Skip to content

Commit 4ca2d23

Browse files
lingdielingdie
authored
feat: helm charts support installing gateway in daemonset mod. (#1054)
1 parent 0ce52de commit 4ca2d23

File tree

3 files changed

+335
-1
lines changed

3 files changed

+335
-1
lines changed

‎helm/core/templates/daemonset.yaml

+329
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,329 @@
1+
{{- if eq .Values.gateway.kind "DaemonSet" -}}
2+
{{- $o11y := .Values.global.o11y }}
3+
{{- $unprivilegedPortSupported := true }}
4+
{{- range $index, $node := (lookup "v1" "Node" "default" "").items }}
5+
{{- $kernelVersion := $node.status.nodeInfo.kernelVersion }}
6+
{{- if $kernelVersion }}
7+
{{- $kernelVersion = regexFind "^(\\d+\\.\\d+\\.\\d+)" $kernelVersion }}
8+
{{- if and $kernelVersion (semverCompare "<4.11.0" $kernelVersion) }}
9+
{{- $unprivilegedPortSupported = false }}
10+
{{- end }}
11+
{{- end }}
12+
{{- end -}}
13+
apiVersion: apps/v1
14+
kind: DaemonSet
15+
metadata:
16+
name: {{ include "gateway.name" . }}
17+
namespace: {{ .Release.Namespace }}
18+
labels:
19+
{{- include "gateway.labels" . | nindent 4}}
20+
annotations:
21+
{{- .Values.gateway.annotations | toYaml | nindent 4 }}
22+
spec:
23+
selector:
24+
matchLabels:
25+
{{- include "gateway.selectorLabels" . | nindent 6 }}
26+
template:
27+
metadata:
28+
annotations:
29+
{{- if .Values.global.enableHigressIstio }}
30+
"enableHigressIstio": "true"
31+
{{- end }}
32+
{{- if .Values.gateway.podAnnotations }}
33+
{{- toYaml .Values.gateway.podAnnotations | nindent 8 }}
34+
{{- end }}
35+
labels:
36+
sidecar.istio.io/inject: "false"
37+
{{- with .Values.gateway.revision }}
38+
istio.io/rev: {{ . }}
39+
{{- end }}
40+
{{- include "gateway.selectorLabels" . | nindent 8 }}
41+
spec:
42+
{{- with .Values.gateway.imagePullSecrets }}
43+
imagePullSecrets:
44+
{{- toYaml . | nindent 8 }}
45+
{{- end }}
46+
serviceAccountName: {{ include "gateway.serviceAccountName" . }}
47+
securityContext:
48+
{{- if .Values.gateway.securityContext }}
49+
{{- toYaml .Values.gateway.securityContext | nindent 8 }}
50+
{{- else if and $unprivilegedPortSupported (and (not .Values.gateway.hostNetwork) (semverCompare ">=1.22-0" .Capabilities.KubeVersion.GitVersion)) }}
51+
# Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
52+
sysctls:
53+
- name: net.ipv4.ip_unprivileged_port_start
54+
value: "0"
55+
{{- end }}
56+
containers:
57+
{{- if $o11y.enabled }}
58+
{{- $config := $o11y.promtail }}
59+
- name: promtail
60+
image: {{ $config.image.repository }}:{{ $config.image.tag }}
61+
imagePullPolicy: IfNotPresent
62+
args:
63+
- -config.file=/etc/promtail/promtail.yaml
64+
env:
65+
- name: 'HOSTNAME'
66+
valueFrom:
67+
fieldRef:
68+
fieldPath: 'spec.nodeName'
69+
ports:
70+
- containerPort: {{ $config.port }}
71+
name: http-metrics
72+
protocol: TCP
73+
readinessProbe:
74+
failureThreshold: 3
75+
httpGet:
76+
path: /ready
77+
port: {{ $config.port }}
78+
scheme: HTTP
79+
initialDelaySeconds: 10
80+
periodSeconds: 10
81+
successThreshold: 1
82+
timeoutSeconds: 1
83+
volumeMounts:
84+
- name: promtail-config
85+
mountPath: "/etc/promtail"
86+
- name: log
87+
mountPath: /var/log/proxy
88+
- name: tmp
89+
mountPath: /tmp
90+
{{- end }}
91+
- name: higress-gateway
92+
image: "{{ .Values.gateway.hub | default .Values.global.hub }}/{{ .Values.gateway.image | default "gateway" }}:{{ .Values.gateway.tag | default .Chart.AppVersion }}"
93+
args:
94+
- proxy
95+
- router
96+
- --domain
97+
- $(POD_NAMESPACE).svc.cluster.local
98+
- --proxyLogLevel=warning
99+
- --proxyComponentLogLevel=misc:error
100+
- --log_output_level=all:info
101+
- --serviceCluster=higress-gateway
102+
securityContext:
103+
{{- if .Values.gateway.containerSecurityContext }}
104+
