2022-03-29 00:03:23 +00:00
#! Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
2020-10-14 22:05:42 +00:00
#! SPDX-License-Identifier: Apache-2.0
2020-10-09 23:00:11 +00:00
#@ load("@ytt:data", "data")
2022-03-29 21:24:40 +00:00
#@ load("@ytt:assert", "assert")
Improve the selectors of Deployments and Services
Fixes #801. The solution is complicated by the fact that the Selector
field of Deployments is immutable. It would have been easy to just
make the Selectors of the main Concierge Deployment, the Kube cert agent
Deployment, and the various Services use more specific labels, but
that would break upgrades. Instead, we make the Pod template labels and
the Service selectors more specific, because those not immutable, and
then handle the Deployment selectors in a special way.
For the main Concierge and Supervisor Deployments, we cannot change
their selectors, so they remain "app: app_name", and we make other
changes to ensure that only the intended pods are selected. We keep the
original "app" label on those pods and remove the "app" label from the
pods of the Kube cert agent Deployment. By removing it from the Kube
cert agent pods, there is no longer any chance that they will
accidentally get selected by the main Concierge Deployment.
For the Kube cert agent Deployment, we can change the immutable selector
by deleting and recreating the Deployment. The new selector uses only
the unique label that has always been applied to the pods of that
deployment. Upon recreation, these pods no longer have the "app" label,
so they will not be selected by the main Concierge Deployment's
selector.
The selector of all Services have been updated to use new labels to
more specifically target the intended pods. For the Concierge Services,
this will prevent them from accidentally including the Kube cert agent
pods. For the Supervisor Services, we follow the same convention just
to be consistent and to help future-proof the Supervisor app in case it
ever has a second Deployment added to it.
The selector of the auto-created impersonation proxy Service was
also previously using the "app" label. There is no change to this
Service because that label will now select the correct pods, since
the Kube cert agent pods no longer have that label. It would be possible
to update that selector to use the new more specific label, but then we
would need to invent a way to pass that label into the controller, so
it seemed like more work than was justified.
2021-09-14 20:35:10 +00:00
#@ load("helpers.lib.yaml", "labels", "deploymentPodLabel", "namespace", "defaultResourceName", "defaultResourceNameWithSuffix")
2020-10-09 23:00:11 +00:00
2022-03-29 21:24:40 +00:00
#@ if hasattr(data.values, "service_http_nodeport_port"):
#@ assert.fail('value "service_http_nodeport_port" has been renamed to "deprecated_service_http_nodeport_port" and will be removed in a future release')
2022-03-29 00:03:23 +00:00
#@ end
2022-03-29 21:24:40 +00:00
#@ if hasattr(data.values, "service_http_nodeport_nodeport"):
#@ assert.fail('value "service_http_nodeport_nodeport" has been renamed to "deprecated_service_http_nodeport_nodeport" and will be removed in a future release')
2022-03-29 00:03:23 +00:00
#@ end
2022-03-29 21:24:40 +00:00
#@ if hasattr(data.values, "service_http_loadbalancer_port"):
#@ assert.fail('value "service_http_loadbalancer_port" has been renamed to "deprecated_service_http_loadbalancer_port" and will be removed in a future release')
2022-03-29 00:03:23 +00:00
#@ end
2022-03-29 21:24:40 +00:00
#@ if hasattr(data.values, "service_http_clusterip_port"):
#@ assert.fail('value "service_http_clusterip_port" has been renamed to "deprecated_service_http_clusterip_port" and will be removed in a future release')
2022-03-29 00:03:23 +00:00
#@ end
#@ if data.values.deprecated_service_http_nodeport_port or data.values.service_https_nodeport_port:
2020-10-09 23:00:11 +00:00
---
apiVersion : v1
kind : Service
metadata :
2020-10-14 22:05:42 +00:00
name : #@ defaultResourceNameWithSuffix("nodeport")
namespace : #@ namespace()
labels : #@ labels()
2021-09-15 20:08:49 +00:00
#! prevent kapp from altering the selector of our services to match kubectl behavior
annotations :
kapp.k14s.io/disable-default-label-scoping-rules : ""
2020-10-09 23:00:11 +00:00
spec :
type : NodePort
Improve the selectors of Deployments and Services
Fixes #801. The solution is complicated by the fact that the Selector
field of Deployments is immutable. It would have been easy to just
make the Selectors of the main Concierge Deployment, the Kube cert agent
Deployment, and the various Services use more specific labels, but
that would break upgrades. Instead, we make the Pod template labels and
the Service selectors more specific, because those not immutable, and
then handle the Deployment selectors in a special way.
