Refactor Ingress (#219)
* Refactor Ingress and Add Tests * New HTTP Ingress UI Layout * Cleanup plain TCP and all UDP ingress UI's * Bulk Traefik Changes: - update traefik - move storage to common chart - Remove reflector - Remove Cert-Manager - Add http IngressRoute to common - remove ingress(Route) from traefik - Cleanup Ingress(Route) to be includable in other charts * Update common included with all Apps * Update traefik and addserviceName, servicePort and serviceKind to questions.yaml * Polish: Auto find port and servicename for ingress, allow override * Add basic documentation and examples * Cleanup * small bugfix * fix mini mistake in qbittorrent * Use default torrent port within qbittorrent
This commit is contained in:
Kjeld Schouten-Lebbing
@@ -39,9 +39,6 @@ Main entrypoint for the common library chart. It will render all underlying temp
|
||||
{{- include "common.statefulset" . | nindent 0 }}
|
||||
{{- end -}}
|
||||
{{ include "common.services" . | nindent 0 }}
|
||||
{{- print "---" | nindent 0 -}}
|
||||
{{ include "common.ingress" . | nindent 0 }}
|
||||
{{- print "---" | nindent 0 -}}
|
||||
{{ include "common.appIngress" . | nindent 0 }}
|
||||
{{ include "common.storage.permissions" . | nindent 0 }}
|
||||
{{- end -}}
|
||||
|
||||
@@ -21,25 +21,84 @@ Renders the Ingress objects required by the chart by returning a concatinated li
|
||||
of the main Ingress and any additionalIngresses.
|
||||
*/}}
|
||||
{{- define "common.ingress" -}}
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $svcPort := .Values.services.main.port.port -}}
|
||||
|
||||
{{- /* Generate primary ingress */ -}}
|
||||
{{- $ingressValues := .Values.ingress -}}
|
||||
{{- $_ := set . "ObjectValues" (dict "ingress" $ingressValues) -}}
|
||||
{{- include "common.classes.ingress" . }}
|
||||
|
||||
{{- /* Generate additional ingresses as required */ -}}
|
||||
{{- range $index, $extraIngress := .Values.ingress.additionalIngresses }}
|
||||
{{- if $extraIngress.enabled -}}
|
||||
{{- /* Generate named ingresses as required */ -}}
|
||||
{{- range $name, $ingress := .Values.ingress }}
|
||||
{{- if $ingress.enabled -}}
|
||||
{{- print ("---") | nindent 0 -}}
|
||||
{{- $ingressValues := $extraIngress -}}
|
||||
{{- if not $ingressValues.nameSuffix -}}
|
||||
{{- $_ := set $ingressValues "nameSuffix" $index -}}
|
||||
{{- $ingressValues := $ingress -}}
|
||||
|
||||
{{/* set defaults */}}
|
||||
{{- if or (not $ingressValues.nameSuffix) ( ne $name "main" ) -}}
|
||||
{{- $_ := set $ingressValues "nameSuffix" $name -}}
|
||||
{{ end -}}
|
||||
{{- $_ := set $ "ObjectValues" (dict "ingress" $ingressValues) -}}
|
||||
{{- include "common.classes.ingress" $ -}}
|
||||
{{- if not $ingressValues.type -}}
|
||||
{{- $_ := set $ingressValues "type" "HTTP" -}}
|
||||
{{ end -}}
|
||||
{{- if not $ingressValues.certType -}}
|
||||
{{- $_ := set $ingressValues "certType" "" -}}
|
||||
{{ end -}}
|
||||
|
||||
{{- if or ( eq $ingressValues.type "TCP" ) ( eq $ingressValues.type "UDP" ) ( eq $ingressValues.type "HTTP-IR" ) -}}
|
||||
{{- include "common.classes.ingressRoute" $ -}}