{{- toYaml .Values.gateway.containerSecurityContext | nindent 12 }}
105+
{{- else if and $unprivilegedPortSupported (and (not .Values.gateway.hostNetwork) (semverCompare ">=1.22-0" .Capabilities.KubeVersion.GitVersion)) }}
106+
# Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
107+
capabilities:
108+
drop:
109+
- ALL
110+
allowPrivilegeEscalation: false
111+
privileged: false
112+
# When enabling lite metrics, the configuration template files need to be replaced.
113+
{{- if not .Values.global.liteMetrics }}
114+
readOnlyRootFilesystem: true
115+
{{- end }}
116+
runAsUser: 1337
117+
runAsGroup: 1337
118+
runAsNonRoot: true
119+
{{- else }}
120+
capabilities:
121+
drop:
122+
- ALL
123+
add:
124+
- NET_BIND_SERVICE
125+
runAsUser: 0
126+
runAsGroup: 1337
127+
runAsNonRoot: false
128+
allowPrivilegeEscalation: true
129+
{{- end }}
130+
env:
131+
- name: NODE_NAME
132+
valueFrom:
133+
fieldRef:
134+
apiVersion: v1
135+
fieldPath: spec.nodeName
136+
- name: POD_NAME
137+
valueFrom:
138+
fieldRef:
139+
apiVersion: v1
140+
fieldPath: metadata.name
141+
- name: POD_NAMESPACE
142+
valueFrom:
143+
fieldRef:
144+
apiVersion: v1
145+
fieldPath: metadata.namespace
146+
- name: INSTANCE_IP
147+
valueFrom:
148+
fieldRef:
149+
apiVersion: v1
150+
fieldPath: status.podIP
151+
- name: HOST_IP
152+
valueFrom:
153+
fieldRef:
154+
apiVersion: v1
155+
fieldPath: status.hostIP
156+
- name: SERVICE_ACCOUNT
157+
valueFrom:
158+
fieldRef:
159+
fieldPath: spec.serviceAccountName
160+
- name: PILOT_XDS_SEND_TIMEOUT
161+
value: 60s
162+
- name: PROXY_XDS_VIA_AGENT
163+
value: "true"
164+
- name: ENABLE_INGRESS_GATEWAY_SDS
165+
value: "false"
166+
- name: JWT_POLICY
167+
value: {{ include "controller.jwtPolicy" . }}
168+
- name: ISTIO_META_HTTP10
169+
value: "1"
170+
- name: ISTIO_META_CLUSTER_ID
171+
value: "{{ $.Values.clusterName | default `Kubernetes` }}"
172+
- name: INSTANCE_NAME
173+
value: "higress-gateway"
174+
{{- if .Values.global.liteMetrics }}
175+
- name: LITE_METRICS
176+
value: "on"
177+
{{- end }}
178+
{{- if include "skywalking.enabled" . }}
179+
- name: ISTIO_BOOTSTRAP_OVERRIDE
180+
value: /etc/istio/custom-bootstrap/custom_bootstrap.json
181+
{{- end }}
182+
{{- with .Values.gateway.networkGateway }}
183+
- name: ISTIO_META_REQUESTED_NETWORK_VIEW
184+
value: "{{.}}"
185+
{{- end }}
186+
{{- range $key, $val := .Values.env }}
187+
- name: {{ $key }}
188+
value: {{ $val | quote }}
189+
{{- end }}
190+
ports:
191+
- containerPort: 15090
192+
protocol: TCP
193+
name: http-envoy-prom
194+
{{- if or .Values.global.local .Values.global.kind }}
195+
- containerPort: {{ .Values.gateway.httpPort }}
196+
hostPort: {{ .Values.gateway.httpPort }}
197+
name: http
198+
protocol: TCP
199+
- containerPort: {{ .Values.gateway.httpsPort }}
200+
hostPort: {{ .Values.gateway.httpsPort }}
201+
name: https
202+
protocol: TCP
203+
{{- end }}
204+
readinessProbe:
205+
failureThreshold: {{ .Values.gateway.readinessFailureThreshold }}
206+
httpGet:
207+
path: /healthz/ready
208+
port: 15021
209+
scheme: HTTP
210+
initialDelaySeconds: {{ .Values.gateway.readinessInitialDelaySeconds }}
211+
periodSeconds: {{ .Values.gateway.readinessPeriodSeconds }}
212+
successThreshold: {{ .Values.gateway.readinessSuccessThreshold }}
213+
timeoutSeconds: {{ .Values.gateway.readinessTimeoutSeconds }}
214+
{{- if not (or .Values.global.local .Values.global.kind) }}
215+
resources:
216+
{{- toYaml .Values.gateway.resources | nindent 12 }}
217+
{{- end }}
218+
volumeMounts:
219+
{{- if eq (include "controller.jwtPolicy" .) "third-party-jwt" }}
220+
- name: istio-token
221+
mountPath: /var/run/secrets/tokens
222+
readOnly: true
223+
{{- end }}
224+
- name: config
225+
mountPath: /etc/istio/config
226+
- name: istio-ca-root-cert
227+
mountPath: /var/run/secrets/istio
