kourier.yaml

# Copyright 2020 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: Namespace
metadata:
  name: kourier-system
  labels:
    networking.knative.dev/ingress-provider: kourier
    serving.knative.dev/release: "v1.0.0"

---
# Copyright 2020 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: ConfigMap
metadata:
  name: kourier-bootstrap
  namespace: kourier-system
  labels:
    networking.knative.dev/ingress-provider: kourier
    serving.knative.dev/release: "v1.0.0"
data:
  envoy-bootstrap.yaml: |
    dynamic_resources:
      ads_config:
        transport_api_version: V3
        api_type: GRPC
        rate_limit_settings: {}
        grpc_services:
        - envoy_grpc: {cluster_name: xds_cluster}
      cds_config:
        resource_api_version: V3
        ads: {}
      lds_config:
        resource_api_version: V3
        ads: {}
    node:
      cluster: kourier-knative
      id: 3scale-kourier-gateway
    static_resources:
      listeners:
        - name: stats_listener
          address:
            socket_address:
              address: 0.0.0.0
              port_value: 9000
          filter_chains:
            - filters:
                - name: envoy.filters.network.http_connection_manager
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                    stat_prefix: stats_server
                    http_filters:
                      - name: envoy.filters.http.router
                    route_config:
                      virtual_hosts:
                        - name: admin_interface
                          domains:
                            - "*"
                          routes:
                            - match:
                                safe_regex:
                                  google_re2: {}
                                  regex: '/(certs|stats(/prometheus)?|server_info|clusters|listeners|ready)?'
                                headers:
                                  - name: ':method'
                                    exact_match: GET
                              route:
                                cluster: service_stats
      clusters:
        - name: service_stats
          connect_timeout: 0.250s
          type: static
          load_assignment:
            cluster_name: service_stats
            endpoints:
              lb_endpoints:
                endpoint:
                  address:
                    pipe:
                      path: /tmp/envoy.admin
        - name: xds_cluster
          connect_timeout: 1s
          type: strict_dns
          load_assignment:
            cluster_name: xds_cluster
            endpoints:
              lb_endpoints:
                endpoint:
                  address:
                    socket_address:
                      address: "net-kourier-controller.knative-serving"
                      port_value: 18000
          http2_protocol_options: {}
          type: STRICT_DNS
    admin:
      access_log_path: "/dev/stdout"
      address:
        pipe:
          path: /tmp/envoy.admin

---
# Copyright 2021 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: ConfigMap
metadata:
  name: config-kourier
  namespace: knative-serving
  labels:
    networking.knative.dev/ingress-provider: kourier
    serving.knative.dev/release: "v1.0.0"
data:
  _example: |
    ################################
    #                              #
    #    EXAMPLE CONFIGURATION     #
    #                              #
    ################################

    # This block is not actually functional configuration,
    # but serves to illustrate the available configuration
    # options and document them in a way that is accessible
    # to users that `kubectl edit` this config map.
    #
    # These sample configuration options may be copied out of
    # this example block and unindented to be in the data block
    # to actually change the configuration.

    # Specifies whether requests reaching the Kourier gateway
    # in the context of services should be logged. Readiness
    # probes etc. must be configured via the bootstrap config.
    enable-service-access-logging: "true"

---
# Copyright 2020 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: net-kourier
  namespace: knative-serving
  labels:
    networking.knative.dev/ingress-provider: kourier
    serving.knative.dev/release: "v1.0.0"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: net-kourier
  namespace: knative-serving
  labels:
    networking.knative.dev/ingress-provider: kourier
    serving.knative.dev/release: "v1.0.0"
rules:
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "update", "patch"]
  - apiGroups: [""]
    resources: ["pods", "endpoints", "services", "secrets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["networking.internal.knative.dev"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch", "patch"]
  - apiGroups: ["networking.internal.knative.dev"]
    resources: ["ingresses/status"]
    verbs: ["update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: net-kourier
  labels:
    networking.knative.dev/ingress-provider: kourier
    serving.knative.dev/release: "v1.0.0"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: net-kourier
subjects:
  - kind: ServiceAccount
    name: net-kourier
    namespace: knative-serving

