Sergiusz Bazanski | 6f773e0 | 2019-10-02 20:46:48 +0200 | [diff] [blame] | 1 | # Mirko, an abstraction layer for hscloud kubernetes services. |
| 2 | |
| 3 | local kube = import "kube.libsonnet"; |
| 4 | |
| 5 | { |
| 6 | Environment(name): { |
| 7 | local env = self, |
| 8 | local cfg = env.cfg, |
| 9 | cfg:: { |
| 10 | name: name, |
| 11 | namespace: cfg.name, |
| 12 | }, |
| 13 | |
| 14 | namespace: kube.Namespace(cfg.namespace), |
| 15 | |
| 16 | components: {}, // type: mirko.Component |
| 17 | |
| 18 | // Currently hardcoded! |
| 19 | // This might end up being something passed part of kubecfg evaluation, |
| 20 | // when we get to supporting multiple/federated clusters. |
| 21 | // For now, this is goog enough. |
| 22 | pkiRealm:: "hswaw.net", |
| 23 | pkiClusterFQDN:: "k0.hswaw.net", |
| 24 | |
| 25 | // Generate an ingress if we have any public ports. |
| 26 | publicHTTPPorts:: std.flattenArrays([ |
| 27 | [ |
| 28 | { |
| 29 | local component = env.components[c], |
| 30 | |
| 31 | service: component.svc, |
| 32 | port: component.cfg.ports.publicHTTP[p].port, |
| 33 | dns: component.cfg.ports.publicHTTP[p].dns, |
| 34 | } |
| 35 | for p in std.objectFields(env.components[c].cfg.ports.publicHTTP) |
| 36 | ] |
| 37 | for c in std.objectFields(env.components) |
| 38 | ]), |
| 39 | |
| 40 | ingress: if std.length(env.publicHTTPPorts) > 0 then kube.Ingress("mirko-public") { |
| 41 | metadata+: { |
| 42 | namespace: env.cfg.namespace, |
| 43 | labels: { |
| 44 | "app.kubernetes.io/name": cfg.name, |
| 45 | "app.kubernetes.io/managed-by": "kubecfg-mirko", |
| 46 | "app.kubernetes.io/component": cfg.name, |
| 47 | "mirko.hscloud.hackerspace.pl/environment": env.cfg.name, |
| 48 | "mirko.hscloud.hackerspace.pl/component": "mirko-public-ingress", |
| 49 | }, |
| 50 | annotations+: { |
| 51 | "kubernetes.io/tls-acme": "true", |
| 52 | "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod", |
| 53 | }, |
| 54 | }, |
| 55 | spec+: { |
| 56 | tls: [ |
| 57 | { |
| 58 | hosts: [p.dns for p in env.publicHTTPPorts], |
| 59 | secretName: "mirko-public-tls", |
| 60 | }, |
| 61 | ], |
| 62 | rules: [ |
| 63 | { |
| 64 | host: p.dns, |
| 65 | http: { |
| 66 | paths: [ |
| 67 | { path: "/", backend: { serviceName: p.service.metadata.name, servicePort: p.port }}, |
| 68 | ], |
| 69 | }, |
| 70 | } |
| 71 | for p in env.publicHTTPPorts |
| 72 | ], |
| 73 | }, |
| 74 | } else {} |
| 75 | }, |
| 76 | |
| 77 | Component(env, name): { |
| 78 | local component = self, |
| 79 | local cfg = component.cfg, |
| 80 | |
| 81 | makeName(suffix):: "%s%s%s" % [cfg.prefix, cfg.name, suffix], |
| 82 | |
| 83 | metadata:: { |
| 84 | namespace: env.cfg.namespace, |
| 85 | labels: { |
| 86 | "app.kubernetes.io/name": env.cfg.name, |
| 87 | "app.kubernetes.io/managed-by": "kubecfg-mirko", |
| 88 | "app.kubernetes.io/component": cfg.name, |
| 89 | "mirko.hscloud.hackerspace.pl/environment": env.cfg.name, |
| 90 | "mirko.hscloud.hackerspace.pl/component": cfg.name, |
| 91 | }, |
| 92 | }, |
| 93 | |
| 94 | |
| 95 | # Tunables for users. |
| 96 | cfg:: { |
| 97 | name: name, |
| 98 | |
| 99 | prefix:: "", |
| 100 | image:: env.image, |
| 101 | volumes:: {}, |
| 102 | containers:: { |
| 103 | main: cfg.container, |
| 104 | }, |
Sergiusz Bazanski | 92b48d6 | 2020-01-08 13:59:04 +0100 | [diff] [blame] | 105 | nodeSelector: null, |
Sergiusz Bazanski | aa8c2b0 | 2020-02-15 12:38:39 +0100 | [diff] [blame] | 106 | securityContext: {}, |
Sergiusz Bazanski | 6f773e0 | 2019-10-02 20:46:48 +0200 | [diff] [blame] | 107 | container:: error "container(s) must be set", |
| 108 | ports:: { |
| 109 | publicHTTP: {}, // name -> { port: no, dns: fqdn } |
| 110 | grpc: { main: 4200 }, // name -> port no |
| 111 | }, |
| 112 | |
| 113 | }, |
| 114 | |
| 115 | allPorts:: { |
