salt, ui: deploy UI using *Ingress*es

The Kubernetes API, SaltAPI, Prometheus and the actual UI are now exposed using the `nginx-control-plane` *Ingress* controller, and as such accessible through the control-plane network IP of the 'bootstrap' node, port 8443. Fixes: #1602 See: #1602 Fixes: #1797 See: #1797 Fixes: #1799 See: #1799 Fixes: #1800 See: #1800
scality · Sep 29, 2019 · 01d3285 · 01d3285
1 parent f024e88
commit 01d3285
Show file tree

Hide file tree

Showing 11 changed files with 165 additions and 52 deletions.
diff --git a/buildchain/buildchain/salt_tree.py b/buildchain/buildchain/salt_tree.py
@@ -216,9 +216,12 @@ def _get_parts(self) -> Iterator[str]:
             'prometheus-nodeport.sls'),
     Path('salt/metalk8s/addons/prometheus-operator/deployed/storageclass.sls'),
 
-    Path('salt/metalk8s/addons/ui/deployed.sls'),
-    Path('salt/metalk8s/addons/ui/files/metalk8s-ui-deployment.yaml'),
-    Path('salt/metalk8s/addons/ui/precheck.sls'),
+    Path('salt/metalk8s/addons/ui/deployed/dependencies.sls'),
+    Path('salt/metalk8s/addons/ui/deployed/ingress.sls'),
+    Path('salt/metalk8s/addons/ui/deployed/init.sls'),
+    Path('salt/metalk8s/addons/ui/deployed/files/metalk8s-ui-deployment.yaml'),
+    Path('salt/metalk8s/addons/ui/deployed/namespace.sls'),
+    Path('salt/metalk8s/addons/ui/deployed/ui.sls'),
 
     Path('salt/metalk8s/addons/volumes/deployed.sls'),
     targets.TemplateFile(

diff --git a/salt/metalk8s/addons/ui/deployed/dependencies.sls b/salt/metalk8s/addons/ui/deployed/dependencies.sls
@@ -0,0 +1,55 @@
+#!kubernetes kubeconfig=/etc/kubernetes/admin.conf&context=kubernetes-admin@kubernetes
+
+kind: Service
+apiVersion: v1
+metadata:
+  name: kubernetes-api
+  namespace: metalk8s-ui
+  labels:
+    app: metalk8s-ui
+    app.kubernetes.io/managed-by: salt
+    app.kubernetes.io/name: metalk8s-ui
+    app.kubernetes.io/part-of: metalk8s
+    heritage: metalk8s
+spec:
+  type: ExternalName
+  externalName: kubernetes.default.svc.cluster.local
+  ports:
+    - name: https
+      port: 443
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: salt-api
+  namespace: metalk8s-ui
+  labels:
+    app: metalk8s-ui
+    app.kubernetes.io/managed-by: salt
+    app.kubernetes.io/name: metalk8s-ui
+    app.kubernetes.io/part-of: metalk8s
+    heritage: metalk8s
+spec:
+  type: ExternalName
+  externalName: salt-master.kube-system.svc.cluster.local
+  ports:
+    - name: https
+      port: 4507
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: prometheus-api
+  namespace: metalk8s-ui
+  labels:
+    app: metalk8s-ui
+    app.kubernetes.io/managed-by: salt
+    app.kubernetes.io/name: metalk8s-ui
+    app.kubernetes.io/part-of: metalk8s
+    heritage: metalk8s
+spec:
+  type: ExternalName
+  externalName: prometheus-operator-prometheus.metalk8s-monitoring.svc.cluster.local
+  ports:
+    - name: http
+      port: 9090
diff --git a/...dons/ui/files/metalk8s-ui-deployment.yaml → ...eployed/files/metalk8s-ui-deployment.yaml b/...dons/ui/files/metalk8s-ui-deployment.yaml → ...eployed/files/metalk8s-ui-deployment.yaml
diff --git a/salt/metalk8s/addons/ui/deployed/ingress.sls b/salt/metalk8s/addons/ui/deployed/ingress.sls
@@ -0,0 +1,78 @@
+#!kubernetes kubeconfig=/etc/kubernetes/admin.conf&context=kubernetes-admin@kubernetes
+
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: metalk8s-ui-proxies-https
+  namespace: metalk8s-ui
+  labels:
+    app: metalk8s-ui
+    app.kubernetes.io/managed-by: salt
+    app.kubernetes.io/name: metalk8s-ui
+    app.kubernetes.io/part-of: metalk8s
+    heritage: metalk8s
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: '/$2'
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+    kubernetes.io/ingress.class: "nginx-control-plane"
+spec:
+  rules:
+  - http:
+      paths:
+      - path: /api/kubernetes(/|$)(.*)
+        backend:
+          serviceName: kubernetes-api
+          servicePort: 443
+      - path: /api/salt(/|$)(.*)
+        backend:
+          serviceName: salt-api
+          servicePort: 4507
+---
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: metalk8s-ui-proxies-http
+  namespace: metalk8s-ui
+  labels:
+    app: metalk8s-ui
+    app.kubernetes.io/managed-by: salt
+    app.kubernetes.io/name: metalk8s-ui
+    app.kubernetes.io/part-of: metalk8s
+    heritage: metalk8s
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: '/$2'
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    kubernetes.io/ingress.class: "nginx-control-plane"
+spec:
+  rules:
+  - http:
+      paths:
+      - path: /api/prometheus(/|$)(.*)
+        backend:
+          serviceName: prometheus-api
+          servicePort: 9090
+---
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: metalk8s-ui
+  namespace: metalk8s-ui
+  labels:
+    app: metalk8s-ui
+    app.kubernetes.io/managed-by: salt
+    app.kubernetes.io/name: metalk8s-ui
+    app.kubernetes.io/part-of: metalk8s
+    heritage: metalk8s
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    kubernetes.io/ingress.class: "nginx-control-plane"
+spec:
+  rules:
+  - http:
+      paths:
+      - path: /
+        backend:
+          serviceName: metalk8s-ui
+          servicePort: 80
diff --git a/salt/metalk8s/addons/ui/deployed/init.sls b/salt/metalk8s/addons/ui/deployed/init.sls
@@ -0,0 +1,5 @@
+include:
+- .namespace
+- .dependencies
+- .ui
+- .ingress
diff --git a/salt/metalk8s/addons/ui/deployed/namespace.sls b/salt/metalk8s/addons/ui/deployed/namespace.sls
@@ -0,0 +1,10 @@
+#!kubernetes kubeconfig=/etc/kubernetes/admin.conf&context=kubernetes-admin@kubernetes
+
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: metalk8s-ui
+  labels:
+    app.kubernetes.io/managed-by: salt
+    app.kubernetes.io/part-of: metalk8s
+    heritage: metalk8s
diff --git a/salt/metalk8s/addons/ui/deployed.sls → salt/metalk8s/addons/ui/deployed/ui.sls b/salt/metalk8s/addons/ui/deployed.sls → salt/metalk8s/addons/ui/deployed/ui.sls
@@ -1,19 +1,9 @@
 include:
-  - .precheck
+- .namespace
 
