Installer le contrôleur d’Ingress Contour

Cette fiche pratique vous est délivrée pour information uniquement, Contour n’est pas un composant obligatoire. Vous êtes totalement libre d’utiliser n’importe quel autre contrôleur d’ingress. Aucun support ne sera délivré sur Contour.

kubectl apply -f https://github.com/vmware-tanzu/carvel-kapp-controller/releases/latest/download/release.yml

kubectl create ns packages
tanzu package repository add tanzu-standard --url projects.registry.vmware.com/tkg/packages/standard/repo:v2.2.0 -n packages

# tanzu package available list cert-manager.tanzu.vmware.com -A

- Retrieving available packages...
  NAMESPACE   NAME                           VERSION                RELEASED-AT 
  packages  cert-manager.tanzu.vmware.com  1.1.0+vmware.1-tkg.2   2020-11-24 18:00:00 +0000 UTC  
  packages  cert-manager.tanzu.vmware.com  1.1.0+vmware.2-tkg.1   2020-11-24 18:00:00 +0000 UTC  
  packages  cert-manager.tanzu.vmware.com  1.10.2+vmware.1-tkg.1  2023-01-11 12:00:00 +0000 UTC  
  packages  cert-manager.tanzu.vmware.com  1.5.3+vmware.2-tkg.1   2021-08-23 17:22:51 +0000 UTC  
  packages  cert-manager.tanzu.vmware.com  1.5.3+vmware.4-tkg.1   2021-08-23 17:22:51 +0000 UTC  
  packages  cert-manager.tanzu.vmware.com  1.5.3+vmware.7-tkg.1   2021-08-23 17:22:51 +0000 UTC  
  packages  cert-manager.tanzu.vmware.com  1.5.3+vmware.7-tkg.3   2021-08-23 17:22:51 +0000 UTC  
  packages  cert-manager.tanzu.vmware.com  1.7.2+vmware.1-tkg.1   2021-10-29 12:00:00 +0000 UTC  
  packages  cert-manager.tanzu.vmware.com  1.7.2+vmware.3-tkg.1   2021-10-29 12:00:00 +0000 UTC  
  packages  cert-manager.tanzu.vmware.com  1.7.2+vmware.3-tkg.3   2021-10-29 12:00:00 +0000 UTC

tanzu package install cert-manager --package-name cert-manager.tanzu.vmware.com --namespace NAMESPACE --version VERSION

tanzu package install cert-manager --package cert-manager.tanzu.vmware.com --namespace packages --version 1.7.2+vmware.3-tkg.3

# tanzu package installed list -A

\ Retrieving installed packages...
  NAME          PACKAGE-NAME                   PACKAGE-VERSION       STATUS               NAMESPACE
  cert-manager  cert-manager.tanzu.vmware.com  1.7.2+vmware.3-tkg.3  Reconcile succeeded  packages

---
infrastructure_provider: vsphere
namespace: tanzu-system-ingress
contour:
 configFileContents: {}
 useProxyProtocol: false
 replicas: 2
 pspNames: "vmware-system-restricted"
 logLevel: info
envoy:
 service:
   type: LoadBalancer
   annotations: {}
   nodePorts:
     http: null
     https: null
   externalTrafficPolicy: Cluster
   disableWait: false
 hostPorts:
   enable: true
   http: 80
   https: 443
 hostNetwork: false
 terminationGracePeriodSeconds: 300
 logLevel: info
 pspNames: null
certificates:
 duration: 8760h
 renewBefore: 360h

# tanzu package available list contour.tanzu.vmware.com -A

- Retrieving available packages...
  NAME                           DISPLAY-NAME  SHORT-DESCRIPTION           LATEST-VERSION         NAMESPACE
  contour.tanzu.vmware.com       contour       An ingress controller       1.18.2+vmware.1-tkg.1   packages

tanzu package install contour \
--package-name contour.tanzu.vmware.com \
--version VERSION \
--values-file contour-data-values.yaml \
--namespace NAMESPACE

tanzu package install contour \
--package-name contour.tanzu.vmware.com \
--version 1.18.2+vmware.1-tkg.1 \
--values-file contour-data-values.yaml \
--namespace packages

tanzu package installed list -A

\ Retrieving installed packages...
  NAME          PACKAGE-NAME                   PACKAGE-VERSION       STATUS               NAMESPACE
  contour       contour.tanzu.vmware.com       1.18.2+vmware.1-tkg.1 Reconcile succeeded  packages

Pour notre test, nous allons utiliser une zone DNS publique et gratuite qui permet de simplifier nos tests au niveau de la résolution DNS. Ceci est utilisé uniquement pour test et non recommandé en production ou il faudra utiliser un service DNS « classique ». nip.io retourne simplement l’IP qui est contenu dans le nom complet DNS que l’on cherche à résoudre. Plusieurs formats sont possibles, en voici un exemple :

banana.100.10.12.2.nip.ip va retourner l’IP : 100.100.12.2

apple.100.10.12.2.nip.ip va retourner l’IP : 100.100.12.2

kind: Pod
apiVersion: v1
metadata:
  name: apple-app
  labels:
    app: apple
spec:
  containers:
    - name: apple-app
      image: hashicorp/http-echo
      args:
        - "-text=apple"

---

kind: Service
apiVersion: v1
metadata:
  name: apple-service
spec:
  selector:
    app: apple
  ports:
    - port: 5678 # Default port for image

kind: Pod
apiVersion: v1
metadata:
  name: banana-app
  labels:
    app: banana
spec:
  containers:
    - name: banana-app
      image: hashicorp/http-echo
      args:
        - "-text=banana"

---

kind: Service
apiVersion: v1
metadata:
  name: banana-service
spec:
  selector:
    app: banana
  ports:
    - port: 5678 # Default port for image

kubectl apply -f apple.yaml
kubectl apply -f banana.yaml

kubectl get pods banana
kubectl get pods apple

Si vous venez juste d’installer Contour, il est possible que l’adresse externe ne soit pas encore affectée, dans ce cas attendez encore quelques secondes.

kubectl get svc envoy -n tanzu-system-ingress
NAME    TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)                      AGE
envoy   LoadBalancer   100.65.98.108   100.101.191.4   80:30411/TCP,443:30934/TCP   4d3h

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: apple-ingress
  annotations:
    ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: apple.[IP].nip.io
    http:
      paths:
        - path: /
          backend:
            serviceName: apple-service
            servicePort: 5678
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: banana-ingress
  annotations:
    ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: banana.[IP].nip.io
    http:
      paths:
        - path: /
          backend:
            serviceName: banana-service
            servicePort: 5678

kubectl apply -f ingress.yaml

kubectl get ingress

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: example-ingress
  annotations:
    ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: myapp.[IP].nip.io
    http:
      paths:
        - path: /apple
          backend:
            serviceName: apple-service
            servicePort: 5678
        - path: /banana
          backend:
            serviceName: banana-service
            servicePort: 5678