Allow config ingress gateway (#2434)

* update ingress reconciler to watch the configmap

* remove knative-ingressgateway usage

* add docs to tell how to set up gateway

* indent columns

* sync pkg

Gopkg.toml

@@ -23,8 +23,8 @@ required = [
 
 [[override]]
   name = "github.com/knative/pkg"
-  # HEAD as of 2018-11-21
-  revision = "acfd173abd8d2063ddceedb3487599f97ac93db8"
+  # HEAD as of 2018-11-28
+  revision = "9a644df00f19da719379ca936c1949f56d8c3eb5"
 
 [[override]]
   name = "go.uber.org/zap"

config/202-gateway.yaml

@@ -1,26 +1,36 @@
-# We stand up a new Gateway service to receive all external traffic
-# for Knative pods.  These pods are basically standalone Envoy proxy
-# pods to convert all external traffic into cluster traffic.
+# Copyright 2018 The Knative Authors
 #
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
 #
-# The reason for standing up these pods are because Istio Gateway
-# cannot not share these ingress pods.  Istio provide a default, but
-# we don't want to use it and causing unwanted sharing with users'
-# Gateways if they have some.
+#     https://www.apache.org/licenses/LICENSE-2.0
 #
-# The YAML is cloned from Istio's.  However, in the future we may want
-# to incorporate more of our logic to tailor to our users' specific
-# needs.
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# The Gateway resource here is to attach to a gateway service that
+# receive all external traffic for Knative pods. We don't maintain
+# extra Gateway service and deployment in knative, but use that
+# provided in Istio by default.
+
+# If you want to replace the Gateway service and deployment to that
+# of your own, you'll need to update the label selector and ports
+# fields accordingly.
 
