salt, ui: deploy UI using *Ingress*es

The Kubernetes API, SaltAPI, Prometheus and the actual UI are now
exposed using the `nginx-control-plane` *Ingress* controller, and as
such accessible through the control-plane network IP of the 'bootstrap'
node, port 8443.

Fixes: #1602
See: #1602
Fixes: #1797
See: #1797
Fixes: #1799
See: #1799
Fixes: #1800
See: #1800

buildchain/buildchain/salt_tree.py

@@ -216,9 +216,12 @@ def _get_parts(self) -> Iterator[str]:
             'prometheus-nodeport.sls'),
     Path('salt/metalk8s/addons/prometheus-operator/deployed/storageclass.sls'),
 
-    Path('salt/metalk8s/addons/ui/deployed.sls'),
-    Path('salt/metalk8s/addons/ui/files/metalk8s-ui-deployment.yaml'),
-    Path('salt/metalk8s/addons/ui/precheck.sls'),
+    Path('salt/metalk8s/addons/ui/deployed/dependencies.sls'),
+    Path('salt/metalk8s/addons/ui/deployed/ingress.sls'),
+    Path('salt/metalk8s/addons/ui/deployed/init.sls'),
+    Path('salt/metalk8s/addons/ui/deployed/files/metalk8s-ui-deployment.yaml'),
+    Path('salt/metalk8s/addons/ui/deployed/namespace.sls'),
+    Path('salt/metalk8s/addons/ui/deployed/ui.sls'),
 
     Path('salt/metalk8s/addons/volumes/deployed.sls'),
     targets.TemplateFile(

salt/metalk8s/addons/ui/deployed/dependencies.sls

@@ -0,0 +1,55 @@
+#!kubernetes kubeconfig=/etc/kubernetes/admin.conf&context=kubernetes-admin@kubernetes
+
+kind: Service
+apiVersion: v1
+metadata:
+  name: kubernetes-api
+  namespace: metalk8s-ui
+  labels:
+    app: metalk8s-ui
+    app.kubernetes.io/managed-by: salt
+    app.kubernetes.io/name: metalk8s-ui
+    app.kubernetes.io/part-of: metalk8s
+    heritage: metalk8s
+spec:
+  type: ExternalName
+  externalName: kubernetes.default.svc.cluster.local
+  ports:
+    - name: https
+      port: 443
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: salt-api
+  namespace: metalk8s-ui
+  labels:
+    app: metalk8s-ui
+    app.kubernetes.io/managed-by: salt
+    app.kubernetes.io/name: metalk8s-ui
+    app.kubernetes.io/part-of: metalk8s
+    heritage: metalk8s
+spec:
+  type: ExternalName
+  externalName: salt-master.kube-system.svc.cluster.local
+  ports:
+    - name: https
+      port: 4507
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: prometheus-api
+  namespace: metalk8s-ui
+  labels:
+    app: metalk8s-ui
+    app.kubernetes.io/managed-by: salt
+    app.kubernetes.io/name: metalk8s-ui
+    app.kubernetes.io/part-of: metalk8s
+    heritage: metalk8s
+spec:
+  type: ExternalName
+  externalName: prometheus-operator-prometheus.metalk8s-monitoring.svc.cluster.local
+  ports:
+    - name: http
+      port: 9090

salt/metalk8s/addons/ui/deployed/ingress.sls

@@ -0,0 +1,78 @@
+#!kubernetes kubeconfig=/etc/kubernetes/admin.conf&context=kubernetes-admin@kubernetes
+
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: metalk8s-ui-proxies-https
+  namespace: metalk8s-ui
+  labels:
+    app: metalk8s-ui
+    app.kubernetes.io/managed-by: salt
+    app.kubernetes.io/name: metalk8s-ui
+    app.kubernetes.io/part-of: metalk8s
+    heritage: metalk8s
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: '/$2'
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+    kubernetes.io/ingress.class: "nginx-control-plane"
+spec:
+  rules:
+  - http:
+      paths:
+      - path: /api/kubernetes(/|$)(.*)
+        backend:
+          serviceName: kubernetes-api
+          servicePort: 443
+      - path: /api/salt(/|$)(.*)
+        backend:
+          serviceName: salt-api
+          servicePort: 4507
+---
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: metalk8s-ui-proxies-http
+  namespace: metalk8s-ui
+  labels:
+    app: metalk8s-ui
+    app.kubernetes.io/managed-by: salt
+    app.kubernetes.io/name: metalk8s-ui
+    app.kubernetes.io/part-of: metalk8s
+    heritage: metalk8s
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: '/$2'
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    kubernetes.io/ingress.class: "nginx-control-plane"
+spec:
+  rules:
+  - http:
+      paths:
+      - path: /api/prometheus(/|$)(.*)
+        backend:
+          serviceName: prometheus-api
+          servicePort: 9090
+---
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: metalk8s-ui
+  namespace: metalk8s-ui
+  labels:
+    app: metalk8s-ui
+    app.kubernetes.io/managed-by: salt
+    app.kubernetes.io/name: metalk8s-ui
+    app.kubernetes.io/part-of: metalk8s
+    heritage: metalk8s
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    kubernetes.io/ingress.class: "nginx-control-plane"
+spec:
+  rules:
+  - http:
+      paths:
+      - path: /
+        backend:
+          serviceName: metalk8s-ui
+          servicePort: 80

