Skip to content

Commit 9c91df0

Browse files
rickymoorhouserickymoorhouse
committed
feat: re-instate support for username/password and log level
This will require a secret containing client_id, client_secret, username, password and realm Also improving the docs and sample manifests for installation For #109 Signed-off-by: Ricky Moorhouse <[email protected]>
1 parent 315543b commit 9c91df0

15 files changed

+275
-104
lines changed

‎deployment/certificate.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
apiVersion: cert-manager.io/v1
3+
kind: Certificate
4+
metadata:
5+
name: trawler-certificate
6+
namespace: apic
7+
spec:
8+
dnsNames:
9+
- trawler.apic.svc.cluster.local
10+
duration: 17520h0m0s
11+
# Update with your appropriate cert issuer
12+
issuerRef:
13+
group: cert-manager.io
14+
kind: ClusterIssuer
15+
name: ingress-cluster-issuer
16+
renewBefore: 720h0m0s
17+
secretName: trawler-certificate
18+
usages:
19+
- digital signature
20+
- key encipherment

‎deployment/clusterrole.yaml

Lines changed: 24 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,28 @@
1-
kind: ClusterRole
1+
---
22
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
34
metadata:
45
name: trawler
56
rules:
6-
- apiGroups: [""]
7-
resources: ["pods","services","secrets"]
8-
verbs: ["get","list"]
9-
- apiGroups: ["management.apiconnect.ibm.com"]
10-
resources: ["managementclusters"]
11-
verbs: ["get","list"]
12-
- apiGroups: ["analytics.apiconnect.ibm.com"]
13-
resources: ["analyticsclusters"]
14-
verbs: ["get","list"]
15-
- apiGroups: ["gateway.apiconnect.ibm.com"]
16-
resources: ["gatewayclusters"]
17-
verbs: ["get","list"]
18-
- apiGroups: ["portal.apiconnect.ibm.com"]
19-
resources: ["portalclusters"]
20-
verbs: ["get","list"]
7+
- apiGroups:
8+
- ''
9+
resources:
10+
- pods
11+
- services
12+
- secrets
13+
verbs:
14+
- get
15+
- list
16+
- apiGroups:
17+
- management.apiconnect.ibm.com
18+
- portal.apiconnect.ibm.com
19+
- gateway.apiconnect.ibm.com
20+
- analytics.apiconnect.ibm.com
21+
resources:
22+
- managementclusters
23+
- analyticsclusters
24+
- portalclusters
25+
- gatewayclusters
26+
verbs:
27+
- get
28+
- list

‎deployment/config.yaml

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,30 @@
11
# Example configuration file
22
prometheus:
3-
port: 63512
3+
port: 63512
44
enabled: true
5+
logging:
6+
level: info
57
nets:
8+
apiconnect:
9+
enabled: true
10+
analytics:
11+
enabled: true
12+
namespace: analytics-namespace
13+
certificates:
14+
enabled: true
15+
frequency: 600
616
datapower:
717
enabled: true
818
username: admin
9-
namespace: apic
19+
namespace: gateway-namespace
20+
api_tests:
21+
enabled: false
22+
apis:
23+
- name: testapi
24+
path: /porg/catalog/test
25+
method: get
26+
headers: {}
1027
manager:
1128
enabled: true
12-
username: admin
13-
namespace: apic
14-
analytics:
15-
enabled: true
16-
namespace: apic
29+
process_org_metrics: false
30+
namespace: manager-apic

