This is an automated email from the ASF dual-hosted git repository.
AlinsRan pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix-ingress-controller.git
The following commit(s) were added to refs/heads/master by this push:
new 061b4931 fix: make the kustomize manifests deployable and consistent
(#2835)
061b4931 is described below
commit 061b4931dfb63cc1039d6f64a05cffcaa88aa6fc
Author: AlinsRan <[email protected]>
AuthorDate: Tue Aug 11 17:08:08 2026 +0800
fix: make the kustomize manifests deployable and consistent (#2835)
---
.github/workflows/kustomize-checker.yml | 144 ++++++++++++++
config/certmanager/certificate-metrics.yaml | 20 --
config/certmanager/kustomization.yaml | 4 +-
config/crd/kustomization.yaml | 32 ++-
config/default/kustomization.yaml | 215 +++++++++------------
config/default/manager_webhook_patch.yaml | 10 +-
config/default/metrics_service.yaml | 11 +-
config/{samples => manager}/config.yaml | 0
config/manager/kustomization.yaml | 13 +-
config/manager/manager.yaml | 48 ++---
config/network-policy/allow-metrics-traffic.yaml | 31 +++
config/network-policy/kustomization.yaml | 4 +
config/prometheus/kustomization.yaml | 3 +
config/prometheus/monitor.yaml | 21 +-
config/rbac/kustomization.yaml | 9 +-
config/rbac/leader_election_role.yaml | 2 +-
config/rbac/leader_election_role_binding.yaml | 2 +-
config/rbac/role.yaml | 14 +-
config/rbac/role_binding.yaml | 2 +-
config/rbac/service_account.yaml | 2 +-
...x.apache.org_v1alpha1_backendtrafficpolicy.yaml | 20 ++
.../apisix.apache.org_v1alpha1_consumer.yaml | 5 +
.../apisix.apache.org_v1alpha1_gatewayproxy.yaml | 19 +-
...apisix.apache.org_v1alpha1_httproutepolicy.yaml | 8 +-
.../apisix.apache.org_v1alpha1_l4routepolicy.yaml | 19 ++
.../apisix.apache.org_v1alpha1_pluginconfig.yaml | 14 ++
.../apisix.apache.org_v2_apisixconsumer.yaml | 6 +-
.../apisix.apache.org_v2_apisixglobalrule.yaml | 7 +-
.../apisix.apache.org_v2_apisixpluginconfig.yaml | 9 +-
.../samples/apisix.apache.org_v2_apisixroute.yaml | 12 +-
.../apisix.apache.org_v2_apisixupstream.yaml | 10 +-
config/samples/kustomization.yaml | 25 ++-
config/webhook/kustomization.yaml | 3 +
config/webhook/service.yaml | 8 +-
34 files changed, 489 insertions(+), 263 deletions(-)
diff --git a/.github/workflows/kustomize-checker.yml
b/.github/workflows/kustomize-checker.yml
new file mode 100644
index 00000000..ba62bdad
--- /dev/null
+++ b/.github/workflows/kustomize-checker.yml
@@ -0,0 +1,144 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Kustomize Checker
+
+on:
+ push:
+ branches:
+ - master
+ pull_request:
+ branches:
+ - master
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number ||
github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ changes:
+ runs-on: ubuntu-latest
+ outputs:
+ manifests: ${{ steps.filter.outputs.manifests }}
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ submodules: recursive
+
+ - uses: ./.github/actions/paths-filter
+ id: filter
+ with:
+ token: ${{ secrets.GITHUB_TOKEN }}
+ filters: |
+ manifests:
+ - 'config/**'
+ - 'api/**'
+ - 'Makefile'
+ # The image entrypoint decides which config file the controller
+ # reads, so it is part of what makes the manifests correct.
+ - 'Dockerfile'
+ - '.github/workflows/kustomize-checker.yml'
+
+ kustomize-checker:
+ needs: changes
+ if: |
+ (needs.changes.outputs.manifests == 'true')
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+
+ - name: Setup Go Env
+ uses: actions/setup-go@v5
+ with:
+ go-version: "1.26"
+
+ - name: Install kind
+ run: |
+ go install sigs.k8s.io/[email protected]
+
+ - name: Build the installer
+ run: |
+ make build-installer
+ test -s dist/install.yaml
+
+ # The CRDs, the webhook configuration and the manager ClusterRole are all
+ # generated from the Go types by the `make build-installer` step above.
+ # `git add -N` is what makes a brand new CRD file visible here: it is
+ # untracked, and `git diff` alone does not report untracked files.
+ - name: Check generated manifests are up to date
+ run: |
+ git add -A -N config
+ if ! git diff --exit-code -- config/crd/bases
config/webhook/manifests.yaml config/rbac/role.yaml; then
+ echo "::error::generated manifests are out of date, run 'make
manifests' and commit the result"
+ exit 1
+ fi
+
+ # Every kustomization is built, not just the ones config/default pulls
in,
+ # so that a broken sub-directory is caught even while it is opt-in.
+ - name: Build every kustomization
+ run: |
+ set -o pipefail
+ for dir in $(find config -name kustomization.yaml -printf '%h\n' |
sort); do
+ echo "::group::kustomize build $dir"
+ ./bin/kustomize build "$dir" > /dev/null
+ echo "::endgroup::"
+ done
+ ./bin/kustomize build config/samples > dist/samples.yaml
+ test -s dist/samples.yaml
+
+ - name: Launch Kind Cluster
+ run: |
+ make kind-up
+
+ # `make deploy` is the install path README.md and the developer guide
tell
+ # people to run, so exercise that rather than a hand-rolled apply. The
+ # apply validates every rendered object against the API server, the CRD
+ # schemas included. It is a client-side apply, which also keeps the CRDs
+ # honest about the 262144-byte last-applied annotation limit that a
+ # server-side apply would hide.
