Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Helm chart support for webhook sidecar #3966

Closed
wants to merge 2 commits into from
Closed

Helm chart support for webhook sidecar #3966

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cc1c5f5
Helm chart support for provider images
johngmyers Sep 30, 2023
d179660
Also scrape metrics from provider-metrics port
johngmyers Nov 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions charts/external-dns/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

- Added the option to explicitly enable or disable service account token automounting. ([#3983](https:/kubernetes-sigs/external-dns/pull/3983)) [@gilles-gosuin](https:/gilles-gosuin)
- Added the option to configure revisionHistoryLimit on the K8s Deployment resource. ([#4008](https:/kubernetes-sigs/external-dns/pull/4008)) [@arnisoph](https:/arnisoph)
- Added support for webhook sidecars.

## [v1.13.1] - 2023-09-07

Expand Down
142 changes: 75 additions & 67 deletions charts/external-dns/README.md
View file
Open in desktop

Large diffs are not rendered by default.

14 changes: 14 additions & 0 deletions charts/external-dns/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,3 +70,17 @@ The image to use
{{- define "external-dns.image" -}}
{{- printf "%s:%s" .Values.image.repository (default (printf "v%s" .Chart.AppVersion) .Values.image.tag) }}
{{- end }}

{{/*
Keep backward compatibility on provider
*/}}
{{- define "external-dns.providername" -}}
{{- if eq (typeOf .Values.provider) "string" }}
{{- .Values.provider }}
{{- if contains "/" .Values.provider }}
{{- fail "A provider image must be specified as provider.name" }}
{{- end }}
{{- else }}
{{- .Values.provider.name }}
{{- end }}
{{- end }}
57 changes: 52 additions & 5 deletions charts/external-dns/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
{{- $providername := include "external-dns.providername" . }}
apiVersion: apps/v1
kind: Deployment
metadata:
Expand Down Expand Up @@ -103,7 +104,11 @@ spec:
{{- range .Values.domainFilters }}
- --domain-filter={{ . }}
{{- end }}
- --provider={{ tpl .Values.provider $ }}
{{- if contains "/" $providername }}
- --provider=webhook
{{- else }}
- --provider={{ tpl $providername $ }}
{{- end }}
{{- range .Values.extraArgs }}
- {{ tpl . $ }}
{{- end }}
Expand All @@ -115,9 +120,9 @@ spec:
{{- toYaml .Values.livenessProbe | nindent 12 }}
readinessProbe:
{{- toYaml .Values.readinessProbe | nindent 12 }}
{{- if or .Values.secretConfiguration.enabled .Values.extraVolumeMounts }}
{{- if or .Values.secretConfiguration.mountPath .Values.extraVolumeMounts }}
johngmyers marked this conversation as resolved.
Show resolved Hide resolved
volumeMounts:
{{- if .Values.secretConfiguration.enabled }}
{{- if .Values.secretConfiguration.mountPath }}
johngmyers marked this conversation as resolved.
Show resolved Hide resolved
- name: secrets
mountPath: {{ tpl .Values.secretConfiguration.mountPath $ }}
{{- with .Values.secretConfiguration.subPath }}
Expand All @@ -132,9 +137,51 @@ spec:
resources:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- if or .Values.secretConfiguration.enabled .Values.extraVolumes }}
{{- if contains "/" $providername }}
- name: provider
{{- with .Values.securityContext }}
securityContext:
{{- toYaml . | nindent 12 }}
{{- end }}
image: {{ tpl $providername $ }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
{{- with .Values.provider.env }}
env:
{{- toYaml . | nindent 12 }}
{{- end }}
args:
{{- range .Values.provider.args }}
- {{ tpl . $ }}
{{- end }}
ports:
- name: provider-metrics
johngmyers marked this conversation as resolved.
Show resolved Hide resolved
protocol: TCP
containerPort: 8080
Comment on lines +156 to +159
Copy link
Contributor

@mloiseleur mloiseleur Nov 14, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this port expected on all webhook providers ?
FTM, I have seen they are using one port (8888) by default, to serve provider methods and probes.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is my proposal. We'll want them to have a separate port for metrics because security depends on the provider methods not being accessible outside of the pod. I don't see any benefit in letting webhook providers choose different metrics ports.

