From 354b922e48972b19a291d6fa4699ca6f17d21f5a Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Fri, 9 Oct 2020 16:00:11 -0700 Subject: [PATCH] Allow creation of different Service types in Supervisor ytt templates - Tiltfile and prepare-for-integration-tests.sh both specify the NodePort Service using `--data-value-yaml 'service_nodeport_port=31234'` - Also rename the namespaces used by the Concierge and Supervisor apps during integration tests running locally --- deploy/supervisor/deployment.yaml | 38 +---------------- deploy/supervisor/service.yaml | 59 +++++++++++++++++++++++++++ deploy/supervisor/values.yaml | 7 ++++ hack/lib/tilt/Tiltfile | 45 +++++++++++--------- hack/lib/tilt/nodeport.yaml | 13 ------ hack/prepare-for-integration-tests.sh | 22 ++-------- 6 files changed, 97 insertions(+), 87 deletions(-) create mode 100644 deploy/supervisor/service.yaml delete mode 100644 hack/lib/tilt/nodeport.yaml diff --git a/deploy/supervisor/deployment.yaml b/deploy/supervisor/deployment.yaml index cd4079c8a..459276fbb 100644 --- a/deploy/supervisor/deployment.yaml +++ b/deploy/supervisor/deployment.yaml @@ -76,8 +76,8 @@ spec: command: #! override the default entrypoint - /usr/local/bin/pinniped-supervisor args: - - /etc/podinfo #! TODO proper flag parsing instead of positional - - /etc/config/pinniped.yaml #! TODO proper flag parsing instead of positional + - /etc/podinfo + - /etc/config/pinniped.yaml resources: requests: memory: "128Mi" @@ -86,24 +86,6 @@ spec: mountPath: /etc/config - name: podinfo mountPath: /etc/podinfo -#! livenessProbe: -#! httpGet: -#! path: /healthz -#! port: 443 -#! scheme: HTTPS -#! initialDelaySeconds: 2 -#! timeoutSeconds: 15 -#! periodSeconds: 10 -#! failureThreshold: 5 -#! readinessProbe: -#! httpGet: -#! path: /healthz -#! port: 443 -#! scheme: HTTPS -#! initialDelaySeconds: 2 -#! timeoutSeconds: 3 -#! periodSeconds: 10 -#! failureThreshold: 3 volumes: - name: config-volume configMap: @@ -128,19 +110,3 @@ spec: matchLabels: app: #@ data.values.app_name topologyKey: kubernetes.io/hostname ---- -apiVersion: v1 -kind: Service -metadata: - name: #@ data.values.app_name - namespace: #@ data.values.namespace - labels: - app: #@ data.values.app_name -spec: - type: ClusterIP - selector: - app: #@ data.values.app_name - ports: - - protocol: TCP - port: 80 - targetPort: 80 diff --git a/deploy/supervisor/service.yaml b/deploy/supervisor/service.yaml new file mode 100644 index 000000000..6acbe7fc5 --- /dev/null +++ b/deploy/supervisor/service.yaml @@ -0,0 +1,59 @@ +#@ load("@ytt:data", "data") + +#@ if data.values.service_nodeport_port: +--- +apiVersion: v1 +kind: Service +metadata: + name: #@ data.values.app_name + "-nodeport" + namespace: #@ data.values.namespace + labels: + app: #@ data.values.app_name +spec: + type: NodePort + selector: + app: #@ data.values.app_name + ports: + - protocol: TCP + port: 80 + targetPort: 80 + nodePort: #@ data.values.service_nodeport_port +#@ end + +#@ if data.values.service_clusterip_port: +--- +apiVersion: v1 +kind: Service +metadata: + name: #@ data.values.app_name + "-clusterip" + namespace: #@ data.values.namespace + labels: + app: #@ data.values.app_name +spec: + type: ClusterIP + selector: + app: #@ data.values.app_name + ports: + - protocol: TCP + port: #@ data.values.service_clusterip_port + targetPort: 80 +#@ end + +#@ if data.values.service_loadbalancer_port: +--- +apiVersion: v1 +kind: Service +metadata: + name: #@ data.values.app_name + "-loadbalancer" + namespace: #@ data.values.namespace + labels: + app: #@ data.values.app_name +spec: + type: LoadBalancer + selector: + app: #@ data.values.app_name + ports: + - protocol: TCP + port: #@ data.values.service_loadbalancer_port + targetPort: 80 +#@ end diff --git a/deploy/supervisor/values.yaml b/deploy/supervisor/values.yaml index 6df6efe99..6e74ca362 100644 --- a/deploy/supervisor/values.yaml +++ b/deploy/supervisor/values.yaml @@ -20,3 +20,10 @@ image_tag: latest #! Typically the value would be the output of: kubectl create secret docker-registry x --docker-server=https://example.io --docker-username="USERNAME" --docker-password="PASSWORD" --dry-run=client -o json | jq -r '.data[".dockerconfigjson"]' #! Optional. image_pull_dockerconfigjson: #! e.g. {"auths":{"https://registry.example.com":{"username":"USERNAME","password":"PASSWORD","auth":"BASE64_ENCODED_USERNAME_COLON_PASSWORD"}}} + +#! Specify how to expose the Supervisor app as a Service. +#! Typically you would set a value for only one of the following. +#! Setting any of these values means that a Service of that type will be created. +service_nodeport_port: #! e.g. 31234 +service_loadbalancer_port: #! e.g. 443 +service_clusterip_port: #! e.g. 443 diff --git a/hack/lib/tilt/Tiltfile b/hack/lib/tilt/Tiltfile index be2c87923..26213238d 100644 --- a/hack/lib/tilt/Tiltfile +++ b/hack/lib/tilt/Tiltfile @@ -8,15 +8,18 @@ os.putenv('GOARCH', 'amd64') os.putenv('CGO_ENABLED', '0') os.putenv('KUBE_GIT_VERSION', 'v0.0.0') +##################################################################################################### # Compile all of our ./cmd/... binaries. +# + local_resource( 'compile', 'cd ../../../ && mkdir -p ./hack/lib/tilt/build && go build -v -ldflags "$(hack/get-ldflags.sh)" -o ./hack/lib/tilt/build ./cmd/...', deps=['../../../cmd', '../../../internal', '../../../pkg', '../../../generated'], ) -# -# local-user-authenticator app +##################################################################################################### +# Local-user-authenticator app # # Build a container image for local-user-authenticator, with live-update enabled. @@ -37,17 +40,18 @@ k8s_yaml(local([ # Collect all the deployed local-user-authenticator resources under a "local-user-auth" resource tab. k8s_resource( - workload='local-user-authenticator', - new_name='local-user-auth', + workload='local-user-authenticator', # this is the deployment name + new_name='local-user-auth', # this is the name that will appear in the tilt UI objects=[ + # these are the objects that would otherwise appear in the "uncategorized" tab in the tilt UI 'local-user-authenticator:namespace', 'local-user-authenticator:serviceaccount', 'local-user-authenticator:role', - 'local-user-authenticator:rolebinding' + 'local-user-authenticator:rolebinding', ], ) -# +##################################################################################################### # Supervisor app # @@ -63,19 +67,23 @@ docker_build_with_restart('image/supervisor', '.', k8s_yaml(local([ 'ytt', '--file', '../../../deploy/supervisor', + '--data-value', 'app_name=pinniped-supervisor', + '--data-value', 'namespace=supervisor', '--data-value', 'image_repo=image/supervisor', '--data-value', 'image_tag=tilt-dev', - '--data-value-yaml', 'replicas=1' + '--data-value-yaml', 'replicas=1', + '--data-value-yaml', 'service_nodeport_port=31234', ])) # Collect all the deployed supervisor resources under a "supervisor" resource tab. k8s_resource( - workload='pinniped-supervisor', - new_name='supervisor', + workload='pinniped-supervisor', # this is the deployment name + new_name='supervisor', # this is the name that will appear in the tilt UI objects=[ + # these are the objects that would otherwise appear in the "uncategorized" tab in the tilt UI 'oidcproviderconfigs.config.pinniped.dev:customresourcedefinition', 