Skip to content

Commit 8e96598

Browse files
michaelvlmichaelvl
authored
use crossplane v2 namespaced resources in gateway blueprint (#309)
* use crossplane v2 namespaced resources in gateway blueprint * update compatibility matrix
1 parent 9beb9ec commit 8e96598

File tree

2 files changed

+160
-74
lines changed

2 files changed

+160
-74
lines changed

‎blueprints/aws-alb-crossplane/README.md‎

Lines changed: 57 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -4,71 +4,81 @@ This blueprint builds a data-path that consists of the following AWS
44
infrastructure:
55

66
- Application load balancer (ALB).
7-
- Security group for ALB, together with ingress and egress rules (for
8-
both data and healthchecks).
7+
- Security group for ALB, together with ingress and egress rules (for both data
8+
and healthchecks).
99
- ALB target group
10-
- ALB listener definitions for both terminating TLS (port 443) and redirecting HTTP (port 80) to HTTPS.
10+
- ALB listener definitions for both terminating TLS (port 443) and redirecting
11+
HTTP (port 80) to HTTPS.
1112

1213
This definition also includes the following Kubernetes infrastructure:
1314

14-
- A 'child' `Gateway` using the *istio* `GatewayClass`. This creates
15-
an Istio ingress gateway.
16-
- `TargetGroupBinding` (an [AWS load balancer controller
17-
CRD](https://github.com/kubernetes-sigs/aws-load-balancer-controller/)
18-
for propagating Kubernetes endpoints for the Istio ingress gateway
19-
to the AWS ALB target group. This links the Kubernetes internal and
20-
AWS infrastructure.
15+
- A 'child' `Gateway` using the _istio_ `GatewayClass`. This creates an Istio
16+
ingress gateway.
17+
- `TargetGroupBinding` (an
18+
[AWS load balancer controller CRD](https://github.com/kubernetes-sigs/aws-load-balancer-controller/)
19+
for propagating Kubernetes endpoints for the Istio ingress gateway to the AWS
20+
ALB target group. This links the Kubernetes internal and AWS infrastructure.
2121
- Optional HorizontalPodAutoscaler
2222
- Optional PodDisruptionBudget
2323

24-
**Note** the ALB terminates TLS and forwards traffic un-encrypted to
25-
the Istio ingress gateway.
24+
**Note** the ALB terminates TLS and forwards traffic un-encrypted to the Istio
25+
ingress gateway.
2626

2727
This definition is provided in the following files:
2828

29-
- [`gatewayclassblueprint-aws-alb-crossplane.yaml`](gatewayclassblueprint-aws-alb-crossplane.yaml) blueprint for infrastructure implementation
30-
- [`gatewayclass-aws-alb-crossplane.yaml`](gatewayclass-aws-alb-crossplane.yaml) definitions of `GatewayClass`es referencing the above `GatewayClassBlueprint`. Three `GatewayClass`es are created, one that is intended for internet exposed gateways (`public`), one for internet exposed gateways but access limited by e.g. ACLs (`private`) and one for non internet exposed gateways (`internal`).
31-
- [`gatewayclassconfig-aws-alb-crossplane-dev-env.yaml`](../../test-data/gatewayclassconfig-aws-alb-crossplane-dev-env.yaml) example settings for the three `GatewayClass`es defined in `gatewayclass-aws-alb-crossplane.yaml`, i.e. with different subnet settings for the internet-exposed and non internet-exposed `GatewayClass'es.
29+
- [`gatewayclassblueprint-aws-alb-crossplane.yaml`](gatewayclassblueprint-aws-alb-crossplane.yaml)
30+
blueprint for infrastructure implementation
31+
- [`gatewayclass-aws-alb-crossplane.yaml`](gatewayclass-aws-alb-crossplane.yaml)
32+
definitions of `GatewayClass`es referencing the above `GatewayClassBlueprint`.
33+
Three `GatewayClass`es are created, one that is intended for internet exposed
34+
gateways (`public`), one for internet exposed gateways but access limited by
35+
e.g. ACLs (`private`) and one for non internet exposed gateways (`internal`).
36+
- [`gatewayclassconfig-aws-alb-crossplane-dev-env.yaml`](../../test-data/gatewayclassconfig-aws-alb-crossplane-dev-env.yaml)
37+
example settings for the three `GatewayClass`es defined in
38+
`gatewayclass-aws-alb-crossplane.yaml`, i.e. with different subnet settings
39+
for the internet-exposed and non internet-exposed `GatewayClass'es.
3240
- [`gatewayclassblueprint-crossplane-aws-alb-values.yaml`](../../charts/bifrost-gateway-controller/ci/gatewayclassblueprint-crossplane-aws-alb-values.yaml)
33-
RBAC for bifrost-gateway-controller Helm deployment suited for the `aws-alb-crossplane` blueprint.
41+
RBAC for bifrost-gateway-controller Helm deployment suited for the
42+
`aws-alb-crossplane` blueprint.
3443