livenessProbe:
{{- toYaml .Values.provider.livenessProbe | nindent 12 }}
readinessProbe:
{{- toYaml .Values.provider.readinessProbe | nindent 12 }}
{{- if or .Values.provider.secretConfiguration.mountPath .Values.provider.extraVolumeMounts }}
volumeMounts:
{{- if .Values.provider.secretConfiguration.mountPath }}
- name: secrets
mountPath: {{ tpl .Values.provider.secretConfiguration.mountPath $ }}
{{- with .Values.provider.secretConfiguration.subPath }}
subPath: {{ tpl . $ }}
{{- end }}
{{- end }}
{{- with .Values.provider.extraVolumeMounts }}
{{- toYaml . | nindent 12 }}
{{- end }}
{{- end }}
{{- with .Values.provider.resources }}
resources:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- end }}
{{- if or .Values.secretConfiguration.mountPath (and (contains "/" $providername) .Values.provider.secretConfiguration.mountPath) .Values.extraVolumes }}
volumes:
{{- if .Values.secretConfiguration.enabled }}
{{- if or .Values.secretConfiguration.mountPath (and (contains "/" $providername) .Values.provider.secretConfiguration.mountPath) }}
- name: secrets
secret:
secretName: {{ include "external-dns.fullname" . }}
Expand Down
18 changes: 10 additions & 8 deletions charts/external-dns/templates/servicemonitor.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,32 +22,34 @@ spec:
matchLabels:
{{- include "external-dns.selectorLabels" . | nindent 6 }}
endpoints:
- port: http
{{- range (list "http" "provider-metrics" }}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I need to make the "provider-metrics" part of this conditional on there being a provider sidecar.

- port: {{ . }}
path: /metrics
{{- with .Values.serviceMonitor.interval }}
{{- with $.Values.serviceMonitor.interval }}
interval: {{ . }}
{{- end }}
{{- with .Values.serviceMonitor.scheme }}
{{- with $.Values.serviceMonitor.scheme }}
scheme: {{ . }}
{{- end }}
{{- with .Values.serviceMonitor.bearerTokenFile }}
{{- with $.Values.serviceMonitor.bearerTokenFile }}
bearerTokenFile: {{ . }}
{{- end }}
{{- with .Values.serviceMonitor.tlsConfig }}
{{- with $.Values.serviceMonitor.tlsConfig }}
tlsConfig:
{{- toYaml .| nindent 8 }}
{{- end }}
{{- with .Values.serviceMonitor.scrapeTimeout }}
{{- with $.Values.serviceMonitor.scrapeTimeout }}
scrapeTimeout: {{ . }}
{{- end }}
{{- with .Values.serviceMonitor.metricRelabelings }}
{{- with $.Values.serviceMonitor.metricRelabelings }}
metricRelabelings:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.serviceMonitor.relabelings }}
{{- with $.Values.serviceMonitor.relabelings }}
relabelings:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}
{{- with .Values.serviceMonitor.targetLabels }}
targetLabels:
{{- toYaml . | nindent 4 }}
Expand Down
3 changes: 0 additions & 3 deletions charts/external-dns/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,6 @@
"$schema": "http://json-schema.org/draft-07/schema",
"type": "object",
"properties": {
"provider": {
"type": "string"
},
"extraArgs": {
"type": "array",
"items": {
Expand Down
38 changes: 37 additions & 1 deletion charts/external-dns/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,7 +180,43 @@ txtSuffix: ""

domainFilters: []

provider: aws
provider:
# The name of the DNS provider. This can be either a built-in provider or a provider image to run as a sidecar container.
name: "aws"
# Arguments to pass to the provider container (these can be templated).
args: []
# [Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the provider container; this supports the full [EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#envvar-v1-core) API including secrets and configmaps.
env: []
# Additional volume mounts for the provider container; this supports the full [VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#volumemount-v1-core) API.
extraVolumeMounts: []
# [Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) for the provider container; this supports the full [Probe](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#probe-v1-core) API.
livenessProbe:
httpGet:
path: /healthz
port: provider-metrics
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 2
successThreshold: 1
# [Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) for the webhook container; this supports the full [Probe](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#probe-v1-core) API.
readinessProbe:
httpGet:
path: /healthz
port: provider-metrics
initialDelaySeconds: 5
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 6
successThreshold: 1
# Resource requests and limits for the provider container; this supports the full [ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#resourcerequirements-v1-core) API.
resources: {}

secretConfiguration:
# Mount path of secret configuration secret in the provider container (this can be templated).
mountPath: ""
# Sub-path of secret configuration secret in the provider container (this can be templated).
subPath: ""

extraArgs: []

Expand Down
Loading