diff options
| -rw-r--r-- | docs/sections/guides/infra_guides/oom_base_optional_addons.rst | 12 | ||||
| -rw-r--r-- | docs/sections/resources/yaml/envoyfilter-case.yaml | 43 | ||||
| -rw-r--r-- | docs/sections/resources/yaml/istio-ingress.yaml | 32 | ||||
| -rw-r--r-- | kubernetes/common/common/templates/_ingress.tpl | 112 | ||||
| -rw-r--r-- | kubernetes/strimzi/templates/strimzi-kafka.yaml | 4 | ||||
| -rw-r--r-- | kubernetes/strimzi/values.yaml | 36 |
6 files changed, 193 insertions, 46 deletions
diff --git a/docs/sections/guides/infra_guides/oom_base_optional_addons.rst b/docs/sections/guides/infra_guides/oom_base_optional_addons.rst index f795a8664a..b55ed0ef66 100644 --- a/docs/sections/guides/infra_guides/oom_base_optional_addons.rst +++ b/docs/sections/guides/infra_guides/oom_base_optional_addons.rst @@ -127,12 +127,20 @@ Install Istio Gateway > kubectl label namespace istio-ingress istio-injection=enabled -- Install the Istio Gateway chart,replacing the +- To expose additional ports besides HTTP/S (e.g. for external Kafka access) + create an override file (e.g. istio-ingress.yaml) + + .. collapse:: istio-ingress.yaml + + .. include:: ../../resources/yaml/istio-ingress.yaml + :code: yaml + +- Install the Istio Gateway chart using the override file, replacing the <recommended-istio-version> with the version defined in the :ref:`versions_table` table:: > helm upgrade -i istio-ingress istio/gateway -n istio-ingress - --version <recommended-istio-version> --wait + --version <recommended-istio-version> -f ingress-istio.yaml --wait Kiali Installation ================== diff --git a/docs/sections/resources/yaml/envoyfilter-case.yaml b/docs/sections/resources/yaml/envoyfilter-case.yaml index c919319ecc..31e80374e2 100644 --- a/docs/sections/resources/yaml/envoyfilter-case.yaml +++ b/docs/sections/resources/yaml/envoyfilter-case.yaml @@ -37,4 +37,47 @@ spec: stateful_formatter: name: preserve_case typed_config: + '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig +--- +apiVersion: networking.istio.io/v1alpha3 +kind: EnvoyFilter +metadata: + name: header-casing-outbound + namespace: istio-config + #annotations: + # argocd.argoproj.io/hook: PostSync +spec: + configPatches: + - applyTo: CLUSTER + match: + context: SIDECAR_OUTBOUND + patch: + operation: MERGE + value: + typed_extension_protocol_options: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + use_downstream_protocol_config: + http_protocol_options: + header_key_format: + stateful_formatter: + name: preserve_case + typed_config: + '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig + - applyTo: NETWORK_FILTER + match: + listener: + filterChain: + filter: + name: envoy.filters.network.http_connection_manager + patch: + operation: MERGE + value: + typed_config: + '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + http_protocol_options: + header_key_format: + stateful_formatter: + name: preserve_case + typed_config: '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
\ No newline at end of file diff --git a/docs/sections/resources/yaml/istio-ingress.yaml b/docs/sections/resources/yaml/istio-ingress.yaml new file mode 100644 index 0000000000..5f000d306d --- /dev/null +++ b/docs/sections/resources/yaml/istio-ingress.yaml @@ -0,0 +1,32 @@ +service: + # Type of service. Set to "None" to disable the service entirely + type: LoadBalancer + ports: + - name: status-port + port: 15021 + protocol: TCP + targetPort: 15021 + - name: http2 + port: 80 + protocol: TCP + targetPort: 80 + - name: https + port: 443 + protocol: TCP + targetPort: 443 + - name: kafka-bootstrap + port: 9010 + targetPort: 9010 + protocol: TCP + - name: kafka-0 + port: 9000 + targetPort: 9000 + protocol: TCP + - name: kafka-1 + port: 9001 + targetPort: 9001 + protocol: TCP + - name: kafka-2 + port: 9002 + targetPort: 9002 + protocol: TCP
