From bb25f72d4dd9e686485853106abbf2e034eabfa3 Mon Sep 17 00:00:00 2001 From: Markos Chandras Date: Thu, 28 May 2020 12:56:56 +0100 Subject: [PATCH] [bitnami/thanos]: Move querier Ingress config to querier section (#2684) * [bitnami/thanos]: Move querier Ingress config to querier section Thanos querier is not the only component which can benefit from an ingress object. bucketweb, storegateway, querier etc can all use an ingress resource to be exposed outside of cluster. As such, it's cleaner to have the ingress configuration for querier in the relevant section instead of having it as a global configuration option. This enables us to form a pattern on how to introduce ingresses to the rest of the resources. * [bitnami/thanos] Update components versions Signed-off-by: Bitnami Containers Co-authored-by: Bitnami Containers --- bitnami/thanos/Chart.yaml | 2 +- bitnami/thanos/README.md | 44 +++++--- bitnami/thanos/templates/NOTES.txt | 8 +- .../templates/{ => querier}/ingress.yaml | 24 ++-- bitnami/thanos/values-production.yaml | 105 +++++++++-------- bitnami/thanos/values.yaml | 106 +++++++++--------- 6 files changed, 150 insertions(+), 139 deletions(-) rename bitnami/thanos/templates/{ => querier}/ingress.yaml (52%) diff --git a/bitnami/thanos/Chart.yaml b/bitnami/thanos/Chart.yaml index d6e6672ca..7705a04b5 100644 --- a/bitnami/thanos/Chart.yaml +++ b/bitnami/thanos/Chart.yaml @@ -15,4 +15,4 @@ maintainers: name: thanos sources: - https://github.com/bitnami/bitnami-docker-thanos -version: 0.7.0 +version: 1.0.0 diff --git a/bitnami/thanos/README.md b/bitnami/thanos/README.md index b9153dc52..c27503921 100644 --- a/bitnami/thanos/README.md +++ b/bitnami/thanos/README.md @@ -149,6 +149,17 @@ The following tables lists the configurable parameters of the Thanos chart and t | `querier.pdb.create` | Enable/disable a Pod Disruption Budget creation | `false` | | `querier.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `1` | | `querier.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable | `nil` | +| `querier.ingress.enabled` | Enable ingress controller resource | `false` | +| `querier.ingress.certManager` | Add annotations for cert-manager | `false` | +| `querier.ingress.hostname` | Default host for the ingress resource | `thanos.local` | +| `querier.ingress.annotations` | Ingress annotations | `[]` | +| `querier.ingress.extraHosts[0].name` | Additional hostnames to be covered | `nil` | +| `querier.ingress.extraHosts[0].path` | Additional hostnames to be covered | `nil` | +| `querier.ingress.extraTls[0].hosts[0]` | TLS configuration for additional hostnames to be covered | `nil` | +| `querier.ingress.extraTls[0].secretName` | TLS configuration for additional hostnames to be covered | `nil` | +| `querier.ingress.secrets[0].name` | TLS Secret Name | `nil` | +| `querier.ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | +| `querier.ingress.secrets[0].key` | TLS Secret Key | `nil` | ### Thanos Bucket Web parameters @@ -327,22 +338,6 @@ The following tables lists the configurable parameters of the Thanos chart and t | `ruler.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `1` | | `ruler.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable | `nil` | -### Ingress parameters - -| Parameter | Description | Default | -|-------------------------------------------------|--------------------------------------------------------------------------------------------------------|---------------------------------------------------------| -| `ingress.enabled` | Enable ingress controller resource | `false` | -| `ingress.certManager` | Add annotations for cert-manager | `false` | -| `ingress.hostname` | Default host for the ingress resource | `thanos.local` | -| `ingress.annotations` | Ingress annotations | `[]` | -| `ingress.extraHosts[0].name` | Additional hostnames to be covered | `nil` | -| `ingress.extraHosts[0].path` | Additional hostnames to be covered | `nil` | -| `ingress.extraTls[0].hosts[0]` | TLS configuration for additional hostnames to be covered | `nil` | -| `ingress.extraTls[0].secretName` | TLS configuration for additional hostnames to be covered | `nil` | -| `ingress.secrets[0].name` | TLS Secret Name | `nil` | -| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | -| `ingress.secrets[0].key` | TLS Secret Key | `nil` | - ### Metrics parameters | Parameter | Description | Default | @@ -546,3 +541,20 @@ By default, the chart is configured to use Kubernetes Security Context to automa As an alternative, this chart supports using an initContainer to change the ownership of the volumes before mounting it in the final destination. You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + +## Upgrading + +### To 1.0.0 +If you are upgrading from a `<1.0.0` release you need to move your Querier Ingress information to the new values settings: +``` +ingress.enabled -> querier.ingress.enabled +ingress.certManager -> querier.ingress.certManager +ingress.hostname -> querier.ingress.hostname +ingress.annotations -> querier.ingress.annotations +ingress.extraHosts[0].name -> querier.ingress.extraHosts[0].name +ingress.extraHosts[0].path -> querier.ingress.extraHosts[0].path +ingress.extraHosts[0].hosts[0] -> querier.ingress.extraHosts[0].hosts[0] +ingress.extraHosts[0].secretName -> querier.ingress.extraHosts[0].secretName +ingress.secrets[0].name -> querier.ingress.secrets[0].name +ingress.secrets[0].certificate -> querier.ingress.secrets[0].certificate +ingress.secrets[0].key -> querier.ingress.secrets[0].key diff --git a/bitnami/thanos/templates/NOTES.txt b/bitnami/thanos/templates/NOTES.txt index 49f60ce48..371020435 100644 --- a/bitnami/thanos/templates/NOTES.txt +++ b/bitnami/thanos/templates/NOTES.txt @@ -27,13 +27,13 @@ Thanos Querier can be accessed through following DNS name from within your clust To access Thanos Querier from outside the cluster execute the following commands: -{{- if .Values.ingress.enabled }} +{{- if .Values.querier.ingress.enabled }} 1. Get the Thanos Querier URL and associate Thanos Querier hostname to your cluster external IP: export CLUSTER_IP=$(minikube ip) # On Minikube. Use: `kubectl cluster-info` on others K8s clusters - echo "Thanos Querier URL: http{{ if .Values.ingress.tls }}s{{ end }}://{{ .Values.ingress.hostname }}/" - echo "$CLUSTER_IP {{ .Values.ingress.hostname }}" | sudo tee -a /etc/hosts + echo "Thanos Querier URL: http{{ if .Values.querier.ingress.tls }}s{{ end }}://{{ .Values.querier.ingress.hostname }}/" + echo "$CLUSTER_IP {{ .Values.querier.ingress.hostname }}" | sudo tee -a /etc/hosts {{- else }} @@ -72,4 +72,4 @@ WARNING: You deployed Thanos whitout enabling Thanos Querier!! {{- end }} {{- include "thanos.validateValues" . }} -{{- include "thanos.checkRollingTags" . }} \ No newline at end of file +{{- include "thanos.checkRollingTags" . }} diff --git a/bitnami/thanos/templates/ingress.yaml b/bitnami/thanos/templates/querier/ingress.yaml similarity index 52% rename from bitnami/thanos/templates/ingress.yaml rename to bitnami/thanos/templates/querier/ingress.yaml index 77825b02c..aa5b6799d 100644 --- a/bitnami/thanos/templates/ingress.yaml +++ b/bitnami/thanos/templates/querier/ingress.yaml @@ -1,20 +1,20 @@ -{{- if .Values.ingress.enabled -}} +{{- if .Values.querier.ingress.enabled -}} apiVersion: extensions/v1beta1 kind: Ingress metadata: name: {{ include "thanos.fullname" . }} labels: {{- include "thanos.labels" . | nindent 4 }} annotations: - {{- if .Values.ingress.certManager }} + {{- if .Values.querier.ingress.certManager }} kubernetes.io/tls-acme: "true" {{- end }} - {{- range $key, $value := .Values.ingress.annotations }} + {{- range $key, $value := .Values.querier.ingress.annotations }} {{ $key }}: {{ $value | quote }} {{- end }} spec: rules: - {{- if .Values.ingress.hostname }} - - host: {{ .Values.ingress.hostname }} + {{- if .Values.querier.ingress.hostname }} + - host: {{ .Values.querier.ingress.hostname }} http: paths: - path: / @@ -22,7 +22,7 @@ spec: serviceName: {{ template "thanos.fullname" . }}-querier servicePort: http {{- end }} - {{- range .Values.ingress.extraHosts }} + {{- range .Values.querier.ingress.extraHosts }} - host: {{ .name }} http: paths: @@ -31,15 +31,15 @@ spec: serviceName: {{ template "thanos.fullname" $ }}-querier servicePort: http {{- end }} - {{- if or .Values.ingress.tls .Values.ingress.extraTls .Values.ingress.hosts }} + {{- if or .Values.querier.ingress.tls .Values.querier.ingress.extraTls .Values.querier.ingress.hosts }} tls: - {{- if .Values.ingress.tls }} + {{- if .Values.querier.ingress.tls }} - hosts: - - {{ .Values.ingress.hostname }} - secretName: {{ printf "%s-tls" .Values.ingress.hostname }} + - {{ .Values.querier.ingress.hostname }} + secretName: {{ printf "%s-tls" .Values.querier.ingress.hostname }} {{- end }} - {{- if .Values.ingress.extraTls }} - {{- toYaml .Values.ingress.extraTls | nindent 4 }} + {{- if .Values.querier.ingress.extraTls }} + {{- toYaml .Values.querier.ingress.extraTls | nindent 4 }} {{- end }} {{- end }} {{- end }} diff --git a/bitnami/thanos/values-production.yaml b/bitnami/thanos/values-production.yaml index 9a13e72e0..d3dceb60b 100644 --- a/bitnami/thanos/values-production.yaml +++ b/bitnami/thanos/values-production.yaml @@ -14,7 +14,7 @@ image: registry: docker.io repository: bitnami/thanos - tag: 0.12.2-scratch-r11 + tag: 0.12.2-scratch-r12 ## Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## @@ -236,6 +236,57 @@ querier: ## # maxUnavailable: 1 + ## Configure the ingress resource that allows you to access Thanos Querier + ## ref: http://kubernetes.io/docs/user-guide/ingress/ + ## + ingress: + ## Set to true to enable ingress record generation + ## + enabled: false + + ## Set this to true in order to add the corresponding annotations for cert-manager + ## + certManager: false + + ## When the ingress is enabled, a host pointing to this will be created + ## + hostname: thanos.local + + ## Ingress annotations done as key:value pairs + ## For a full list of possible ingress annotations, please see + ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md + ## + ## If certManager is set to true, annotation kubernetes.io/tls-acme: "true" will automatically be set + ## + annotations: {} + + ## The list of additional hostnames to be covered with this ingress record. + ## Most likely the hostname above will be enough, but in the event more hosts are needed, this is an array + ## extraHosts: + ## - name: thanos.local + ## path: / + + ## The tls configuration for additional hostnames to be covered with this ingress record. + ## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + ## extraTls: + ## - hosts: + ## - thanos.local + ## secretName: thanos.local-tls + + ## If you're providing your own certificates, please use this to add the certificates as secrets + ## key and certificate should start with -----BEGIN CERTIFICATE----- or + ## -----BEGIN RSA PRIVATE KEY----- + ## + ## name should line up with a tlsSecret set further up + ## If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set + ## + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + ## + secrets: [] + ## - name: thanos.local-tls + ## key: + ## Thanos Bucket Web parameters ## bucketweb: @@ -1001,58 +1052,6 @@ metrics: ## # scrapeTimeout: 10s -## Configure the ingress resource that allows you to access Thanos Querier -## ref: http://kubernetes.io/docs/user-guide/ingress/ -## -ingress: - ## Set to true to enable ingress record generation - ## - enabled: false - - ## Set this to true in order to add the corresponding annotations for cert-manager - ## - certManager: false - - ## When the ingress is enabled, a host pointing to this will be created - ## - hostname: thanos.local - - ## Ingress annotations done as key:value pairs - ## For a full list of possible ingress annotations, please see - ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md - ## - ## If certManager is set to true, annotation kubernetes.io/tls-acme: "true" will automatically be set - ## - annotations: {} - - ## The list of additional hostnames to be covered with this ingress record. - ## Most likely the hostname above will be enough, but in the event more hosts are needed, this is an array - ## extraHosts: - ## - name: thanos.local - ## path: / - - ## The tls configuration for additional hostnames to be covered with this ingress record. - ## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls - ## extraTls: - ## - hosts: - ## - thanos.local - ## secretName: thanos.local-tls - - ## If you're providing your own certificates, please use this to add the certificates as secrets - ## key and certificate should start with -----BEGIN CERTIFICATE----- or - ## -----BEGIN RSA PRIVATE KEY----- - ## - ## name should line up with a tlsSecret set further up - ## If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set - ## - ## It is also possible to create and manage the certificates outside of this helm chart - ## Please see README.md for more information - ## - secrets: [] - ## - name: thanos.local-tls - ## key: - ## certificate: - ## Init Container paramaters ## Change the