[incubator/argo-ingress] Import new chart for CloudFlare Ingress Controller

incubator/argo-ingress/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

incubator/argo-ingress/Chart.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+name: argo-ingress
+version: 0.5.2
+home: https://developers.cloudflare.com/argo-tunnel/
+description: Installs the cloudflare argo tunnel ingress controller
+maintainers:
+  - name: Nathan Franzen
+    email: nate@stackpointcloud.com

incubator/argo-ingress/Makefile

@@ -0,0 +1,2 @@
+update:
+	curl -sSL https://github.com/cloudflare/cloudflare-ingress-controller/archive/master.tar.gz -o - | tar --strip-components=2 --overwrite -zvx  */chart

incubator/argo-ingress/README.md

@@ -0,0 +1,57 @@
+# Cloudflare Argo Tunnel ingress controller Helm chart
+
+## Cloudflare Argo Tunnel
+
+The Cloudflare Argo Tunnel Ingress Controller makes connections between a Kubernetes
+service and the Cloudflare edge, exposing an application in your cluster to the
+internet at a hostname of your choice. A quick description of the details can be
+found at https://developers.cloudflare.com/argo-tunnel/quickstart/ and
+https://github.com/cloudflare/cloudflare-ingress-controller.
+
+**Note:** Before installing Cloudflare Argo Tunnel you need to obtain Cloudflare
+credentials for your domain zone. The credentials are obtained wtih use of the cloudflared
+application, available from https://developers.cloudflare.com/argo-tunnel/downloads/
+
+
+To deploy Cloudflare Argo Tunnel Ingress Controller:
+
+```
+### set these variables to match your situation
+DOMAIN=mydomain.com
+
+CERT_FILE=$HOME/.cloudflared/cert.pem
+CERT_B64=$(base64 $CERT_FILE)
+
+NS="argo"
+USE_RBAC=true
+###
+
+RELEASE_NAME="argo-$DOMAIN"
+
+helm install --name $RELEASE_NAME --namespace $NS \
+   --set rbac.install=$USE_RBAC \
+   --set secret.install=true,secret.domain=$DOMAIN,secret.certificate_b64=$CERT_B64 \
+   chart/
+```
+
+
+Check that pods are running:
+
+```bash
+kubectl -n argo get pods
+NAME                                                    READY     STATUS    RESTARTS   AGE
+cloudflare-argo-ingress-cloudflare-argo-ingress-3061065498-v6mw5   1/1       Running   0          1m
+```
+
+## Testing external access
+
+Now you should be able to check argo at https://argo.mydomain.com/
+And if you noticed Cloudflare Argo Tunnel creates `https` connection by default :-)
+
+## Remove
+
+The release can be cleaned up with helm:
+
+```bash
+helm delete --purge  $RELEASE_NAME
+```

incubator/argo-ingress/templates/NOTES.txt

@@ -0,0 +1,56 @@
+
+{{ if .Values.secret.install }}
+The Cloudflare Argo Tunnel Ingress Controller is configured with a
+set of credentials assigned the domain {{ .Values.secret.domain }}
+{{ else }}
+The Cloudflare Argo Tunnel Ingress Controller requires a set of credentials
+installed as a secret labeled with the domain {{ .Values.secret.domain }}
+
+Obtain the credentials for your cloudflare domain using the _cloudflared_ binary
+See https://developers.cloudflare.com/argo-tunnel/quickstart/ for more documentation.
+
+Create and label the secret. The name of the secret is arbitrary, but it must be labeled
+with the correct cloudflare domain ({{ .Values.secret.domain }}).
+
+kubectl --namespace={{ .Release.Namespace }} \
+    create secret generic cloudflared-cert-{{ .Values.secret.domain | replace "." "-"}} \
+    --from-file=cert.pem=$HOME/.cloudflared/cert.pem
+
+kubectl --namespace={{ .Release.Namespace }} \
+     label secret cloudflared-cert-{{ .Values.secret.domain | replace "." "-"}}\
+     cloudflare-argo/domain={{ .Values.secret.domain }}
+
+{{ end }}
+
+{{ if .Values.loadbalancing.enabled }}
+The cloudflare ingress controller has been installed as a deployment of {{ .Values.replicaCount }} pod(s)
+replicas, and traffic can routed to them through a cloudflare loadbalancer.  The use of a loadbalancer
+is enabled by the presence of an annotation on the ingress, `argo.cloudflare.com/lb-pool` whose
+value should be the name of the service.
+{{- else }}
+The cloudflare ingress controller has been installed as a deployment with a single pod and traffic
+is being routed through a cloudflare hostname without loadbalancing.
+{{- end }}
+
+To set up a argo tunnel to your service, install an ingress of this form:
+
+    apiVersion: extensions/v1beta1
+    kind: Ingress
+    metadata:
+      annotations:
+        kubernetes.io/ingress.class: argo-tunnel
+        {{- if .Values.loadbalancing.enabled }}
+        argo.cloudflare.com/lb-pool: [NAME OF SERVICE]
+        {{- end }}
+      name: [NAME OF INGRESS]
+      namespace: {{ .Release.Namespace }}
+    spec:
+      rules:
+      - host: [NAME].{{ .Values.secret.domain }}
+        http:
+          paths:
+          - backend:
+              serviceName: [NAME OF SERVICE]
+              servicePort: [SERVICE PORT]
+
+For more information, visit https://developers.cloudflare.com/argo-tunnel/