|
||||
{{- else -}}
|
||||
{{- include "common.classes.ingress" $ -}}
|
||||
{{ end -}}
|
||||
|
||||
{{- if $ingressValues.authForwardURL -}}
|
||||
{{- print ("---") | nindent 0 -}}
|
||||
{{- include "common.classes.ingress.authForward" $ }}
|
||||
{{ end -}}
|
||||
|
||||
{{- if eq $ingressValues.certType "ixcert" -}}
|
||||
{{- $_ := set $ "ObjectValues" (dict "certHolder" $ingressValues) -}}
|
||||
{{- print ("---") | nindent 0 -}}
|
||||
{{- include "common.resources.cert.secret" $ }}
|
||||
{{ end -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{- /* Generate additional ingresses as required */ -}}
|
||||
{{- range $index, $additionalIngress := .Values.additionalIngress }}
|
||||
{{- if $additionalIngress.enabled -}}
|
||||
{{- print ("---") | nindent 0 -}}
|
||||
{{- $ingressValues := $additionalIngress -}}
|
||||
|
||||
{{/* set defaults */}}
|
||||
{{- $name := ( $index | quote ) -}}
|
||||
{{- if $ingressValues.name -}}
|
||||
{{- $name := $ingressValues.name -}}
|
||||
{{- end }}
|
||||
|
||||
{{- if or (not $ingressValues.nameSuffix) ( ne $name "main" ) -}}
|
||||
{{- $_ := set $ingressValues "nameSuffix" $name -}}
|
||||
{{ end -}}
|
||||
{{- $_ := set $ "ObjectValues" (dict "ingress" $ingressValues) -}}
|
||||
{{- if not $ingressValues.type -}}
|
||||
{{- $_ := set $ingressValues "type" "HTTP" -}}
|
||||
{{ end -}}
|
||||
{{- if not $ingressValues.certType -}}
|
||||
{{- $_ := set $ingressValues "certType" "" -}}
|
||||
{{ end -}}
|
||||
|
||||
{{- if or ( eq $ingressValues.type "TCP" ) ( eq $ingressValues.type "UDP" ) ( eq $ingressValues.type "HTTP-IR" ) -}}
|
||||
{{- include "common.classes.ingressRoute" $ -}}
|
||||
{{- else -}}
|
||||
{{- include "common.classes.ingress" $ -}}
|
||||
{{ end -}}
|
||||
|
||||
{{- if $ingressValues.authForwardURL -}}
|
||||
{{- print ("---") | nindent 0 -}}
|
||||
{{- include "common.classes.ingress.authForward" $ }}
|
||||
{{ end -}}
|
||||
|
||||
{{- if eq $ingressValues.certType "ixcert" -}}
|
||||
{{- $_ := set $ "ObjectValues" (dict "certHolder" $ingressValues) -}}
|
||||
{{- print ("---") | nindent 0 -}}
|
||||
{{- include "common.resources.cert.secret" $ }}
|
||||
{{ end -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
|
||||
@@ -21,12 +21,9 @@ Default NOTES.txt content.
|
||||
*/}}
|
||||
{{- define "common.notes.defaultNotes" -}}
|
||||
{{- $svcPort := .Values.services.main.port.port -}}
|
||||
1. Get the application URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range .Values.ingress.hosts }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{- if .hostTpl }}{{ tpl .hostTpl $ }}{{ else }}{{ .host }}{{ end }}{{ (first .paths).path }}
|
||||
{{- end }}
|
||||
{{- else if contains "NodePort" .Values.services.main.type }}
|
||||
echo "use your Ingress URL to connect or find the application URL by running these commands:"
|
||||
|
||||
{{- if contains "NodePort" .Values.services.main.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.names.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
|
||||
@@ -27,8 +27,14 @@ of the main Service and any additionalServices.
