diff --git a/.gitignore b/.gitignore index 835d304..1610fa1 100644 --- a/.gitignore +++ b/.gitignore @@ -4,4 +4,5 @@ venv .docker_data __pycache__ .pytest_cache -*.pyc \ No newline at end of file +*.pyc +.env diff --git a/deploy/kubernetes/easyhaproxy-clusterip.yml b/deploy/kubernetes/easyhaproxy-clusterip.yml new file mode 100644 index 0000000..93d00bc --- /dev/null +++ b/deploy/kubernetes/easyhaproxy-clusterip.yml @@ -0,0 +1,208 @@ +--- +# Source: easyhaproxy/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ingress-easyhaproxy + namespace: easyhaproxy + labels: + helm.sh/chart: easyhaproxy-0.1.2 + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress + app.kubernetes.io/version: "test" + app.kubernetes.io/managed-by: Helm +--- +# Source: easyhaproxy/templates/clusterrole.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: ingress-easyhaproxy + namespace: easyhaproxy + labels: + helm.sh/chart: easyhaproxy-0.1.2 + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress + app.kubernetes.io/version: "test" + app.kubernetes.io/managed-by: Helm +rules: +- apiGroups: + - "" + resources: + # - configmaps + # - endpoints + # - nodes + - pods + - services + - namespaces + # - events + - serviceaccounts + verbs: + - get + - list + - watch +- apiGroups: + - "extensions" + - "networking.k8s.io" + resources: + - ingresses + # - ingresses/status + # - ingressclasses + verbs: + - get + - list + - watch +# - apiGroups: +# - "extensions" +# - "networking.k8s.io" +# resources: +# - ingresses/status +# verbs: +# - update +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + # - watch + # - create + # - patch + # - update +# - apiGroups: +# - "discovery.k8s.io" +# resources: +# - endpointslices +# verbs: +# - get +# - list +# - watch +--- +# Source: easyhaproxy/templates/clusterrolebinding.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: ingress-easyhaproxy + namespace: easyhaproxy + labels: + helm.sh/chart: easyhaproxy-0.1.2 + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress + app.kubernetes.io/version: "test" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: ingress-easyhaproxy +subjects: +- kind: ServiceAccount + name: ingress-easyhaproxy + namespace: easyhaproxy +--- +# Source: easyhaproxy/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: +metadata: + name: ingress-easyhaproxy + namespace: easyhaproxy + labels: + helm.sh/chart: easyhaproxy-0.1.2 + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress + app.kubernetes.io/version: "test" + app.kubernetes.io/managed-by: Helm + annotations: + {} +spec: + type: ClusterIP + ports: + - name: http + port: 80 + + - name: https + port: 443 + + - name: stats + port: 1936 + + + + selector: + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress +--- +# Source: easyhaproxy/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ingress-easyhaproxy + namespace: easyhaproxy + labels: + helm.sh/chart: easyhaproxy-0.1.2 + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress + app.kubernetes.io/version: "test" + app.kubernetes.io/managed-by: Helm +spec: + selector: + matchLabels: + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress + template: + metadata: + labels: + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: easyhaproxy/node + operator: In + values: + - master + serviceAccountName: ingress-easyhaproxy + securityContext: + {} + containers: + - name: easyhaproxy + securityContext: + {} + image: "byjg/easy-haproxy:test" + imagePullPolicy: Always + ports: + - name: http + containerPort: 80 + + - name: https + containerPort: 443 + + - name: stats + containerPort: 1936 + + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: EASYHAPROXY_DISCOVER + value: kubernetes + - name: HAPROXY_USERNAME + value: admin + - name: HAPROXY_PASSWORD + value: password + - name: EASYHAPROXY_REFRESH_CONF + value: "10" + - name: HAPROXY_CUSTOMERRORS + value: "true" + - name: EASYHAPROXY_SSL_MODE + value: loose + - name: EASYHAPROXY_LOG_LEVEL + value: DEBUG + - name: HAPROXY_LOG_LEVEL + value: DEBUG + - name: CERTBOT_LOG_LEVEL + value: DEBUG diff --git a/deploy/kubernetes/easyhaproxy.yml b/deploy/kubernetes/easyhaproxy-daemonset.yml similarity index 94% rename from