mirror of
https://github.com/gitpod-io/gitpod.git
synced 2025-12-08 17:36:30 +00:00
52a7727b4f
* [node-labeler] Refactor node labeling to use taints instead of labels * [agent-smith] Add toleration to daemonset * Add workspace component tolerations to various Gitpod components if it running in Full installation * Apply suggestions from code review Co-authored-by: Kyle Brennan <kyle@gitpod.io> * Update components/node-labeler/cmd/run.go Co-authored-by: Kyle Brennan <kyle@gitpod.io> --------- Co-authored-by: Kyle Brennan <kyle@gitpod.io>
298 lines
9.9 KiB
Go
298 lines
9.9 KiB
Go
// Copyright (c) 2021 Gitpod GmbH. All rights reserved.
|
|
// Licensed under the GNU Affero General Public License (AGPL).
|
|
// See License.AGPL.txt in the project root for license information.
|
|
|
|
package proxy
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/gitpod-io/gitpod/common-go/baseserver"
|
|
"github.com/gitpod-io/gitpod/installer/pkg/cluster"
|
|
"github.com/gitpod-io/gitpod/installer/pkg/config/v1/experimental"
|
|
|
|
"github.com/gitpod-io/gitpod/installer/pkg/common"
|
|
|
|
appsv1 "k8s.io/api/apps/v1"
|
|
corev1 "k8s.io/api/core/v1"
|
|
"k8s.io/apimachinery/pkg/api/resource"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/runtime"
|
|
"k8s.io/apimachinery/pkg/util/intstr"
|
|
"k8s.io/utils/pointer"
|
|
)
|
|
|
|
func deployment(ctx *common.RenderContext) ([]runtime.Object, error) {
|
|
labels := common.CustomizeLabel(ctx, Component, common.TypeMetaDeployment)
|
|
|
|
var hashObj []runtime.Object
|
|
if objs, err := configmap(ctx); err != nil {
|
|
return nil, err
|
|
} else {
|
|
hashObj = append(hashObj, objs...)
|
|
}
|
|
|
|
prometheusPort := corev1.ContainerPort{
|
|
ContainerPort: baseserver.BuiltinMetricsPort,
|
|
Name: baseserver.BuiltinMetricsPortName,
|
|
}
|
|
|
|
volumes := []corev1.Volume{{
|
|
Name: "vhosts",
|
|
VolumeSource: corev1.VolumeSource{
|
|
ConfigMap: &corev1.ConfigMapVolumeSource{
|
|
LocalObjectReference: corev1.LocalObjectReference{Name: fmt.Sprintf("%s-config", Component)},
|
|
},
|
|
},
|
|
}, {
|
|
Name: "config-certificates",
|
|
VolumeSource: corev1.VolumeSource{
|
|
Secret: &corev1.SecretVolumeSource{
|
|
SecretName: ctx.Config.Certificate.Name,
|
|
},
|
|
},
|
|
},
|
|
common.CAVolume(),
|
|
}
|
|
|
|
volumeMounts := []corev1.VolumeMount{{
|
|
Name: "vhosts",
|
|
MountPath: "/etc/caddy/vhosts",
|
|
}, {
|
|
Name: "config-certificates",
|
|
MountPath: "/etc/caddy/certificates",
|
|
},
|
|
common.CAVolumeMount()}
|
|
|
|
if pointer.BoolDeref(ctx.Config.ContainerRegistry.InCluster, false) {
|
|
volumes = append(volumes, corev1.Volume{
|
|
Name: RegistryAuthSecret,
|
|
VolumeSource: corev1.VolumeSource{
|
|
Secret: &corev1.SecretVolumeSource{
|
|
SecretName: RegistryAuthSecret,
|
|
},
|
|
},
|
|
}, corev1.Volume{
|
|
Name: RegistryTLSCertSecret,
|
|
VolumeSource: corev1.VolumeSource{
|
|
Secret: &corev1.SecretVolumeSource{
|
|
SecretName: RegistryTLSCertSecret,
|
|
},
|
|
},
|
|
})
|
|
volumeMounts = append(volumeMounts, corev1.VolumeMount{
|
|
Name: RegistryAuthSecret,
|
|
MountPath: "/etc/caddy/registry-auth",
|
|
}, corev1.VolumeMount{
|
|
Name: RegistryTLSCertSecret,
|
|
MountPath: "/etc/caddy/registry-certs",
|
|
})
|
|
|
|
if objs, err := common.DockerRegistryHash(ctx); err != nil {
|
|
return nil, err
|
|
} else {
|
|
hashObj = append(hashObj, objs...)
