Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 926eae9

Browse files
steveslokastevesloka
committedMar 8, 2019
Add support for Kubernetes by deploying code-server, Contour for ingress
controller, and Cert Manager for Let's Encrypt certificates, with persistent storage with AWS EBS volumes. Signed-off-by: Steve Sloka <[email protected]>
1 parent cded51f commit 926eae9

File tree

5 files changed

+672
-0
lines changed

5 files changed

+672
-0
lines changed
 

‎deployment/Dockerfile

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
FROM golang:stretch
2+
WORKDIR /app
3+
RUN apt-get update \
4+
&& apt-get install -y wget net-tools vim rsync \
5+
&& rm -rf /var/lib/apt/lists/*
6+
RUN wget https://github.com/$(wget https://github.com/codercom/code-server/releases/latest -O - | egrep '/.*/.*-linux.tar.gz' -o) \
7+
&& tar -xvzf * \
8+
&& cd * \
9+
&& chmod +x code-server \
10+
&& mv ./code-server /
11+
12+
EXPOSE 8443
13+
CMD /code-server -p 8443

‎deployment/certmanager.yaml

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
---
2+
# Source: cert-manager/templates/00-namespace.yaml
3+
4+
apiVersion: v1
5+
kind: Namespace
6+
metadata:
7+
name: "cert-manager"
8+
9+
---
10+
# Source: cert-manager/templates/serviceaccount.yaml
11+
apiVersion: v1
12+
kind: ServiceAccount
13+
metadata:
14+
name: cert-manager
15+
namespace: "cert-manager"
16+
labels:
17+
app: cert-manager
18+
chart: cert-manager-v0.4.1
19+
release: cert-manager
20+
heritage: Tiller
21+
---
22+
# Source: cert-manager/templates/certificate-crd.yaml
23+
apiVersion: apiextensions.k8s.io/v1beta1
24+
kind: CustomResourceDefinition
25+
metadata:
26+
name: certificates.certmanager.k8s.io
27+
labels:
28+
app: cert-manager
29+
chart: cert-manager-v0.4.1
30+
release: cert-manager
31+
heritage: Tiller
32+
spec:
33+
group: certmanager.k8s.io
34+
version: v1alpha1
35+
scope: Namespaced
36+
names:
37+
kind: Certificate
38+
plural: certificates
39+
shortNames:
40+
- cert
41+
- certs
42+
43+
---
44+
# Source: cert-manager/templates/clusterissuer-crd.yaml
45+
apiVersion: apiextensions.k8s.io/v1beta1
46+
kind: CustomResourceDefinition
47+
metadata:
48+
name: clusterissuers.certmanager.k8s.io
49+
labels:
50+
app: cert-manager
51+
chart: cert-manager-v0.4.1
52+
release: cert-manager
53+
heritage: Tiller
54+
spec:
55+
group: certmanager.k8s.io
56+
version: v1alpha1
57+
names:
58+
kind: ClusterIssuer
59+
plural: clusterissuers
60+
scope: Cluster
61+
---
62+
# Source: cert-manager/templates/issuer-crd.yaml
63+
apiVersion: apiextensions.k8s.io/v1beta1
64+
kind: CustomResourceDefinition
65+
metadata:
66+
name: issuers.certmanager.k8s.io
67+
labels:
68+
app: cert-manager
69+
chart: cert-manager-v0.4.1
70+
release: cert-manager
71+
heritage: Tiller
72+
spec:
73+
group: certmanager.k8s.io
74+
version: v1alpha1
75+
names:
76+
kind: Issuer
77+
plural: issuers
78+
scope: Namespaced
79+
---
80+
# Source: cert-manager/templates/rbac.yaml
81+
apiVersion: rbac.authorization.k8s.io/v1beta1
