Zones parameters#
This documentation describes parameters that can be filled with zones
Kubernetes#
On cluster zones only A kubernetes parameter is automatically generated for a cluster zone. It is possible to fully override it:
"kub-10007": {
type: "cluster"
parameters: kubernetes: cluster_version: "1.25"
parameters: kubernetes: pools: {
"ingress-controller": {
labels: "caascad.io/nodepool": "ingress-controller"
flavor_id: "s3.2xlarge.4"
availability_zone: "eu-west-0a"
min_nodes: 2
max_nodes: 2
desired_nodes: 2
}
}
}
Loadbalancers#
How does this work#
A loadbalancer parameter can be provided on clusters or services zones.
When it is provided on clusters zones, the cluster zone run list will be populated with fe_loadbalancer_v3, fe_whitelist and ingress_controller_(Loadbalancer name) configurations.
When it is provided on service zones, the cluster zone carrying the service zone will have its own parameter loadbalancer automatically filled with those of the service zones.
Several loadbalancers can be provided this way.
Loadbalancers declaration#
Loadbalancers can be declared this way in zones definitions:
"svc-signon-stg": {
parameters: loadbalancers: lb1: _ // will provider loadbalancer, ingress controller and whitelist
parameters: loadbalancers: lb2: ingress_controller: false // will deploy only loadbalancer and whitelist
}
Loadbalancers parameter is a map where first level attributes are loadbalancer names:
parameters: loadbalancers: (LoadbalancerName): _
If the loadbalancer is to be used without ingress controllers:
parameters: loadbalancers: (LoadbalancerName): ingress_controller: false
Applying ACL to the LB#
If you use the specific word private for the loadbalancer name, then your loadbalancer will automatically inherit from an acl policy already declared in ${ENVS_NG}/contexts/ngot/fe_whitelist.cue. The ACL applied to loadbalancers whose name is `private`` let Orange VPN, the whole NGOT line and infra zone pass.
If you need specific ACL you will have to declare a loadbalancer with a name different than private and describe its ACL in ${ENVS_NG}/contexts/ngot/fe_whitelist.cue:
"<YOUR LB NAME>-\(zone.name)": {
// example to secure TCP/443
"TCP/443": {
one_acl: "<comma separated IP list>"
}
//other rules comes here
//...
}
Deploying loadbalancers#
When a service zone is declared in ngot_zones with loadbalancers, the cluster zone must apply some configurations before the service zones is provisioned:
ZONE_NAME="<your zone name>" # example ZONE_NAME="svc-signon-stg"
cd ${ENVS_NG}/zones/ngot_zones
INGRESSES=($(cue export | jq --arg ZONE_NAME ${ZONE_NAME} -r '.zones[$ZONE_NAME].parameters.loadbalancers|to_entries[]|" -c ingress_controller_v2_\(.key)"'))
CLUSTER_ZONE="$(cue export | jq --arg ZONE_NAME ${ZONE_NAME} -r '.zones[$ZONE_NAME].cluster_zone_name')"
echo "INGRESSES=${INGRESSES[@]}"
echo "CLUSTER_ZONE=${CLUSTER_ZONE}"
cd ${ENVS_NG}/context/ngot
# Verify the command to execute:
cat <<EOC
trackbone apply -z "${CLUSTER_ZONE}" \
-c fe_loadbalancer_v3 \
-c fe_whitelist \
${INGRESSES[@]}
EOC
Run the command printed above or copy/paste it to a CAASCHR.
In the case where you would move from one loadbalancer to another one for an envs-ng configuration, and if the first loadbalancer should remain (for other configurations), the commands become:
trackbone apply -z ${CLUSTER} -c fe_loadbalancer_v3 --non-interactive
trackbone apply -z ${CLUSTER} -c ingress_controller_v2_${NEW} --non-interactive
trackbone apply -z ${CLUSTER} -c ingress_controller_v2_${OLD} --non-interactive
trackbone apply -z ${CLUSTER} -c fe_whitelist
trackbone apply -z ${ZONE_NAME} -c <your configuration>
In the case where you would move from one loadbalancer back to private (or public) , the commands become:
git switch master
# DO NOT DESTROY private OR public.
# ONLY DESTROY A NAMED LB
trackbone destroy -z ${CLUSTER} -c ingress_controller_v2_${OLD} --non-interactive
kubectl -n kube-system edit cm coredns # remove the old lines; this is a bug in envs-ng (22/11/2024): it will not do it for you
kubectl -n kube-system rollout restart deployment/coredns
git switch <your working branch>
trackbone apply -z ${CLUSTER} -c fe_loadbalancer_v3 --non-interactive
trackbone apply -z ${CLUSTER} -c ingress_controller_v2_${NEW} --non-interactive
trackbone apply -z ${CLUSTER} -c fe_whitelist
trackbone apply -z ${ZONE_NAME} -c <your configuration>
kswitch ${CLUSTER}
kubectl -n ingress-nginx-v2-${OLD} get all # Check that the namespace is empty
kubectl delete ns ingress-nginx-v2-${OLD}
Warning
Do not destroy the LB / ingress controllers for private or public.
This only applies for other LB / ingress controllers.