Skip to content

Commit 9915baa

Browse files
butonicbutonic
authored
Merge pull request opencloud-eu#16 from opencloud-eu/generic-gateway
make gateway generic
2 parents 43bbd12 + d178f33 commit 9915baa

15 files changed

+201
-70
lines changed

‎README.md

Lines changed: 18 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@ Welcome to the **OpenCloud Helm Charts** repository! This repository is intended
2222
- [OnlyOffice Settings](#onlyoffice-settings)
2323
- [Collabora Settings](#collabora-settings)
2424
- [Collaboration Service Settings](#collaboration-service-settings)
25-
- [Cilium Gateway API Configuration](#cilium-gateway-api-configuration)
26-
- [Cilium HTTPRoute Settings](#cilium-httproute-settings)
25+
- [Gateway API Configuration](#gateway-api-configuration)
26+
- [HTTPRoute Settings](#httproute-settings)
2727
- [Setting Up Gateway API with Talos, Cilium, and cert-manager](#setting-up-gateway-api-with-talos-cilium-and-cert-manager)
2828
- [Installing the DEV Helm Charts](#-installing-the-dev-helm-charts)
2929
- [License](#-license)
@@ -69,8 +69,8 @@ To install the chart with the release name `opencloud`:
6969
helm install opencloud . \
7070
--namespace opencloud \
7171
--create-namespace \
72-
--set cilium.httproute.gateway.name=cilium-gateway \
73-
--set cilium.httproute.gateway.namespace=kube-system
72+
--set httpRoute.gateway.name=opencloud-gateway \
73+
--set httpRoute.gateway.namespace=kube-system
7474
```
7575

7676
## Architecture
@@ -307,19 +307,19 @@ The following table lists the configurable parameters of the OpenCloud chart and
307307
| `collaboration.wopiDomain` | WOPI server domain | `collaboration.opencloud.test` |
308308
| `collaboration.resources` | CPU/Memory resource requests/limits | `{}` |
309309

310-
## Cilium Gateway API Configuration
310+
## Gateway API Configuration
311311

312-
This chart includes Cilium HTTPRoute resources that can be used to expose the OpenCloud, Keycloak, and MinIO services externally. The HTTPRoutes are configured to route traffic to the respective services.
312+
This chart includes HTTPRoute resources that can be used to expose the OpenCloud, Keycloak, and MinIO services externally. The HTTPRoutes are configured to route traffic to the respective services.
313313

314-
### Cilium HTTPRoute Settings
314+
### HTTPRoute Settings
315315

316316
| Parameter | Description | Default |
317317
| --------- | ----------- | ------- |
318-
| `cilium.httproute.enabled` | Enable Cilium HTTPRoutes | `true` |
319-
| `cilium.httproute.gateway.name` | Gateway name | `cilium-gateway` |
320-
| `cilium.httproute.gateway.namespace` | Gateway namespace | `""` (defaults to Release.Namespace) |
318+
| `httpRoute.enabled` | Enable HTTPRoutes | `true` |
319+
| `httpRoute.gateway.name` | Gateway name | `opencloud-gateway` |
320+
| `httpRoute.gateway.namespace` | Gateway namespace | `""` (defaults to Release.Namespace) |
321321

322-
The following HTTPRoutes are created when `cilium.httproute.enabled` is set to `true`:
322+
The following HTTPRoutes are created when `httpRoute.enabled` is set to `true`:
323323

324324
1. **OpenCloud HTTPRoute**:
325325
- Hostname: `global.domain.opencloud`
@@ -368,7 +368,7 @@ The following HTTPRoutes are created when `cilium.httproute.enabled` is set to `
368368
- Port: 9300
369369
- Headers: Adds Permissions-Policy header to prevent browser features like interest-based advertising
370370

371-
All HTTPRoutes are configured to use the same Gateway specified by `cilium.httproute.gateway.name` and `cilium.httproute.gateway.namespace`.
371+
All HTTPRoutes are configured to use the same Gateway specified by `httpRoute.gateway.name` and `httpRoute.gateway.namespace`.
372372

373373
## Setting Up Gateway API with Talos, Cilium, and cert-manager
374374

@@ -392,7 +392,7 @@ helm repo add cilium https://helm.cilium.io/
392392
helm install cilium cilium/cilium \
393393
--namespace kube-system \
394394
--set gatewayAPI.enabled=true \
395-
--set kubeProxyReplacement=strict \
395+
--set kubeProxyReplacement=true \
396396
--set k8sServiceHost=<your-kubernetes-api-server-ip> \
397397
--set k8sServicePort=6443
398398
```
@@ -402,14 +402,8 @@ helm install cilium cilium/cilium \
402402
Install cert-manager to manage TLS certificates:
403403

