deployment-rbac.yaml

# This file is generated from the individual yaml files by examples/render.sh.
# Do not edit this file directly but instead edit the source files and
# re-render.
apiVersion: v1
kind: Namespace
metadata:
  name: heptio-contour
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: contour
  namespace: heptio-contour
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: ingressroutes.contour.heptio.com
  labels:
    component: ingressroute
spec:
  group: contour.heptio.com
  version: v1beta1
  scope: Namespaced
  names:
    plural: ingressroutes
    kind: IngressRoute
  additionalPrinterColumns:
    - name: FQDN
      type: string
      description: Fully qualified domain name
      JSONPath: .spec.virtualhost.fqdn
    - name: TLS Secret
      type: string
      description: Secret with TLS credentials
      JSONPath: .spec.virtualhost.tls.secretName
    - name: First route
      type: string
      description: First routes defined
      JSONPath: .spec.routes[0].match
    - name: Status
      type: string
      description: The current status of the IngressRoute
      JSONPath: .status.currentStatus
    - name: Status Description
      type: string
      description: Description of the current status
      JSONPath: .status.description
  validation:
    openAPIV3Schema:
      properties:
        spec:
          properties:
            virtualhost:
              properties:
                fqdn:
                  type: string
                  # This regex handles two cases:
                  # 1. A reasonably well-formed FQDN, which is allowed
                  #    a hyphen in the top-level label (not usually
                  #    the case for TLDs.) This fixes https://github.com/heptio/contour/issues/1117
                  #    This is the first option in the regex.
                  # 2. A bareword containing a hyphen, no periods. This fixes 
                  #    https://github.com/heptio/contour/issues/755 and is the
                  #    second option in the regex
                  pattern: ^([a-zA-Z0-9]+(-[a-zA-Z0-9]+)*\.)+[\-a-z0-9]{2,}|[\-a-z0-9]+$
                tls:
                  properties:
                    secretName:
                      type: string
                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?([\.\/][a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                    minimumProtocolVersion:
                      type: string
                      enum:
                        - "1.3"
                        - "1.2"
                        - "1.1"
            strategy:
              type: string
              enum:
                - RoundRobin
                - WeightedLeastRequest
                - Random
                - Cookie
            healthCheck:
              type: object
              required:
                - path
              properties:
                path:
                  type: string
                  pattern: ^\/.*$
                intervalSeconds:
                  type: integer
                timeoutSeconds:
                  type: integer
                unhealthyThresholdCount:
                  type: integer
                healthyThresholdCount:
                  type: integer
            routes:
              type: array
              items:
                required:
                  - match
                properties:
                  match:
                    type: string
                    pattern: ^\/.*$
                  delegate:
                    type: object
                    required:
                      - name
                    properties:
                      name:
                        type: string
                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ # DNS-1123 subdomain
                      namespace:
                        type: string
                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ # DNS-1123 label
                  services:
                    type: array
                    items:
                      type: object
                      required:
                        - name
                        - port
                      properties:
                        name:
                          type: string
                          pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$ # DNS-1035 label
                        port:
                          type: integer
                        weight:
                          type: integer
                        strategy:
                          type: string
                          enum:
                            - RoundRobin
                            - WeightedLeastRequest
                            - Random
                            - Cookie
                        healthCheck:
                          type: object
                          required:
                            - path
                          properties:
                            path:
                              type: string
                              pattern: ^\/.*$
                            intervalSeconds:
                              type: integer
                            timeoutSeconds:
                              type: integer
                            unhealthyThresholdCount:
                              type: integer
                            healthyThresholdCount:
                              type: integer
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: tlscertificatedelegations.contour.heptio.com
  labels:
    component: tlscertificatedelegation
spec:
  group: contour.heptio.com
  version: v1beta1
  scope: Namespaced
  names:
    plural: tlscertificatedelegations
    kind: TLSCertificateDelegation
  validation:
    openAPIV3Schema:
      properties:
        spec:
          properties:
            delegations:
              type: array
              items:
                type: object
                required:
                  - secretName
                  - targetNamespaces
                properties:
                  match:
                    type: string
                  targetNamespaces:
                    type: array
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: contour
  name: contour
  namespace: heptio-contour
spec:
  selector:
    matchLabels:
      app: contour
  replicas: 2
  template:
    metadata:
      labels:
        app: contour
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8002"
        prometheus.io/path: "/stats/prometheus"
    spec:
      containers:
      - image: gcr.io/heptio-images/contour:v0.14.1
        imagePullPolicy: Always
        name: contour
        command: ["contour"]
        args: ["serve", "--incluster", "--envoy-service-http-port", "8080", "--envoy-service-https-port", "8443"]
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8000
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8000
      - image: docker.io/envoyproxy/envoy:v1.10.0
        name: envoy
        ports:
        - containerPort: 8080
          name: http
        - containerPort: 8443
          name: https
        command: ["envoy"]
        args:
        - --config-path /config/contour.json
        - --service-cluster cluster0
        - --service-node node0
        - --log-level info
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8002
          initialDelaySeconds: 3
          periodSeconds: 3
        volumeMounts:
        - name: contour-config
          mountPath: /config
        lifecycle:
          preStop:
            exec:
              command: ["wget", "-qO-", "--post-data=''", "http://localhost:9001/healthcheck/fail"] 
      initContainers:
      - image: gcr.io/heptio-images/contour:v0.14.1
        imagePullPolicy: Always
        name: envoy-initconfig
        command: ["contour"]
        args:
        - bootstrap
        - /config/contour.json
        volumeMounts:
        - name: contour-config
          mountPath: /config
        env:
        - name: CONTOUR_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
      volumes:
      - name: contour-config
        emptyDir: {}
      dnsPolicy: ClusterFirst
      serviceAccountName: contour
      terminationGracePeriodSeconds: 30
      # The affinity stanza below tells Kubernetes to try hard not to place 2 of
      # these pods on the same node.
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchLabels:
                  app: contour
              topologyKey: kubernetes.io/hostname
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: contour
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: contour
subjects:
- kind: ServiceAccount
  name: contour
  namespace: heptio-contour
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: contour
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - nodes
  - pods
  - secrets
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups: ["contour.heptio.com"]
  resources: ["ingressroutes", "tlscertificatedelegations"]
  verbs:
  - get
  - list
  - watch
  - put
  - post
  - patch
---
apiVersion: v1
kind: Service
metadata:
 name: contour
 namespace: heptio-contour
 annotations:
  # This annotation puts the AWS ELB into "TCP" mode so that it does not
  # do HTTP negotiation for HTTPS connections at the ELB edge.
  # The downside of this is the remote IP address of all connections will
  # appear to be the internal address of the ELB. See docs/proxy-proto.md
  # for information about enabling the PROXY protocol on the ELB to recover
  # the original remote IP address.
  service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp

  # Scrape metrics for the contour container
  # The envoy container is scraped by annotations on the pod spec
  prometheus.io/port: "8000"
  prometheus.io/scrape: "true"
spec:
 ports:
 - port: 80
   name: http
   protocol: TCP
   targetPort: 8080
 - port: 443
   name: https
   protocol: TCP
   targetPort: 8443
 selector:
   app: contour
 type: LoadBalancer
---