addons: add Traefik to be used for HTTP-01 HTTPRoute solving

Signed-off-by: Maël Valais <mael@vls.dev>

devel/BUILD.bazel

@@ -18,6 +18,7 @@ filegroup(
         "//devel/addon/pebble:all-srcs",
         "//devel/addon/sample-external-issuer:all-srcs",
         "//devel/addon/samplewebhook:all-srcs",
+        "//devel/addon/traefik:all-srcs",
         "//devel/addon/vault:all-srcs",
         "//devel/bin:all-srcs",
         "//devel/cluster:all-srcs",

devel/addon/bind/manifests/configmap.yaml

@@ -39,6 +39,8 @@ data:
     ingress-nginx	IN	A {SERVICE_IP_PREFIX}.15
     *.gateway IN  A {SERVICE_IP_PREFIX}.14
     gateway IN  A {SERVICE_IP_PREFIX}.14
+    *.traefik IN  A {SERVICE_IP_PREFIX}.13
+    traefik IN  A {SERVICE_IP_PREFIX}.13
 
   db.dns01.example.com: |
     ;

devel/addon/traefik/BUILD.bazel

@@ -0,0 +1,23 @@
+load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
+
+container_bundle(
+    name = "bundle",
+    images = {
+        "traefik:2.4.9": "@io_traefik_traefik//image",
+    },
+    tags = ["manual"],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

devel/addon/traefik/install.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+
+# Copyright 2021 The cert-manager Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Install HAProxy as a gateway-API e2e test.
+
+set -o nounset
+set -o errexit
+set -o pipefail
+
+SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
+source "${SCRIPT_ROOT}/../../lib/lib.sh"
+
+check_tool helm
+check_tool kubectl
+
+helm repo add traefik --force-update https://helm.traefik.io/traefik
+
+IMAGE_TAG="2.4.9"
+
+require_image "traefik:${IMAGE_TAG}" "//devel/addon/traefik:bundle"
+
+helm upgrade --install --create-namespace \
+  --namespace traefik \
+  --version 10.1.1 \
+  --set additionalArguments='{--experimental.kubernetesgateway=true,--providers.kubernetesgateway=true}' \
+  --set image.tag=${IMAGE_TAG} \
+  --set "service.type=ClusterIP" \
+  --set "service.spec.clusterIP=10.0.0.13" \
+  traefik traefik/traefik
+
+kubectl apply -f- <<EOF
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: gateway-role
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - endpoints
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - networking.x-k8s.io
+    resources:
+      - gatewayclasses
+      - gateways
+      - httproutes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - networking.x-k8s.io
+    resources:
+      - gatewayclasses/status
+      - gateways/status
+      - httproutes/status
+    verbs:
+      - update
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: gateway-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: gateway-role
+subjects:
+  - kind: ServiceAccount
+    name: traefik
+    namespace: traefik
+EOF
+
+cat <<EOYAML | kubectl apply -f -
+apiVersion: networking.x-k8s.io/v1alpha1
+kind: GatewayClass
+metadata:
+  name: traefik-acmesolver
+spec:
+  controller: traefik.io/gateway-controller
+EOYAML
+
+cat <<EOYAML | kubectl apply -f -
+apiVersion: networking.x-k8s.io/v1alpha1
+kind: Gateway
+metadata:
+  name: acmesolver
+  namespace: traefik
+spec:
+  gatewayClassName: traefik-acmesolver
+  listeners:
+  - protocol: HTTP
+    port: 80
+    routes:
+      kind: HTTPRoute
+      selector:
+        matchLabels:
+          acme: solver
+      namespaces:
+        from: All
+EOYAML

test/e2e/images.bzl

@@ -32,7 +32,6 @@ def install():
         patch_cmds = ["sed -i -e 's/private/public/g' 'cmd/pebble/BUILD.bazel'"],
     )
 
-
     ## Fetch nginx-ingress for use during e2e tests
     ## You can change the version of nginx-ingress used for tests by changing the
     ## 'tag' and 'digest' fields in these rules.
@@ -51,7 +50,16 @@ def install():
         registry = "k8s.gcr.io",
         repository = "ingress-nginx/controller",
         tag = "v1.0.0-alpha.2",
-        digest = "sha256:90f417ffd979f6493ea302f6757763365263d2f8112447139dffa97d927f5dfb"
+        digest = "sha256:90f417ffd979f6493ea302f6757763365263d2f8112447139dffa97d927f5dfb",
+    )
+
+    ## Fetch traefik for use during e2e tests.
+    container_pull(
+        name = "io_traefik_traefik",
+        registry = "docker.io",
+        repository = "traefik",
+        tag = "2.4.9",
+        digest = "sha256:bfba2ddb60cea5ebe8bea579a4a18be0bf9cac323783216f83ca268ce0004252",
     )
 
     ## Fetch vault for use during e2e tests
@@ -62,7 +70,7 @@ def install():
         registry = "index.docker.io",
         repository = "library/vault",
         tag = "1.2.3",
-        digest = "sha256:b1c86c9e173f15bb4a926e4144a63f7779531c30554ac7aee9b2a408b22b2c01"
+        digest = "sha256:b1c86c9e173f15bb4a926e4144a63f7779531c30554ac7aee9b2a408b22b2c01",
     )
 
     ## Fetch bind for use during e2e tests
@@ -71,7 +79,7 @@ def install():
         registry = "index.docker.io",
         repository = "sameersbn/bind",
         tag = "9.11.3-20190706",
-        digest = "sha256:b8e84f9a9fe0c05c3a963606c3d0170622be9c5e8800431ffcaadb0c79a3ff75"
+        digest = "sha256:b8e84f9a9fe0c05c3a963606c3d0170622be9c5e8800431ffcaadb0c79a3ff75",
     )
 
     ## Fetch sample-external-issuer for use during e2e tests
@@ -80,5 +88,5 @@ def install():
         registry = "ghcr.io",
         repository = "wallrj/sample-external-issuer/controller",
         tag = "v0.0.0-30-gf333b9e",
-        digest = "sha256:609a12fca03554a186e516ef065b4152f02596fba697e3cc45f3593654c87a86"
+        digest = "sha256:609a12fca03554a186e516ef065b4152f02596fba697e3cc45f3593654c87a86",
     )