|
||||
{{- if $extraService.enabled -}}
|
||||
{{- print ("---") | nindent 0 -}}
|
||||
{{- $serviceValues := $extraService -}}
|
||||
{{- if not $serviceValues.nameSuffix -}}
|
||||
{{- $_ := set $serviceValues "nameSuffix" $index -}}
|
||||
|
||||
{{- $name := ( $index | quote ) -}}
|
||||
{{- if $serviceValues.name -}}
|
||||
{{- $name := $serviceValues.name -}}
|
||||
{{- end }}
|
||||
|
||||
{{- if or (not $serviceValues.nameSuffix) ( ne $name "main" ) -}}
|
||||
{{- $_ := set $serviceValues "nameSuffix" $name -}}
|
||||
{{ end -}}
|
||||
{{- $_ := set $ "ObjectValues" (dict "service" $serviceValues) -}}
|
||||
{{- include "common.classes.service" $ -}}
|
||||
|
||||
@@ -1,31 +0,0 @@
|
||||
{{/*
|
||||
Renders the additioanl authForward objects from appAuthForward
|
||||
*/}}
|
||||
{{- define "common.classes.appAuthForward" -}}
|
||||
{{- /* Generate TrueNAS SCALE app services as required v1 */ -}}
|
||||
{{- $values := .Values.appIngress -}}
|
||||
{{- if hasKey . "ObjectValues" -}}
|
||||
{{- with .ObjectValues.appIngress -}}
|
||||
{{- $values = . -}}
|
||||
{{- end -}}
|
||||
{{ end -}}
|
||||
{{- $authForwardName := include "common.names.fullname" . -}}
|
||||
{{- if hasKey $values "nameSuffix" -}}
|
||||
{{- $authForwardName = printf "%v-%v" $authForwardName $values.nameSuffix -}}
|
||||
{{ end -}}
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: {{ $authForwardName }}
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: {{ $values.authForwardURL }}
|
||||
tls:
|
||||
insecureSkipVerify: true
|
||||
rustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- Remote-User
|
||||
- Remote-Groups
|
||||
- Remote-Name
|
||||
- Remote-Email
|
||||
{{- end }}
|
||||
@@ -1,84 +0,0 @@
|
||||
{{/*
|
||||
This template serves as a blueprint for all appIngress objects that are created
|
||||
within the common library.
|
||||
*/}}
|
||||
{{- define "common.classes.appIngressHTTP" -}}
|
||||
{{- $values := .Values.appIngress -}}
|
||||
{{- if hasKey . "ObjectValues" -}}
|
||||
{{- with .ObjectValues.appIngress -}}
|
||||
{{- $values = . -}}
|
||||
{{- end -}}
|
||||
{{ end -}}
|
||||
{{- $IngressName := include "common.names.fullname" . -}}
|
||||
{{- if hasKey $values "nameSuffix" -}}
|
||||
{{- $IngressName = printf "%v-%v" $IngressName $values.nameSuffix -}}
|
||||
{{ end -}}
|
||||
{{- $svcName := $values.serviceName | default (include "common.names.fullname" .) -}}
|
||||
{{- $svcPort := $values.servicePort | default $.Values.services.main.port.port -}}
|
||||
apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $IngressName }}
|
||||
labels:
|
||||
{{- include "common.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- if or (eq $values.certType "letsencrypt-prod") (eq $values.certType "letsencrypt-staging") }}
|
||||
cert-manager.io/cluster-issuer: {{ $values.certType }}
|
||||
{{- end }}
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: {{ $values.entrypoint }}
|
||||
traefik.ingress.kubernetes.io/router.middlewares: traefik-middlewares-chain-public@kubernetescrd
|
||||
{{- if $values.authForwardURL }}
|
||||
traefik.ingress.kubernetes.io/router.middlewares: {{ $IngressName }}
|
||||
{{- end }}
|
||||
{{- with $values.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if eq (include "common.capabilities.ingress.apiVersion" $) "networking.k8s.io/v1" }}
|
||||
{{- if $values.IngressClassName }}
|
||||
IngressClassName: {{ $values.appIngressHTTPClassName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $values.certType }}
|
||||
tls:
|
||||
{{- if eq $values.certType "selfsigned" -}}{}{{ else }}
|
||||
- hosts:
|
||||
{{- range $values.hosts }}
|
||||
- {{ .host | quote }}
|
||||
{{- end }}
|
||||
{{- if eq $values.certType "selfsigned" -}}
|
||||
secretName:
|
||||
{{ else if eq $values.certType "existingcert" }}
|
||||
secretName: {{ $values.existingcert }}
|
||||
{{ else if eq $values.certType "ixcert" }}
|
||||
secretName: {{ $IngressName }}
|
||||
{{ else if eq $values.certType "wildcard" }}
|
||||
secretName: wildcardcert
|
||||
{{ else }}
|
||||
secretName: {{ $IngressName }}-tls-secret
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range $values.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
{{- if eq (include "common.capabilities.ingress.apiVersion" $) "networking.k8s.io/v1" }}
|
||||
pathType: Prefix
|
||||
{{- end }}
|
||||
backend:
|
||||
{{- if eq (include "common.capabilities.ingress.apiVersion" $) "networking.k8s.io/v1" }}
|
||||
service:
|
||||
name: {{ $svcName }}
|
||||
port:
|
||||
number: {{ $svcPort }}
|
||||
{{- else }}
|
||||
serviceName: {{ $svcName }}
|
||||
servicePort: {{ $svcPort }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,64 +0,0 @@
|
||||
{{/*
|
||||
This template serves as a blueprint for all appIngressTCP objects that are created
|
||||
within the common library.
