-
Notifications
You must be signed in to change notification settings - Fork 105
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
CP/DP Split: Add agent/nginx container and deployment (#2958)
Updating the nginx docker containers to build and include agent. Once agent is officially released, we can use the published binary instead of building. Added a temporary nginx deployment to the helm chart to deploy a standalone nginx pod. Added the basic gRPC server and agent API implementation to allow for the agent pod to connect to the control plane without errors.
- Loading branch information
Showing
31 changed files
with
2,351 additions
and
267 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| #!/bin/bash | ||
|
|
||
| set -euxo pipefail | ||
|
|
||
| handle_term() { | ||
| echo "received TERM signal" | ||
| echo "stopping nginx-agent ..." | ||
| kill -TERM "${agent_pid}" 2>/dev/null | ||
| echo "stopping nginx ..." | ||
| kill -TERM "${nginx_pid}" 2>/dev/null | ||
| } | ||
|
|
||
| trap 'handle_term' TERM | ||
|
|
||
| rm -rf /var/run/nginx/*.sock | ||
|
|
||
| # Launch nginx | ||
| echo "starting nginx ..." | ||
| /usr/sbin/nginx -g "daemon off;" & | ||
|
|
||
| nginx_pid=$! | ||
|
|
||
| SECONDS=0 | ||
|
|
||
| while ! ps -ef | grep "nginx: master process" | grep -v grep; do | ||
| if ((SECONDS > 5)); then | ||
| echo "couldn't find nginx master process" | ||
| exit 1 | ||
| fi | ||
| done | ||
|
|
||
| # start nginx-agent, pass args | ||
| echo "starting nginx-agent ..." | ||
| nginx-agent "$@" & | ||
|
|
||
| agent_pid=$! | ||
|
|
||
| if [ $? != 0 ]; then | ||
| echo "couldn't start the agent, please check the log file" | ||
| exit 1 | ||
| fi | ||
|
|
||
| wait_term() { | ||
| wait ${agent_pid} | ||
| trap - TERM | ||
| kill -QUIT "${nginx_pid}" 2>/dev/null | ||
| echo "waiting for nginx to stop..." | ||
| wait ${nginx_pid} | ||
| } | ||
|
|
||
| wait_term | ||
|
|
||
| echo "nginx-agent process has stopped, exiting." |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
19 changes: 19 additions & 0 deletions
19
charts/nginx-gateway-fabric/templates/tmp-nginx-agent-conf.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: nginx-agent-config | ||
| namespace: {{ .Release.Namespace }} | ||
| data: | ||
| nginx-agent.conf: |- | ||
| command: | ||
| server: | ||
| host: {{ include "nginx-gateway.fullname" . }}.{{ .Release.Namespace }}.svc | ||
| port: 443 | ||
| allowed_directories: | ||
| - /etc/nginx | ||
| - /usr/share/nginx | ||
| - /var/run/nginx | ||
| features: | ||
| - connection | ||
| log: | ||
| level: debug |
186 changes: 186 additions & 0 deletions
186
charts/nginx-gateway-fabric/templates/tmp-nginx-deployment.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,186 @@ | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: tmp-nginx-deployment | ||
| namespace: {{ .Release.Namespace }} | ||
| spec: | ||
| selector: | ||
| matchLabels: | ||
| app.kubernetes.io/name: tmp-nginx-deployment | ||
| app.kubernetes.io/instance: {{ .Release.Name }} | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app.kubernetes.io/name: tmp-nginx-deployment | ||
| app.kubernetes.io/instance: {{ .Release.Name }} | ||
| spec: | ||
| initContainers: | ||
| - name: sleep # wait for a bit for control plane to be ready | ||
| image: {{ .Values.nginxGateway.image.repository }}:{{ default .Chart.AppVersion .Values.nginxGateway.image.tag }} | ||
| imagePullPolicy: {{ .Values.nginxGateway.image.pullPolicy }} | ||
| command: | ||
| - /usr/bin/gateway | ||
| - sleep | ||
| - --duration=15s | ||
| - name: init | ||
| image: {{ .Values.nginxGateway.image.repository }}:{{ default .Chart.AppVersion .Values.nginxGateway.image.tag }} | ||
| imagePullPolicy: {{ .Values.nginxGateway.image.pullPolicy }} | ||
| command: | ||
| - /usr/bin/gateway | ||
| - initialize | ||
| - --source | ||
| - /includes/main.conf | ||
| {{- if .Values.nginx.plus }} | ||
| - --source | ||
| - /includes/mgmt.conf | ||
| - --nginx-plus | ||
| {{- end }} | ||
| - --destination | ||
| - /etc/nginx/main-includes | ||
| env: | ||
| - name: POD_UID | ||
| valueFrom: | ||
| fieldRef: | ||
| fieldPath: metadata.uid | ||
| securityContext: | ||
| seccompProfile: | ||
| type: RuntimeDefault | ||
| capabilities: | ||
| drop: | ||
| - ALL | ||
| readOnlyRootFilesystem: true | ||
