Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[bitnami/chart] Add NLB load balancer support, run envoy container as root #2961

Merged
merged 3 commits into from
Jul 14, 2020
Merged

[bitnami/chart] Add NLB load balancer support, run envoy container as root #2961

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ba6cc60
feat: support nlb load balancer type, default envoy container securit…
geota Jun 26, 2020
9a528ba
Address PR feedback. Use enabled/disabled idiom for securityContext c…
geota Jul 13, 2020
6be268e
Merge branch 'master' into nlb_better_security_context_handling
Jul 14, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion bitnami/contour/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ sources:
- https://github.com/projectcontour/contour
- https://github.com/envoyproxy/envoy
- https://github.com/bitnami/bitnami-docker-contour
version: 1.0.1
version: 1.0.2
geota marked this conversation as resolved.
Show resolved Hide resolved
maintainers:
- name: cellebyte
url: https://github.com/Cellebyte
Expand Down
25 changes: 21 additions & 4 deletions bitnami/contour/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,10 +95,14 @@ The following tables lists the configurable parameters of the contour chart and
| `envoy.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) |
| `envoy.resources.limits` | Specify resource limits which the container is not allowed to succeed. | `{}` (does not add resource limits to deployed pods) |
| `envoy.resources.requests` | Specify resource requests which the container needs to spawn. | `{}` (does not add resource limits to deployed pods) |
| `envoy.nodeSelector` | Node labels for envoy pod assignment | `{}` |
| `envoy.tolerations` | Tolerations for envoy pod assignment | `[]` |
| `envoy.affinity` | Affinity for envoy pod assignment | `{}` |
| `envoy.podAnnotations` | Envoy Pod annotations | `{}` |
| `envoy.nodeSelector` | Node labels for envoy pod assignment | `{}` |
| `envoy.tolerations` | Tolerations for envoy pod assignment | `[]` |
| `envoy.affinity` | Affinity for envoy pod assignment | `{}` |
| `envoy.podAnnotations` | Envoy Pod annotations | `{}` |
| `envoy.podSecurityContext` | Envoy Pod securityContext | `{}` |
| `envoy.containerSecurityContext` | Envoy Container securityContext | `{}` |
| `envoy.dnsPolicy` | Envoy Pod Dns Policy | `ClusterFirst` |
| `envoy.hostNetwork` | Envoy Pod host network access | `false` |
| `envoy.readynessProbe.enabled` | Enable/disable the Readyness probe | `true` |
| `envoy.readynessProbe.initialDelaySeconds` | Delay before readyness probe is initiated | `10` |
| `envoy.readynessProbe.periodSeconds` | How often to perform the probe | `3` |
Expand Down Expand Up @@ -194,3 +198,16 @@ configInline:
# - "user_agent"
# - "x_forwarded_for"
```

### Deploying Contour with an AWS NLB

By default, Contour is launched with a AWS Classic ELB. To launch contour backed by a NLB, please set [these settings](https://github.com/projectcontour/contour/tree/master/examples/contour#deploying-with-host-networking-enabled-for-envoy):