404404
```bash
405-
# Add the Jetstack Helm repository
406-
helm repo add jetstack https://charts.jetstack.io
407-
408-
# Install cert-manager
409-
helm install cert-manager jetstack/cert-manager \
410-
--namespace cert-manager \
411-
--create-namespace \
412-
--set installCRDs=true
405+
# install the default cert manager
406+
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.17.0/cert-manager.yaml
413407
```
414408

415409
### Step 3: Create a ClusterIssuer for cert-manager
@@ -470,6 +464,7 @@ kubectl apply -f cluster-issuer.yaml
470464

471465
Create a Gateway resource to expose your services:
472466

467+
473468
```yaml
474469
# gateway.yaml
475470
apiVersion: gateway.networking.k8s.io/v1beta1
@@ -616,8 +611,8 @@ cd opencloud-helm
616611
helm install opencloud . \
617612
--namespace opencloud \
618613
--create-namespace \
619-
--set cilium.httproute.gateway.name=cilium-gateway \
620-
--set cilium.httproute.gateway.namespace=kube-system
614+
--set httpRoute.gateway.name=opencloud-gateway \
615+
--set httpRoute.gateway.namespace=kube-system
621616
```
622617

623618
### Troubleshooting

‎templates/NOTES.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,10 @@ The following services have been deployed:
5454
{{- end }}
5555

5656

57-
{{- if .Values.cilium.httproute.enabled }}
58-
IMPORTANT: This chart includes Cilium HTTPRoute resources that route traffic to the OpenCloud, Keycloak, and MinIO services.
59-
All HTTPRoutes are configured to use the Gateway named "{{ .Values.cilium.httproute.gateway.name }}" in the
60-
{{ if .Values.cilium.httproute.gateway.namespace }}{{ .Values.cilium.httproute.gateway.namespace }}{{ else }}{{ .Values.namespace }}{{ end }} namespace.
57+
{{- if .Values.httpRoute.enabled }}
58+
IMPORTANT: This chart includes HTTPRoute resources that route traffic to the OpenCloud, Keycloak, and MinIO services.
59+
All HTTPRoutes are configured to use the Gateway named "{{ .Values.httpRoute.gateway.name }}" in the
60+
{{ if .Values.httpRoute.gateway.namespace }}{{ .Values.httpRoute.gateway.namespace }}{{ else }}{{ .Values.namespace }}{{ end }} namespace.
6161

6262
Make sure the Gateway exists and is properly configured to accept traffic for the following domains:
6363
- OpenCloud: {{ include "opencloud.domain" . }} (Service: {{ include "opencloud.opencloud.fullname" . }}, Port: 9200)
@@ -72,7 +72,7 @@ Make sure the Gateway exists and is properly configured to accept traffic for th
7272
{{- end }}
7373

7474
{{- else }}
75-
IMPORTANT: The Cilium HTTPRoutes are disabled. You need to configure your own ingress controller
75+
IMPORTANT: The HTTPRoutes are disabled. You need to configure your own ingress controller
7676
to expose these services externally.
7777

7878
Example domains for your ingress configuration:

‎templates/gateway/collaboration-httproute.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if and .Values.cilium.httproute.enabled .Values.onlyoffice.collaboration.enabled .Values.onlyoffice.enabled }}
1+
{{- if and .Values.httpRoute.enabled .Values.onlyoffice.collaboration.enabled .Values.onlyoffice.enabled }}
22
apiVersion: gateway.networking.k8s.io/v1beta1
33
kind: HTTPRoute
44
metadata:
@@ -9,8 +9,8 @@ metadata:
99
app.kubernetes.io/component: collaboration
1010
spec:
1111
parentRefs:
12-
- name: {{ .Values.cilium.httproute.gateway.name }}
13-
namespace: {{ .Values.cilium.httproute.gateway.namespace | default .Values.namespace }}
12+
- name: {{ .Values.httpRoute.gateway.name }}
13+
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
1414
sectionName: collaboration-https
1515
hostnames:
1616
- {{ .Values.global.domain.wopi | quote }}