 {%- set kubeconfig = "/etc/kubernetes/admin.conf" %}
 {%- set context = "kubernetes-admin@kubernetes" %}
 
-{%- set apiserver = 'https://' ~ pillar.metalk8s.api_server.host ~ ':6443' %}
-{%- set saltapi = 'https://' ~ pillar.metalk8s.endpoints['salt-master'].ip ~ ':' ~ pillar.metalk8s.endpoints['salt-master'].ports.api %}
-{%- set prometheus = 'http://' ~ grains.metalk8s.workload_plane_ip ~ ':30222'  %}
-
-Create metalk8s-ui namespace:
-  metalk8s_kubernetes.namespace_present:
-    - name: metalk8s-ui
-    - kubeconfig: {{ kubeconfig }}
-    - context: {{ context }}
-
 Create metalk8s-ui deployment:
   metalk8s_kubernetes.deployment_present:
     - name: metalk8s-ui
@@ -40,7 +30,7 @@ Create metalk8s-ui service:
           targetPort: 80
         selector:
           app: metalk8s-ui
-        type: NodePort
+        type: ClusterIP
 
 Create metalk8s-ui ConfigMap:
   metalk8s_kubernetes.configmap_present:
@@ -51,9 +41,9 @@ Create metalk8s-ui ConfigMap:
     - data:
         config.json: |
           {
-            "url": "{{ apiserver }}",
-            "url_salt": "{{ saltapi }}",
-            "url_prometheus": "{{ prometheus }}"
+            "url": "/api/kubernetes",
+            "url_salt": "/api/salt",
+            "url_prometheus": "/api/prometheus"
           }
 
 Create ui-branding ConfigMap:

diff --git a/salt/metalk8s/addons/ui/precheck.sls b/salt/metalk8s/addons/ui/precheck.sls
diff --git a/salt/metalk8s/deployed.sls b/salt/metalk8s/deployed.sls
@@ -8,3 +8,4 @@ include:
   - metalk8s.addons.nginx-ingress.deployed
   - metalk8s.addons.nginx-ingress-control-plane.deployed
   - metalk8s.addons.volumes.deployed
+  - metalk8s.addons.ui.deployed
diff --git a/salt/metalk8s/orchestrate/bootstrap/init.sls b/salt/metalk8s/orchestrate/bootstrap/init.sls
@@ -154,26 +154,6 @@ Deploy Kubernetes objects:
   - require:
     - http: Wait for API server to be available
 
-Precheck for MetalK8s UI:
-  salt.runner:
-    - name: state.orchestrate
-    - mods:
-      - metalk8s.addons.ui.precheck
-    - saltenv: {{ saltenv }}
-    - retry:
-        attempts: 5
-    - require:
-      - salt: Deploy Kubernetes objects
-
-Deploy MetalK8s UI:
-  salt.runner:
-    - name: state.orchestrate
-    - mods:
-      - metalk8s.addons.ui.deployed
-    - saltenv: {{ saltenv }}
-    - require:
-      - salt: Precheck for MetalK8s UI
-
 Store MetalK8s version in annotations:
   metalk8s_kubernetes.namespace_annotation_present:
     - name: "kube-system"

diff --git a/tests/post/steps/test_ui.py b/tests/post/steps/test_ui.py
@@ -16,15 +16,13 @@ def reach_UI(host):
     with host.sudo():
         output = host.check_output(' '.join([
             'salt-call', '--local', '--out=json',
-            'grains.get', 'metalk8s:workload_plane_ip',
+            'grains.get', 'metalk8s:control_plane_ip',
         ]))
         ip = json.loads(output)['local']
 
-        cmd_port = ('kubectl --kubeconfig=/etc/kubernetes/admin.conf'
-                    ' get svc -n metalk8s-ui metalk8s-ui --no-headers'
-                    ' -o custom-columns=":spec.ports[0].nodePort"')
-        port = host.check_output(cmd_port)
-
-    response = requests.get('http://{ip}:{port}'.format(ip=ip, port=port))
+    response = requests.get(
+        'https://{ip}:8443'.format(ip=ip),
+        verify=False,
+    )
 
     assert response.status_code == 200, response.text