82+
kind: ClusterRole
83+
metadata:
84+
name: cert-manager
85+
labels:
86+
app: cert-manager
87+
chart: cert-manager-v0.4.1
88+
release: cert-manager
89+
heritage: Tiller
90+
rules:
91+
- apiGroups: ["certmanager.k8s.io"]
92+
resources: ["certificates", "issuers", "clusterissuers"]
93+
verbs: ["*"]
94+
- apiGroups: [""]
95+
# TODO: remove endpoints once 0.4 is released. We include it here in case
96+
# users use the 'master' version of the Helm chart with a 0.2.x release of
97+
# cert-manager that still performs leader election with Endpoint resources.
98+
# We advise users don't do this, but some will anyway and this will reduce
99+
# friction.
100+
resources: ["endpoints", "configmaps", "secrets", "events", "services", "pods"]
101+
verbs: ["*"]
102+
- apiGroups: ["extensions"]
103+
resources: ["ingresses"]
104+
verbs: ["*"]
105+
---
106+
apiVersion: rbac.authorization.k8s.io/v1beta1
107+
kind: ClusterRoleBinding
108+
metadata:
109+
name: cert-manager
110+
labels:
111+
app: cert-manager
112+
chart: cert-manager-v0.4.1
113+
release: cert-manager
114+
heritage: Tiller
115+
roleRef:
116+
apiGroup: rbac.authorization.k8s.io
117+
kind: ClusterRole
118+
name: cert-manager
119+
subjects:
120+
- name: cert-manager
121+
namespace: "cert-manager"
122+
kind: ServiceAccount
123+
---
124+
# Source: cert-manager/templates/deployment.yaml
125+
apiVersion: apps/v1beta1
126+
kind: Deployment
127+
metadata:
128+
name: cert-manager
129+
namespace: "cert-manager"
130+
labels:
131+
app: cert-manager
132+
chart: cert-manager-v0.4.1
133+
release: cert-manager
134+
heritage: Tiller
135+
spec:
136+
replicas: 1
137+
selector:
138+
matchLabels:
139+
app: cert-manager
140+
release: cert-manager
141+
template:
142+
metadata:
143+
labels:
144+
app: cert-manager
145+
release: cert-manager
146+
annotations:
147+
spec:
148+
serviceAccountName: cert-manager
149+
containers:
150+
- name: cert-manager
151+
image: "quay.io/jetstack/cert-manager-controller:v0.4.1"
152+
imagePullPolicy: IfNotPresent
153+
args:
154+
- --cluster-resource-namespace=$(POD_NAMESPACE)
155+
- --leader-election-namespace=$(POD_NAMESPACE)
156+
env:
157+
- name: POD_NAMESPACE
158+
valueFrom:
159+
fieldRef:
160+
fieldPath: metadata.namespace
161+
resources:
162+
requests:
163+
cpu: 10m
164+
memory: 32Mi
165+
---
166+
apiVersion: certmanager.k8s.io/v1alpha1
167+
kind: ClusterIssuer
168+
metadata:
169+
name: letsencrypt-prod
170+
namespace: cert-manager
171+
spec:
172+
acme:
173+
email: <emailAddress>
174+
http01: {}
175+
privateKeySecretRef:
176+
name: letsencrypt-prod
177+
server: https://acme-v02.api.letsencrypt.org/directory
178+
---
179+
apiVersion: certmanager.k8s.io/v1alpha1
180+
kind: ClusterIssuer
181+
metadata:
182+
name: letsencrypt-staging
183+
namespace: cert-manager
184+
spec:
185+
acme:
186+
email: <emailAddress>
187+
http01: {}
188+
privateKeySecretRef:
189+
name: letsencrypt-staging
190+
server: https://acme-staging-v02.api.letsencrypt.org/directory
191+
---