‎templates/gateway/gateway.yaml

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
{{- if .Values.httpRoute.gateway.create }}
2+
apiVersion: gateway.networking.k8s.io/v1
3+
kind: Gateway
4+
metadata:
5+
name: {{ .Values.httpRoute.gateway.name }}
6+
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
7+
labels:
8+
{{- include "opencloud.labels" . | nindent 4 }}
9+
spec:
10+
gatewayClassName: {{ .Values.httpRoute.gateway.className }}
11+
infrastructure:
12+
annotations:
13+
{{- with .Values.httpRoute.gateway.annotations }}
14+
{{- toYaml . | nindent 6 }}
15+
{{- end }}
16+
listeners:
17+
- name: opencloud-https
18+
protocol: HTTPS
19+
port: {{ .Valuees.httpRoute.gateway.port | default 443 }}
20+
hostname: {{ .Values.global.domain.opencloud | quote }}
21+
tls:
22+
mode: Terminate
23+
certificateRefs:
24+
- name: opencloud-wildcard-tls
25+
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
26+
allowedRoutes:
27+
namespaces:
28+
from: Selector
29+
selector:
30+
matchLabels:
31+
kubernetes.io/metadata.name: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
32+
{{- if .Values.keycloak.enabled }}
33+
- name: keycloak-https
34+
protocol: HTTPS
35+
port: {{ .Valuees.httpRoute.gateway.port | default 443 }}
36+
hostname: {{ .Values.global.domain.keycloak | quote }}
37+
tls:
38+
mode: Terminate
39+
certificateRefs:
40+
- name: opencloud-wildcard-tls
41+
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
42+
allowedRoutes:
43+
namespaces:
44+
from: Selector
45+
selector:
46+
matchLabels:
47+
kubernetes.io/metadata.name: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
48+
{{- end }}
49+
{{- if and .Values.opencloud.storage.s3.internal.enabled .Values.opencloud.storage.s3.internal.httpRoute.enabled }}
50+
- name: minio-https
51+
protocol: HTTPS
52+
port: {{ .Valuees.httpRoute.gateway.port | default 443 }}
53+
hostname: {{ .Values.global.domain.minio | quote }}
54+
tls:
55+
mode: Terminate
56+
certificateRefs:
57+
- name: opencloud-wildcard-tls
58+
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
59+
allowedRoutes:
60+
namespaces:
61+
from: Selector
62+
selector:
63+
matchLabels:
64+
kubernetes.io/metadata.name: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
65+
{{- end }}
66+
{{- if .Values.onlyoffice.enabled }}
67+
- name: onlyoffice-https
68+
protocol: HTTPS
69+
port: {{ .Valuees.httpRoute.gateway.port | default 443 }}
70+
hostname: {{ .Values.global.domain.onlyoffice | quote }}
71+
tls:
72+
mode: Terminate
73+
certificateRefs:
74+
- name: opencloud-wildcard-tls
75+
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
76+
allowedRoutes:
77+
namespaces:
78+
from: Selector
79+
selector:
80+
matchLabels:
81+
kubernetes.io/metadata.name: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
82+
{{- end }}
83+
{{- if and .Values.onlyoffice.collaboration.enabled .Values.onlyoffice.enabled }}
84+
- name: collaboration-https
85+
protocol: HTTPS
86+
port: {{ .Valuees.httpRoute.gateway.port | default 443 }}
87+
hostname: {{ .Values.global.domain.wopi | quote }}
88+
tls:
89+
mode: Terminate
90+
certificateRefs:
91+
- name: opencloud-wildcard-tls
92+
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
93+
allowedRoutes:
94+
namespaces:
95+
from: Selector
96+
selector:
97+
matchLabels:
98+
kubernetes.io/metadata.name: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
99+
{{- end }}
100+
{{- end }}

‎templates/gateway/https-httproute.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if .Values.cilium.httproute.enabled }}
1+
{{- if .Values.httpRoute.enabled }}
22
apiVersion: gateway.networking.k8s.io/v1beta1
33
kind: HTTPRoute
44
metadata:
@@ -8,8 +8,8 @@ metadata:
88
{{- include "opencloud.labels" . | nindent 4 }}
99
spec:
1010
parentRefs:
11-
- name: {{ .Values.cilium.httproute.gateway.name }}
12-
namespace: {{ .Values.cilium.httproute.gateway.namespace | default .Values.namespace }}
11+
- name: {{ .Values.httpRoute.gateway.name }}
12+
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
1313
sectionName: opencloud-https
1414
hostnames:
1515
- {{ include "opencloud.domain" . | quote }}