'pinniped-supervisor-static-config:configmap', - 'pinniped-supervisor:namespace', + 'supervisor:namespace', 'pinniped-supervisor:role', 'pinniped-supervisor:rolebinding', 'pinniped-supervisor:serviceaccount', @@ -90,9 +98,7 @@ docker_build_with_restart('image/concierge', '.', only=['./build/pinniped-concierge'], ) -k8s_yaml('nodeport.yaml') - -# +##################################################################################################### # Concierge app # @@ -101,20 +107,21 @@ k8s_yaml(local([ 'sh', '-c', 'ytt --file ../../../deploy/concierge ' + '--data-value app_name=pinniped-concierge ' + - '--data-value namespace=integration ' + + '--data-value namespace=concierge ' + '--data-value image_repo=image/concierge ' + '--data-value image_tag=tilt-dev ' + '--data-value kube_cert_agent_image=debian:10.5-slim ' + '--data-value discovery_url=$(TERM=dumb kubectl cluster-info | awk \'/Kubernetes master/ {print $NF}\') ' + - '--data-value-yaml replicas=1' + '--data-value-yaml replicas=1', ])) # Collect all the deployed local-user-authenticator resources under a "concierge" resource tab. k8s_resource( - workload='pinniped-concierge', - new_name='concierge', + workload='pinniped-concierge', # this is the deployment name + new_name='concierge', # this is the name that will appear in the tilt UI objects=[ - 'integration:namespace', + # these are the objects that would otherwise appear in the "uncategorized" tab in the tilt UI + 'concierge:namespace', 'pinniped-concierge-aggregated-api-server:clusterrole', 'pinniped-concierge-aggregated-api-server:clusterrolebinding', 'pinniped-concierge-aggregated-api-server:role', @@ -135,7 +142,7 @@ k8s_resource( ], ) -# +##################################################################################################### # Finish setting up cluster and creating integration test env file # diff --git a/hack/lib/tilt/nodeport.yaml b/hack/lib/tilt/nodeport.yaml deleted file mode 100644 index ddad93253..000000000 --- a/hack/lib/tilt/nodeport.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: pinniped-supervisor-node-port - namespace: pinniped-supervisor -spec: - type: NodePort - selector: - app: pinniped-supervisor - ports: - - port: 80 - targetPort: 80 - nodePort: 31234 diff --git a/hack/prepare-for-integration-tests.sh b/hack/prepare-for-integration-tests.sh index bf7c299df..04aa55317 100755 --- a/hack/prepare-for-integration-tests.sh +++ b/hack/prepare-for-integration-tests.sh @@ -200,7 +200,7 @@ kubectl create secret generic "$test_username" \ # Deploy the Pinniped Supervisor # supervisor_app_name="pinniped-supervisor" -supervisor_namespace="pinniped-supervisor" +supervisor_namespace="supervisor" if ! tilt_mode; then pushd deploy/supervisor >/dev/null @@ -210,27 +210,11 @@ if ! tilt_mode; then --data-value "app_name=$supervisor_app_name" \ --data-value "namespace=$supervisor_namespace" \ --data-value "image_repo=$registry_repo" \ + --data-value-yaml 'service_nodeport_port=31234' \ --data-value "image_tag=$tag" >"$manifest" kapp deploy --yes --app "$supervisor_app_name" --diff-changes --file "$manifest" - log_note "Adding NodePort service to expose the Pinniped Supervisor app on the kind node..." -cat </dev/null fi @@ -238,7 +222,7 @@ fi # Deploy Pinniped # concierge_app_name="pinniped-concierge" -concierge_namespace="integration" +concierge_namespace="concierge" webhook_url="https://local-user-authenticator.local-user-authenticator.svc/authenticate" webhook_ca_bundle="$(kubectl get secret local-user-authenticator-tls-serving-certificate --namespace local-user-authenticator -o 'jsonpath={.data.caCertificate}')" discovery_url="$(TERM=dumb kubectl cluster-info | awk '/Kubernetes master/ {print $NF}')"