|
||||
*/}}
|
||||
{{- define "common.classes.appIngressTCP" -}}
|
||||
{{- $values := .Values.appIngress -}}
|
||||
{{- if hasKey . "ObjectValues" -}}
|
||||
{{- with .ObjectValues.appIngress -}}
|
||||
{{- $values = . -}}
|
||||
{{- end -}}
|
||||
{{ end -}}
|
||||
{{- $IngressName := include "common.names.fullname" . -}}
|
||||
{{- if hasKey $values "nameSuffix" -}}
|
||||
{{- $IngressName = printf "%v-%v" $IngressName $values.nameSuffix -}}
|
||||
{{ end -}}
|
||||
{{- $svcName := $values.serviceName | default (include "common.names.fullname" .) -}}
|
||||
{{- $svcPort := $values.servicePort | default $.Values.services.main.port.port -}}
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRouteTCP
|
||||
metadata:
|
||||
name: {{ $IngressName }}
|
||||
labels:
|
||||
{{- include "common.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- if or (eq $values.certType "letsencrypt-prod") (eq $values.certType "letsencrypt-staging") }}
|
||||
cert-manager.io/cluster-issuer: {{ $values.certType }}
|
||||
{{- end }}
|
||||
{{- with $values.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
entryPoints:
|
||||
- {{ $values.entrypoint }}
|
||||
routes:
|
||||
- match: HostSNI(`*`)
|
||||
services:
|
||||
- name: {{ $svcName }}
|
||||
port: {{ $svcPort }}
|
||||
weight: 10
|
||||
terminationDelay: 400
|
||||
{{- if $values.certType }}
|
||||
tls:
|
||||
{{- if eq $values.certType "selfsigned" -}}{}{{ else }}
|
||||
domains:
|
||||
- main: {{ index $values.hosts 0 }}
|
||||
sans:
|
||||
{{- range $values.hosts }}
|
||||
- {{ .host | quote }}
|
||||
{{- end }}
|
||||
{{- if eq $values.certType "selfsigned" -}}
|
||||
secretName:
|
||||
{{ else if eq $values.certType "existingcert" }}
|
||||
secretName: {{ $values.existingcert }}
|
||||
{{ else if eq $values.certType "ixcert" }}
|
||||
secretName: {{ $IngressName }}
|
||||
{{ else if eq $values.certType "wildcard" }}
|
||||
secretName: wildcardcert
|
||||
{{ else }}
|
||||
secretName: {{ $IngressName }}-tls-secret
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
passthrough: false
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,36 +0,0 @@
|
||||
{{/*
|
||||
This template serves as a blueprint for all appIngressTCP objects that are created
|
||||
within the common library.
|
||||
*/}}
|
||||
{{- define "common.classes.appIngressUDP" -}}
|
||||
{{- $values := .Values.appIngress -}}
|
||||
{{- if hasKey . "ObjectValues" -}}
|
||||
{{- with .ObjectValues.appIngress -}}
|
||||
{{- $values = . -}}
|
||||
{{- end -}}
|
||||
{{ end -}}
|
||||
{{- $IngressName := include "common.names.fullname" . -}}
|
||||
{{- if hasKey $values "nameSuffix" -}}
|
||||
{{- $IngressName = printf "%v-%v" $IngressName $values.nameSuffix -}}
|
||||
{{ end -}}
|
||||
{{- $svcName := $values.serviceName | default (include "common.names.fullname" .) -}}
|
||||
{{- $svcPort := $values.servicePort | default $.Values.services.main.port.port -}}
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRouteUDP
|
||||
metadata:
|
||||
name: {{ $IngressName }}
|
||||
labels:
|
||||
{{- include "common.labels" . | nindent 4 }}
|
||||
{{- with $values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
entryPoints:
|
||||
- {{ $values.entrypoint }}
|
||||
routes:
|
||||
- services:
|
||||
- name: {{ $svcName }}
|
||||
port: {{ $svcPort }}
|
||||
weight: 10
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{/*
|
||||
Renders the additional authForward objects from ingress
|
||||
*/}}
|
||||
{{- define "common.classes.ingress.authForward" -}}
|
||||
{{- $authForwardName := include "common.names.fullname" . -}}
|
||||
{{- $values := .Values -}}
|
||||
{{- if hasKey . "ObjectValues" -}}
|
||||
{{- with .ObjectValues.ingress -}}
|
||||
{{- $values = . -}}
|
||||
{{- end -}}
|
||||
{{ end -}}
|
||||
{{- if hasKey $values "nameSuffix" -}}
|
||||
{{- $authForwardName = printf "%v-%v" $authForwardName $values.nameSuffix -}}
|
||||
{{ end -}}
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: {{ $authForwardName }}-auth-forward
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: {{ $values.authForwardURL | quote }}
|
||||
tls:
|
||||
insecureSkipVerify: true
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- Remote-User
|
||||
- Remote-Groups
|
||||
- Remote-Name
|
||||
- Remote-Email
|
||||
{{- end }}
|
||||
@@ -15,44 +15,65 @@ limitations under the License.