3544
### TargetGroup name limit
3645

37-
The `TargetGroup` resource in AWS has a character limit of 32 in AWS. This doesn't leave a lot of room for identifiers in the name. For this reason, the generated name (the format of which is `gw-<NAMESPACE>-<NAME>`) will be cut off at 25 characters, and then appended with the first 6 characters of the SHA1 of the entire name. This should ensure uniqueness of names, while also forcing conforming to the 32 character limit.
46+
The `TargetGroup` resource in AWS has a character limit of 32 in AWS. This
47+
doesn't leave a lot of room for identifiers in the name. For this reason, the
48+
generated name (the format of which is `gw-<NAMESPACE>-<NAME>`) will be cut off
49+
at 25 characters, and then appended with the first 6 characters of the SHA1 of
50+
the entire name. This should ensure uniqueness of names, while also forcing
51+
conforming to the 32 character limit.
3852

39-
Because of this method, the name of `TargetGroups` might not always contain the full `name` and `namespace` of the corresponding Kubernetes resource. For this reason, these resources in AWS will also be tagged with `bifrost-gateway-controller/targetgroup_name` and `bifrost-gateway-controller/targetgroup_namespace`.
53+
Because of this method, the name of `TargetGroups` might not always contain the
54+
full `name` and `namespace` of the corresponding Kubernetes resource. For this
55+
reason, these resources in AWS will also be tagged with
56+
`bifrost-gateway-controller/targetgroup_name` and
57+
`bifrost-gateway-controller/targetgroup_namespace`.
4058

4159
## Compatibility
4260

43-
This blueprint use AWS Crossplane resources through the [Upbound AWS
44-
Provider](https://marketplace.upbound.io/providers/upbound/provider-aws). The
45-
following compatibility between this blueprint, Crossplane, Crossplane
61+
This blueprint use AWS Crossplane resources through the
62+
[Upbound AWS Provider](https://marketplace.upbound.io/providers/upbound/provider-aws).
63+
The following compatibility between this blueprint, Crossplane, Crossplane
4664
Upbound AWS provider and Istio versions has been verified:
4765

