From ebb1d7cd2d7b27165f95bec0e584017b938c4b33 Mon Sep 17 00:00:00 2001 From: nold Date: Tue, 17 May 2022 20:16:33 +0200 Subject: [PATCH] add(ingress): apisix --- projects/core/project.yml | 7 +++ projects/core/values/apisix.yaml | 98 ++++++++++++++++++++++++++++++++ 2 files changed, 105 insertions(+) create mode 100644 projects/core/values/apisix.yaml diff --git a/projects/core/project.yml b/projects/core/project.yml index e5394290..ab7e86b5 100644 --- a/projects/core/project.yml +++ b/projects/core/project.yml @@ -55,6 +55,13 @@ apps: targetRevision: 10.19.5 syncWave: '0' +- name: apisix + existingNamespace: ingress-internal + repoURL: https://charts.apiseven.com + chart: apisix-ingress-controller + targetRevision: 0.9.2 + syncWave: '0' + - name: cilium existingNamespace: kube-system repoURL: https://helm.cilium.io diff --git a/projects/core/values/apisix.yaml b/projects/core/values/apisix.yaml new file mode 100644 index 00000000..96c170b0 --- /dev/null +++ b/projects/core/values/apisix.yaml @@ -0,0 +1,98 @@ +image: + repository: apache/apisix-ingress-controller + pullPolicy: IfNotPresent + tag: "1.4.1" + +service: + annotations: + metallb.universe.tf/address-pool: internal + port: 80 + +config: + logLevel: "info" + logOutput: "stderr" + # the TLS certificate file path. + certFile: "/etc/webhook/certs/cert.pem" + # the TLS key file path. + keyFile: "/etc/webhook/certs/key.pem" + # the HTTP Server listen address, default is ":8080" + httpListen: ":8080" + # the HTTPS Server listen address, default is ":8443" + httpsListen: ":8443" + # the controller will use the Endpoint of this Service to + # update the status information of the Ingress resource. + # The format is "namespace/svc-name" to solve the situation that + # the data plane and the controller are not deployed in the same namespace. + ingressPublishService: "" + ingressStatusAddress: [] + # enable profiling via web interfaces host:port/debug/pprof, default is true. + enableProfiling: true + # Kubernetes related configurations. + kubernetes: + # the Kubernetes configuration file path, default is "", so the in-cluster + # configuration will be used. + kubeconfig: "" + # how long should apisix-ingress-controller re-synchronizes with Kubernetes, + # default is 6h, + resyncInterval: "6h" + # namespace list that controller will watch for resources, + # by default all namespaces (represented by "*") are watched. + appNamespaces: ["*"] + # namespace_selector represent basis for selecting managed namespaces. + # the field is support since version 1.4.0 + # For example, "apisix.ingress=watching", so ingress will watching the namespaces which labels "apisix.ingress=watching" + namespaceSelector: [""] + # the election id for the controller leader campaign, + # only the leader will watch and delivery resource changes, + # other instances (as candidates) stand by. + electionId: "ingress-apisix-leader" + # The class of an Ingress object is set using the field IngressClassName in + # Kubernetes clusters version v1.18.0 or higher or the annotation + # "kubernetes.io/ingress.class" (deprecated). + ingressClass: "apisix" + # the supported ingress api group version, can be "networking/v1beta1", + # "networking/v1" (for Kubernetes version v1.19.0 or higher), and + # "extensions/v1beta1", default is "networking/v1". + ingressVersion: "networking/v1" + # whether to watch EndpointSlices rather than Endpoints. + watchEndpointSlices: false + # the supported apisixroute api group version, can be "apisix.apache.org/v2beta1" + # "apisix.apache.org/v2beta2" or "apisix.apache.org/v2beta3" + apisixRouteVersion: "apisix.apache.org/v2beta3" + # whether to enable support for Gateway API. + # Note: This feature is currently under development and may not work as expected. + # It is not recommended to use it in a production environment. + # Before we announce support for it to reach Beta level or GA. + enableGatewayAPI: false + # APISIX related configurations. + apisix: + serviceName: apisix-admin + serviceNamespace: ingress-apisix + servicePort: 9180 + adminKey: "edd1c9f034335f136f87ad84b625c8f1" + clusterName: "default" + +initContainer: + image: busybox + tag: 1.28 + +serviceMonitor: + enabled: true + namespace: "monitoring" + interval: 15s + # @param serviceMonitor.labels ServiceMonitor extra labels + labels: {} + # @param serviceMonitor.annotations ServiceMonitor annotations + annotations: {} + + +podSecurityContext: + fsGroup: 2000 + +securityContext: + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000