‎templates/gateway/keycloak-https-httproute.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if and .Values.cilium.httproute.enabled .Values.keycloak.enabled (not .Values.keycloak.external.enabled) }}
1+
{{- if and .Values.httpRoute.enabled .Values.keycloak.enabled (not .Values.keycloak.external.enabled) }}
22
apiVersion: gateway.networking.k8s.io/v1beta1
33
kind: HTTPRoute
44
metadata:
@@ -9,8 +9,8 @@ metadata:
99
app.kubernetes.io/component: keycloak
1010
spec:
1111
parentRefs:
12-
- name: {{ .Values.cilium.httproute.gateway.name }}
13-
namespace: {{ .Values.cilium.httproute.gateway.namespace | default .Values.namespace }}
12+
- name: {{ .Values.httpRoute.gateway.name }}
13+
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
1414
sectionName: keycloak-https
1515
hostnames:
1616
- {{ include "opencloud.keycloak.domain" . | quote }}

‎templates/gateway/minio-httproute.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if and .Values.cilium.httproute.enabled .Values.opencloud.storage.s3.internal.enabled }}
1+
{{- if and .Values.httpRoute.enabled .Values.opencloud.storage.s3.internal.enabled .Values.opencloud.storage.s3.internal.httpRoute.enabled }}
22
apiVersion: gateway.networking.k8s.io/v1beta1
33
kind: HTTPRoute
44
metadata:
@@ -9,8 +9,8 @@ metadata:
99
app.kubernetes.io/component: minio
1010
spec:
1111
parentRefs:
12-
- name: {{ .Values.cilium.httproute.gateway.name }}
13-
namespace: {{ .Values.cilium.httproute.gateway.namespace | default .Values.namespace }}
12+
- name: {{ .Values.httpRoute.gateway.name }}
13+
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
1414
sectionName: minio-https
1515
hostnames:
1616
- {{ include "opencloud.minio.domain" . | quote }}

‎templates/gateway/onlyoffice-httproute-echo.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ metadata:
99
app.kubernetes.io/component: onlyoffice
1010
spec:
1111
parentRefs:
12-
- name: {{ .Values.cilium.httproute.gateway.name }}
13-
namespace: {{ .Values.cilium.httproute.gateway.namespace | default .Values.namespace }}
12+
- name: {{ .Values.httpRoute.gateway.name }}
13+
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
1414
sectionName: onlyoffice-https
1515
hostnames:
1616
- {{ .Values.global.domain.onlyoffice | quote }}

‎templates/gateway/onlyoffice-httproute.yaml

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if and .Values.cilium.httproute.enabled .Values.onlyoffice.enabled }}
1+
{{- if and .Values.httpRoute.enabled .Values.onlyoffice.enabled }}
22
apiVersion: gateway.networking.k8s.io/v1beta1
33
kind: HTTPRoute
44
metadata:
@@ -9,8 +9,8 @@ metadata:
99
app.kubernetes.io/component: onlyoffice
1010
spec:
1111
parentRefs:
12-
- name: {{ .Values.cilium.httproute.gateway.name }}
13-
namespace: {{ .Values.cilium.httproute.gateway.namespace | default .Values.namespace }}
12+
- name: {{ .Values.httpRoute.gateway.name }}
13+
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
1414
sectionName: onlyoffice-https
1515
hostnames:
1616
- {{ .Values.global.domain.onlyoffice | quote }}
@@ -19,6 +19,20 @@ spec:
1919
- path:
2020
type: PathPrefix
2121
value: /
22+
filters:
23+
{{- if eq .Values.httpRoute.gateway.className "traefik" }}
24+
- type: ExtensionRef
25+
extensionRef:
26+
group: traefik.io
27+
kind: Middleware
28+
name: add-x-forwarded-proto-https
29+
{{- else }}
30+
- type: RequestHeaderModifier
31+
requestHeaderModifier:
32+
add:
33+
- name: X-Forwarded-Proto
34+
value: https
35+
{{- end }}
2236
backendRefs:
2337
- name: {{ include "opencloud.fullname" . }}-onlyoffice
2438
port: 80

‎templates/gateway/onlyoffice-tlsroute.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ metadata:
99
app.kubernetes.io/component: onlyoffice
1010
spec:
1111
parentRefs:
12-
- name: {{ .Values.cilium.httproute.gateway.name }}
13-
namespace: {{ .Values.cilium.httproute.gateway.namespace | default .Values.namespace }}
12+
- name: {{ .Values.httpRoute.gateway.name }}
13+
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
1414
sectionName: onlyoffice-tls
1515
hostnames:
1616
- {{ .Values.global.domain.onlyoffice | quote }}

0 commit comments

Comments
 (0)