+ - name: Deploy to the cluster
+ run: |
+ set -o pipefail
+ make deploy
+ crds=$(kubectl get crd -o name | grep 'apisix\.apache\.org$')
+ test -n "$crds"
+ echo "$crds" | xargs kubectl wait --for=condition=Established
--timeout=60s
+
+ # The samples are validated against the CRDs installed above, so a sample
+ # that misses a required field or violates a CEL rule fails here.
+ - name: Validate the samples against the installed CRDs
+ run: |
+ kubectl apply --server-side --dry-run=server -f dist/samples.yaml
+
+ # The teardown README.md documents. Deleting the cluster underneath it
+ # would not tell us whether `make undeploy` still resolves.
+ # ignore-not-found=true is the flag the target itself documents. The
+ # Namespace is the first object in the stream, so whether the namespaced
+ # objects after it still exist by the time their own delete is issued
+ # depends on how fast it finishes terminating; the flag keeps the step
+ # from turning that race into a failure.
+ - name: Undeploy from the cluster
+ run: |
+ make undeploy ignore-not-found=true
+
+ - name: Tear down Kind Cluster
+ if: always()
+ run: |
+ make kind-down
diff --git a/config/certmanager/certificate-metrics.yaml
b/config/certmanager/certificate-metrics.yaml
deleted file mode 100644
index b47c8989..00000000
--- a/config/certmanager/certificate-metrics.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# The following manifests contain a self-signed issuer CR and a metrics
certificate CR.
-# More document can be found at https://docs.cert-manager.io
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
- labels:
- app.kubernetes.io/name: apisix-ingress-controller
- app.kubernetes.io/managed-by: kustomize
- name: metrics-certs # this name should match the one appeared in
kustomizeconfig.yaml
- namespace: system
-spec:
- dnsNames:
- # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
- # replacements in the config/default/kustomization.yaml file.
- - SERVICE_NAME.SERVICE_NAMESPACE.svc
- - SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
- issuerRef:
- kind: Issuer
- name: selfsigned-issuer
- secretName: metrics-server-cert
diff --git a/config/certmanager/kustomization.yaml
b/config/certmanager/kustomization.yaml
index fcb7498e..eb73a8a7 100644
--- a/config/certmanager/kustomization.yaml
+++ b/config/certmanager/kustomization.yaml
@@ -1,7 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
resources:
- issuer.yaml
- certificate-webhook.yaml
-- certificate-metrics.yaml
configurations:
- kustomizeconfig.yaml
diff --git a/config/crd/kustomization.yaml b/config/crd/kustomization.yaml
index c2a7b3c0..48579493 100644
--- a/config/crd/kustomization.yaml
+++ b/config/crd/kustomization.yaml
@@ -1,21 +1,25 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
# This kustomization.yaml is not intended to be run by itself,
# since it depends on service name and namespace that are out of this
kustomize package.
# It should be run by config/default
resources:
-- bases/apisix.apache.org_pluginconfigs.yaml
-- bases/apisix.apache.org_gatewayproxies.yaml
-- bases/apisix.apache.org_consumers.yaml
-- bases/apisix.apache.org_backendtrafficpolicies.yaml
-- bases/apisix.apache.org_httproutepolicies.yaml
-- bases/apisix.apache.org_l4routepolicies.yaml
-- bases/apisix.apache.org_apisixroutes.yaml
- bases/apisix.apache.org_apisixconsumers.yaml
- bases/apisix.apache.org_apisixglobalrules.yaml
+- bases/apisix.apache.org_apisixpluginconfigs.yaml
+- bases/apisix.apache.org_apisixroutes.yaml
- bases/apisix.apache.org_apisixtlses.yaml
- bases/apisix.apache.org_apisixupstreams.yaml
-- bases/apisix.apache.org_apisixpluginconfigs.yaml
+- bases/apisix.apache.org_backendtrafficpolicies.yaml
+- bases/apisix.apache.org_consumers.yaml
+- bases/apisix.apache.org_gatewayproxies.yaml
+- bases/apisix.apache.org_httproutepolicies.yaml
+- bases/apisix.apache.org_l4routepolicies.yaml
+- bases/apisix.apache.org_pluginconfigs.yaml
# +kubebuilder:scaffold:crdkustomizeresource
+# Schema validations that controller-gen cannot express through markers.
patches:
- path: patches/consumer_credential_oneof.yaml
target:
@@ -29,19 +33,9 @@ patches:
name: apisixconsumers.apisix.apache.org
group: apiextensions.k8s.io
version: v1
-# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK]
prefix.
-# patches here are for enabling the conversion webhook for each CRD
-#- path: patches/webhook_in_gatewayproxies.yaml
# +kubebuilder:scaffold:crdkustomizewebhookpatch
-
-# [CERTMANAGER] To enable cert-manager, uncomment all the sections with
[CERTMANAGER] prefix.
-# patches here are for enabling the CA injection for each CRD
-#- path: patches/cainjection_in_guestbooks.yaml
-#- path: patches/cainjection_in_gatewayproxies.yaml
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
-# [WEBHOOK] To enable webhook, uncomment the following section
-# the following config is for teaching kustomize how to do kustomization for
CRDs.
