Sergiusz Bazanski | a9c7e86 | 2019-04-01 17:56:28 +0200 | [diff] [blame] | 1 | # Deploy a per-cluster Nginx Ingress Controller |
| 2 | |
| 3 | local kube = import "../../../kube/kube.libsonnet"; |
| 4 | |
| 5 | { |
| 6 | Environment: { |
| 7 | local env = self, |
| 8 | local cfg = env.cfg, |
| 9 | cfg:: { |
| 10 | image: "quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.23.0", |
| 11 | namespace: "nginx-system", |
| 12 | }, |
| 13 | |
| 14 | metadata:: { |
| 15 | namespace: cfg.namespace, |
| 16 | labels: { |
| 17 | "app.kubernetes.io/name": "ingress-nginx", |
| 18 | "app.kubernetes.io/part-of": "ingress-nginx", |
| 19 | }, |
| 20 | }, |
| 21 | |
| 22 | namespace: kube.Namespace(cfg.namespace), |
| 23 | |
| 24 | maps: { |
| 25 | make(name):: kube.ConfigMap(name) { |
| 26 | metadata+: env.metadata, |
| 27 | }, |
| 28 | configuration: env.maps.make("nginx-configuration"), |
Sergiusz Bazanski | 543b412 | 2019-06-29 22:42:39 +0200 | [diff] [blame] | 29 | tcp: env.maps.make("tcp-services") { |
| 30 | data: { |
| 31 | "22": "gerrit/gerrit:22" |
| 32 | } |
| 33 | }, |
Sergiusz Bazanski | a9c7e86 | 2019-04-01 17:56:28 +0200 | [diff] [blame] | 34 | udp: env.maps.make("udp-services"), |
| 35 | }, |
| 36 | |
| 37 | sa: kube.ServiceAccount("nginx-ingress-serviceaccount") { |
| 38 | metadata+: env.metadata, |
| 39 | }, |
| 40 | |
| 41 | cr: kube.ClusterRole("nginx-ingress-clusterrole") { |
| 42 | metadata+: env.metadata { |
| 43 | namespace:: null, |
| 44 | }, |
| 45 | rules: [ |
| 46 | { |
| 47 | apiGroups: [""], |
| 48 | resources: ["configmaps", "endpoints", "nodes", "pods", "secrets"], |
| 49 | verbs: ["list", "watch"], |
| 50 | }, |
| 51 | { |
| 52 | apiGroups: [""], |
| 53 | resources: ["nodes"], |
| 54 | verbs: ["get"], |
| 55 | }, |
| 56 | { |
| 57 | apiGroups: [""], |
| 58 | resources: ["services"], |
| 59 | verbs: ["get", "list", "watch"], |
| 60 | }, |
| 61 | { |
| 62 | apiGroups: ["extensions"], |
| 63 | resources: ["ingresses"], |
| 64 | verbs: ["get", "list", "watch"], |
| 65 | }, |
| 66 | { |
| 67 | apiGroups: [""], |
| 68 | resources: ["events"], |
| 69 | verbs: ["create", "patch"], |
| 70 | }, |
| 71 | { |
| 72 | apiGroups: ["extensions"], |
| 73 | resources: ["ingresses/status"], |
| 74 | verbs: ["update"], |
| 75 | }, |
| 76 | ], |
| 77 | }, |
| 78 | |
| 79 | crb: kube.ClusterRoleBinding("nginx-ingress-clusterrole-nisa-binding") { |
| 80 | metadata+: env.metadata { |
| 81 | namespace:: null, |
| 82 | }, |
| 83 | roleRef: { |
| 84 | apiGroup: "rbac.authorization.k8s.io", |
| 85 | kind: "ClusterRole", |
| 86 | name: env.cr.metadata.name, |
| 87 | }, |
| 88 | subjects: [ |
| 89 | { |
| 90 | kind: "ServiceAccount", |
| 91 | name: env.sa.metadata.name, |
| 92 | namespace: env.sa.metadata.namespace, |
| 93 | }, |
| 94 | ], |
| 95 | }, |
| 96 | |
| 97 | role: kube.Role("nginx-ingress-role") { |
| 98 | metadata+: env.metadata, |
| 99 | rules : [ |
| 100 | { |
| 101 | apiGroups: [""], |
| 102 | resources: ["configmaps", "pods", "secrets", "namespaces"], |
| 103 | verbs: ["get"], |
| 104 | }, |
| 105 | { |
| 106 | apiGroups: [""], |
| 107 | resources: ["configmaps"], |
| 108 | resourceNames: ["ingress-controller-leader-nginx"], |
| 109 | verbs: ["get", "update"], |
| 110 | }, |
| 111 | { |
| 112 | apiGroups: [""], |