\ No newline at end of file diff --git a/kubernetes/common/common/templates/_ingress.tpl b/kubernetes/common/common/templates/_ingress.tpl index 30ef02295f..a9ffd70f96 100644 --- a/kubernetes/common/common/templates/_ingress.tpl +++ b/kubernetes/common/common/templates/_ingress.tpl @@ -102,18 +102,20 @@ true */}} {{- define "istio.config.port" -}} {{- $dot := default . .dot -}} -{{- if .exposedPort }} - number: {{ .exposedPort }} -{{- if .exposedProtocol }} - name: {{ .baseaddr }} - protocol: {{ .exposedProtocol }} +{{- $baseaddr := (required "'baseaddr' param, set to the specific part of the fqdn, is required." .baseaddr) -}} +{{- $protocol := (required "'protocol' param, set to the name of the port, is required." .protocol) -}} +{{- if $dot.exposedPort }} + number: {{ $dot.exposedPort }} +{{- if $dot.exposedProtocol }} + name: {{ $protocol }}-{{ $dot.exposedPort }} + protocol: {{ $dot.exposedProtocol }} {{- else }} - name: http + name: {{ $protocol }} protocol: HTTP {{- end -}} {{- else }} number: 80 - name: http + name: {{ $protocol }} protocol: HTTP {{- end -}} {{- end -}} @@ -148,25 +150,47 @@ true Istio Helper function to add the route to the service */}} {{- define "istio.config.route" -}} -{{- $dot := default . .dot -}} - http: +{{- $dot := default . .dot -}} +{{- $protocol := (required "'protocol' param, is required." .protocol) -}} +{{- if eq $protocol "tcp" }} + - match: + - port: {{ $dot.exposedPort }} + route: + - destination: + port: + {{- if $dot.plain_port }} + {{- if kindIs "string" $dot.plain_port }} + name: {{ $dot.plain_port }} + {{- else }} + number: {{ $dot.plain_port }} + {{- end }} + {{- else }} + {{- if kindIs "string" $dot.port }} + name: {{ $dot.port }} + {{- else }} + number: {{ $dot.port }} + {{- end }} + {{- end }} + host: {{ $dot.name }} +{{- else if eq $protocol "http" }} - route: - destination: port: - {{- if .plain_port }} - {{- if kindIs "string" .plain_port }} - name: {{ .plain_port }} + {{- if $dot.plain_port }} + {{- if kindIs "string" $dot.plain_port }} + name: {{ $dot.plain_port }} {{- else }} - number: {{ .plain_port }} + number: {{ $dot.plain_port }} {{- end }} {{- else }} - {{- if kindIs "string" .port }} - name: {{ .port }} + {{- if kindIs "string" $dot.port }} + name: {{ $dot.port }} {{- else }} - number: {{ .port }} + number: {{ $dot.port }} {{- end }} {{- end }} - host: {{ .name }} + host: {{ $dot.name }} +{{- end -}} {{- end -}} {{/* @@ -240,12 +264,27 @@ true {{- end -}} {{/* + Create Port entry in the Gateway resource +*/}} +{{- define "istio.config.gatewayPort" -}} +{{- $dot := default . .dot -}} +{{- $service := (required "'service' param, set to the specific service, is required." .service) -}} +{{- $baseaddr := (required "'baseaddr' param, set to the specific part of the fqdn, is required." .baseaddr) -}} +{{- $protocol := (required "'protocol' param, set to the specific port, is required." .protocol) -}} + - port: + {{- include "istio.config.port" (dict "dot" $service "baseaddr" $baseaddr "protocol" $protocol) }} + hosts: + - {{ include "ingress.config.host" (dict "dot" $dot "baseaddr" $baseaddr) }} + {{- include "istio.config.tls" (dict "dot" $dot "service" $service "baseaddr" $baseaddr) }} +{{- end -}} + +{{/* Create Istio Ingress resources per defined service */}} {{- define "common.istioIngress" -}} -{{- $dot := default . .dot -}} -{{ range $dot.Values.ingress.service }} -{{- $baseaddr := (required "'baseaddr' param, set to the specific part of the fqdn, is required." .baseaddr) }} +{{- $dot := default . .dot -}} +{{ range $dot.Values.ingress.service }} +{{- $baseaddr := (required "'baseaddr' param, set to the specific part of the fqdn, is required." .baseaddr) }} --- apiVersion: networking.istio.io/v1beta1 