-
+# Teaches kustomize how to substitute name references inside CRDs.
configurations:
- kustomizeconfig.yaml
diff --git a/config/default/kustomization.yaml
b/config/default/kustomization.yaml
index 48795b19..7d245e36 100644
--- a/config/default/kustomization.yaml
+++ b/config/default/kustomization.yaml
@@ -1,154 +1,111 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
# Adds namespace to all resources.
namespace: apisix-ingress-system
-# Value of this field is prepended to the
-# names of all resources, e.g. a deployment named
-# "wordpress" becomes "alices-wordpress".
-# Note that it should also match with the prefix (text before '-') of the
namespace
-# field above.
+# Value of this field is prepended to the names of all resources, e.g. a
+# deployment named "wordpress" becomes "alices-wordpress". It should also match
+# the prefix (text before '-') of the namespace field above.
namePrefix: apisix-ingress-
-# Labels to add to all resources and selectors.
-#labels:
-#- includeSelectors: true
-# pairs:
-# someName: someValue
-
resources:
- ../crd
- ../rbac
- ../manager
-# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK]
prefix including the one in
-# crd/kustomization.yaml
+# [WEBHOOK] To enable the admission webhook, uncomment ../webhook,
../certmanager,
+# the patches and the replacements below, and set `webhook.enable` to true in
+# config/manager/config.yaml. cert-manager (https://cert-manager.io) must be
+# installed in the cluster to issue the serving certificate.
#- ../webhook
-# [CERTMANAGER] To enable cert-manager, uncomment all sections with
'CERTMANAGER'. 'WEBHOOK' components are required.
#- ../certmanager
-# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with
'PROMETHEUS'.
-#- ../prometheus
# [METRICS] Expose the controller manager metrics service.
- metrics_service.yaml
-- ../samples
+# [PROMETHEUS] To scrape the metrics with the Prometheus Operator, uncomment
+# the following line. It requires the ServiceMonitor CRD.
+#- ../prometheus
+# [NETWORK-POLICY] To restrict traffic to the controller, uncomment the
+# following line. It only admits webhook calls from namespaces labeled
+# `webhook: enabled` and metrics scrapes from namespaces labeled
+# `metrics: enabled`; everything else reaching the pod is denied.
#- ../network-policy
-# Uncomment the patches line if you enable Metrics, and/or are using webhooks
and cert-manager
+# [WEBHOOK] Mount the serving certificate into the manager and let cert-manager
+# inject the CA bundle into the webhook configuration.
#patches:
-# [METRICS] The following patch will enable the metrics endpoint using HTTPS
and the port :8443.
-# More info: https://book.kubebuilder.io/reference/metrics
-#- path: manager_patch.yaml
-# target:
-# kind: Deployment
-
-# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK]
prefix including the one in
-# crd/kustomization.yaml
#- path: manager_webhook_patch.yaml
# target:
# kind: Deployment
# name: controller-manager
-
-# [CERTMANAGER] To enable cert-manager, uncomment all sections with
'CERTMANAGER'.
-# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA
injection in the admission webhooks.
-# 'CERTMANAGER' needs to be enabled to use ca injection
#- path: webhookcainjection_patch.yaml
# target:
# kind: ValidatingWebhookConfiguration
# name: validating-webhook-configuration
-# [CERTMANAGER] To enable cert-manager, uncomment all sections with
'CERTMANAGER' prefix.
-# Uncomment the following replacements to add the cert-manager CA injection
annotations
-# replacements:
-# - source: # Add cert-manager annotation to ValidatingWebhookConfiguration,
MutatingWebhookConfiguration and CRDs
-# kind: Certificate
-# group: cert-manager.io
-# version: v1
-# name: serving-cert # this name should match the one in certificate.yaml
-# fieldPath: .metadata.namespace # namespace of the certificate CR
-# targets:
-# - select:
-# kind: ValidatingWebhookConfiguration
-# fieldPaths:
-# - .metadata.annotations.[cert-manager.io/inject-ca-from]
-# options:
-# delimiter: '/'
-# index: 0
-# create: true
-# - select:
-# kind: MutatingWebhookConfiguration
-# fieldPaths:
-# - .metadata.annotations.[cert-manager.io/inject-ca-from]
-# options:
-# delimiter: '/'
-# index: 0
-# create: true
-# - select:
-# kind: CustomResourceDefinition
-# fieldPaths:
-# - .metadata.annotations.[cert-manager.io/inject-ca-from]
-# options:
-# delimiter: '/'
-# index: 0
-# create: true
-# - source:
-# kind: Certificate
-# group: cert-manager.io
-# version: v1
-# name: serving-cert # this name should match the one in certificate.yaml
-# fieldPath: .metadata.name
-# targets:
-# - select:
-# kind: ValidatingWebhookConfiguration
-# fieldPaths:
-# - .metadata.annotations.[cert-manager.io/inject-ca-from]
-# options:
-# delimiter: '/'
-# index: 1
-# create: true
-# - select:
-# kind: MutatingWebhookConfiguration
-# fieldPaths:
-# - .metadata.annotations.[cert-manager.io/inject-ca-from]
-# options:
-# delimiter: '/'
-# index: 1
-# create: true
-# - select:
-# kind: CustomResourceDefinition
-# fieldPaths:
-# - .metadata.annotations.[cert-manager.io/inject-ca-from]
-# options:
-# delimiter: '/'
-# index: 1
-# create: true
-# - source: # Add cert-manager annotation to the webhook Service
-# kind: Service
-# version: v1
-# name: webhook-service
-# fieldPath: .metadata.name # namespace of the service
-# targets:
-# - select:
-# kind: Certificate
-# group: cert-manager.io
-# version: v1
-# fieldPaths:
-# - .spec.dnsNames.0
-# - .spec.dnsNames.1
-# options:
-# delimiter: '.'