‎deployment/deployment.yaml

Lines changed: 66 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -18,48 +18,74 @@ spec:
1818
prometheus.io/port: "63512"
1919
prometheus.io/scrape: "true"
2020
spec:
21-
volumes:
22-
- name: trawler-config
23-
configMap:
21+
containers:
22+
- env:
23+
- name: MGMT_CREDS
24+
value: /app/management
25+
- name: ANALYTICS_CERTS
26+
value: /app/analytics
27+
- name: SECURE
28+
value: 'true'
29+
- name: CERT_PATH
30+
value: /app/certs
31+
- name: CONFIG_PATH
32+
value: /app/config/config.yaml
33+
image: $IMAGE
34+
imagePullPolicy: Always
2435
name: trawler
25-
optional: true
26-
- name: trawler-secrets
27-
secret:
28-
secretName: trawler
29-
optional: true
30-
hostNetwork: false
36+
ports:
37+
- containerPort: 63512
38+
name: metrics
39+
protocol: TCP
40+
resources:
41+
limits:
42+
cpu: 500m
43+
memory: 256Mi
44+
requests:
45+
cpu: 200m
46+
memory: 128Mi
47+
securityContext:
48+
privileged: false
49+
readOnlyRootFilesystem: true
50+
runAsNonRoot: true
51+
volumeMounts:
52+
- mountPath: /app/config
53+
name: trawler-config
54+
- mountPath: /app/management
55+
name: trawler-creds
56+
- mountPath: /app/datapower
57+
name: datapower-creds
58+
# Update the following for your analytics deployment (replace analytics with your subsystem name)
59+
- mountPath: /app/analytics
60+
name: analytics-client-certificate
61+
readOnly: true
62+
- mountPath: /app/certs
63+
name: trawler-certificate
64+
readOnly: true
3165
dnsPolicy: ClusterFirstWithHostNet
66+
hostNetwork: false
3267
serviceAccount: trawler
33-
tolerations:
34-
- effect: NoSchedule
35-
key: node-role.kubernetes.io/master
3668
terminationGracePeriodSeconds: 5
37-
containers:
38-
- name: trawler
39-
image: ghcr.io/ibm/apiconnect-trawler/trawler:main
40-
imagePullPolicy: Always
41-
securityContext:
42-
allowPrivilegeEscalation: false
43-
privileged: false
44-
runAsNonRoot: true
45-
readOnlyRootFilesystem: false
46-
ports:
47-
- containerPort: 63512
48-
name: metrics
49-
protocol: TCP
50-
resources:
51-
requests:
52-
cpu: 200m
53-
memory: 128Mi
54-
limits:
55-
cpu: 500m
56-
memory: 256Mi
57-
readinessProbe:
58-
exec:
59-
command: [ "test", "-e", "/app/trawler.py" ]
60-
initialDelaySeconds: 10
61-
volumeMounts:
62-
- mountPath: /app/config
69+
volumes:
70+
- configMap:
71+
name: trawler-config
72+
optional: true
6373
name: trawler-config
64-
- mountPath: /app/secrets
65-
name: trawler-secrets
74+
- name: trawler-creds
75+
secret:
76+
optional: true
77+
secretName: trawler-mgmt-creds
78+
- name: trawler-certificate
79+
secret:
80+
defaultMode: 420
81+
optional: true
82+
secretName: trawler-certificate
83+
- name: analytics-client-certificate
84+
secret:
85+
defaultMode: 420
86+
secretName: analytics-client
87+
- name: datapower-creds
88+
secret:
89+
defaultMode: 420
90+
optional: true
91+
secretName: trawler-dp-creds

‎deployment/kustomization.yaml

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,21 @@
11
apiVersion: kustomize.config.k8s.io/v1beta1
22
kind: Kustomization
33
configMapGenerator:
4-
- name: trawler
4+
- name: trawler-config
55
files:
66
- config.yaml
77
resources:
8+
- certificate.yaml
89
- deployment.yaml
910
- serviceaccount.yaml
1011
- clusterrole.yaml
1112
- clusterrolebinding.yaml
12-
# Uncomment secret.yaml if you have set passwords in it
13-
# - secret.yaml
13+
- networkpolicy_trawler-a7s.yaml
14+
- networkpolicy_trawler.yaml
15+
- secret-mgmt.yaml
16+
- secret-dp.yaml
1417
# Uncomment the following if you are using prometheus-operator
1518
# - service.yaml
1619
# - servicemonitor.yaml
1720

18-
namespace: apic-monitoring
21+
namespace: apic

‎deployment/networkpolicy_trawler-a7s.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: trawler-a7s
6+
spec:
7+
ingress:
8+
- from:
9+
- podSelector:
10+
matchLabels:
11+
app: trawler
12+
podSelector:
13+
matchLabels:
14+
app.kubernetes.io/instance: analytics
15+
app.kubernetes.io/name: director
16+
policyTypes:
17+
- Ingress

‎deployment/networkpolicy_trawler.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: trawler-networkpolicy
6+
spec:
7+
ingress:
8+
- from:
9+
- namespaceSelector:
10+
matchLabels:
11+
name: openshift-user-workload-monitoring
12+
podSelector: {}
13+
ports:
14+
- port: 63512
15+
protocol: TCP
16+
podSelector:
17+
matchLabels:
18+
app: trawler
19+
policyTypes:
20+
- Ingress

‎deployment/secret-dp.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v1
2+
stringData:
3+
username: admin
4+
password:
5+
kind: Secret
6+
metadata:
7+
name: trawler-dp-creds
8+
type: Opaque

‎deployment/secret-mgmt.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
stringData:
3+
client_id:
4+
client_secret:
5+
# Uncomment and insert the values for the below as needed
6+
# username:
7+
# password:
8+
# realm:
9+
kind: Secret
10+
metadata:
11+
name: trawler-mgmt-creds
12+
type: Opaque

‎deployment/secret.yaml

Lines changed: 0 additions & 9 deletions
This file was deleted.

0 commit comments

Comments
 (0)