```yaml
envoy:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
service:
annotations:
service.beta.kubernetes.io/aws-load-balancer-type: nlb
```
11 changes: 11 additions & 0 deletions bitnami/contour/templates/daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,12 @@ spec:
tolerations: {{- include "contour.tplValue" (dict "value" .Values.envoy.tolerations "context" $) | nindent 8 }}
{{- end }}
terminationGracePeriodSeconds: {{ .Values.envoy.terminationGracePeriodSeconds }}
hostNetwork: {{ .Values.envoy.hostNetwork }}
dnsPolicy: {{ .Values.envoy.dnsPolicy }}
{{- with .Values.envoy.podSecurityContext }}
securityContext:
{{ toYaml . | indent 8 }}
{{- end }}
containers:
- command:
- contour
Expand Down Expand Up @@ -69,6 +75,10 @@ spec:
image: {{ include "envoy.image" . }}
imagePullPolicy: {{ .Values.envoy.image.pullPolicy }}
name: envoy
{{- with .Values.envoy.containerSecurityContext }}
securityContext:
{{ toYaml . | indent 10 }}
{{- end }}
env:
- name: CONTOUR_NAMESPACE
valueFrom:
Expand All @@ -92,6 +102,7 @@ spec:
- containerPort: 8002
name: metrics
protocol: TCP

{{- if .Values.envoy.readinessProbe.enabled }}
readinessProbe:
httpGet:
Expand Down
11 changes: 5 additions & 6 deletions bitnami/contour/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,13 +105,12 @@ spec:
fieldPath: metadata.name
dnsPolicy: ClusterFirst
serviceAccountName: {{ include "contour.contourServiceAccountName" . }}
{{- if .Values.contour.securityContext.enabled }}
{{- with .Values.contour.securityContext }}
{{- if or (not (hasKey . "enabled")) .enabled }}
securityContext:
runAsUser: {{ .Values.contour.securityContext.runAsUser }}
runAsGroup: {{ .Values.contour.securityContext.runAsGroup }}
fsGroup: {{ .Values.contour.securityContext.fsGroup }}
runAsNonRoot: {{ .Values.contour.securityContext.runAsNonRoot }}
{{- end }}
{{ toYaml (omit . "enabled") | indent 8 }}
{{- end }}
{{- end }}
volumes:
- name: contourcert
secret:
Expand Down
3 changes: 3 additions & 0 deletions bitnami/contour/templates/service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,13 +28,16 @@ metadata:
{{- include "contour.tplValue" (dict "value" .Values.envoy.service.labels "context" $) | nindent 4 }}
{{- end }}
annotations:
{{- if (ne (get .Values.envoy.service.annotations "service.beta.kubernetes.io/aws-load-balancer-type") "nlb") }}
Copy link
Contributor

@mkilchhofer mkilchhofer Sep 6, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While working on #3381 and testing my changes with helm 2.14 and 2.16 I get this error:

helm2 lint .

==> Linting .
[ERROR] templates/: parse error in "contour/templates/service.yaml": template: contour/templates/service.yaml:34: function "get" not defined

Error: 1 chart(s) linted, 1 chart(s) failed

I realized that this is a function introduced in Sprig v3: Masterminds/sprig#197.

Since bitnami needs helm v2 compat, I think we should try to solve this using an available function. I'll propose to fix it like this inside #3381

{{- if (ne (index .Values.envoy.service.annotations "service.beta.kubernetes.io/aws-load-balancer-type" | toString ) "nlb") }}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with you @mkilchhofer !! Would you open a PR addressing this? thanks in advance

# This annotation puts the AWS ELB into "TCP" mode so that it does not
# do HTTP negotiation for HTTPS connections at the ELB edge.
# The downside of this is the remote IP address of all connections will
# appear to be the internal address of the ELB. See docs/proxy-proto.md
# for information about enabling the PROXY protocol on the ELB to recover
# the original remote IP address.
# We don't set this for nlb, per the contour docs.
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
{{- end }}
{{- if .Values.envoy.service.annotations }}
{{- include "contour.tplValue" (dict "value" .Values.envoy.service.annotations "context" $) | nindent 4 }}
{{- end }}
Expand Down
25 changes: 25 additions & 0 deletions bitnami/contour/values-production.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,6 +257,27 @@ envoy:
##
podAnnotations: {}

## Pod security context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
##
podSecurityContext: {}

## Envoy container security context - envoy needs to run as root to bind to 80, 443
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
##
containerSecurityContext:
runAsUser: 0
geota marked this conversation as resolved.
Show resolved Hide resolved

## Pod host network access
## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces
##
hostNetwork: false

## Pod's DNS Policy
## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
##
dnsPolicy: ClusterFirst

serviceAccount:
# Specifies whether a ServiceAccount should be created
create: true
Expand Down Expand Up @@ -292,6 +313,10 @@ envoy:
type: LoadBalancer
externalTrafficPolicy: Local

## Service annotations
##
annotations: {}

ports:
## HTTP Port
##
Expand Down
26 changes: 25 additions & 1 deletion bitnami/contour/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,7 +185,6 @@ contour:
successThreshold: 1

securityContext:
enabled: true
runAsNonRoot: true
runAsUser: 1001
runAsGroup: 1001
Expand Down Expand Up @@ -252,6 +251,27 @@ envoy:
##
podAnnotations: {}

## Pod security context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
##
podSecurityContext: {}

## Envoy container security context - envoy needs to run as root to bind to 80, 443
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
##
containerSecurityContext:
runAsUser: 0

## Pod host network access
## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces
##
hostNetwork: false

## Pod's DNS Policy
## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
##
dnsPolicy: ClusterFirst

serviceAccount:
# Specifies whether a ServiceAccount should be created
create: true
Expand Down Expand Up @@ -287,6 +307,10 @@ envoy:
type: LoadBalancer
externalTrafficPolicy: Local

## Service annotations
##
annotations: {}

ports:
## HTTP Port
##
Expand Down