Skip to content

Commit

Permalink
feat(istio): Add Virtual service and basic Ingress support
Browse files Browse the repository at this point in the history
  • Loading branch information
yyvess committed Jan 26, 2024
1 parent 1781867 commit 96ec259
Show file tree
Hide file tree
Showing 35 changed files with 1,959 additions and 579 deletions.
27 changes: 10 additions & 17 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,11 @@
# keycloak

A [timoni.sh](http://timoni.sh) module for deploying keycloak to Kubernetes clusters.
A [timoni.sh](http://timoni.sh) module for deploying [keycloak](https://www.keycloak.org/) on Kubernetes clusters.

> [!IMPORTANT]
> Note that module in under development and is still in its infancy.
> Any feedback and PR are welcome

## Install

Expand All @@ -22,6 +27,9 @@ timoni -n keycloak apply keycloak oci://ghcr.io/yyvess/keycloak \
--values ./my-values.cue
```

By default, the server uses the dev-file database. This is the default database that the server will use to persist data and only exists for development use-cases. The dev-file database **is not suitable for production use-cases**, and must be replaced before deploying to production.


## Uninstall

To uninstall an instance and delete all its Kubernetes resources:
Expand All @@ -32,19 +40,4 @@ timoni -n keycloak delete keycloak

## Configuration

| Key | Type | Default | Description |
|--------------------------|----------------------------------|--------------------|----------------------------------------------------------------------------------------------------------------------------------------------|
| `image: tag:` | `string` | `<latest version>` | Container image tag |
| `image: digest:` | `string` | `""` | Container image digest, takes precedence over `tag` when specified |
| `image: repository:` | `string` | `docker.io/nginx` | Container image repository |
| `image: pullPolicy:` | `string` | `IfNotPresent` | [Kubernetes image pull policy](https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy) |
| `metadata: labels:` | `{[ string]: string}` | `{}` | Common labels for all resources |
| `metadata: annotations:` | `{[ string]: string}` | `{}` | Common annotations for all resources |
| `pod: annotations:` | `{[ string]: string}` | `{}` | Annotations applied to pods |
| `pod: affinity:` | `corev1.#Affinity` | `{}` | [Kubernetes affinity and anti-affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) |
| `pod: imagePullSecrets:` | `[...timoniv1.#ObjectReference]` | `[]` | [Kubernetes image pull secrets](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod) |
| `replicas:` | `int` | `1` | Kubernetes deployment replicas |
| `resources:` | `timoniv1.#ResourceRequirements` | `{}` | [Kubernetes resource requests and limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers) |
| `securityContext:` | `corev1.#SecurityContext` | `{}` | [Kubernetes container security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context) |
| `service: annotations:` | `{[ string]: string}` | `{}` | Annotations applied to the Kubernetes Service |
| `service: port:` | `int` | `80` | Kubernetes Service HTTP port |
Look samples on test folder
123 changes: 123 additions & 0 deletions cue.mod/gen/extensions.istio.io/wasmplugin/v1alpha1/types_gen.cue
Original file line number Diff line number Diff line change
@@ -0,0 +1,123 @@
// Code generated by timoni. DO NOT EDIT.

//timoni:generate timoni vendor crd -f https://raw.githubusercontent.com/istio/istio/master/manifests/charts/base/crds/crd-all.gen.yaml

package v1alpha1

import (
"strings"
"list"
)

#WasmPlugin: {
// Extend the functionality provided by the Istio proxy through
// WebAssembly filters. See more details at:
// https://istio.io/docs/reference/config/proxy_extensions/wasm-plugin.html
spec!: #WasmPluginSpec
apiVersion: "extensions.istio.io/v1alpha1"
kind: "WasmPlugin"
metadata!: {
name!: strings.MaxRunes(253) & strings.MinRunes(1) & {
string
}
namespace!: strings.MaxRunes(63) & strings.MinRunes(1) & {
string
}
labels?: {
[string]: string
}
annotations?: {
[string]: string
}
}
}

// Extend the functionality provided by the Istio proxy through
// WebAssembly filters. See more details at:
// https://istio.io/docs/reference/config/proxy_extensions/wasm-plugin.html
#WasmPluginSpec: {
// Specifies the failure behavior for the plugin due to fatal
// errors.
failStrategy?: "FAIL_CLOSE" | "FAIL_OPEN"

// The pull behaviour to be applied when fetching Wasm module by
// either OCI image or http/https.
imagePullPolicy?: "UNSPECIFIED_POLICY" | "IfNotPresent" | "Always"

// Credentials to use for OCI image pulling.
imagePullSecret?: strings.MaxRunes(253) & strings.MinRunes(1)

// Specifies the criteria to determine which traffic is passed to
// WasmPlugin.
match?: [...{
// Criteria for selecting traffic by their direction.
mode?: "UNDEFINED" | "CLIENT" | "SERVER" | "CLIENT_AND_SERVER"

// Criteria for selecting traffic by their destination port.
ports?: [...{
number: uint16 & >=1
}]
}]

// Determines where in the filter chain this `WasmPlugin` is to be
// injected.
phase?: "UNSPECIFIED_PHASE" | "AUTHN" | "AUTHZ" | "STATS"

// The configuration that will be passed on to the plugin.
pluginConfig?: {
...
}

// The plugin name to be used in the Envoy configuration (used to
// be called `rootID`).
pluginName?: strings.MaxRunes(256) & strings.MinRunes(1)

// Determines ordering of `WasmPlugins` in the same `phase`.
priority?: null | int
selector?: {
// One or more labels that indicate a specific set of pods/VMs on
// which a policy should be applied.
matchLabels?: {
[string]: string
}
}

// SHA256 checksum that will be used to verify Wasm module or OCI
// container.
sha256?: =~"(^$|^[a-f0-9]{64}$)"

// Optional.
targetRef?: {
// group is the group of the target resource.
group?: string

// kind is kind of the target resource.
kind?: string

// name is the name of the target resource.
name?: string

// namespace is the namespace of the referent.
namespace?: string
}

// Specifies the type of Wasm Extension to be used.
type?: "UNSPECIFIED_PLUGIN_TYPE" | "HTTP" | "NETWORK"

// URL of a Wasm module or OCI container.
url: strings.MinRunes(1)
verificationKey?: string
vmConfig?: {
// Specifies environment variables to be injected to this VM.
env?: list.MaxItems(256) & [...{
// Name of the environment variable.
name: strings.MaxRunes(256) & strings.MinRunes(1)

// Value for the environment variable.
value?: strings.MaxRunes(2048)

// Source for the environment variable's value.
valueFrom?: "INLINE" | "HOST"
}]
}
}
Loading

0 comments on commit 96ec259

Please sign in to comment.