kind: Gateway @@ -255,11 +294,17 @@ spec: selector: istio: ingress # use Istio default gateway implementation servers: - - port: - {{- include "istio.config.port" . }} - hosts: - - {{ include "ingress.config.host" (dict "dot" $dot "baseaddr" $baseaddr) }} - {{- include "istio.config.tls" (dict "dot" $dot "service" . "baseaddr" $baseaddr) }} +{{- if .tcpRoutes }} +{{ range .tcpRoutes }} + {{ include "istio.config.gatewayPort" (dict "dot" $dot "service" . "baseaddr" $baseaddr "protocol" "tcp") | trim }} +{{ end -}} +{{- else }} + {{- if .protocol }} + {{ include "istio.config.gatewayPort" (dict "dot" $dot "service" . "baseaddr" $baseaddr "protocol" .protocol) | trim }} + {{- else }} + {{ include "istio.config.gatewayPort" (dict "dot" $dot "service" . "baseaddr" $baseaddr "protocol" "http") | trim }} + {{ end }} +{{ end }} --- apiVersion: networking.istio.io/v1beta1 kind: VirtualService @@ -270,8 +315,21 @@ spec: - {{ include "ingress.config.host" (dict "dot" $dot "baseaddr" $baseaddr) }} gateways: - {{ $baseaddr }}-gateway - {{ include "istio.config.route" . | trim }} -{{- end -}} +{{- if .tcpRoutes }} + tcp: +{{ range .tcpRoutes }} + {{ include "istio.config.route" (dict "dot" . "protocol" "tcp") | trim }} +{{ end -}} +{{- else }} + {{- if .protocol }} + {{ .protocol }}: + {{ include "istio.config.route" (dict "dot" . "protocol" .protocol) | trim }} + {{- else }} + http: + {{ include "istio.config.route" (dict "dot" . "protocol" "http") | trim }} + {{ end }} +{{ end }} +{{- end -}} {{- end -}} {{/* diff --git a/kubernetes/strimzi/templates/strimzi-kafka.yaml b/kubernetes/strimzi/templates/strimzi-kafka.yaml index 99252ec3e6..3ce7b1d627 100644 --- a/kubernetes/strimzi/templates/strimzi-kafka.yaml +++ b/kubernetes/strimzi/templates/strimzi-kafka.yaml @@ -36,9 +36,9 @@ spec: - name: external port: 9094 type: {{ if (include "common.ingressEnabled" .) }}cluster-ip{{ else }}nodeport{{ end }} - tls: true + tls: {{ if (include "common.ingressEnabled" .) }}false{{ else }}true{{ end }} authentication: - type: tls + type: {{ if (include "common.ingressEnabled" .) }}{{ .Values.config.saslMechanism }}{{ else }}tls{{ end }} configuration: {{- if not (include "common.ingressEnabled" .) }} bootstrap: diff --git a/kubernetes/strimzi/values.yaml b/kubernetes/strimzi/values.yaml index ec1ed887a7..057f2003c7 100644 --- a/kubernetes/strimzi/values.yaml +++ b/kubernetes/strimzi/values.yaml @@ -19,6 +19,12 @@ global: nodePortPrefixExt: 304 persistence: mountPath: /dockerdata-nfs + ingress: + virtualhost: + baseurl: &baseurl "simpledemo.onap.org" + preaddr: &preaddr "" + postaddr: &postaddr "" + ################################################################# # Application configuration defaults. ################################################################# @@ -66,23 +72,23 @@ ingress: - baseaddr: "kafka-bootstrap-api" name: "onap-strimzi-kafka-external-bootstrap" port: 9094 + protocol: tcp exposedPort: 9010 exposedProtocol: TLS - - baseaddr: "kafka-0-api" - name: "onap-strimzi-kafka-0" - port: 9094 - exposedPort: *advertizedPortBroker0 - exposedProtocol: TLS - - baseaddr: "kafka-1-api" - name: "onap-strimzi-kafka-1" - port: 9094 - exposedPort: *advertizedPortBroker1 - exposedProtocol: TLS - - baseaddr: "kafka-2-api" - name: "onap-strimzi-kafka-2" - port: 9094 - exposedPort: *advertizedPortBroker2 - exposedProtocol: TLS + - baseaddr: "kafka-api" + tcpRoutes: + - name: "onap-strimzi-kafka-0" + port: 9094 + exposedPort: *advertizedPortBroker0 + exposedProtocol: TLS + - name: "onap-strimzi-kafka-1" + port: 9094 + exposedPort: *advertizedPortBroker1 + exposedProtocol: TLS + - name: "onap-strimzi-kafka-2" + port: 9094 + exposedPort: *advertizedPortBroker2 + exposedProtocol: TLS ###################### # Component overrides |