics-receive-example-com-tls
41+
name: metrics-receive-example-com-tls
42+
namespace: syn-loki
43+
stringData:
44+
tls.cert: |
45+
-----BEGIN CERTIFICATE-----
46+
...
47+
-----END CERTIFICATE-----
48+
tls.key: |
49+
-----BEGIN PRIVATE KEY-----
50+
...
51+
-----END PRIVATE KEY-----
52+
type: Opaque

‎tests/golden/extra-config/loki/loki/10_helm_loki/loki/templates/gateway/ingress.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: gateway
6+
app.kubernetes.io/instance: loki
7+
app.kubernetes.io/name: loki
8+
app.kubernetes.io/version: 3.7.2
9+
custom-label: my-label
10+
helm.sh/chart: loki-13.7.2
11+
name: loki-gateway
12+
namespace: syn-loki
13+
spec:
14+
rules:
15+
- host: metrics-receive.example.com
16+
http:
17+
paths:
18+
- backend:
19+
service:
20+
name: loki-gateway
21+
port:
22+
number: 80
23+
path: /
24+
pathType: Prefix
25+
tls:
26+
- hosts:
27+
- metrics-receive.example.com
28+
secretName: metrics-receive-example-com-tls

0 commit comments

Comments
 (0)