|
||||
|
||||
This file is considered to be modified by the TrueCharts Project.
|
||||
*/}}
|
||||
|
||||
{{/*
|
||||
This template serves as a blueprint for all Ingress objects that are created
|
||||
within the common library.
|
||||
*/}}
|
||||
{{- define "common.classes.ingress" -}}
|
||||
{{- $ingressName := include "common.names.fullname" . -}}
|
||||
{{- $values := .Values.ingress -}}
|
||||
{{- $values := .Values -}}
|
||||
{{- $svcPort := 80 }}
|
||||
{{- $ingressService := $.Values }}
|
||||
{{- if hasKey . "ObjectValues" -}}
|
||||
{{- with .ObjectValues.ingress -}}
|
||||
{{- $values = . -}}
|
||||
{{- end -}}
|
||||
{{ end -}}
|
||||
|
||||
{{- if hasKey $values "nameSuffix" -}}
|
||||
{{- $ingressName = printf "%v-%v" $ingressName $values.nameSuffix -}}
|
||||
{{- if and ( $.Values.services ) ( not $values.servicePort ) }}
|
||||
{{- $ingressService := index $.Values.services $values.nameSuffix }}
|
||||
{{- $svcPort = $ingressService.port.port }}
|
||||
{{ end -}}
|
||||
{{- else if and ( $.Values.services ) ( not $values.servicePort ) }}
|
||||
{{- $svcPort = $.Values.services.main.port.port }}
|
||||
{{ end -}}
|
||||
{{- $svcName := $values.serviceName | default (include "common.names.fullname" .) -}}
|
||||
{{- $svcPort := $values.servicePort | default $.Values.services.main.port.port -}}
|
||||
|
||||
{{- $svcName := $values.serviceName | default $ingressName -}}
|
||||
|
||||
{{- if $values.servicePort }}
|
||||
{{- $svcPort = $values.servicePort -}}
|
||||
{{- end }}
|
||||
|
||||
apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $ingressName }}
|
||||
labels:
|
||||
{{- include "common.labels" . | nindent 4 }}
|
||||
{{- with $values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: {{ $values.entrypoint }}
|
||||
traefik.ingress.kubernetes.io/router.middlewares: traefik-middlewares-chain-public@kubernetescrd{{ if $values.authForwardURL }},{{ $ingressName }}-auth-forward{{ end }}
|
||||
{{- with $values.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if eq (include "common.capabilities.ingress.apiVersion" $) "networking.k8s.io/v1" }}
|
||||
{{- if $values.ingressClassName }}
|
||||
ingressClassName: {{ $values.ingressClassName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $values.tls }}
|
||||
{{- if or ( eq $values.certType "selfsigned") (eq $values.certType "ixcert") ( $values.tls ) }}
|
||||
tls:
|
||||
{{- if $values.tls }}
|
||||
{{- range $values.tls }}
|
||||
- hosts:
|
||||
{{- if and ( not .hosts ) ( not .hostsTpl ) }}
|
||||
{{- range $values.hosts }}
|
||||
- {{ .host | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
@@ -61,10 +82,21 @@ spec:
|
||||
{{- end }}
|
||||
{{- if .secretNameTpl }}
|
||||
secretName: {{ tpl .secretNameTpl $ | quote}}
|
||||
{{- else }}
|
||||
{{- else if eq $values.certType "ixcert" }}
|
||||
secretName: {{ $ingressName }}
|
||||
{{- else if .secretName }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
- hosts:
|
||||
{{- range $values.hosts }}
|
||||
- {{ .host | quote }}
|
||||
{{- end }}
|
||||
{{- if eq $values.certType "ixcert" }}
|
||||
secretName: {{ $ingressName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range $values.hosts }}
|
||||
|
||||
@@ -0,0 +1,125 @@
|
||||
{{/*
|
||||
This template serves as a blueprint for all ingressRoute objects that are created
|
||||
within the common library.