-# index: 0
-# create: true
-# - source:
-# kind: Service
-# version: v1
-# name: webhook-service
-# fieldPath: .metadata.namespace # namespace of the service
-# targets:
-# - select:
-# kind: Certificate
-# group: cert-manager.io
-# version: v1
-# fieldPaths:
-# - .spec.dnsNames.0
-# - .spec.dnsNames.1
-# options:
-# delimiter: '.'
-# index: 1
-# create: true
+# [WEBHOOK] Inject the cert-manager CA into the webhook configuration, and the
+# webhook Service name/namespace into the certificate's dnsNames.
+#replacements:
+#- source: # Add the cert-manager annotation to the
ValidatingWebhookConfiguration
+# kind: Certificate
+# group: cert-manager.io
+# version: v1
+# name: serving-cert # this name should match the one in
certificate-webhook.yaml
+# fieldPath: .metadata.namespace # namespace of the certificate CR
+# targets:
+# - select:
+# kind: ValidatingWebhookConfiguration
+# fieldPaths:
+# - .metadata.annotations.[cert-manager.io/inject-ca-from]
+# options:
+# delimiter: '/'
+# index: 0
+# create: true
+#- source:
+# kind: Certificate
+# group: cert-manager.io
+# version: v1
+# name: serving-cert
+# fieldPath: .metadata.name
+# targets:
+# - select:
+# kind: ValidatingWebhookConfiguration
+# fieldPaths:
+# - .metadata.annotations.[cert-manager.io/inject-ca-from]
+# options:
+# delimiter: '/'
+# index: 1
+# create: true
+#- source: # Add the webhook Service name to the certificate dnsNames
+# kind: Service
+# version: v1
+# name: webhook-service
+# fieldPath: .metadata.name
+# targets:
+# - select:
+# kind: Certificate
+# group: cert-manager.io
+# version: v1
+# fieldPaths:
+# - .spec.dnsNames.0
+# - .spec.dnsNames.1
+# options:
+# delimiter: '.'
+# index: 0
+# create: true
+#- source: # Add the webhook Service namespace to the certificate dnsNames
+# kind: Service
+# version: v1
+# name: webhook-service
+# fieldPath: .metadata.namespace
+# targets:
+# - select:
+# kind: Certificate
+# group: cert-manager.io
+# version: v1
+# fieldPaths:
+# - .spec.dnsNames.0
+# - .spec.dnsNames.1
+# options:
+# delimiter: '.'
+# index: 1
+# create: true
diff --git a/config/default/manager_webhook_patch.yaml
b/config/default/manager_webhook_patch.yaml
index 7c12cdb4..0d1cd5eb 100644
--- a/config/default/manager_webhook_patch.yaml
+++ b/config/default/manager_webhook_patch.yaml
@@ -1,5 +1,5 @@
-# This patch ensures the webhook certificates are properly mounted in the
manager container.
-# It configures the necessary arguments, volumes, volume mounts, and container
ports.
+# This patch mounts the webhook serving certificate into the manager container.
+# The mount path and the port must match the `webhook` section of config.yaml.
apiVersion: apps/v1
kind: Deployment
metadata:
@@ -10,14 +10,12 @@ spec:
spec:
containers:
- name: manager
- args:
- - --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs
ports:
- containerPort: 9443
- name: webhook-server
+ name: webhook
protocol: TCP
volumeMounts:
- - mountPath: /tmp/k8s-webhook-server/serving-certs
+ - mountPath: /certs
name: webhook-certs
readOnly: true
volumes:
diff --git a/config/default/metrics_service.yaml
b/config/default/metrics_service.yaml
index b4aea0bf..62ff0731 100644
--- a/config/default/metrics_service.yaml
+++ b/config/default/metrics_service.yaml
@@ -3,15 +3,18 @@ kind: Service
metadata:
labels:
control-plane: controller-manager
- app.kubernetes.io/name: apisix-ingress
+ app.kubernetes.io/name: apisix-ingress-controller
app.kubernetes.io/managed-by: kustomize
name: controller-manager-metrics-service
namespace: system
spec:
+ # The metrics endpoint is served over plain HTTP without authentication. Set
+ # `secure_metrics` in config/manager/config.yaml to put it behind the
authn/authz
+ # filter backed by the metrics_auth_role in config/rbac.
ports:
- - name: https
- port: 8443
+ - name: metrics
+ port: 8080
protocol: TCP
- targetPort: 8443
+ targetPort: metrics
selector:
control-plane: controller-manager
diff --git a/config/samples/config.yaml b/config/manager/config.yaml
similarity index 100%
rename from config/samples/config.yaml
rename to config/manager/config.yaml
diff --git a/config/manager/kustomization.yaml
b/config/manager/kustomization.yaml
index e8a9cbf9..d32615de 100644
--- a/config/manager/kustomization.yaml
+++ b/config/manager/kustomization.yaml
@@ -1,7 +1,16 @@
-resources:
-- manager.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
+
+resources:
+- manager.yaml
+
+# The controller reads its configuration from /app/conf/config.yaml, which is
+# mounted from this ConfigMap. See config.yaml for the documented options.
