Example needed. External and internal contour deployments with helm

[artyom-p]

Hello, I'm quite new to Kubernetes and I'm looking for an example of multi-instance contour deployment to implement external and internal ingresses. Is it doable with helm at all?

I found this ticket - #855, but im still struggling on how to convert that to helm chart deployments.

[youngnick]

Thanks for the question @artyom-p!

@OrlinVasilev and @jonasrosland, seems like this might be a good candidate for a tech writer to look into? There are definitely some other places that are doing two deployments, and it's a common enough use case that having a writeup would be very useful.

[rdgacarvalho]

Hi, I have tried to achieve this setup two months ago and, unfortunately, didn't work.

I've defined two different ingress class names external & internal. For the first deployment via helm I kept CRD create enabled. For the second deployment, I didn't enable CRD.

The result was, the second deployment finished but the helm status was failed due to I didn't use atomic flag for testing.

Would be good to have this ability in contour like in the other Ingresses.

Best.

[youngnick]

Thanks for the feedback @rdgacarvalho. I haven't spent much time with Helm, so I'm not sure what you mean by "didn't use atomic flag for testing". Is there something that needs fixing in the Helm chart, or something we need to change in Contour itself, do you think?

[rdgacarvalho]

Hi @youngnick no worries. The atomic flag in the helm, in summary, will only install/upgrade a chart whether the install of all the charts finishes with success. Otherwise, helm will execute the rollback automatically.
There is one thing I am planing to do in my next PR. It was adding an additionalLabels to the ServiceMonitor section. Nowadays, we can not set/pass labels to it that matches our own ServiceMonitors definition.

[youngnick]

Reading back over this, I just realized I didn't check something - Contour does not work with two installs in the same namespace, even if the ingress-class is different. When doing the internal/external deployment, did you have different namespaces?

[skriss]

cross-posting the example from #855 (comment):

Just if anybody is interested, using the bitnam helm chart, deploying a internal and external contour would look like this

contour:
  ingressClass:
    name: contour-${name}
    create: true
    default: ${isDefaultIngress}
  manageCRDs: ${manageCRDs}
envoy:
  service:
    externalIPs:
      - ${hostIP}
    ports:
      http: 80
      https: 443
  extraArgs:
    - --base-id ${id}
  hostPorts:
    http: ${hostPortHttp}
    https: ${hostPortHttps}

• name: internal/external
• isDefaultIngress: should be true for only on (notice [bitnami/contour] cannot make ingress non-default bitnami/charts#8450)
• hostIp: should be the IP of the control plain to bind for (if internal and external are routed via different ips)
• be sure to use different ports for hostPortHttp / hostPortHttps even if you find on different externalIPs
• be sure to change the id to a unique value for each deployment, e.g. 1 for internal, 2 for external
• of course, every deployment of the chart must go into a different namespaces