| 116 | ['grpc-' + p]: cfg.ports.grpc[p] |
| 117 | for p in std.objectFields(cfg.ports.grpc) |
| 118 | } + { |
| 119 | ['pubhttp-' + p] : cfg.ports.publicHTTP[p].port |
| 120 | for p in std.objectFields(cfg.ports.publicHTTP) |
| 121 | }, |
| 122 | |
| 123 | Container(name):: kube.Container(component.makeName(name)) { |
| 124 | image: cfg.image, |
| 125 | volumeMounts_: { |
| 126 | pki: { mountPath: "/mnt/pki" }, |
| 127 | }, |
| 128 | ports_: { |
| 129 | [p]: { containerPort: component.allPorts[p] } |
| 130 | for p in std.objectFields(component.allPorts) |
| 131 | }, |
| 132 | resources: { |
| 133 | requests: { |
| 134 | cpu: "25m", |
| 135 | memory: "64Mi", |
| 136 | }, |
| 137 | limits: { |
| 138 | cpu: "500m", |
| 139 | memory: "128Mi", |
| 140 | }, |
| 141 | }, |
| 142 | }, |
| 143 | |
| 144 | GoContainer(name, binary):: component.Container(name) { |
| 145 | command: [ |
| 146 | binary, |
| 147 | "-hspki_realm", env.pkiRealm, |
| 148 | "-hspki_cluster", env.pkiClusterFQDN, |
| 149 | "-hspki_tls_ca_path", "/mnt/pki/ca.crt", |
| 150 | "-hspki_tls_certificate_path", "/mnt/pki/tls.crt", |
| 151 | "-hspki_tls_key_path", "/mnt/pki/tls.key", |
| 152 | "-logtostderr", |
| 153 | "-listen_address", "0.0.0.0:4200", |
| 154 | ], |
| 155 | }, |
| 156 | |
| 157 | deployment: kube.Deployment(component.makeName("-main")) { |
| 158 | metadata+: component.metadata, |
| 159 | spec+: { |
| 160 | template+: { |
| 161 | spec+: { |
| 162 | volumes_: { |
| 163 | pki: { |
| 164 | secret: { secretName: component.pki.cert.spec.secretName }, |
| 165 | }, |
| 166 | } + cfg.volumes, |
| 167 | containers_: cfg.containers, |
Sergiusz Bazanski | 92b48d6 | 2020-01-08 13:59:04 +0100 | [diff] [blame] | 168 | nodeSelector: cfg.nodeSelector, |
Sergiusz Bazanski | 6f773e0 | 2019-10-02 20:46:48 +0200 | [diff] [blame] | 169 | |
| 170 | serviceAccountName: component.sa.metadata.name, |
Sergiusz Bazanski | aa8c2b0 | 2020-02-15 12:38:39 +0100 | [diff] [blame] | 171 | securityContext: cfg.securityContext, |
Sergiusz Bazanski | 6f773e0 | 2019-10-02 20:46:48 +0200 | [diff] [blame] | 172 | }, |
| 173 | }, |
| 174 | }, |
| 175 | }, |
| 176 | |
| 177 | svc: kube.Service(component.makeName("")) { // No suffix, name part of DNS entry. |
| 178 | metadata+: component.metadata, |
| 179 | target_pod:: component.deployment.spec.template, |
| 180 | spec+: { |
| 181 | ports: [ |
| 182 | { |
| 183 | name: p, |
| 184 | port: component.allPorts[p], |
| 185 | targetPort: component.allPorts[p], |
| 186 | } |
| 187 | for p in std.objectFields(component.allPorts) |
| 188 | ], |
| 189 | }, |
| 190 | }, |
| 191 | |
| 192 | sa: kube.ServiceAccount(component.makeName("-main")) { |
| 193 | metadata+: component.metadata, |
| 194 | }, |
| 195 | |
| 196 | pki: { |
| 197 | cert: kube.Certificate(component.makeName("-cert")) { |
| 198 | metadata+: component.metadata, |
| 199 | |
| 200 | spec: { |
| 201 | secretName: component.makeName("-cert"), |
| 202 | duration: "35040h0m0s", // 4 years |
| 203 | issuerRef: { |
| 204 | // Contract with cluster/lib/pki.libsonnet. |
| 205 | name: "pki-ca", |
| 206 | kind: "ClusterIssuer", |
| 207 | }, |
| 208 | commonName: "%s.%s.svc.%s" % [component.svc.metadata.name, component.svc.metadata.namespace, env.pkiClusterFQDN ], |
| 209 | dnsNames: [ |
| 210 | "%s" % [component.svc.metadata.name ], |
| 211 | "%s.%s" % [component.svc.metadata.name, component.svc.metadata.namespace ], |
| 212 | "%s.%s.svc" % [component.svc.metadata.name, component.svc.metadata.namespace ], |
| 213 | "%s.%s.svc.cluster.local" % [component.svc.metadata.name, component.svc.metadata.namespace ], |
| 214 | "%s.%s.svc.%s" % [component.svc.metadata.name, component.svc.metadata.namespace, env.pkiClusterFQDN ], |
| 215 | ], |
| 216 | }, |
| 217 | }, |
| 218 | }, |
| 219 | }, |
| 220 | } |