48-
| Bifrost/Blueprint | AWS Provider | Crossplane | Istio | Status |
49-
| ----------------- | ------------ | ---------- | ----- | ------ |
50-
| `0.0.18` | `v0.28.0` | `v1.11.0` | `1.16.1` | :heavy_check_mark: |
51-
| `0.0.18` | `v0.32.1` | `v1.11.0` | `1.16.1` | :x: |
52-
| `0.0.18` | `v0.33.0` | `v1.11.0` | `1.16.1` | :heavy_check_mark: |
53-
| `0.0.19` | `v0.33.0` | `v1.11.0` | `1.16.1` | :heavy_check_mark: |
54-
| `0.0.20` | `v0.33.0` | `v1.11.0` | `1.17.2` | :x: (*) |
55-
| `0.0.21` | `v0.33.0` | `v1.11.0` | `1.17.2` | :heavy_check_mark: |
56-
| `0.0.21` | `v0.36.0` | `v1.12.2` | `1.18.0` | :heavy_check_mark: (**) |
57-
58-
(*) In Istio [1.17.0 Gateway naming convention was changed](https://istio.io/latest/news/releases/1.17.x/announcing-1.17/change-notes/) to be a concatenation of Gateway `Name` and `GatewayClass`.
59-
60-
(**) From this time, we switched from using a monolothic AWS provider to using provider families. Details are in make target `deploy-crossplane-aws-provider`.
66+
| Bifrost/Blueprint | AWS Provider | Crossplane | Istio | Status |
67+
| ----------------- | --------------------------------- | ----------------- | -------- | ------------------ |
68+
| `0.0.24` | `v1.23.0-crossplane-v2-preview.0` | `2.0.0-preview.1` | `1.26.1` | :heavy_check_mark: |
6169

6270
## Testing AWS/Crossplane/Istio Blueprint
6371

64-
This section describes how to test the blueprint using different
65-
version of the dependencies.
72+
This section describes how to test the blueprint using different version of the
73+
dependencies.
6674

6775
### Prerequisite
6876

6977
- A Kubernetes cluster.
70-
- IAM roles for Crossplane to interact with AWS (see make target `deploy-crossplane-aws-provider`).
71-
- IAM role for AWS load balancer controller (see make target `deploy-aws-load-balancer-controller`)
78+
- IAM roles for Crossplane to interact with AWS (see make target
79+
`deploy-crossplane-aws-provider`).
80+
- IAM role for AWS load balancer controller (see make target
81+
`deploy-aws-load-balancer-controller`)
7282
- A TLS certificate and associated domain name (see below).
7383

7484
Specifically these environment variables should be provided:
@@ -84,7 +94,8 @@ export CERTIFICATE_ARN=
8494

8595
### Deploying Dependencies
8696

87-
Deploy dependencies with the make targets shown below. Version information can be left out to use default versions:
97+
Deploy dependencies with the make targets shown below. Version information can
98+
be left out to use default versions:
8899

89100
```bash
90101
make deploy-gateway-api
@@ -103,12 +114,11 @@ BIFROST_BLUEPRINTS_VERSION=0.0.21 make deploy-aws-istio-blueprint
103114
```
104115

105116
Note, there is also a `deploy-aws-istio-blueprint-local` make target to deploy
106-
local repository blueprint version which is useful when developing
107-
blueprints.
117+
local repository blueprint version which is useful when developing blueprints.
108118

109-
A `GatewayClassConfig` is also needed - because it is very environment
110-
specific, this guide does not describe how to prepare it. Additionally,
111-
a namespace-default `GatewayClassConfig` may be needed:
119+
A `GatewayClassConfig` is also needed - because it is very environment specific,
120+
this guide does not describe how to prepare it. Additionally, a
121+
namespace-default `GatewayClassConfig` may be needed:
112122

113123
```bash
114124
make deploy-namespace-gatewayclassconfig
@@ -120,9 +130,9 @@ Deploy the getting-started use-case:
120130
GATEWAY_CLASS_NAME=aws-alb-crossplane-public make deploy-getting-started-usecase
121131
```
122132

123-
Test the deployed data-path when resources are ready (use
124-
e.g. `hack/demo/show-resources.sh` to observe status). Particularly
125-
watch for an address on `foo-gateway`.
133+
Test the deployed data-path when resources are ready (use e.g.
134+
`hack/demo/show-resources.sh` to observe status). Particularly watch for an
135+
address on `foo-gateway`.
126136

127137
```bash
128138
hack/demo/curl.sh $DOMAIN # Where DOMAIN is as defined above

0 commit comments

Comments
 (0)