‎deployment/contour.yaml

Lines changed: 344 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,344 @@
1+
# This file is generated from the individual yaml files by deployment/render.sh.
2+
# Do not edit this file directly but instead edit the source files and
3+
# re-render.
4+
apiVersion: v1
5+
kind: Namespace
6+
metadata:
7+
name: heptio-contour
8+
---
9+
apiVersion: v1
10+
kind: ServiceAccount
11+
metadata:
12+
name: contour
13+
namespace: heptio-contour
14+
---
15+
apiVersion: apiextensions.k8s.io/v1beta1
16+
kind: CustomResourceDefinition
17+
metadata:
18+
name: ingressroutes.contour.heptio.com
19+
labels:
20+
component: ingressroute
21+
spec:
22+
group: contour.heptio.com
23+
version: v1beta1
24+
scope: Namespaced
25+
names:
26+
plural: ingressroutes
27+
kind: IngressRoute
28+
additionalPrinterColumns:
29+
- name: FQDN
30+
type: string
31+
description: Fully qualified domain name
32+
JSONPath: .spec.virtualhost.fqdn
33+
- name: TLS Secret
34+
type: string
35+
description: Secret with TLS credentials
36+
JSONPath: .spec.virtualhost.tls.secretName
37+
- name: First route
38+
type: string
39+
description: First routes defined
40+
JSONPath: .spec.routes[0].match
41+
- name: Status
42+
type: string
43+
description: The current status of the IngressRoute
44+
JSONPath: .status.currentStatus
45+
- name: Status Description
46+
type: string
47+
description: Description of the current status
48+
JSONPath: .status.description
49+
validation:
50+
openAPIV3Schema:
51+
properties:
52+
spec:
53+
properties:
54+
virtualhost:
55+
properties:
56+
fqdn:
57+
type: string
58+
pattern: ^([a-zA-Z0-9]+(-[a-zA-Z0-9]+)*\.)+[a-z0-9]{2,}$
59+
tls:
60+
properties:
61+
secretName:
62+
type: string
63+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ # DNS-1123 subdomain
64+
minimumProtocolVersion:
65+
type: string
66+
enum:
67+
- "1.3"
68+
- "1.2"
69+
- "1.1"
70+
strategy:
71+
type: string
72+
enum:
73+
- RoundRobin
74+
- WeightedLeastRequest
75+
- Random
76+
- RingHash
77+
- Maglev
78+
healthCheck:
79+
type: object
80+
required:
81+
- path
82+
properties:
83+
path:
84+
type: string
85+
pattern: ^\/.*$
86+
intervalSeconds:
87+
type: integer
88+
timeoutSeconds:
89+
type: integer
90+
unhealthyThresholdCount:
91+
type: integer
92+
healthyThresholdCount:
93+
type: integer
94+
routes:
95+
type: array
96+
items:
97+
required:
98+
- match
99+
properties:
100+
match:
101+
type: string
102+
pattern: ^\/.*$
103+
delegate:
104+
type: object
105+
required:
106+
- name
107+
properties:
108+
name:
109+
type: string
110+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ # DNS-1123 subdomain
111+
namespace:
112+
type: string
113+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ # DNS-1123 label
114+
services:
115+
type: array
116+
items:
117+
type: object
118+
required:
119+
- name
120+
- port
121+
properties:
122+
name:
123+
type: string
124+
pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$ # DNS-1035 label
125+
port:
126+
type: integer
127+
weight:
128+
type: integer
129+
strategy:
130+
type: string
131+
enum:
132+
- RoundRobin
133+
- WeightedLeastRequest
134+
- Random
135+
- RingHash
136+
- Maglev
137+
healthCheck:
138+
type: object
139+
required:
140+
- path
141+
properties:
142+
path:
143+
type: string
144+
pattern: ^\/.*$
145+
intervalSeconds:
146+
type: integer
147+
timeoutSeconds:
148+
type: integer
149+
unhealthyThresholdCount:
150+
type: integer
151+
healthyThresholdCount:
152+
type: integer
153+
---
154+
apiVersion: apiextensions.k8s.io/v1beta1
155+
kind: CustomResourceDefinition
156+
metadata:
157+
name: tlscertificatedelegations.contour.heptio.com
158+
labels:
159+
component: tlscertificatedelegation
160+
spec:
161+
group: contour.heptio.com
162+
version: v1beta1
163+
scope: Namespaced
164+
names:
165+
plural: tlscertificatedelegations
166+
kind: TLSCertificateDelegation
167+
---
168+
apiVersion: extensions/v1beta1
169+
kind: Deployment
170+
metadata:
171+
labels:
172+
app: contour
173+
name: contour
174+
namespace: heptio-contour
175+
spec:
176+
selector:
177+
matchLabels:
178+
app: contour
179+
replicas: 2
180+
template:
181+
metadata:
182+
labels:
183+
app: contour
184+
annotations:
185+
prometheus.io/scrape: "true"
186+
prometheus.io/port: "8002"
187+
prometheus.io/path: "/stats"
188+
prometheus.io/format: "prometheus"
189+
spec:
190+
containers:
191+
- image: gcr.io/heptio-images/contour:v0.10.0
192+
imagePullPolicy: Always
193+
name: contour
194+
command: ["contour"]
195+
args: ["serve", "--incluster"]
196+
- image: docker.io/envoyproxy/envoy-alpine:v1.9.0
197+
name: envoy
198+
ports:
199+
- containerPort: 8080
200+
name: http
201+
- containerPort: 8443
202+
name: https
203+
command: ["envoy"]
204+
args:
205+
- --config-path /config/contour.json
206+
- --service-cluster cluster0
207+
- --service-node node0
208+
- --log-level info
209+
- --v2-config-only
210+
readinessProbe:
211+
httpGet:
212+
path: /healthz
213+
port: 8002
214+
initialDelaySeconds: 3
215+
periodSeconds: 3
216+
volumeMounts:
217+
- name: contour-config
218+
mountPath: /config
219+
lifecycle:
220+
preStop:
221+
exec:
222+
command: ["wget", "-qO-", "http://localhost:9001/healthcheck/fail"]
223+
initContainers:
224+
- image: gcr.io/heptio-images/contour:master
225+
imagePullPolicy: Always
226+
name: envoy-initconfig
227+
command: ["contour"]
228+
args:
229+
- bootstrap
230+
# Uncomment the statsd-enable to enable statsd metrics
231+
#- --statsd-enable
232+
# Uncomment to set a custom stats emission address and port
233+
#- --stats-address=0.0.0.0
234+
#- --stats-port=8002
235+
- /config/contour.json
236+
volumeMounts:
237+
- name: contour-config
238+
mountPath: /config
239+
volumes:
240+
- name: contour-config
241+
emptyDir: {}
242+
dnsPolicy: ClusterFirst
243+
serviceAccountName: contour
244+
terminationGracePeriodSeconds: 30
245+
# The affinity stanza below tells Kubernetes to try hard not to place 2 of
246+
# these pods on the same node.
247+
affinity:
248+
podAntiAffinity:
249+
preferredDuringSchedulingIgnoredDuringExecution:
250+
- weight: 100
251+
podAffinityTerm:
252+
labelSelector:
253+
matchLabels:
254+
app: contour
255+
topologyKey: kubernetes.io/hostname
256+
---
257+
apiVersion: rbac.authorization.k8s.io/v1beta1
258+
kind: ClusterRoleBinding
259+
metadata:
260+
name: contour
261+
roleRef:
262+
apiGroup: rbac.authorization.k8s.io
263+
kind: ClusterRole
264+
name: contour
265+
subjects:
266+
- kind: ServiceAccount
267+
name: contour
268+
namespace: heptio-contour
269+
---
270+
apiVersion: rbac.authorization.k8s.io/v1beta1
271+
kind: ClusterRole
272+
metadata:
273+
name: contour
274+
rules:
275+
- apiGroups:
276+
- ""
277+
resources:
278+
- configmaps
279+
- endpoints
280+
- nodes
281+
- pods
282+
- secrets
283+
verbs:
284+
- list
285+
- watch
286+
- apiGroups:
287+
- ""
288+
resources:
289+
- nodes
290+
verbs:
291+
- get
292+
- apiGroups:
293+
- ""
294+
resources:
295+
- services
296+
verbs:
297+
- get
298+
- list
299+
- watch
300+
- apiGroups:
301+
- extensions
302+
resources:
303+
- ingresses
304+
verbs:
305+
- get
306+
- list
307+
- watch
308+
- apiGroups: ["contour.heptio.com"]
309+
resources: ["ingressroutes", "tlscertificatedelegations"]
310+
verbs:
311+
- get
312+
- list
313+
- watch
314+
- put
315+
- post
316+
- patch
317+
---
318+
apiVersion: v1
319+
kind: Service
320+
metadata:
321+
name: contour
322+
namespace: heptio-contour
323+
annotations:
324+
# This annotation puts the AWS ELB into "TCP" mode so that it does not
325+
# do HTTP negotiation for HTTPS connections at the ELB edge.
326+
# The downside of this is the remote IP address of all connections will
327+
# appear to be the internal address of the ELB. See docs/proxy-proto.md
328+
# for information about enabling the PROXY protocol on the ELB to recover
329+
# the original remote IP address.
330+
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
331+
spec:
332+
ports:
333+
- port: 80
334+
name: http
335+
protocol: TCP
336+
targetPort: 8080
337+
- port: 443
338+
name: https
339+
protocol: TCP
340+
targetPort: 8443
341+
selector:
342+
app: contour
343+
type: LoadBalancer
344+
---