---
# Copyright 2020 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: net-kourier-controller
  namespace: knative-serving
  labels:
    networking.knative.dev/ingress-provider: kourier
    serving.knative.dev/release: "v1.0.0"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: net-kourier-controller
  template:
    metadata:
      labels:
        app: net-kourier-controller
    spec:
      containers:
        - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:385a3609052ef4eab8250334c82a5ad3e12a9e1d2ec65f8a448c2b270e9d86df
          name: controller
          env:
            - name: CERTS_SECRET_NAMESPACE
              value: ""
            - name: CERTS_SECRET_NAME
              value: ""
            - name: SYSTEM_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: METRICS_DOMAIN
              value: "knative.dev/samples"
            - name: KOURIER_GATEWAY_NAMESPACE
              value: "kourier-system"
          ports:
            - name: http2-xds
              containerPort: 18000
              protocol: TCP
          readinessProbe:
            exec:
              command: ["/ko-app/kourier", "-probe-addr=:18000"]
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            capabilities:
              drop:
                - all
      restartPolicy: Always
      serviceAccountName: net-kourier
---
apiVersion: v1
kind: Service
metadata:
  name: net-kourier-controller
  namespace: knative-serving
  labels:
    networking.knative.dev/ingress-provider: kourier
    serving.knative.dev/release: "v1.0.0"
spec:
  ports:
    - name: grpc-xds
      port: 18000
      protocol: TCP
      targetPort: 18000
  selector:
    app: net-kourier-controller
  type: ClusterIP

---
# Copyright 2020 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: 3scale-kourier-gateway
  namespace: kourier-system
  labels:
    networking.knative.dev/ingress-provider: kourier
    serving.knative.dev/release: "v1.0.0"
spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  selector:
    matchLabels:
      app: 3scale-kourier-gateway
  template:
    metadata:
      labels:
        app: 3scale-kourier-gateway
      annotations:
        # v0.26 supports envoy v3 API, so
        # adding this label to restart pod.
        networking.knative.dev/poke: "v0.26"
    spec:
      containers:
        - args:
            - --base-id 1
            - -c /tmp/config/envoy-bootstrap.yaml
            - --log-level info
          command:
            - /usr/local/bin/envoy
          image: docker.io/envoyproxy/envoy:v1.17-latest
          name: kourier-gateway
          ports:
            - name: http2-external
              containerPort: 8080
              protocol: TCP
            - name: http2-internal
              containerPort: 8081
              protocol: TCP
            - name: https-external
              containerPort: 8443
              protocol: TCP
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: false
            runAsNonRoot: false
            capabilities:
              drop:
                - all
          volumeMounts:
            - name: config-volume
              mountPath: /tmp/config
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "curl -X POST --unix /tmp/envoy.admin http://localhost/healthcheck/fail; sleep 15"]
          readinessProbe:
            httpGet:
              httpHeaders:
                - name: Host
                  value: internalkourier
              path: /ready
              port: 8081
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 5
      volumes:
        - name: config-volume
          configMap:
            name: kourier-bootstrap
      restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
  name: kourier
  namespace: kourier-system
  labels:
    networking.knative.dev/ingress-provider: kourier
    serving.knative.dev/release: "v1.0.0"
spec:
  ports:
    - name: http2
      port: 80
      protocol: TCP
      targetPort: 8080
    - name: https
      port: 443
      protocol: TCP
      targetPort: 8443
  selector:
    app: 3scale-kourier-gateway
  type: LoadBalancer
---
apiVersion: v1
kind: Service
metadata:
  name: kourier-internal
  namespace: kourier-system
  labels:
    networking.knative.dev/ingress-provider: kourier
    serving.knative.dev/release: "v1.0.0"
spec:
  ports:
    - name: http2
      port: 80
      protocol: TCP
      targetPort: 8081
  selector:
    app: 3scale-kourier-gateway
  type: ClusterIP

---