|
||||
*/}}
|
||||
{{- define "common.classes.ingressRoute" -}}
|
||||
{{- $ingressName := include "common.names.fullname" . -}}
|
||||
{{- $values := .Values -}}
|
||||
{{- $svcPort := 80 }}
|
||||
{{- $ingressService := $.Values }}
|
||||
{{- if hasKey . "ObjectValues" -}}
|
||||
{{- with .ObjectValues.ingress -}}
|
||||
{{- $values = . -}}
|
||||
{{- end -}}
|
||||
{{ end -}}
|
||||
|
||||
{{- if hasKey $values "nameSuffix" -}}
|
||||
{{- $ingressName = printf "%v-%v" $ingressName $values.nameSuffix -}}
|
||||
{{- if and ( $.Values.services ) ( not $values.servicePort ) }}
|
||||
{{- $ingressService := index $.Values.services $values.nameSuffix }}
|
||||
{{- $svcPort = $ingressService.port.port }}
|
||||
{{ end -}}
|
||||
{{- else if and ( $.Values.services ) ( not $values.servicePort ) }}
|
||||
{{- $svcPort = $.Values.services.main.port.port }}
|
||||
{{ end -}}
|
||||
|
||||
{{- $svcName := $values.serviceName | default $ingressName -}}
|
||||
|
||||
{{- if $values.servicePort }}
|
||||
{{- $svcPort = $values.servicePort -}}
|
||||
{{- end }}
|
||||
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
{{- if eq $values.type "UDP" }}
|
||||
kind: IngressRouteUDP
|
||||
{{- else if eq $values.type "TCP" }}
|
||||
kind: IngressRouteTCP
|
||||
{{- else }}
|
||||
kind: IngressRoute
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: {{ $ingressName }}
|
||||
labels:
|
||||
{{- include "common.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- with $values.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
entryPoints:
|
||||
- {{ $values.entrypoint }}
|
||||
routes:
|
||||
{{- if eq $values.type "UDP" }}
|
||||
- services:
|
||||
- name: {{ $svcName }}
|
||||
port: {{ $svcPort }}
|
||||
weight: 10
|
||||
{{- else if eq $values.type "TCP" }}
|
||||
- match: HostSNI(`*`)
|
||||
services:
|
||||
- name: {{ $svcName }}
|
||||
port: {{ $svcPort }}
|
||||
weight: 10
|
||||
terminationDelay: 400
|
||||
{{- else }}
|
||||
- kind: Rule
|
||||
match: Host(`{{ (index $values.hosts 0).host }}`)
|
||||
services:
|
||||
- name: {{ $svcName }}
|
||||
{{- if $values.serviceKind }}
|
||||
kind: {{ $values.serviceKind }}
|
||||
{{- else }}
|
||||
port: {{ $svcPort }}
|
||||
{{- end }}
|
||||
middlewares:
|
||||
- name: traefik-middlewares-chain-public@kubernetescrd
|
||||
{{- if $values.authForwardURL }}
|
||||
- name: "{{ $ingressName }}-auth-forward"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if not ( eq $values.type "UDP" ) }}
|
||||
{{- if or ( eq $values.certType "selfsigned") (eq $values.certType "ixcert") }}
|
||||
tls:
|
||||
domains:
|
||||
- main: {{ (index $values.hosts 0).host }}
|
||||
sans:
|
||||
{{- range $values.hosts }}
|
||||
- {{ .host | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if $values.tls }}
|
||||
{{- range $values.tls }}
|
||||
|
||||
{{- if .hosts }}
|
||||
- main: {{ index .hosts 0 }}
|
||||
{{- range .hosts }}
|
||||
sans:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .hosts }}
|
||||
- main: {{ index .hostsTpl 0 }}
|
||||
{{- range .hosts }}
|
||||
sans:
|
||||
{{- range .hostsTpl }}
|
||||
- {{ tpl . $ | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if eq $values.certType "ixcert" }}
|
||||
secretName: {{ $ingressName }}
|
||||
{{- end }}
|
||||