For the main Concierge and Supervisor Deployments, we cannot change
their selectors, so they remain "app: app_name", and we make other
changes to ensure that only the intended pods are selected. We keep the
original "app" label on those pods and remove the "app" label from the
pods of the Kube cert agent Deployment. By removing it from the Kube
cert agent pods, there is no longer any chance that they will
accidentally get selected by the main Concierge Deployment.
For the Kube cert agent Deployment, we can change the immutable selector
by deleting and recreating the Deployment. The new selector uses only
the unique label that has always been applied to the pods of that
deployment. Upon recreation, these pods no longer have the "app" label,
so they will not be selected by the main Concierge Deployment's
selector.
The selector of all Services have been updated to use new labels to
more specifically target the intended pods. For the Concierge Services,
this will prevent them from accidentally including the Kube cert agent
pods. For the Supervisor Services, we follow the same convention just
to be consistent and to help future-proof the Supervisor app in case it
ever has a second Deployment added to it.
The selector of the auto-created impersonation proxy Service was
also previously using the "app" label. There is no change to this
Service because that label will now select the correct pods, since
the Kube cert agent pods no longer have that label. It would be possible
to update that selector to use the new more specific label, but then we
would need to invent a way to pass that label into the controller, so
it seemed like more work than was justified.
2021-09-14 20:35:10 +00:00
selector : #@ deploymentPodLabel()
2020-10-09 23:00:11 +00:00
ports :
2022-03-29 00:03:23 +00:00
#@ if data.values.deprecated_service_http_nodeport_port:
2020-10-27 00:03:26 +00:00
- name : http
protocol : TCP
2022-03-29 00:03:23 +00:00
port : #@ data.values.deprecated_service_http_nodeport_port
2020-11-02 16:57:05 +00:00
targetPort : 8080
2022-03-29 00:03:23 +00:00
#@ if data.values.deprecated_service_http_nodeport_nodeport:
nodePort : #@ data.values.deprecated_service_http_nodeport_nodeport
2020-10-22 22:37:35 +00:00
#@ end
2020-10-27 00:03:26 +00:00
#@ end
#@ if data.values.service_https_nodeport_port:
- name : https
protocol : TCP
port : #@ data.values.service_https_nodeport_port
2020-11-02 16:57:05 +00:00
targetPort : 8443
2020-10-27 00:03:26 +00:00
#@ if data.values.service_https_nodeport_nodeport:
nodePort : #@ data.values.service_https_nodeport_nodeport
#@ end
#@ end
2020-10-09 23:00:11 +00:00
#@ end
2022-03-29 00:03:23 +00:00
#@ if data.values.deprecated_service_http_clusterip_port or data.values.service_https_clusterip_port:
2020-10-09 23:00:11 +00:00
---
apiVersion : v1
kind : Service
metadata :
2020-10-14 22:05:42 +00:00
name : #@ defaultResourceNameWithSuffix("clusterip")
namespace : #@ namespace()
labels : #@ labels()
2021-09-15 20:08:49 +00:00
#! prevent kapp from altering the selector of our services to match kubectl behavior
annotations :
kapp.k14s.io/disable-default-label-scoping-rules : ""
2020-10-09 23:00:11 +00:00
spec :
type : ClusterIP
Improve the selectors of Deployments and Services
Fixes #801. The solution is complicated by the fact that the Selector
field of Deployments is immutable. It would have been easy to just
make the Selectors of the main Concierge Deployment, the Kube cert agent
Deployment, and the various Services use more specific labels, but
that would break upgrades. Instead, we make the Pod template labels and
the Service selectors more specific, because those not immutable, and
then handle the Deployment selectors in a special way.
For the main Concierge and Supervisor Deployments, we cannot change
their selectors, so they remain "app: app_name", and we make other
changes to ensure that only the intended pods are selected. We keep the
original "app" label on those pods and remove the "app" label from the
pods of the Kube cert agent Deployment. By removing it from the Kube
cert agent pods, there is no longer any chance that they will
accidentally get selected by the main Concierge Deployment.
For the Kube cert agent Deployment, we can change the immutable selector
by deleting and recreating the Deployment. The new selector uses only
the unique label that has always been applied to the pods of that
deployment. Upon recreation, these pods no longer have the "app" label,
so they will not be selected by the main Concierge Deployment's
selector.
The selector of all Services have been updated to use new labels to
more specifically target the intended pods. For the Concierge Services,
this will prevent them from accidentally including the Kube cert agent
pods. For the Supervisor Services, we follow the same convention just
to be consistent and to help future-proof the Supervisor app in case it
ever has a second Deployment added to it.
