From ab49ce8339045fbd9fc3af65147e84f5b5792116 Mon Sep 17 00:00:00 2001 From: "Javier J. Salmeron Garcia" Date: Wed, 27 Mar 2019 11:55:42 +0100 Subject: [PATCH 1/2] [bitnami/apache] Add ingress rules Signed-off-by: Javier J. Salmeron Garcia --- bitnami/apache/Chart.yaml | 2 +- bitnami/apache/README.md | 11 ++++++ bitnami/apache/templates/ingress.yaml | 43 +++++++++++++++++++++ bitnami/apache/values.yaml | 54 +++++++++++++++++++++++++++ 4 files changed, 109 insertions(+), 1 deletion(-) create mode 100644 bitnami/apache/templates/ingress.yaml diff --git a/bitnami/apache/Chart.yaml b/bitnami/apache/Chart.yaml index b30a6899b..8341b62af 100644 --- a/bitnami/apache/Chart.yaml +++ b/bitnami/apache/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: apache -version: 4.1.1 +version: 4.2.0 appVersion: 2.4.38 description: Chart for Apache HTTP Server keywords: diff --git a/bitnami/apache/README.md b/bitnami/apache/README.md index 1fa78b465..9b6d8c6e8 100644 --- a/bitnami/apache/README.md +++ b/bitnami/apache/README.md @@ -54,6 +54,17 @@ The following tables lists the configurable parameters of the Apache chart and t | `image.pullPolicy` | Apache Docker image pull policy | `Always` | | `image.pullSecrets` | Specify Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `podAnnotations` | Pod annotations | `{}` | +| `ingress.enabled` | Enable ingress controller resource | `false` | +| `ingress.annotations` | Ingress annotations | `[]` | +| `ingress.certManager` | Add annotations for cert-manager | `false` | +| `ingress.hosts[0].name` | Hostname to your Apache installation | `apache.local` | +| `ingress.hosts[0].path` | Path within the url structure | `/` | +| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | +| `ingress.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` | +| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `apache.local-tls-secret` | +| `ingress.secrets[0].name` | TLS Secret Name | `nil` | +| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | +| `ingress.secrets[0].key` | TLS Secret Key | `nil` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Apache exporter image registry | `docker.io` | | `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | diff --git a/bitnami/apache/templates/ingress.yaml b/bitnami/apache/templates/ingress.yaml new file mode 100644 index 000000000..fa6a047c8 --- /dev/null +++ b/bitnami/apache/templates/ingress.yaml @@ -0,0 +1,43 @@ +{{- if .Values.ingress.enabled }} +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + name: {{ template "fullname" . }} + labels: + app: "{{ template "fullname" . }}" + chart: "{{ template "chart" . }}" + release: {{ .Release.Name | quote }} + heritage: {{ .Release.Service | quote }} + annotations: + {{- if .Values.ingress.certManager }} + kubernetes.io/tls-acme: "true" + {{- end }} + {{- range $key, $value := .Values.ingress.annotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} +spec: + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .name }} + http: + paths: + - path: {{ default "/" .path }} + backend: + serviceName: {{ template "fullname" $ }} + servicePort: http + {{- end }} + tls: + {{- range .Values.ingress.hosts }} + {{- if .tls }} + - hosts: + {{- if .tlsHosts }} + {{- range $host := .tlsHosts }} + - {{ $host }} + {{- end }} + {{- else }} + - {{ .name }} + {{- end }} + secretName: {{ .tlsSecret }} + {{- end }} + {{- end }} +{{- end }} diff --git a/bitnami/apache/values.yaml b/bitnami/apache/values.yaml index ffbb09d94..8fea1aacc 100644 --- a/bitnami/apache/values.yaml +++ b/bitnami/apache/values.yaml @@ -29,6 +29,60 @@ image: ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ## podAnnotations: {} + +## Configure the ingress resource that allows you to access the +## Apache installation. Set up the URL +## ref: http://kubernetes.io/docs/user-guide/ingress/ +## +ingress: + ## Set to true to enable ingress record generation + enabled: false + + ## Set this to true in order to add the corresponding annotations for cert-manager + certManager: false + + ## Ingress annotations done as key:value pairs + ## For a full list of possible ingress annotations, please see + ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md + ## + ## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set + ## If certManager is set to true, annotation kubernetes.io/tls-acme: "true" will automatically be set + annotations: + # kubernetes.io/ingress.class: nginx + + ## The list of hostnames to be covered with this ingress record. + ## Most likely this will be just one host, but in the event more hosts are needed, this is an array + hosts: + - name: apache.local + path: / + + ## Set this to true in order to enable TLS on the ingress record + tls: false + + ## Optionally specify the TLS hosts for the ingress record + ## Useful when the Ingress controller supports www-redirection + ## If not specified, the above host name will be used + # tlsHosts: + # - www.apache.local + # - apache.local + + ## If TLS is set to true, you must declare what secret will store the key/certificate for TLS + tlsSecret: apache.local-tls + + secrets: + ## If you're providing your own certificates, please use this to add the certificates as secrets + ## key and certificate should start with -----BEGIN CERTIFICATE----- or + ## -----BEGIN RSA PRIVATE KEY----- + ## + ## name should line up with a tlsSecret set further up + ## If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set + ## + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + # - name: apache.local-tls + # key: + # certificate: + ## Prometheus Exporter / Metrics ## metrics: From 303827fd2670ea5781daa7d011f47c3add9595da Mon Sep 17 00:00:00 2001 From: "Javier J. Salmeron Garcia" Date: Wed, 1 May 2019 16:50:10 +0200 Subject: [PATCH 2/2] Apply suggestions Signed-off-by: Javier J. Salmeron Garcia --- bitnami/apache/README.md | 71 +++++++++++++-------------- bitnami/apache/templates/ingress.yaml | 22 +++------ bitnami/apache/values.yaml | 20 +++----- 3 files changed, 48 insertions(+), 65 deletions(-) diff --git a/bitnami/apache/README.md b/bitnami/apache/README.md index 9b6d8c6e8..651772aa2 100644 --- a/bitnami/apache/README.md +++ b/bitnami/apache/README.md @@ -44,42 +44,41 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the Apache chart and their default values. -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------------------- | ------------------------------------------------------------ | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | Apache Docker image registry | `docker.io` | -| `image.repository` | Apache Docker image name | `bitnami/apache` | -| `image.tag` | Apache Docker image tag | `{VERSION}` | -| `image.pullPolicy` | Apache Docker image pull policy | `Always` | -| `image.pullSecrets` | Specify Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `podAnnotations` | Pod annotations | `{}` | -| `ingress.enabled` | Enable ingress controller resource | `false` | -| `ingress.annotations` | Ingress annotations | `[]` | -| `ingress.certManager` | Add annotations for cert-manager | `false` | -| `ingress.hosts[0].name` | Hostname to your Apache installation | `apache.local` | -| `ingress.hosts[0].path` | Path within the url structure | `/` | -| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | -| `ingress.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` | -| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `apache.local-tls-secret` | -| `ingress.secrets[0].name` | TLS Secret Name | `nil` | -| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | -| `ingress.secrets[0].key` | TLS Secret Key | `nil` | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | -| `metrics.image.pullPolicy` | Apache exporter image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Specify Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | -| `metrics.resources` | Exporter resource requests/limit | {} | -| `service.type` | Kubernetes Service type | `LoadBalancer` | -| `service.port` | Service HTTP port | `80` | -| `service.httpsPort` | Service HTTPS port | `443` | -| `service.nodePorts.http` | Kubernetes http node port | `""` | -| `service.nodePorts.https` | Kubernetes https node port | `""` | -| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | -| `service.loadBalancerIP` | LoadBalancer service IP address | `""` | +| Parameter | Description | Default | +|----------------------------------|--------------------------------------------------|--------------------------------------------------------------| +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | Apache Docker image registry | `docker.io` | +| `image.repository` | Apache Docker image name | `bitnami/apache` | +| `image.tag` | Apache Docker image tag | `{VERSION}` | +| `image.pullPolicy` | Apache Docker image pull policy | `Always` | +| `image.pullSecrets` | Specify Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `podAnnotations` | Pod annotations | `{}` | +| `ingress.enabled` | Enable ingress controller resource | `false` | +| `ingress.certManager` | Add annotations for cert-manager | `false` | +| `ingress.annotations` | Ingress annotations | `[]` | +| `ingress.hosts[0].name` | Hostname to your Apache installation | `example.local` | +| `ingress.hosts[0].path` | Path within the url structure | `/` | +| `ingress.tls[0].hosts[0]` | TLS hosts | `example.local` | +| `ingress.tls[0].secretName` | TLS Secret (certificates) | `example.local-tls` | +| `ingress.secrets[0].name` | TLS Secret Name | `nil` | +| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | +| `ingress.secrets[0].key` | TLS Secret Key | `nil` | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image.registry` | Apache exporter image registry | `docker.io` | +| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.pullPolicy` | Apache exporter image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | +| `metrics.resources` | Exporter resource requests/limit | {} | +| `service.type` | Kubernetes Service type | `LoadBalancer` | +| `service.port` | Service HTTP port | `80` | +| `service.httpsPort` | Service HTTPS port | `443` | +| `service.nodePorts.http` | Kubernetes http node port | `""` | +| `service.nodePorts.https` | Kubernetes https node port | `""` | +| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `service.loadBalancerIP` | LoadBalancer service IP address | `""` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, diff --git a/bitnami/apache/templates/ingress.yaml b/bitnami/apache/templates/ingress.yaml index fa6a047c8..f4f178943 100644 --- a/bitnami/apache/templates/ingress.yaml +++ b/bitnami/apache/templates/ingress.yaml @@ -5,9 +5,9 @@ metadata: name: {{ template "fullname" . }} labels: app: "{{ template "fullname" . }}" - chart: "{{ template "chart" . }}" - release: {{ .Release.Name | quote }} - heritage: {{ .Release.Service | quote }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" annotations: {{- if .Values.ingress.certManager }} kubernetes.io/tls-acme: "true" @@ -23,21 +23,11 @@ spec: paths: - path: {{ default "/" .path }} backend: - serviceName: {{ template "fullname" $ }} + serviceName: "{{ template "fullname" $ }}" servicePort: http {{- end }} + {{- if .Values.ingress.tls }} tls: - {{- range .Values.ingress.hosts }} - {{- if .tls }} - - hosts: - {{- if .tlsHosts }} - {{- range $host := .tlsHosts }} - - {{ $host }} - {{- end }} - {{- else }} - - {{ .name }} - {{- end }} - secretName: {{ .tlsSecret }} - {{- end }} +{{ toYaml .Values.ingress.tls | indent 4 }} {{- end }} {{- end }} diff --git a/bitnami/apache/values.yaml b/bitnami/apache/values.yaml index 74a46d0fb..73f4a77dd 100644 --- a/bitnami/apache/values.yaml +++ b/bitnami/apache/values.yaml @@ -53,21 +53,15 @@ ingress: ## The list of hostnames to be covered with this ingress record. ## Most likely this will be just one host, but in the event more hosts are needed, this is an array hosts: - - name: apache.local + - name: example.local path: / - ## Set this to true in order to enable TLS on the ingress record - tls: false - - ## Optionally specify the TLS hosts for the ingress record - ## Useful when the Ingress controller supports www-redirection - ## If not specified, the above host name will be used - # tlsHosts: - # - www.apache.local - # - apache.local - - ## If TLS is set to true, you must declare what secret will store the key/certificate for TLS - tlsSecret: apache.local-tls + ## The tls configuration for the ingress + ## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + tls: + - hosts: + - example.local + secretName: example.local-tls secrets: ## If you're providing your own certificates, please use this to add the certificates as secrets