+configMapGenerator:
+- files:
+ - config.yaml
+ name: controller-config
+
images:
- name: controller
newName: apache/apisix-ingress-controller
diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
index 9d974876..6fab03d6 100644
--- a/config/manager/manager.yaml
+++ b/config/manager/manager.yaml
@@ -3,7 +3,7 @@ kind: Namespace
metadata:
labels:
control-plane: controller-manager
- app.kubernetes.io/name: apisix-ingress
+ app.kubernetes.io/name: apisix-ingress-controller
app.kubernetes.io/managed-by: kustomize
name: system
---
@@ -14,7 +14,7 @@ metadata:
namespace: system
labels:
control-plane: controller-manager
- app.kubernetes.io/name: apisix-ingress
+ app.kubernetes.io/name: apisix-ingress-controller
app.kubernetes.io/managed-by: kustomize
spec:
selector:
@@ -27,36 +27,11 @@ spec:
kubectl.kubernetes.io/default-container: manager
labels:
control-plane: controller-manager
+ app.kubernetes.io/name: apisix-ingress-controller
spec:
- # TODO(user): Uncomment the following code to configure the nodeAffinity
expression
- # according to the platforms which are supported by your solution.
- # It is considered best practice to support multiple architectures. You
can
- # build your manager image using the makefile target docker-buildx.
- # affinity:
- # nodeAffinity:
- # requiredDuringSchedulingIgnoredDuringExecution:
- # nodeSelectorTerms:
- # - matchExpressions:
- # - key: kubernetes.io/arch
- # operator: In
- # values:
- # - amd64
- # - arm64
- # - ppc64le
- # - s390x
- # - key: kubernetes.io/os
- # operator: In
- # values:
- # - linux
securityContext:
- fsGroup: 2000
- # TODO(user): For common cases that do not require escalating
privileges
- # it is recommended to ensure that all your Pods/Containers are
restrictive.
- # More info:
https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
- # Please uncomment the following code if your project does NOT have to
work on old Kubernetes
- # versions < 1.19 or on vendors versions which do NOT support this
field by default (i.e. Openshift < 4.11 ).
- # seccompProfile:
- # type: RuntimeDefault
+ # fsGroup lets both containers share the ADC Unix socket.
+ fsGroup: 2000
containers:
- image: controller:latest
name: manager
@@ -69,6 +44,13 @@ spec:
valueFrom:
fieldRef:
fieldPath: metadata.name
+ - name: ADC_SERVER_URL
+ value: unix:/sockets/adc.sock
+ ports:
+ # Must match metrics_addr in config.yaml.
+ - name: metrics
+ containerPort: 8080
+ protocol: TCP
volumeMounts:
- name: config-volume
mountPath: /app/conf/config.yaml
@@ -92,8 +74,6 @@ spec:
port: 8081
initialDelaySeconds: 5
periodSeconds: 10
- # TODO(user): Configure the resources accordingly based on the project
requirements.
- # More info:
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources:
limits:
cpu: 500m
@@ -102,14 +82,14 @@ spec:
cpu: 10m
memory: 64Mi
- image: sidecar:latest
+ name: adc-server
env:
- name: ADC_RUNNING_MODE
value: ingress
- - name: ADC_EXPERIMENTAL_FEATURE_FLAGS
+ - name: ADC_EXPERIMENTAL_FEATURE_FLAGS
value: remote-state-file,parallel-backend-request
- name: ADC_INGRESS_LOG_LEVEL
value: info
- name: adc-server
args:
- "server"
- "--listen"
diff --git a/config/network-policy/allow-metrics-traffic.yaml
b/config/network-policy/allow-metrics-traffic.yaml
new file mode 100644
index 00000000..c0e7adbf
--- /dev/null
+++ b/config/network-policy/allow-metrics-traffic.yaml
@@ -0,0 +1,31 @@
+# This NetworkPolicy allows ingress traffic to the metrics endpoint of the
+# controller-manager from namespaces labeled 'metrics: enabled'. Without it the
+# webhook policy in this directory, which only allows 9443, would also cut off
+# metrics scraping, since NetworkPolicies for a pod are additive and a pod
+# selected by any Ingress policy denies everything else.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ labels:
+ app.kubernetes.io/name: apisix-ingress-controller
+ app.kubernetes.io/managed-by: kustomize
+ name: allow-metrics-traffic
+ namespace: system
+spec:
+ podSelector:
+ matchLabels:
+ control-plane: controller-manager
+ app.kubernetes.io/name: apisix-ingress-controller
+ policyTypes:
+ - Ingress
+ ingress:
+ # This allows ingress traffic from any namespace with the label metrics:
enabled
+ - from:
+ - namespaceSelector:
+ matchLabels:
+ metrics: enabled # Only from namespaces with this label
+ ports:
+ # Match the metrics containerPort; NetworkPolicy evaluates the pod's
+ # destination port (post-Service DNAT), not the Service port.
+ - port: 8080
+ protocol: TCP
diff --git a/config/network-policy/kustomization.yaml
b/config/network-policy/kustomization.yaml
index a67bd684..f3a58620 100644
--- a/config/network-policy/kustomization.yaml
+++ b/config/network-policy/kustomization.yaml
@@ -1,2 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
resources:
+- allow-metrics-traffic.yaml
- allow-webhook-traffic.yaml
diff --git a/config/prometheus/kustomization.yaml
b/config/prometheus/kustomization.yaml
index ed137168..ead3cec4 100644
--- a/config/prometheus/kustomization.yaml
+++ b/config/prometheus/kustomization.yaml
@@ -1,2 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
resources:
- monitor.yaml
diff --git a/config/prometheus/monitor.yaml b/config/prometheus/monitor.yaml
index 8a1cad4c..552727fc 100644
--- a/config/prometheus/monitor.yaml
+++ b/config/prometheus/monitor.yaml
@@ -4,27 +4,18 @@ kind: ServiceMonitor
metadata:
labels:
control-plane: controller-manager
- app.kubernetes.io/name: apisix-ingress
+ app.kubernetes.io/name: apisix-ingress-controller
app.kubernetes.io/managed-by: kustomize
name: controller-manager-metrics-monitor
namespace: system
spec:
endpoints:
+ # The metrics endpoint is served over plain HTTP by default. When
+ # `secure_metrics` is enabled in config/manager/config.yaml, switch the
+ # scheme to https, add the bearer token file and configure tlsConfig.