The selector of the auto-created impersonation proxy Service was
also previously using the "app" label. There is no change to this
Service because that label will now select the correct pods, since
the Kube cert agent pods no longer have that label. It would be possible
to update that selector to use the new more specific label, but then we
would need to invent a way to pass that label into the controller, so
it seemed like more work than was justified.
2021-09-14 20:35:10 +00:00
selector : #@ deploymentPodLabel()
2020-10-09 23:00:11 +00:00
ports :
2022-03-29 00:03:23 +00:00
#@ if data.values.deprecated_service_http_clusterip_port:
2020-10-27 00:03:26 +00:00
- name : http
protocol : TCP
2022-03-29 00:03:23 +00:00
port : #@ data.values.deprecated_service_http_clusterip_port
2020-11-02 16:57:05 +00:00
targetPort : 8080
2020-10-27 00:03:26 +00:00
#@ end
#@ if data.values.service_https_clusterip_port:
- name : https
protocol : TCP
port : #@ data.values.service_https_clusterip_port
2020-11-02 16:57:05 +00:00
targetPort : 8443
2020-10-27 00:03:26 +00:00
#@ end
2020-10-09 23:00:11 +00:00
#@ end
2022-03-29 00:03:23 +00:00
#@ if data.values.deprecated_service_http_loadbalancer_port or data.values.service_https_loadbalancer_port:
2020-10-09 23:00:11 +00:00
---
apiVersion : v1
kind : Service
metadata :
2020-10-14 22:05:42 +00:00
name : #@ defaultResourceNameWithSuffix("loadbalancer")
namespace : #@ namespace()
labels : #@ labels()
2021-09-15 20:08:49 +00:00
#! prevent kapp from altering the selector of our services to match kubectl behavior
annotations :
kapp.k14s.io/disable-default-label-scoping-rules : ""
2020-10-09 23:00:11 +00:00
spec :
type : LoadBalancer
Improve the selectors of Deployments and Services
Fixes #801. The solution is complicated by the fact that the Selector
field of Deployments is immutable. It would have been easy to just
make the Selectors of the main Concierge Deployment, the Kube cert agent
Deployment, and the various Services use more specific labels, but
that would break upgrades. Instead, we make the Pod template labels and
the Service selectors more specific, because those not immutable, and
then handle the Deployment selectors in a special way.
For the main Concierge and Supervisor Deployments, we cannot change
their selectors, so they remain "app: app_name", and we make other
changes to ensure that only the intended pods are selected. We keep the
original "app" label on those pods and remove the "app" label from the
pods of the Kube cert agent Deployment. By removing it from the Kube
cert agent pods, there is no longer any chance that they will
accidentally get selected by the main Concierge Deployment.
For the Kube cert agent Deployment, we can change the immutable selector
by deleting and recreating the Deployment. The new selector uses only
the unique label that has always been applied to the pods of that
deployment. Upon recreation, these pods no longer have the "app" label,
so they will not be selected by the main Concierge Deployment's
selector.
The selector of all Services have been updated to use new labels to
more specifically target the intended pods. For the Concierge Services,
this will prevent them from accidentally including the Kube cert agent
pods. For the Supervisor Services, we follow the same convention just
to be consistent and to help future-proof the Supervisor app in case it
ever has a second Deployment added to it.
The selector of the auto-created impersonation proxy Service was
also previously using the "app" label. There is no change to this
Service because that label will now select the correct pods, since
the Kube cert agent pods no longer have that label. It would be possible
to update that selector to use the new more specific label, but then we
would need to invent a way to pass that label into the controller, so
it seemed like more work than was justified.
2021-09-14 20:35:10 +00:00
selector : #@ deploymentPodLabel()
2020-10-28 23:45:23 +00:00
#@ if data.values.service_loadbalancer_ip:
loadBalancerIP : #@ data.values.service_loadbalancer_ip
#@ end
2020-10-09 23:00:11 +00:00
ports :
2022-03-29 00:03:23 +00:00
#@ if data.values.deprecated_service_http_loadbalancer_port:
2020-10-27 00:03:26 +00:00
- name : http
protocol : TCP
2022-03-29 00:03:23 +00:00
port : #@ data.values.deprecated_service_http_loadbalancer_port
2020-11-02 16:57:05 +00:00
targetPort : 8080
2020-10-27 00:03:26 +00:00
#@ end
#@ if data.values.service_https_loadbalancer_port:
- name : https
protocol : TCP
port : #@ data.values.service_https_loadbalancer_port
2020-11-02 16:57:05 +00:00
targetPort : 8443
2020-10-27 00:03:26 +00:00
#@ end
2020-10-09 23:00:11 +00:00
#@ end