|
|
}
|
|
}
|
|
|
|
configHash, err := common.ObjectHash(hashObj, nil)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
var frontendDevEnabled bool
|
|
var trustedSegmentKey string
|
|
var untrustedSegmentKey string
|
|
var segmentEndpoint string
|
|
_ = ctx.WithExperimental(func(cfg *experimental.Config) error {
|
|
if cfg.WebApp != nil && cfg.WebApp.ProxyConfig != nil {
|
|
frontendDevEnabled = cfg.WebApp.ProxyConfig.FrontendDevEnabled
|
|
if cfg.WebApp.ProxyConfig.AnalyticsPlugin != nil {
|
|
trustedSegmentKey = cfg.WebApp.ProxyConfig.AnalyticsPlugin.TrustedSegmentKey
|
|
untrustedSegmentKey = cfg.WebApp.ProxyConfig.AnalyticsPlugin.UntrustedSegmentKey
|
|
segmentEndpoint = cfg.WebApp.ProxyConfig.AnalyticsPlugin.SegmentEndpoint
|
|
}
|
|
}
|
|
if cfg.WebApp != nil && cfg.WebApp.ProxyConfig != nil && cfg.WebApp.ProxyConfig.Configcat != nil && cfg.WebApp.ProxyConfig.Configcat.FromConfigMap != "" {
|
|
volumes = append(volumes, corev1.Volume{
|
|
Name: "configcat",
|
|
VolumeSource: corev1.VolumeSource{
|
|
ConfigMap: &corev1.ConfigMapVolumeSource{
|
|
LocalObjectReference: corev1.LocalObjectReference{Name: cfg.WebApp.ProxyConfig.Configcat.FromConfigMap},
|
|
Optional: pointer.Bool(true),
|
|
},
|
|
},
|
|
})
|
|
volumeMounts = append(volumeMounts, corev1.VolumeMount{
|
|
Name: "configcat",
|
|
MountPath: "/data/configcat",
|
|
})
|
|
}
|
|
return nil
|
|
})
|
|
|
|
const kubeRbacProxyContainerName = "kube-rbac-proxy"
|
|
return []runtime.Object{
|
|
&appsv1.Deployment{
|
|
TypeMeta: common.TypeMetaDeployment,
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
Name: Component,
|
|
Namespace: ctx.Namespace,
|
|
Labels: labels,
|
|
Annotations: common.CustomizeAnnotation(ctx, Component, common.TypeMetaDeployment),
|
|
},
|
|
Spec: appsv1.DeploymentSpec{
|
|
Selector: &metav1.LabelSelector{MatchLabels: common.DefaultLabels(Component)},
|
|
Replicas: common.Replicas(ctx, Component),
|
|
Strategy: common.DeploymentStrategy,
|
|
Template: corev1.PodTemplateSpec{
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
Name: Component,
|
|
Namespace: ctx.Namespace,
|
|
Labels: labels,
|
|
Annotations: common.CustomizeAnnotation(ctx, Component, common.TypeMetaDeployment, func() map[string]string {
|
|
return map[string]string{
|
|
common.AnnotationConfigChecksum: configHash,
|
|
}
|
|
}),
|
|
},
|
|
Spec: corev1.PodSpec{
|
|
Affinity: cluster.WithNodeAffinityHostnameAntiAffinity(Component, cluster.AffinityLabelMeta),
|
|
TopologySpreadConstraints: cluster.WithHostnameTopologySpread(Component),
|
|
PriorityClassName: common.SystemNodeCritical,
|
|
ServiceAccountName: Component,
|
|
EnableServiceLinks: pointer.Bool(false),
|
|
DNSPolicy: corev1.DNSClusterFirst,
|
|
RestartPolicy: corev1.RestartPolicyAlways,
|
|
TerminationGracePeriodSeconds: pointer.Int64(30),
|
|
SecurityContext: &corev1.PodSecurityContext{
|
|
|
|
RunAsNonRoot: pointer.Bool(false),
|
|
},
|
|
Volumes: volumes,
|
|
InitContainers: []corev1.Container{{
|
|
Name: "sysctl",
|
|
Image: ctx.ImageName(common.ThirdPartyContainerRepo(ctx.Config.Repository, common.DockerRegistryURL), InitContainerImage, InitContainerTag),
|
|
ImagePullPolicy: corev1.PullIfNotPresent,
|
|
SecurityContext: &corev1.SecurityContext{
|
|
Privileged: pointer.Bool(true),
|
|
},
|
|
Command: []string{
|
|
"sh",
|
|
"-c",
|
|
"sysctl -w net.core.somaxconn=32768; sysctl -w net.ipv4.ip_local_port_range='1024 65000'",
|
|
},
|
|
}},
|
|