- path: /metrics
- port: https # Ensure this is the name of the port that exposes HTTPS
metrics
- scheme: https
- bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
- tlsConfig:
- # TODO(user): The option insecureSkipVerify: true is not recommended
for production since it disables
- # certificate verification. This poses a significant security risk by
making the system vulnerable to
- # man-in-the-middle attacks, where an attacker could intercept and
manipulate the communication between
- # Prometheus and the monitored services. This could lead to
unauthorized access to sensitive metrics data,
- # compromising the integrity and confidentiality of the information.
- # Please use the following options for secure configurations:
- # caFile: /etc/metrics-certs/ca.crt
- # certFile: /etc/metrics-certs/tls.crt
- # keyFile: /etc/metrics-certs/tls.key
- insecureSkipVerify: true
+ port: metrics
+ scheme: http
selector:
matchLabels:
control-plane: controller-manager
diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml
index 5619aa00..5c5dd650 100644
--- a/config/rbac/kustomization.yaml
+++ b/config/rbac/kustomization.yaml
@@ -1,3 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
resources:
# All RBAC will be applied under this service account in
# the deployment namespace. You may comment out this resource
@@ -10,10 +13,8 @@ resources:
- leader_election_role.yaml
- leader_election_role_binding.yaml
# The following RBAC configurations are used to protect
-# the metrics endpoint with authn/authz. These configurations
-# ensure that only authorized users and service accounts
-# can access the metrics endpoint. Comment the following
-# permissions if you want to disable this protection.
+# the metrics endpoint with authn/authz. They only take effect when
+# `secure_metrics` is enabled in config/manager/config.yaml.
# More info: https://book.kubebuilder.io/reference/metrics.html
- metrics_auth_role.yaml
- metrics_auth_role_binding.yaml
diff --git a/config/rbac/leader_election_role.yaml
b/config/rbac/leader_election_role.yaml
index 5c2240b0..c2e07057 100644
--- a/config/rbac/leader_election_role.yaml
+++ b/config/rbac/leader_election_role.yaml
@@ -3,7 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
- app.kubernetes.io/name: apisix-ingress
+ app.kubernetes.io/name: apisix-ingress-controller
app.kubernetes.io/managed-by: kustomize
name: leader-election-role
rules:
diff --git a/config/rbac/leader_election_role_binding.yaml
b/config/rbac/leader_election_role_binding.yaml
index 25d3e8b0..8e71b396 100644
--- a/config/rbac/leader_election_role_binding.yaml
+++ b/config/rbac/leader_election_role_binding.yaml
@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
- app.kubernetes.io/name: apisix-ingress
+ app.kubernetes.io/name: apisix-ingress-controller
app.kubernetes.io/managed-by: kustomize
name: leader-election-rolebinding
roleRef:
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index bc0f3908..86b93cc3 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -4,13 +4,6 @@ kind: ClusterRole
metadata:
name: apisix-ingress-manager-role
rules:
-- apiGroups:
- - ""
- resources:
- - events
- verbs:
- - create
- - patch
- apiGroups:
- ""
resources:
@@ -23,6 +16,13 @@ rules:
- get
- list
- watch
+- apiGroups:
+ - ""
+ resources:
+ - events
+ verbs:
+ - create
+ - patch
- apiGroups:
- apisix.apache.org
resources:
diff --git a/config/rbac/role_binding.yaml b/config/rbac/role_binding.yaml
index 8dd86bc0..3f381ebb 100644
--- a/config/rbac/role_binding.yaml
+++ b/config/rbac/role_binding.yaml
@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
- app.kubernetes.io/name: apisix-ingress
+ app.kubernetes.io/name: apisix-ingress-controller
app.kubernetes.io/managed-by: kustomize
name: manager-rolebinding
roleRef:
diff --git a/config/rbac/service_account.yaml b/config/rbac/service_account.yaml
index 655fe04c..a801a54f 100644
--- a/config/rbac/service_account.yaml
+++ b/config/rbac/service_account.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
kind: ServiceAccount
metadata:
labels:
- app.kubernetes.io/name: apisix-ingress
+ app.kubernetes.io/name: apisix-ingress-controller
app.kubernetes.io/managed-by: kustomize
name: controller-manager
namespace: system
diff --git
a/config/samples/apisix.apache.org_v1alpha1_backendtrafficpolicy.yaml
b/config/samples/apisix.apache.org_v1alpha1_backendtrafficpolicy.yaml
new file mode 100644
index 00000000..4aa5a988
--- /dev/null