‎deployment/deployment.yaml

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: code-server
5+
---
6+
apiVersion: v1
7+
kind: Service
8+
metadata:
9+
name: code-server
10+
namespace: code-server
11+
spec:
12+
ports:
13+
- port: 80
14+
name: https
15+
protocol: TCP
16+
selector:
17+
app: code-server
18+
type: ClusterIP
19+
---
20+
kind: StorageClass
21+
apiVersion: storage.k8s.io/v1
22+
metadata:
23+
name: gp2
24+
annotations:
25+
storageclass.kubernetes.io/is-default-class: "true"
26+
provisioner: kubernetes.io/aws-ebs
27+
parameters:
28+
type: gp2
29+
fsType: ext4
30+
---
31+
kind: PersistentVolumeClaim
32+
apiVersion: v1
33+
metadata:
34+
name: steves-code
35+
namespace: code-server
36+
spec:
37+
accessModes:
38+
- ReadWriteOnce
39+
resources:
40+
requests:
41+
storage: 60Gi
42+
---
43+
apiVersion: extensions/v1beta1
44+
kind: Deployment
45+
metadata:
46+
labels:
47+
app: code-server
48+
name: code-server
49+
namespace: code-server
50+
spec:
51+
selector:
52+
matchLabels:
53+
app: code-server
54+
replicas: 1
55+
template:
56+
metadata:
57+
labels:
58+
app: code-server
59+
spec:
60+
containers:
61+
- image: stevesloka/code-server
62+
imagePullPolicy: Always
63+
name: code-server
64+
command: ["/code-server"]
65+
args:
66+
- /go/src
67+
- --allow-http
68+
- -p=80
69+
- --cert=/certs/tls.crt
70+
- --cert-key=/certs/tls.key
71+
ports:
72+
- containerPort: 80
73+
name: http
74+
volumeMounts:
75+
- name: code-server-storage
76+
mountPath: /go/src
77+
- name: code-server-certs
78+
mountPath: "/certs"
79+
volumes:
80+
- name: code-server-storage
81+
persistentVolumeClaim:
82+
claimName: steves-code
83+
- name: code-server-certs
84+
secret:
85+
secretName: code-server

‎deployment/ingress.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
2+
apiVersion: certmanager.k8s.io/v1alpha1
3+
kind: Certificate
4+
metadata:
5+
name: code-server
6+
namespace: code-server
7+
spec:
8+
secretName: code-server
9+
issuerRef:
10+
name: letsencrypt-prod
11+
kind: ClusterIssuer
12+
commonName: code.example.com
13+
dnsNames:
14+
- code.example.com
15+
acme:
16+
config:
17+
- http01:
18+
ingressClass: contour
19+
domains:
20+
- code.example.com
21+
---
22+
apiVersion: contour.heptio.com/v1beta1
23+
kind: IngressRoute
24+
metadata:
25+
labels:
26+
app: code-server
27+
name: code-server
28+
namespace: code-server
29+
spec:
30+
virtualhost:
31+
fqdn: code.example.com
32+
tls:
33+
secretName: code-server
34+
routes:
35+
- match: /
36+
enableWebsockets: true
37+
services:
38+
- name: code-server
39+
port: 80

0 commit comments

Comments
 (0)
Please sign in to comment.