incubator/argo-ingress/templates/_helpers.tpl

@@ -0,0 +1,20 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "cloudflare-argo-ingress.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "cloudflare-argo-ingress.fullname" -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}

incubator/argo-ingress/templates/deployment.yaml

@@ -0,0 +1,54 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: {{ template "cloudflare-argo-ingress.fullname" . }}
+  labels:
+    app: {{ template "cloudflare-argo-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  {{- if .Values.loadbalancing.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- else }}
+  replicas: 1
+  {{- end }}
+  template:
+    metadata:
+      labels:
+        app: {{ template "cloudflare-argo-ingress.name" . }}
+        release: {{ .Release.Name }}
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app
+                  operator: In
+                  values:
+                  - {{ template "cloudflare-argo-ingress.name" . }}
+              topologyKey: kubernetes.io/hostname
+      containers:
+        - name: {{ .Chart.Name }}
+          command:
+          - /argot
+          - --v={{ .Values.logging.level }}
+          - --namespace
+          - {{ .Release.Namespace }}
+{{- if .Values.handledIngressClass }}
+          - --ingressClass
+          - {{ .Values.handledIngressClass }}
+{{- end }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
+    {{- if .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+    {{- end }}
+      serviceAccount: {{ .Values.rbac.serviceAccount }}
+      serviceAccountName: {{ .Values.rbac.serviceAccount }}

incubator/argo-ingress/templates/rbac-clusterrole.yaml

@@ -0,0 +1,25 @@
+{{ if .Values.rbac.install }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name:  {{ .Values.rbac.roleName }}
+rules:
+- apiGroups:
+  - ""
+  - "extensions"
+  resources:
+  - endpoints
+  - services
+  - ingresses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - "extensions"
+  resources:
+  - ingresses/status
+  verbs:
+  - get
+  - update
+{{ end }}

incubator/argo-ingress/templates/rbac-clusterrolebinding.yaml

@@ -0,0 +1,14 @@
+{{ if .Values.rbac.install }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Values.rbac.roleName }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.rbac.roleName }}
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.rbac.serviceAccount }}
+  namespace: {{ .Release.Namespace }}
+{{ end }}

incubator/argo-ingress/templates/secret.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.secret.install }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflared-cert-{{ .Values.secret.domain | replace "." "-"  }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "cloudflare-argo-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    cloudflare-argo/domain: {{ .Values.secret.domain }}
+type: Opaque
+data:
+  cert.pem: |-
+    {{ .Values.secret.certificate_b64 }}
+{{ end }}

incubator/argo-ingress/templates/serviceaccount.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.rbac.serviceAccount }}

incubator/argo-ingress/values.yaml

@@ -0,0 +1,47 @@
+# Default values for cloudflare-argo-ingress.
+
+# replicaCount is used only when cloudflare loadbalancing is enabled
+replicaCount: 1
+
+image:
+  repository: gcr.io/stackpoint-public/argot
+  tag: 0.5.2
+  pullPolicy: IfNotPresent
+
+## configure the ingressClass value in order to manage different ingress-controller 
+## deployments each for a different set of ingresses
+## if not set, defaults to the value "argo-tunnel"
+# handledIngressClass: argo-tunnel-custom-value
+
+resources:
+  limits:
+    cpu: 100m
+    memory: 128Mi
+  requests:
+    cpu: 100m
+    memory: 128Mi
+
+rbac:
+  install: true
+  serviceAccount: cloudflare-argo
+  roleName: cloudflare-argo
+
+# Application logging level, higher values give more verbose output
+logging:
+  level: 2
+
+## Cloudflare account details
+
+# The secret contains the base64-encoded origin certificate for your cloudflare domain.
+# Set the install flag false to configure manually in the cluster later.
+# See https://developers.cloudflare.com/argo-tunnel/quickstart/quickstart/ for information on
+# obtaining the origin certificate
+secret:
+  install: false
+  domain: example.co
+  certificate_b64: LS0tLS1CRUdJT...insert base64-encoded certificate here
+
+# Loadbalancing support depends upon the cloudflare account settings
+loadbalancing:
+  enabled: false
+