+++ b/config/samples/apisix.apache.org_v1alpha1_backendtrafficpolicy.yaml
@@ -0,0 +1,20 @@
+apiVersion: apisix.apache.org/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+ labels:
+ app.kubernetes.io/name: apisix-ingress-controller
+ app.kubernetes.io/managed-by: kustomize
+ name: backendtrafficpolicy-sample
+spec:
+ targetRefs:
+ - group: ""
+ kind: Service
+ name: httpbin
+ scheme: http
+ retries: 2
+ loadbalancer:
+ type: roundrobin
+ timeout:
+ connect: 5s
+ read: 10s
+ send: 10s
diff --git a/config/samples/apisix.apache.org_v1alpha1_consumer.yaml
b/config/samples/apisix.apache.org_v1alpha1_consumer.yaml
index 15448cb7..3dd9c5e9 100644
--- a/config/samples/apisix.apache.org_v1alpha1_consumer.yaml
+++ b/config/samples/apisix.apache.org_v1alpha1_consumer.yaml
@@ -1,8 +1,13 @@
apiVersion: apisix.apache.org/v1alpha1
kind: Consumer
metadata:
+ labels:
+ app.kubernetes.io/name: apisix-ingress-controller
+ app.kubernetes.io/managed-by: kustomize
name: consumer-sample
spec:
+ gatewayRef:
+ name: apisix
credentials:
- type: basic-auth
name: basic-auth-sample
diff --git a/config/samples/apisix.apache.org_v1alpha1_gatewayproxy.yaml
b/config/samples/apisix.apache.org_v1alpha1_gatewayproxy.yaml
index 19d7c858..792aa328 100644
--- a/config/samples/apisix.apache.org_v1alpha1_gatewayproxy.yaml
+++ b/config/samples/apisix.apache.org_v1alpha1_gatewayproxy.yaml
@@ -2,12 +2,21 @@ apiVersion: apisix.apache.org/v1alpha1
kind: GatewayProxy
metadata:
labels:
- app.kubernetes.io/name: gatewayproxy
- app.kubernetes.io/instance: gatewayproxy-sample
- app.kubernetes.io/part-of: apisix-ingress-controller
+ app.kubernetes.io/name: apisix-ingress-controller
app.kubernetes.io/managed-by: kustomize
- app.kubernetes.io/created-by: apisix-ingress-controller
name: gatewayproxy-sample
spec:
+ provider:
+ type: ControlPlane
+ controlPlane:
+ endpoints:
+ - http://apisix-admin.default.svc.cluster.local:9180
+ auth:
+ type: AdminKey
+ adminKey:
+ valueFrom:
+ secretKeyRef:
+ name: apisix-admin-key
+ key: admin-key
pluginMetadata:
- "error-page": {"enable":false}
+ "http-logger": {"log_format":{"host":"$host","client_ip":"$remote_addr"}}
diff --git a/config/samples/apisix.apache.org_v1alpha1_httproutepolicy.yaml
b/config/samples/apisix.apache.org_v1alpha1_httproutepolicy.yaml
index b47f40de..1778445b 100644
--- a/config/samples/apisix.apache.org_v1alpha1_httproutepolicy.yaml
+++ b/config/samples/apisix.apache.org_v1alpha1_httproutepolicy.yaml
@@ -6,4 +6,10 @@ metadata:
app.kubernetes.io/managed-by: kustomize
name: httproutepolicy-sample
spec:
- # TODO(user): Add fields here
+ targetRefs:
+ - group: gateway.networking.k8s.io
+ kind: HTTPRoute
+ name: httpbin
+ priority: 100
+ vars:
+ - ["http_x_route_name", "==", "httpbin"]
diff --git a/config/samples/apisix.apache.org_v1alpha1_l4routepolicy.yaml
b/config/samples/apisix.apache.org_v1alpha1_l4routepolicy.yaml
new file mode 100644
index 00000000..258c7033
--- /dev/null
+++ b/config/samples/apisix.apache.org_v1alpha1_l4routepolicy.yaml
@@ -0,0 +1,19 @@
+apiVersion: apisix.apache.org/v1alpha1
+kind: L4RoutePolicy
+metadata:
+ labels:
+ app.kubernetes.io/name: apisix-ingress-controller
+ app.kubernetes.io/managed-by: kustomize
+ name: l4routepolicy-sample
+spec:
+ targetRefs:
+ - group: gateway.networking.k8s.io
+ kind: TCPRoute
+ name: tcp-app
+ plugins:
+ - name: limit-conn
+ config:
+ conn: 100
+ burst: 50
+ default_conn_delay: 0.1
+ key: remote_addr
diff --git a/config/samples/apisix.apache.org_v1alpha1_pluginconfig.yaml
b/config/samples/apisix.apache.org_v1alpha1_pluginconfig.yaml
new file mode 100644
index 00000000..0e523559
--- /dev/null
+++ b/config/samples/apisix.apache.org_v1alpha1_pluginconfig.yaml
@@ -0,0 +1,14 @@
+apiVersion: apisix.apache.org/v1alpha1
+kind: PluginConfig
+metadata:
+ labels:
+ app.kubernetes.io/name: apisix-ingress-controller
+ app.kubernetes.io/managed-by: kustomize
+ name: pluginconfig-sample
+spec:
+ plugins:
+ - name: response-rewrite
+ config:
+ headers:
+ set:
+ X-Sample: apisix-ingress-controller
diff --git a/config/samples/apisix.apache.org_v2_apisixconsumer.yaml
b/config/samples/apisix.apache.org_v2_apisixconsumer.yaml
index b727f195..7362fce9 100644
--- a/config/samples/apisix.apache.org_v2_apisixconsumer.yaml
+++ b/config/samples/apisix.apache.org_v2_apisixconsumer.yaml
@@ -6,4 +6,8 @@ metadata:
app.kubernetes.io/managed-by: kustomize
name: apisixconsumer-sample
spec:
- # TODO(user): Add fields here