 # This is the shared Gateway for all Knative routes to use.
+
 apiVersion: networking.istio.io/v1alpha3
 kind: Gateway
 metadata:
   name: knative-shared-gateway
   namespace: knative-serving
 spec:
   selector:
-    knative: ingressgateway
+    istio: ingressgateway
   servers:
   - port:
       number: 80
@@ -36,231 +46,3 @@ spec:
     - "*"
     tls:
       mode: PASSTHROUGH
----
-# TODO(#1969): We should allow the users to use `istio-ingressgateway` by default,
-#              while having the choice to specify their own Ingress Gateway service
-#              if that isn't enough for them.  That way we can get out of maintaining
-#              these YAML ourselves.
-#
-# This is the Service definition for the ingress pods serving
-# Knative's shared Gateway.
-apiVersion: v1
-kind: Service
-metadata:
-  name: knative-ingressgateway
-  namespace: istio-system
-  annotations:
-  labels:
-    chart: gateways-1.0.1
-    release: RELEASE-NAME
-    heritage: Tiller
-    app: knative-ingressgateway
-    knative: ingressgateway
-spec:
-  type: LoadBalancer
-  selector:
-    app: knative-ingressgateway
-    knative: ingressgateway
-  ports:
-    -
-      name: http2
-      nodePort: 32380
-      port: 80
-      targetPort: 80
-    -
-      name: https
-      nodePort: 32390
-      port: 443
-    -
-      name: tcp
-      nodePort: 32400
-      port: 31400
-    -
-      name: tcp-pilot-grpc-tls
-      port: 15011
-      targetPort: 15011
-    -
-      name: tcp-citadel-grpc-tls
-      port: 8060
-      targetPort: 8060
-    -
-      name: tcp-dns-tls
-      port: 853
-      targetPort: 853
-    -
-      name: http2-prometheus
-      port: 15030
-      targetPort: 15030
-    -
-      name: http2-grafana
-      port: 15031
-      targetPort: 15031
----
-# This is the corresponding Deployment to backed the aforementioned Service.
-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  name: knative-ingressgateway
-  namespace: istio-system
-  labels:
-    chart: gateways-1.0.1
-    release: RELEASE-NAME
-    heritage: Tiller
-    app: knative-ingressgateway
-    knative: ingressgateway
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: knative-ingressgateway
-      knative: ingressgateway
-  template:
-    metadata:
-      labels:
-        app: knative-ingressgateway
-        knative: ingressgateway
-      annotations:
-        sidecar.istio.io/inject: "false"
-        scheduler.alpha.kubernetes.io/critical-pod: ""
-    spec:
-      serviceAccountName: istio-ingressgateway-service-account
-      containers:
-        - name: istio-proxy
-          image: "docker.io/istio/proxyv2:1.0.2"
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 80
-            - containerPort: 443
-            - containerPort: 31400
-            - containerPort: 15011
-            - containerPort: 8060
-            - containerPort: 853
-            - containerPort: 15030
-            - containerPort: 15031
-          args:
-          - proxy
-          - router
-          - -v
-          - "2"
-          - --discoveryRefreshDelay
-          - '1s' #discoveryRefreshDelay
-          - --drainDuration
-          - '45s' #drainDuration
-          - --parentShutdownDuration
-          - '1m0s' #parentShutdownDuration
-          - --connectTimeout
-          - '10s' #connectTimeout
-          - --serviceCluster
-          - knative-ingressgateway
-          - --zipkinAddress
-          - zipkin:9411
-          - --statsdUdpAddress
-          - istio-statsd-prom-bridge:9125
-          - --proxyAdminPort
-          - "15000"
-          - --controlPlaneAuthPolicy
-          - NONE
-          - --discoveryAddress
-          - istio-pilot:8080
-          resources:
-            requests:
-              cpu: 10m
-
-          env:
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: INSTANCE_IP
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: status.podIP
-          - name: ISTIO_META_POD_NAME
-            valueFrom:
-              fieldRef:
-                fieldPath: metadata.name
-          volumeMounts:
-          - name: istio-certs
-            mountPath: /etc/certs
-            readOnly: true
-          - name: ingressgateway-certs
-            mountPath: "/etc/istio/ingressgateway-certs"
-            readOnly: true
-          - name: ingressgateway-ca-certs
-            mountPath: "/etc/istio/ingressgateway-ca-certs"
-            readOnly: true
-      volumes:
-      - name: istio-certs
-        secret:
-          secretName: istio.istio-ingressgateway-service-account
-          optional: true
-      - name: ingressgateway-certs
-        secret:
-          secretName: "istio-ingressgateway-certs"
-          optional: true
-      - name: ingressgateway-ca-certs
-        secret:
-          secretName: "istio-ingressgateway-ca-certs"
-          optional: true
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: beta.kubernetes.io/arch
-                operator: In
-                values:
-                - amd64
-                - ppc64le
-                - s390x
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 2
-            preference:
-              matchExpressions:
-              - key: beta.kubernetes.io/arch
-                operator: In
-                values:
-                - amd64
-          - weight: 2
-            preference:
-              matchExpressions:
-              - key: beta.kubernetes.io/arch
-                operator: In
-                values:
-                - ppc64le
-          - weight: 2
-            preference:
-              matchExpressions:
-              - key: beta.kubernetes.io/arch
-                operator: In
-                values:
-                - s390x
----
-# This is the horizontal pod autoscaler to make sure the ingress Pods
-# scale up to meet traffic demand.
-#
-apiVersion: autoscaling/v2beta1
-kind: HorizontalPodAutoscaler
-metadata:
-    name: knative-ingressgateway
-    namespace: istio-system
-spec:
-    # TODO(1411): Document/fix this.  We are choosing an arbitrary 10 here.
-    maxReplicas: 10
-    minReplicas: 1
-    scaleTargetRef:
-      apiVersion: apps/v1
-      kind: Deployment
-      name: knative-ingressgateway
-    metrics:
-    - type: Resource
-      resource:
-        name: cpu
-        targetAverageUtilization: 60