| 113 | resources: ["configmaps"], |
| 114 | verbs: ["create"], |
| 115 | }, |
| 116 | { |
| 117 | apiGroups: [""], |
| 118 | resources: ["endpoints"], |
| 119 | verbs: ["get"], |
| 120 | }, |
| 121 | ], |
| 122 | }, |
| 123 | |
| 124 | roleb: kube.RoleBinding("nginx-ingress-role-nisa-binding") { |
| 125 | metadata+: env.metadata, |
| 126 | roleRef: { |
| 127 | apiGroup: "rbac.authorization.k8s.io", |
| 128 | kind: "Role", |
| 129 | name: env.role.metadata.name, |
| 130 | }, |
| 131 | subjects: [ |
| 132 | { |
| 133 | kind: "ServiceAccount", |
| 134 | name: env.sa.metadata.name, |
| 135 | namespace: env.sa.metadata.namespace, |
| 136 | }, |
| 137 | ], |
| 138 | }, |
| 139 | |
| 140 | service: kube.Service("ingress-nginx") { |
| 141 | metadata+: env.metadata, |
| 142 | target_pod:: env.deployment.spec.template, |
| 143 | spec+: { |
| 144 | type: "LoadBalancer", |
| 145 | ports: [ |
Sergiusz Bazanski | 543b412 | 2019-06-29 22:42:39 +0200 | [diff] [blame] | 146 | { name: "ssh", port: 22, targetPort: 22, protocol: "TCP" }, |
Sergiusz Bazanski | a9c7e86 | 2019-04-01 17:56:28 +0200 | [diff] [blame] | 147 | { name: "http", port: 80, targetPort: 80, protocol: "TCP" }, |
| 148 | { name: "https", port: 443, targetPort: 443, protocol: "TCP" }, |
| 149 | ], |
| 150 | }, |
| 151 | }, |
| 152 | |
| 153 | deployment: kube.Deployment("nginx-ingress-controller") { |
| 154 | metadata+: env.metadata, |
| 155 | spec+: { |
| 156 | replicas: 1, |
| 157 | template+: { |
| 158 | spec+: { |
| 159 | serviceAccountName: env.sa.metadata.name, |
| 160 | containers_: { |
| 161 | controller: kube.Container("nginx-ingress-controller") { |
| 162 | image: cfg.image, |
| 163 | args: [ |
| 164 | "/nginx-ingress-controller", |
| 165 | "--configmap=%s/%s" % [cfg.namespace, env.maps.configuration.metadata.name], |
| 166 | "--tcp-services-configmap=%s/%s" % [cfg.namespace, env.maps.tcp.metadata.name], |
| 167 | "--udp-services-configmap=%s/%s" % [cfg.namespace, env.maps.udp.metadata.name], |
| 168 | "--publish-service=%s/%s" % [cfg.namespace, env.service.metadata.name], |
| 169 | "--annotations-prefix=nginx.ingress.kubernetes.io", |
| 170 | ], |
| 171 | env_: { |
| 172 | POD_NAME: kube.FieldRef("metadata.name"), |
| 173 | POD_NAMESPACE: kube.FieldRef("metadata.namespace"), |
| 174 | }, |
| 175 | ports_: { |
| 176 | http: { containerPort: 80 }, |
| 177 | https: { containerPort: 443 }, |
| 178 | }, |
| 179 | livenessProbe: { |
| 180 | failureThreshold: 3, |
| 181 | httpGet: { |
| 182 | path: "/healthz", |
| 183 | port: 10254, |
| 184 | scheme: "HTTP", |
| 185 | }, |
| 186 | initialDelaySeconds: 10, |
| 187 | periodSeconds: 10, |
| 188 | successThreshold: 1, |
| 189 | timeoutSeconds: 10, |
| 190 | }, |
| 191 | readinessProbe: { |
| 192 | failureThreshold: 3, |
| 193 | httpGet: { |
| 194 | path: "/healthz", |
| 195 | port: 10254, |
| 196 | scheme: "HTTP", |
| 197 | }, |
| 198 | periodSeconds: 10, |
| 199 | successThreshold: 1, |
| 200 | timeoutSeconds: 10, |
| 201 | }, |
| 202 | securityContext: { |
| 203 | allowPrivilegeEscalation: true, |
| 204 | capabilities: { |
| 205 | drop: ["ALL"], |
| 206 | add: ["NET_BIND_SERVICE"], |
| 207 | }, |
| 208 | runAsUser: 33, |
| 209 | }, |
| 210 | }, |
| 211 | }, |
| 212 | }, |
| 213 | }, |
| 214 | }, |
| 215 | }, |
| 216 | }, |
| 217 | } |