| runAsUser: 102 | ||
| runAsGroup: 1001 | ||
| volumeMounts: | ||
| - name: nginx-includes-bootstrap | ||
| mountPath: /includes | ||
| - name: nginx-main-includes | ||
| mountPath: /etc/nginx/main-includes | ||
| containers: | ||
| - image: {{ .Values.nginx.image.repository }}:{{ .Values.nginx.image.tag | default .Chart.AppVersion }} | ||
| imagePullPolicy: {{ .Values.nginx.image.pullPolicy }} | ||
| name: nginx | ||
| {{- if .Values.nginx.lifecycle }} | ||
| lifecycle: | ||
| {{- toYaml .Values.nginx.lifecycle | nindent 10 }} | ||
| {{- end }} | ||
| ports: | ||
| - containerPort: 80 | ||
| name: http | ||
| - containerPort: 443 | ||
| name: https | ||
| securityContext: | ||
| seccompProfile: | ||
| type: RuntimeDefault | ||
| allowPrivilegeEscalation: {{ .Values.nginx.securityContext.allowPrivilegeEscalation }} | ||
| capabilities: | ||
| add: | ||
| - NET_BIND_SERVICE | ||
| drop: | ||
| - ALL | ||
| readOnlyRootFilesystem: true | ||
| runAsUser: 101 | ||
| runAsGroup: 1001 | ||
| volumeMounts: | ||
| - name: nginx-agent | ||
| mountPath: /etc/nginx-agent | ||
| - name: nginx-conf | ||
| mountPath: /etc/nginx/conf.d | ||
| - name: nginx-stream-conf | ||
| mountPath: /etc/nginx/stream-conf.d | ||
| - name: nginx-main-includes | ||
| mountPath: /etc/nginx/main-includes | ||
| - name: nginx-secrets | ||
| mountPath: /etc/nginx/secrets | ||
| - name: nginx-run | ||
| mountPath: /var/run/nginx | ||
| - name: nginx-cache | ||
| mountPath: /var/cache/nginx | ||
| - name: nginx-includes | ||
| mountPath: /etc/nginx/includes | ||
| {{- if .Values.nginx.plus }} | ||
| - name: nginx-lib | ||
| mountPath: /var/lib/nginx/state | ||
| {{- if .Values.nginx.usage.secretName }} | ||
| - name: nginx-plus-license | ||
| mountPath: /etc/nginx/license.jwt | ||
| subPath: license.jwt | ||
| {{- end }} | ||
| {{- if or .Values.nginx.usage.caSecretName .Values.nginx.usage.clientSSLSecretName }} | ||
| - name: nginx-plus-usage-certs | ||
| mountPath: /etc/nginx/certs-bootstrap/ | ||
| {{- end }} | ||
| {{- end }} | ||
| {{- with .Values.nginx.extraVolumeMounts -}} | ||
| {{ toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| {{- if .Values.nginx.debug }} | ||
| command: | ||
| - "/bin/sh" | ||
| args: | ||
| - "-c" | ||
| - "rm -rf /var/run/nginx/*.sock && nginx-debug -g 'daemon off;'" | ||
| {{- end }} | ||
| terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} | ||
| {{- if .Values.affinity }} | ||
| affinity: | ||
| {{- toYaml .Values.affinity | nindent 8 }} | ||
| {{- end }} | ||
| serviceAccountName: {{ include "nginx-gateway.serviceAccountName" . }} | ||
| securityContext: | ||
| fsGroup: 1001 | ||
| runAsNonRoot: true | ||
| {{- if .Values.tolerations }} | ||
| tolerations: | ||
| {{- toYaml .Values.tolerations | nindent 6 }} | ||
| {{- end }} | ||
| {{- if .Values.nodeSelector }} | ||
| nodeSelector: | ||
| {{- toYaml .Values.nodeSelector | nindent 8 }} | ||
| {{- end }} | ||
| volumes: | ||
| - name: nginx-agent | ||
| configMap: | ||
| name: nginx-agent-config | ||
| - name: nginx-conf | ||
| emptyDir: {} | ||
| - name: nginx-stream-conf | ||
| emptyDir: {} | ||
| - name: nginx-main-includes | ||
| emptyDir: {} | ||
| - name: nginx-secrets | ||
| emptyDir: {} | ||
| - name: nginx-run | ||
| emptyDir: {} | ||
| - name: nginx-cache | ||
| emptyDir: {} | ||
| - name: nginx-includes | ||
| emptyDir: {} | ||
| - name: nginx-includes-bootstrap | ||
| configMap: | ||
| name: nginx-includes-bootstrap | ||
| {{- if .Values.nginx.plus }} | ||
| - name: nginx-lib | ||
| emptyDir: {} | ||
| {{- if .Values.nginx.usage.secretName }} | ||
| - name: nginx-plus-license | ||
| secret: | ||
| secretName: {{ .Values.nginx.usage.secretName }} | ||
| {{- end }} | ||
| {{- if or .Values.nginx.usage.caSecretName .Values.nginx.usage.clientSSLSecretName }} | ||
| - name: nginx-plus-usage-certs | ||
| projected: | ||
| sources: | ||
| {{- if .Values.nginx.usage.caSecretName }} | ||
| - secret: | ||
| name: {{ .Values.nginx.usage.caSecretName }} | ||
| {{- end }} | ||
| {{- if .Values.nginx.usage.clientSSLSecretName }} | ||
| - secret: | ||
| name: {{ .Values.nginx.usage.clientSSLSecretName }} | ||
| {{- end }} | ||
| {{- end }} | ||
| {{- end }} | ||
| {{- with .Values.extraVolumes -}} | ||
| {{ toYaml . | nindent 6 }} | ||
| {{- end }} |
Oops, something went wrong.