owner and group of the persistent volume(s) mountpoint(s) to 'runAsUser:fsGroup' on each component ## values from the securityContext section of the component diff --git a/bitnami/thanos/values.yaml b/bitnami/thanos/values.yaml index c001d5888..d24a3ae03 100644 --- a/bitnami/thanos/values.yaml +++ b/bitnami/thanos/values.yaml @@ -14,7 +14,7 @@ image: registry: docker.io repository: bitnami/thanos - tag: 0.12.2-scratch-r11 + tag: 0.12.2-scratch-r12 ## Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## @@ -236,6 +236,58 @@ querier: ## # maxUnavailable: 1 + ## Configure the ingress resource that allows you to access Thanos Querier + ## ref: http://kubernetes.io/docs/user-guide/ingress/ + ## + ingress: + ## Set to true to enable ingress record generation + ## + enabled: false + + ## Set this to true in order to add the corresponding annotations for cert-manager + ## + certManager: false + + ## When the ingress is enabled, a host pointing to this will be created + ## + hostname: thanos.local + + ## Ingress annotations done as key:value pairs + ## For a full list of possible ingress annotations, please see + ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md + ## + ## If certManager is set to true, annotation kubernetes.io/tls-acme: "true" will automatically be set + ## + annotations: {} + + ## The list of additional hostnames to be covered with this ingress record. + ## Most likely the hostname above will be enough, but in the event more hosts are needed, this is an array + ## extraHosts: + ## - name: thanos.local + ## path: / + + ## The tls configuration for additional hostnames to be covered with this ingress record. + ## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + ## extraTls: + ## - hosts: + ## - thanos.local + ## secretName: thanos.local-tls + + ## If you're providing your own certificates, please use this to add the certificates as secrets + ## key and certificate should start with -----BEGIN CERTIFICATE----- or + ## -----BEGIN RSA PRIVATE KEY----- + ## + ## name should line up with a tlsSecret set further up + ## If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set + ## + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + ## + secrets: [] + ## - name: thanos.local-tls + ## key: + ## certificate: + ## Thanos Bucket Web parameters ## bucketweb: @@ -1004,58 +1056,6 @@ metrics: ## # scrapeTimeout: 10s -## Configure the ingress resource that allows you to access Thanos Querier -## ref: http://kubernetes.io/docs/user-guide/ingress/ -## -ingress: - ## Set to true to enable ingress record generation - ## - enabled: false - - ## Set this to true in order to add the corresponding annotations for cert-manager - ## - certManager: false - - ## When the ingress is enabled, a host pointing to this will be created - ## - hostname: thanos.local - - ## Ingress annotations done as key:value pairs - ## For a full list of possible ingress annotations, please see - ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md - ## - ## If certManager is set to true, annotation kubernetes.io/tls-acme: "true" will automatically be set - ## - annotations: {} - - ## The list of additional hostnames to be covered with this ingress record. - ## Most likely the hostname above will be enough, but in the event more hosts are needed, this is an array - ## extraHosts: - ## - name: thanos.local - ## path: / - - ## The tls configuration for additional hostnames to be covered with this ingress record. - ## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls - ## extraTls: - ## - hosts: - ## - thanos.local - ## secretName: thanos.local-tls - - ## If you're providing your own certificates, please use this to add the certificates as secrets - ## key and certificate should start with -----BEGIN CERTIFICATE----- or - ## -----BEGIN RSA PRIVATE KEY----- - ## - ## name should line up with a tlsSecret set further up - ## If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set - ## - ## It is also possible to create and manage the certificates outside of this helm chart - ## Please see README.md for more information - ## - secrets: [] - ## - name: thanos.local-tls - ## key: - ## certificate: - ## Init Container paramaters ## Change the owner and group of the persistent volume(s) mountpoint(s) to 'runAsUser:fsGroup' on each component ## values from the securityContext section of the component