salt/metalk8s/addons/ui/deployed/init.sls

@@ -0,0 +1,5 @@
+include:
+- .namespace
+- .dependencies
+- .ui
+- .ingress

salt/metalk8s/addons/ui/deployed/namespace.sls

@@ -0,0 +1,10 @@
+#!kubernetes kubeconfig=/etc/kubernetes/admin.conf&context=kubernetes-admin@kubernetes
+
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: metalk8s-ui
+  labels:
+    app.kubernetes.io/managed-by: salt
+    app.kubernetes.io/part-of: metalk8s
+    heritage: metalk8s

salt/metalk8s/addons/ui/deployed.sls → salt/metalk8s/addons/ui/deployed/ui.sls

@@ -1,19 +1,9 @@
 include:
-  - .precheck
+- .namespace
 
 {%- set kubeconfig = "/etc/kubernetes/admin.conf" %}
 {%- set context = "kubernetes-admin@kubernetes" %}
 
-{%- set apiserver = 'https://' ~ pillar.metalk8s.api_server.host ~ ':6443' %}
-{%- set saltapi = 'https://' ~ pillar.metalk8s.endpoints['salt-master'].ip ~ ':' ~ pillar.metalk8s.endpoints['salt-master'].ports.api %}
-{%- set prometheus = 'http://' ~ grains.metalk8s.workload_plane_ip ~ ':30222'  %}
-
-Create metalk8s-ui namespace:
-  metalk8s_kubernetes.namespace_present:
-    - name: metalk8s-ui
-    - kubeconfig: {{ kubeconfig }}
-    - context: {{ context }}
-
 Create metalk8s-ui deployment:
   metalk8s_kubernetes.deployment_present:
     - name: metalk8s-ui
@@ -40,7 +30,7 @@ Create metalk8s-ui service:
           targetPort: 80
         selector:
           app: metalk8s-ui
-        type: NodePort
+        type: ClusterIP
 
 Create metalk8s-ui ConfigMap:
   metalk8s_kubernetes.configmap_present:
@@ -51,9 +41,9 @@ Create metalk8s-ui ConfigMap:
     - data:
         config.json: |
           {
-            "url": "{{ apiserver }}",
-            "url_salt": "{{ saltapi }}",
-            "url_prometheus": "{{ prometheus }}"
+            "url": "/api/kubernetes",
+            "url_salt": "/api/salt",
+            "url_prometheus": "/api/prometheus"
           }
 
 Create ui-branding ConfigMap:

salt/metalk8s/deployed.sls

@@ -8,3 +8,4 @@ include:
   - metalk8s.addons.nginx-ingress.deployed
   - metalk8s.addons.nginx-ingress-control-plane.deployed
   - metalk8s.addons.volumes.deployed
+  - metalk8s.addons.ui.deployed

salt/metalk8s/orchestrate/bootstrap/init.sls

@@ -154,26 +154,6 @@ Deploy Kubernetes objects:
   - require:
     - http: Wait for API server to be available
 
-Precheck for MetalK8s UI:
-  salt.runner:
-    - name: state.orchestrate
-    - mods:
-      - metalk8s.addons.ui.precheck
-    - saltenv: {{ saltenv }}
-    - retry:
-        attempts: 5
-    - require:
-      - salt: Deploy Kubernetes objects
-
-Deploy MetalK8s UI:
-  salt.runner:
-    - name: state.orchestrate
-    - mods:
-      - metalk8s.addons.ui.deployed
-    - saltenv: {{ saltenv }}
-    - require:
-      - salt: Precheck for MetalK8s UI
-
 Store MetalK8s version in annotations:
   metalk8s_kubernetes.namespace_annotation_present:
     - name: "kube-system"