228+
- name: istio-data
229+
mountPath: /var/lib/istio/data
230+
- name: podinfo
231+
mountPath: /etc/istio/pod
232+
- name: proxy-socket
233+
mountPath: /etc/istio/proxy
234+
{{- if include "skywalking.enabled" . }}
235+
- mountPath: /etc/istio/custom-bootstrap
236+
name: custom-bootstrap-volume
237+
{{- end }}
238+
{{- if .Values.global.volumeWasmPlugins }}
239+
- mountPath: /opt/plugins
240+
name: local-wasmplugins-volume
241+
{{- end }}
242+
{{- if $o11y.enabled }}
243+
- mountPath: /var/log/proxy
244+
name: log
245+
{{- end }}
246+
{{- if .Values.gateway.hostNetwork }}
247+
hostNetwork: {{ .Values.gateway.hostNetwork }}
248+
dnsPolicy: ClusterFirstWithHostNet
249+
{{- end }}
250+
{{- with .Values.gateway.nodeSelector }}
251+
nodeSelector:
252+
{{- toYaml . | nindent 8 }}
253+
{{- end }}
254+
{{- with .Values.gateway.affinity }}
255+
affinity:
256+
{{- toYaml . | nindent 8 }}
257+
{{- end }}
258+
{{- with .Values.gateway.tolerations }}
259+
tolerations:
260+
{{- toYaml . | nindent 8 }}
261+
{{- end }}
262+
volumes:
263+
{{- if eq (include "controller.jwtPolicy" .) "third-party-jwt" }}
264+
- name: istio-token
265+
projected:
266+
sources:
267+
- serviceAccountToken:
268+
audience: istio-ca
269+
expirationSeconds: 43200
270+
path: istio-token
271+
{{- end }}
272+
- name: istio-ca-root-cert
273+
configMap:
274+
{{- if .Values.global.enableHigressIstio }}
275+
name: istio-ca-root-cert
276+
{{- else }}
277+
name: higress-ca-root-cert
278+
{{- end }}
279+
- name: config
280+
configMap:
281+
name: higress-config
282+
{{- if include "skywalking.enabled" . }}
283+
- configMap:
284+
defaultMode: 420
285+
name: higress-custom-bootstrap
286+
name: custom-bootstrap-volume
287+
{{- end }}
288+
- name: istio-data
289+
emptyDir: {}
290+
- name: proxy-socket
291+
emptyDir: {}
292+
{{- if $o11y.enabled }}
293+
- name: log
294+
emptyDir: {}
295+
- name: tmp
296+
emptyDir: {}
297+
- name: promtail-config
298+
configMap:
299+
name: higress-promtail
300+
{{- end }}
301+
- name: podinfo
302+
downwardAPI:
303+
defaultMode: 420
304+
items:
305+
- fieldRef:
306+
apiVersion: v1
307+
fieldPath: metadata.labels
308+
path: labels
309+
- fieldRef:
310+
apiVersion: v1
311+
fieldPath: metadata.annotations
312+
path: annotations
313+
- path: cpu-request
314+
resourceFieldRef:
315+
containerName: higress-gateway
316+
divisor: 1m
317+
resource: requests.cpu
318+
- path: cpu-limit
319+
resourceFieldRef:
320+
containerName: higress-gateway
321+
divisor: 1m
322+
resource: limits.cpu
323+
{{- if .Values.global.volumeWasmPlugins }}
324+
- name: local-wasmplugins-volume
325+
hostPath:
326+
path: /opt/plugins
327+
type: Directory
328+
{{- end }}
329+
{{- end }}

‎helm/core/templates/deployment.yaml

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{- if eq .Values.gateway.kind "Deployment" -}}
12
{{- $o11y := .Values.global.o11y }}
23
{{- $unprivilegedPortSupported := true }}
34
{{- range $index, $node := (lookup "v1" "Node" "default" "").items }}
@@ -241,7 +242,7 @@ spec:
241242
mountPath: /var/run/secrets/istio
242243
- name: istio-data
243244
mountPath: /var/lib/istio/data
244-
- name: podinfo
245+
- name: podinfo
245246
mountPath: /etc/istio/pod
246247
- name: proxy-socket
247248
mountPath: /etc/istio/proxy
@@ -340,3 +341,4 @@ spec:
340341
path: /opt/plugins
341342
type: Directory
342343
{{- end }}
344+
{{- end }}

‎helm/core/values.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -396,6 +396,9 @@ gateway:
396396
replicas: 2
397397
image: gateway
398398

399+
# -- Use a `DaemonSet` or `Deployment`
400+
kind: Deployment
401+
399402
# The number of successive failed probes before indicating readiness failure.
400403
readinessFailureThreshold: 30
401404

0 commit comments

Comments
 (0)