passthrough: false
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
@@ -1,37 +0,0 @@
|
||||
{{/*
|
||||
Renders the additional ingress objects from appIngress
|
||||
*/}}
|
||||
{{- define "common.appIngress" -}}
|
||||
{{- if .Values.appIngress -}}
|
||||
{{- range $name, $ingr := .Values.appIngress }}
|
||||
{{- if $ingr.enabled -}}
|
||||
{{- print ("---") | nindent 0 -}}
|
||||
{{- $ingressValues := $ingr -}}
|
||||
{{- if not $ingressValues.nameSuffix -}}
|
||||
{{- $_ := set $ingressValues "nameSuffix" $name -}}
|
||||
{{ end -}}
|
||||
{{- $_ := set $ "ObjectValues" (dict "appIngress" $ingressValues) -}}
|
||||
{{- if $ingressValues.type -}}
|
||||
{{- if eq $ingressValues.type "UDP" -}}
|
||||
{{- include "common.classes.appIngressUDP" $ }}
|
||||
{{- else if eq $ingressValues.type "TCP" -}}
|
||||
{{- include "common.classes.appIngressTCP" $ }}
|
||||
{{- else }}
|
||||
{{- include "common.classes.appIngressHTTP" $ }}
|
||||
{{- if $ingressValues.authForwardURL }}
|
||||
{{- include "common.classes.appAuthForward" $ }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- include "common.classes.appIngressHTTP" $ }}
|
||||
{{- if $ingressValues.authForwardURL }}
|
||||
{{- include "common.classes.appAuthForward" $ }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $_ := set $ "ObjectValues" (dict "certHolder" $ingressValues) -}}
|
||||
{{- print ("---") | nindent 0 -}}
|
||||
{{- include "common.resources.cert.secret" $ }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
+51
-103
@@ -173,46 +173,57 @@ additionalServices: []
|
||||
# annotations: {}
|
||||
# labels: {}
|
||||
|
||||
ingress:
|
||||
enabled: false
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
labels: {}
|
||||
hosts:
|
||||
- host: chart-example.local
|
||||
## Or a tpl that is evaluated
|
||||
# hostTpl: '{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.{{ .Values.ingress.domainname }}'
|
||||
paths:
|
||||
- path: /
|
||||
# Ignored if not kubeVersion >= 1.14-0
|
||||
pathType: Prefix
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
## Or if you need a dynamic secretname
|
||||
# - secretNameTpl: '{{ include "common.names.fullname" . }}-ingress'
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
## Or a tpl that is evaluated
|
||||
# hostsTpl:
|
||||
# - '{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.{{ .Values.ingress.domainname }}'
|
||||
additionalIngresses: []
|
||||
# - enabled: false
|
||||
# nameSuffix: "api"
|
||||
# annotations: {}
|
||||
# # kubernetes.io/ingress.class: nginx
|
||||
# # kubernetes.io/tls-acme: "true"
|
||||
# labels: {}
|
||||
# hosts:
|
||||
# - host: chart-example.local
|
||||
# paths:
|
||||
# - path: /api
|
||||
# # Ignored if not kubeVersion >= 1.14-0
|
||||
# pathType: Prefix
|
||||
# tls: []
|
||||
# # - secretName: chart-example-tls
|
||||
# # hosts:
|
||||
# # - chart-example.local
|
||||
# ingress:
|
||||
# main:
|
||||
# enabled: false
|
||||
# # Used when including ingress using {{ include "common.ingress" . }}
|
||||
# type: "HTTP"
|
||||
# entrypoint: "websecure"
|
||||
# certType: ""
|
||||
# ## Optional: defaults to IngressName
|
||||
# serviceName: ""
|
||||
# ## Optional: Almost never needed
|
||||
# serviceKind: ""
|
||||
# ## Optional: defaults to either service port
|