deploy/kubernetes/easyhaproxy.yml rename to deploy/kubernetes/easyhaproxy-daemonset.yml index f44626d..208eeb5 100644 --- a/deploy/kubernetes/easyhaproxy.yml +++ b/deploy/kubernetes/easyhaproxy-daemonset.yml @@ -6,7 +6,7 @@ metadata: name: ingress-easyhaproxy namespace: easyhaproxy labels: - helm.sh/chart: easyhaproxy-0.1.0 + helm.sh/chart: easyhaproxy-0.1.2 app.kubernetes.io/name: easyhaproxy app.kubernetes.io/instance: ingress app.kubernetes.io/version: "test" @@ -19,7 +19,7 @@ metadata: name: ingress-easyhaproxy namespace: easyhaproxy labels: - helm.sh/chart: easyhaproxy-0.1.0 + helm.sh/chart: easyhaproxy-0.1.2 app.kubernetes.io/name: easyhaproxy app.kubernetes.io/instance: ingress app.kubernetes.io/version: "test" @@ -85,7 +85,7 @@ metadata: name: ingress-easyhaproxy namespace: easyhaproxy labels: - helm.sh/chart: easyhaproxy-0.1.0 + helm.sh/chart: easyhaproxy-0.1.2 app.kubernetes.io/name: easyhaproxy app.kubernetes.io/instance: ingress app.kubernetes.io/version: "test" @@ -106,7 +106,7 @@ metadata: name: ingress-easyhaproxy namespace: easyhaproxy labels: - helm.sh/chart: easyhaproxy-0.1.0 + helm.sh/chart: easyhaproxy-0.1.2 app.kubernetes.io/name: easyhaproxy app.kubernetes.io/instance: ingress app.kubernetes.io/version: "test" @@ -151,7 +151,9 @@ spec: containerPort: 1936 hostPort: 1936 resources: - {} + requests: + cpu: 100m + memory: 128Mi env: - name: EASYHAPROXY_DISCOVER value: kubernetes @@ -170,4 +172,4 @@ spec: - name: HAPROXY_LOG_LEVEL value: DEBUG - name: CERTBOT_LOG_LEVEL - value: DEBUG \ No newline at end of file + value: DEBUG diff --git a/deploy/kubernetes/easyhaproxy-nodeport.yml b/deploy/kubernetes/easyhaproxy-nodeport.yml new file mode 100644 index 0000000..cc0d2a3 --- /dev/null +++ b/deploy/kubernetes/easyhaproxy-nodeport.yml @@ -0,0 +1,208 @@ +--- +# Source: easyhaproxy/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ingress-easyhaproxy + namespace: easyhaproxy + labels: + helm.sh/chart: easyhaproxy-0.1.2 + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress + app.kubernetes.io/version: "test" + app.kubernetes.io/managed-by: Helm +--- +# Source: easyhaproxy/templates/clusterrole.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: ingress-easyhaproxy + namespace: easyhaproxy + labels: + helm.sh/chart: easyhaproxy-0.1.2 + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress + app.kubernetes.io/version: "test" + app.kubernetes.io/managed-by: Helm +rules: +- apiGroups: + - "" + resources: + # - configmaps + # - endpoints + # - nodes + - pods + - services + - namespaces + # - events + - serviceaccounts + verbs: + - get + - list + - watch +- apiGroups: + - "extensions" + - "networking.k8s.io" + resources: + - ingresses + # - ingresses/status + # - ingressclasses + verbs: + - get + - list + - watch +# - apiGroups: +# - "extensions" +# - "networking.k8s.io" +# resources: +# - ingresses/status +# verbs: +# - update +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + # - watch + # - create + # - patch + # - update +# - apiGroups: +# - "discovery.k8s.io" +# resources: +# - endpointslices +# verbs: +# - get +# - list +# - watch +--- +# Source: easyhaproxy/templates/clusterrolebinding.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: ingress-easyhaproxy + namespace: easyhaproxy + labels: + helm.sh/chart: easyhaproxy-0.1.2 + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress + app.kubernetes.io/version: "test" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: ingress-easyhaproxy +subjects: +- kind: ServiceAccount + name: ingress-easyhaproxy + namespace: easyhaproxy +--- +# Source: easyhaproxy/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: +metadata: + name: ingress-easyhaproxy + namespace: easyhaproxy + labels: + helm.sh/chart: easyhaproxy-0.1.2 + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress + app.kubernetes.io/version: "test" + app.kubernetes.io/managed-by: Helm + annotations: + {} +spec: + type: NodePort + ports: + - name: http + port: 80 + nodePort: 31080 + - name: https + port: 443 + nodePort: 31443 + - name: stats + port: 1936 + nodePort: 31936 + + + selector: + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress +--- +# Source: easyhaproxy/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ingress-easyhaproxy + namespace: easyhaproxy + labels: + helm.sh/chart: easyhaproxy-0.1.2 + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress + app.kubernetes.io/version: "test" + app.kubernetes.io/managed-by: Helm +spec: + selector: + matchLabels: + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress + template: + metadata: + labels: + app.kubernetes.io/name: easyhaproxy + app.kubernetes.io/instance: ingress + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: easyhaproxy/node + operator: In + values: + - master + serviceAccountName: ingress-easyhaproxy + securityContext: + {} + containers: + - name: easyhaproxy + securityContext: + {} + image: "byjg/easy-haproxy:test" + imagePullPolicy: Always + ports: + - name: http + containerPort: 80 + + - name: https + containerPort: 443 + + - name: stats + containerPort: 1936 + + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: EASYHAPROXY_DISCOVER + value: kubernetes + - name: HAPROXY_USERNAME + value: admin + - name: HAPROXY_PASSWORD + value: password + - name: EASYHAPROXY_REFRESH_CONF + value: "10" + - name: HAPROXY_CUSTOMERRORS + value: "true" + - name: EASYHAPROXY_SSL_MODE + value: loose + - name: EASYHAPROXY_LOG_LEVEL + value: DEBUG + - name: HAPROXY_LOG_LEVEL + value: DEBUG + - name: CERTBOT_LOG_LEVEL + value: DEBUG diff --git a/docs/kubernetes.md b/docs/kubernetes.md index bc20b63..7181454 100644 --- a/docs/kubernetes.md +++ b/docs/kubernetes.md @@ -2,15 +2,19 @@ ## Setup Kubernetes EasyHAProxy -EasyHAProxy is a Daemonset and it will query all ingress definitions with the annotation `kubernetes.io/ingress.class: easyhaproxy-ingress`. +EasyHAProxy query all ingress definitions with the annotation `kubernetes.io/ingress.class: easyhaproxy-ingress`.Once find the annotation, it will immediatelly setup HAProxy and start to serve it. -Once find the annotation, it will immediatelly setup HAProxy and start to serve it. +There are three installation modes: + +- DaemonSet: It will expose the ports 80, 443 and 1936 +- NodePort: It will expose the ports 31080, 31443 and 31936 +- ClusterIP it will node expose any port. The HAProxy will be accessible only inside the cluster. To install the daemonset in your cluster follow these steps: -1. Identify the node where your EasyHAProxy container will run. +### 1) Identify the node where your EasyHAProxy container will run. -EasyHAProxy is a daemonset but it will be limited to a single node. To understand that see [limitations](limitations.md) page. +Doesn't matter if you choose DaemonSet or ClusterIP, EasyHAProxy will be limited to a single node. To understand that see [limitations](limitations.md) page. ```bash $ kubectl get nodes @@ -20,28 +24,28 @@ node-01 Ready 561d v1.21.13-3 node-02 Ready 561d v1.21.13-3 ``` -2. Add the EasyHAProxy label to the node +Add the EasyHAProxy label to the node ```bash kubectl label nodes node-01 "easyhaproxy/node=master" ``` -3. Install EasyHAProxy +### 2) Install EasyHAProxy There are two ways to install EasyHAProxy in a Kubernetes cluster. You can use Kubernetes Manifest or Helm 3. -3.1. Using Kubernetes Manifest +#### 2.1.) Using Kubernetes Manifest ```bash kubectl create namespace easyhaproxy kubectl apply -f \ - https://raw.githubusercontent.com/haproxytech/kubernetes-ingress/master/deploy/haproxy-ingress-daemonset.yaml + https://raw.githubusercontent.com/byjg/docker-easy-haproxy/kubernetes/deploy/kubernetes/easyhaproxy-daemonset.yml ``` You can configure the behavior of the EasyHAProxy by setup specific environment variables. To get a list of the variables please follow the [docker container environment](docker-environment.md) -3.2. Using HELM 3 +#### 2.2) Using HELM 3 Minimal configuration @@ -49,6 +53,7 @@ Minimal configuration helm repo add byjg https://opensource.byjg.com/helm helm repo update byjg kubectl create namespace easyhaproxy + helm upgrade --install ingress byjg/easyhaproxy \ --namespace easyhaproxy \ --set resources.requests.cpu=100m \ @@ -70,7 +75,17 @@ easyhaproxy: easyhaproxy: DEBUG haproxy: DEBUG -listen_extra_ports: [] +service: + create: false # If false, it will create a Daemonset with hostPort. The easiest. + type: ClusterIP # or NodePort + annotations: {} + +binding: + ports: + http: 80 + https: 443 + stats: 1936 + additionalPorts: [] # Make sure to create this masterNode: @@ -179,8 +194,5 @@ spec: ... ``` - - - ---- [Open source ByJG](http://opensource.byjg.com) diff --git a/helm/easyhaproxy/Chart.yaml b/helm/easyhaproxy/Chart.yaml index eb5db7d..07e4928 100644 --- a/helm/easyhaproxy/Chart.yaml +++ b/helm/easyhaproxy/Chart.yaml @@ -15,7 +15,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.1.1 +version: 0.1.2 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to diff --git a/helm/easyhaproxy/templates/deployment.yaml b/helm/easyhaproxy/templates/deployment.yaml index b4c978e..86fb22c 100644 --- a/helm/easyhaproxy/templates/deployment.yaml +++ b/helm/easyhaproxy/templates/deployment.yaml @@ -1,6 +1,6 @@ --- apiVersion: apps/v1 -kind: DaemonSet +kind: {{ ternary "Deployment" "DaemonSet" .Values.service.create }} metadata: name: {{ include "easyhaproxy.fullname" . }} namespace: {{ .Release.Namespace }} @@ -36,17 +36,17 @@ spec: ports: - name: http containerPort: 80 - hostPort: 80 + {{ if not .Values.service.create }}hostPort: {{ .Values.binding.ports.http }}{{ end }} - name: https containerPort: 443 - hostPort: 443 + {{ if not .Values.service.create }}hostPort: {{ .Values.binding.ports.https }}{{ end }} - name: stats containerPort: 1936 - hostPort: 1936 - {{ range .Values.listen_extra_ports }} - - name: extra{{ . }} - containerPort: {{ . }} - hostPort: {{ . }} + {{ if not .Values.service.create }}hostPort: {{ .Values.binding.ports.stats }}{{ end }} + {{- range $port := .Values.binding.additionalPorts }} + - name: extra{{ $port }} + containerPort: {{ $port }} + {{ if not $.Values.service.create }}hostPort: {{ $port }}{{ end }} {{- end }} resources: {{- toYaml .Values.resources | nindent 12 }} diff --git a/helm/easyhaproxy/templates/service.yaml b/helm/easyhaproxy/templates/service.yaml new file mode 100644 index 0000000..81b2985 --- /dev/null +++ b/helm/easyhaproxy/templates/service.yaml @@ -0,0 +1,34 @@ +{{ if .Values.service.create }} +--- +apiVersion: v1 +kind: Service +metadata: +metadata: + name: {{ include "easyhaproxy.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "easyhaproxy.labels" . | nindent 4 }} + annotations: + {{- toYaml .Values.service.annotations | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - name: http + port: 80 + {{ if eq .Values.service.type "NodePort" }}nodePort: {{ .Values.binding.ports.http }}{{ end }} + - name: https + port: 443 + {{ if eq .Values.service.type "NodePort" }}nodePort: {{ .Values.binding.ports.https }}{{ end }} + - name: stats + port: 1936 + {{ if eq .Values.service.type "NodePort" }}nodePort: {{ .Values.binding.ports.stats }}{{ end }} + {{- range $port := .Values.binding.additionalPorts }} + - name: extra{{ $port }} + port: {{ $port }} + {{ if eq $.Values.service.type "NodePort" }}nodePort: {{ $port }}{{ end }} + {{- end }} + + + selector: + {{- include "easyhaproxy.selectorLabels" . | nindent 4 }} +{{ end }} \ No newline at end of file diff --git a/helm/easyhaproxy/values.schema.json b/helm/easyhaproxy/values.schema.json new file mode 100644 index 0000000..9018523 --- /dev/null +++ b/helm/easyhaproxy/values.schema.json @@ -0,0 +1,19 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema", + "required": [], + "properties": { + "service": { + "type": "object", + "required": [], + "properties": { + "create": { + "type": "boolean" + }, + "type": { + "type": "string", + "enum": ["ClusterIP", "NodePort"] + } + } + } + } +} \ No newline at end of file diff --git a/helm/easyhaproxy/values.yaml b/helm/easyhaproxy/values.yaml index 907fe91..9f1b413 100644 --- a/helm/easyhaproxy/values.yaml +++ b/helm/easyhaproxy/values.yaml @@ -14,6 +14,18 @@ imagePullSecrets: [] nameOverride: "" fullnameOverride: "" +service: + create: false # If false, it will create a Daemonset with hostPort. The easiest. + type: ClusterIP # or NodePort + annotations: {} + +binding: + ports: + http: 80 + https: 443 + stats: 1936 + additionalPorts: [] + serviceAccount: create: true annotations: {} @@ -58,8 +70,6 @@ easyhaproxy: easyhaproxy: DEBUG haproxy: DEBUG -listen_extra_ports: [] - # Make sure to create this masterNode: label: easyhaproxy/node