+ ingressClassName: apisix
+ authParameter:
+ keyAuth:
+ value:
+ key: sample-key
diff --git a/config/samples/apisix.apache.org_v2_apisixglobalrule.yaml
b/config/samples/apisix.apache.org_v2_apisixglobalrule.yaml
index 3714bd00..6243e0ae 100644
--- a/config/samples/apisix.apache.org_v2_apisixglobalrule.yaml
+++ b/config/samples/apisix.apache.org_v2_apisixglobalrule.yaml
@@ -6,4 +6,9 @@ metadata:
app.kubernetes.io/managed-by: kustomize
name: apisixglobalrule-sample
spec:
- # TODO(user): Add fields here
+ ingressClassName: apisix
+ plugins:
+ - name: prometheus
+ enable: true
+ config:
+ prefer_name: true
diff --git a/config/samples/apisix.apache.org_v2_apisixpluginconfig.yaml
b/config/samples/apisix.apache.org_v2_apisixpluginconfig.yaml
index 25678714..2887b947 100644
--- a/config/samples/apisix.apache.org_v2_apisixpluginconfig.yaml
+++ b/config/samples/apisix.apache.org_v2_apisixpluginconfig.yaml
@@ -6,4 +6,11 @@ metadata:
app.kubernetes.io/managed-by: kustomize
name: apisixpluginconfig-sample
spec:
- # TODO(user): Add fields here
+ ingressClassName: apisix
+ plugins:
+ - name: response-rewrite
+ enable: true
+ config:
+ headers:
+ set:
+ X-Sample: apisix-ingress-controller
diff --git a/config/samples/apisix.apache.org_v2_apisixroute.yaml
b/config/samples/apisix.apache.org_v2_apisixroute.yaml
index c38ac626..199125e0 100644
--- a/config/samples/apisix.apache.org_v2_apisixroute.yaml
+++ b/config/samples/apisix.apache.org_v2_apisixroute.yaml
@@ -6,4 +6,14 @@ metadata:
app.kubernetes.io/managed-by: kustomize
name: apisixroute-sample
spec:
- # TODO(user): Add fields here
+ ingressClassName: apisix
+ http:
+ - name: rule-sample
+ match:
+ hosts:
+ - httpbin.example.com
+ paths:
+ - /get
+ backends:
+ - serviceName: httpbin
+ servicePort: 80
diff --git a/config/samples/apisix.apache.org_v2_apisixupstream.yaml
b/config/samples/apisix.apache.org_v2_apisixupstream.yaml
index c28664a3..f117cc4e 100644
--- a/config/samples/apisix.apache.org_v2_apisixupstream.yaml
+++ b/config/samples/apisix.apache.org_v2_apisixupstream.yaml
@@ -6,4 +6,12 @@ metadata:
app.kubernetes.io/managed-by: kustomize
name: apisixupstream-sample
spec:
- # TODO(user): Add fields here
+ ingressClassName: apisix
+ scheme: http
+ retries: 2
+ loadbalancer:
+ type: roundrobin
+ timeout:
+ connect: 5s
+ read: 10s
+ send: 10s
diff --git a/config/samples/kustomization.yaml
b/config/samples/kustomization.yaml
index ed76be84..02b9fe41 100644
--- a/config/samples/kustomization.yaml
+++ b/config/samples/kustomization.yaml
@@ -1,5 +1,20 @@
-## Append samples of your project ##
-configMapGenerator:
- - name: controller-config
- files:
- - config.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+## Sample custom resources of this project.
+## They are not part of the deployment; apply them with
+## kubectl apply -k config/samples
+resources:
+- apisix.apache.org_v1alpha1_backendtrafficpolicy.yaml
+- apisix.apache.org_v1alpha1_consumer.yaml
+- apisix.apache.org_v1alpha1_gatewayproxy.yaml
+- apisix.apache.org_v1alpha1_httproutepolicy.yaml
+- apisix.apache.org_v1alpha1_l4routepolicy.yaml
+- apisix.apache.org_v1alpha1_pluginconfig.yaml
+- apisix.apache.org_v2_apisixconsumer.yaml
+- apisix.apache.org_v2_apisixglobalrule.yaml
+- apisix.apache.org_v2_apisixpluginconfig.yaml
+- apisix.apache.org_v2_apisixroute.yaml
+- apisix.apache.org_v2_apisixtls.yaml
+- apisix.apache.org_v2_apisixupstream.yaml
+# +kubebuilder:scaffold:manifestskustomizesamples
diff --git a/config/webhook/kustomization.yaml
b/config/webhook/kustomization.yaml
index 9cf26134..003c870a 100644
--- a/config/webhook/kustomization.yaml
+++ b/config/webhook/kustomization.yaml
@@ -1,3 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
resources:
- manifests.yaml
- service.yaml
diff --git a/config/webhook/service.yaml b/config/webhook/service.yaml
index 1f0b7c34..55759fb5 100644
--- a/config/webhook/service.yaml
+++ b/config/webhook/service.yaml
@@ -7,10 +7,14 @@ metadata:
name: webhook-service
namespace: system
spec:
+ # targetPort resolves against the `webhook` container port that
+ # config/default/manager_webhook_patch.yaml adds. Pulling this directory in
+ # without that patch renders fine but leaves the Service without endpoints.
ports:
- - port: 443
+ - name: webhook
+ port: 443
protocol: TCP
- targetPort: 9443
+ targetPort: webhook
selector:
control-plane: controller-manager
app.kubernetes.io/name: apisix-ingress-controller