||||
# servicePort: 80
|
||||
# annotations: {}
|
||||
# # kubernetes.io/ingress.class: nginx
|
||||
# # kubernetes.io/tls-acme: "true"
|
||||
# labels: {}
|
||||
# hosts:
|
||||
# - host: chart-example.local
|
||||
# ## Or a tpl that is evaluated
|
||||
# # hostTpl: '{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.{{ .Values.ingress.domainname }}'
|
||||
# paths:
|
||||
# - path: /
|
||||
# # Ignored if not kubeVersion >= 1.14-0
|
||||
# pathType: Prefix
|
||||
# tls: []
|
||||
# # - secretName: chart-example-tls
|
||||
# ## Or if you need a dynamic secretname
|
||||
# # - secretNameTpl: '{{ include "common.names.fullname" . }}-ingress'
|
||||
# # hosts:
|
||||
# # - chart-example.local
|
||||
# ## Or a tpl that is evaluated
|
||||
# # hostsTpl:
|
||||
# # - '{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.{{ .Values.ingress.domainname }}'
|
||||
# additionalIngresses: []
|
||||
# - enabled: false
|
||||
# nameSuffix: "api"
|
||||
# annotations: {}
|
||||
# # kubernetes.io/ingress.class: nginx
|
||||
# # kubernetes.io/tls-acme: "true"
|
||||
# labels: {}
|
||||
# hosts:
|
||||
# - host: chart-example.local
|
||||
# paths:
|
||||
# - path: /api
|
||||
# # Ignored if not kubeVersion >= 1.14-0
|
||||
# pathType: Prefix
|
||||
# tls: []
|
||||
# # - secretName: chart-example-tls
|
||||
# # hosts:
|
||||
# # - chart-example.local
|
||||
|
||||
persistence:
|
||||
config:
|
||||
@@ -291,32 +302,6 @@ PUID: 568
|
||||
PGID: 568
|
||||
UMASK: "002"
|
||||
fixMountPermissions: true
|
||||
# appAdditionalServicesEnabled: false
|
||||
# appAdditionalServices:
|
||||
# api:
|
||||
# enabled: false
|
||||
# type: NodePort
|
||||
# protocol: TCP
|
||||
# port:
|
||||
# port: 8091
|
||||
# nodePort: 38091
|
||||
# additionalPorts: []
|
||||
# - name: api-alt
|
||||
# port: 8092
|
||||
# targetPort: 8092
|
||||
# protocol: TCP
|
||||
# nodePort: 38092
|
||||
# ws:
|
||||
# enabled: false
|
||||
# type: ClusterIP
|
||||
# port:
|
||||
# port: 3000
|
||||
# additionalPorts: {}
|
||||
# foo:
|
||||
# name: ws-alt
|
||||
# protocol: TCP
|
||||
# port: 3001
|
||||
# targetPort: 3001
|
||||
|
||||
# appVolumeMounts:
|
||||
# config:
|
||||
@@ -339,40 +324,3 @@ fixMountPermissions: true
|
||||
# hostPathEnabled: false
|
||||
# hostPath: ""
|
||||
# setPermissions: true
|
||||
|
||||
# appIngress:
|
||||
# main:
|
||||
# enabled: false
|
||||
# entrypoint: "websecure"
|
||||
# certType: "letsencrypt-prod"
|
||||
# existingcert: ""
|
||||
# authForwardURL: ""
|
||||
# annotations: {}
|
||||
# labels: {}
|
||||
# hosts:
|
||||
# - host: app.truecharts.placeholder
|
||||
# paths:
|
||||
# - path: /
|
||||
# # Ignored if not kubeVersion >= 1.14-0
|
||||
# pathType: Prefix
|
||||
#
|
||||
# maintcp:
|
||||
# enabled: false
|
||||
# type: "TCP"
|
||||
# entrypoint: "kms"
|
||||
# certType: "none"
|
||||
# existingcert: ""
|
||||
# annotations: {}
|
||||
# labels: {}
|
||||
# hosts:
|
||||
# - host: app.truecharts.placeholder
|
||||
# paths:
|
||||
# - path: /
|
||||
# # Ignored if not kubeVersion >= 1.14-0
|
||||
# pathType: Prefix
|
||||
# mainudp:
|
||||
# enabled: false
|
||||
# type: "UDP"
|
||||
# entrypoint: "DNSUDP"
|
||||
# annotations: {}
|
||||
# labels: {}
|
||||
|
||||
Reference in New Issue
Block a user