Containers: []corev1.Container{{
|
|
Name: kubeRbacProxyContainerName,
|
|
Image: ctx.ImageName(common.ThirdPartyContainerRepo(ctx.Config.Repository, KubeRBACProxyRepo), KubeRBACProxyImage, KubeRBACProxyTag),
|
|
ImagePullPolicy: corev1.PullIfNotPresent,
|
|
Args: []string{
|
|
"--logtostderr",
|
|
fmt.Sprintf("--insecure-listen-address=[$(IP)]:%d", baseserver.BuiltinMetricsPort),
|
|
"--upstream=http://127.0.0.1:9545/",
|
|
},
|
|
Env: []corev1.EnvVar{{
|
|
Name: "IP",
|
|
ValueFrom: &corev1.EnvVarSource{
|
|
FieldRef: &corev1.ObjectFieldSelector{
|
|
APIVersion: "v1",
|
|
FieldPath: "status.podIP",
|
|
},
|
|
},
|
|
}},
|
|
Ports: []corev1.ContainerPort{{
|
|
ContainerPort: baseserver.BuiltinMetricsPort,
|
|
Name: baseserver.BuiltinMetricsPortName,
|
|
Protocol: *common.TCPProtocol,
|
|
}},
|
|
Resources: common.ResourceRequirements(ctx, Component, kubeRbacProxyContainerName, corev1.ResourceRequirements{
|
|
Requests: corev1.ResourceList{
|
|
"cpu": resource.MustParse("1m"),
|
|
"memory": resource.MustParse("30Mi"),
|
|
},
|
|
}),
|
|
SecurityContext: &corev1.SecurityContext{
|
|
RunAsGroup: pointer.Int64(65532),
|
|
RunAsNonRoot: pointer.Bool(true),
|
|
RunAsUser: pointer.Int64(65532),
|
|
},
|
|
}, {
|
|
Name: Component,
|
|
Image: ctx.ImageName(ctx.Config.Repository, Component, ctx.VersionManifest.Components.Proxy.Version),
|
|
ImagePullPolicy: corev1.PullIfNotPresent,
|
|
Resources: common.ResourceRequirements(ctx, Component, Component, corev1.ResourceRequirements{
|
|
Requests: corev1.ResourceList{
|
|
"cpu": resource.MustParse("100m"),
|
|
"memory": resource.MustParse("200Mi"),
|
|
},
|
|
}),
|
|
Ports: []corev1.ContainerPort{{
|
|
ContainerPort: ContainerHTTPPort,
|
|
Name: "http",
|
|
}, {
|
|
ContainerPort: ContainerHTTPSPort,
|
|
Name: "https",
|
|
}, {
|
|
ContainerPort: ContainerSSHPort,
|
|
Name: ContainerSSHName,
|
|
Protocol: *common.TCPProtocol,
|
|
}, prometheusPort, {
|
|
ContainerPort: ContainerAnalyticsPort,
|
|
Name: ContainerAnalyticsName,
|
|
}, {
|
|
ContainerPort: ContainerConfigcatPort,
|
|
Name: ContainerConfigcatName,
|
|
}},
|
|
SecurityContext: &corev1.SecurityContext{
|
|
Privileged: pointer.Bool(false),
|
|
AllowPrivilegeEscalation: pointer.Bool(false),
|
|
},
|
|
ReadinessProbe: &corev1.Probe{
|
|
ProbeHandler: corev1.ProbeHandler{
|
|
HTTPGet: &corev1.HTTPGetAction{
|
|
Path: "/ready",
|
|
Port: intstr.IntOrString{IntVal: ReadinessPort},
|
|
},
|
|
},
|
|
InitialDelaySeconds: 5,
|
|
PeriodSeconds: 5,
|
|
TimeoutSeconds: 1,
|
|
SuccessThreshold: 1,
|
|
FailureThreshold: 3,
|
|
},
|
|
VolumeMounts: volumeMounts,
|
|
Env: common.CustomizeEnvvar(ctx, Component, common.MergeEnv(
|
|
common.DefaultEnv(&ctx.Config),
|
|
common.ConfigcatProxyEnv(ctx),
|
|
[]corev1.EnvVar{{
|
|
Name: "PROXY_DOMAIN",
|
|
Value: ctx.Config.Domain,
|
|
}, {
|
|
Name: "FRONTEND_DEV_ENABLED",
|
|
Value: fmt.Sprintf("%t", frontendDevEnabled),
|
|
}, {
|
|
Name: "WORKSPACE_HANDLER_FILE",
|
|
Value: strings.ToLower(string(ctx.Config.Kind)),
|
|
}, {
|
|
Name: "ANALYTICS_PLUGIN_TRUSTED_SEGMENT_KEY",
|
|
Value: trustedSegmentKey,
|
|
}, {
|
|
Name: "ANALYTICS_PLUGIN_UNTRUSTED_SEGMENT_KEY",
|
|
Value: untrustedSegmentKey,
|
|
}, {
|
|
Name: "ANALYTICS_PLUGIN_SEGMENT_ENDPOINT",
|
|
Value: segmentEndpoint,
|
|
}},
|
|
)),
|
|
},
|
|
},
|
|
Tolerations: common.WithTolerationWorkspaceComponentNotReady(ctx),
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}, nil
|
|
}
|