diff --git a/charts/gateway-helm/templates/certgen-rbac.yaml b/charts/gateway-helm/templates/certgen-rbac.yaml index f78c36709b6..ff805dad3db 100644 --- a/charts/gateway-helm/templates/certgen-rbac.yaml +++ b/charts/gateway-helm/templates/certgen-rbac.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: ServiceAccount metadata: name: {{ include "eg.fullname" . }}-certgen + namespace: '{{ .Release.Namespace }}' labels: {{- include "eg.labels" . | nindent 4 }} annotations: @@ -11,6 +12,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: {{ include "eg.fullname" . }}-certgen + namespace: '{{ .Release.Namespace }}' labels: {{- include "eg.labels" . | nindent 4 }} annotations: @@ -29,6 +31,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: {{ include "eg.fullname" . }}-certgen + namespace: '{{ .Release.Namespace }}' labels: {{- include "eg.labels" . | nindent 4 }} annotations: diff --git a/charts/gateway-helm/templates/certgen.yaml b/charts/gateway-helm/templates/certgen.yaml index 2b40f599eeb..25f65196da6 100644 --- a/charts/gateway-helm/templates/certgen.yaml +++ b/charts/gateway-helm/templates/certgen.yaml @@ -2,6 +2,7 @@ apiVersion: batch/v1 kind: Job metadata: name: {{ include "eg.fullname" . }}-certgen + namespace: '{{ .Release.Namespace }}' labels: {{- include "eg.labels" . | nindent 4 }} annotations: diff --git a/charts/gateway-helm/templates/envoy-gateway-config.yaml b/charts/gateway-helm/templates/envoy-gateway-config.yaml index 255030c9ee7..c969f60454f 100644 --- a/charts/gateway-helm/templates/envoy-gateway-config.yaml +++ b/charts/gateway-helm/templates/envoy-gateway-config.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: ConfigMap metadata: name: envoy-gateway-config + namespace: '{{ .Release.Namespace }}' labels: {{- include "eg.labels" . | nindent 4 }} data: diff --git a/charts/gateway-helm/templates/envoy-gateway-deployment.yaml b/charts/gateway-helm/templates/envoy-gateway-deployment.yaml index bc4c6224845..e2cc40b9a24 100644 --- a/charts/gateway-helm/templates/envoy-gateway-deployment.yaml +++ b/charts/gateway-helm/templates/envoy-gateway-deployment.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: ServiceAccount metadata: name: envoy-gateway + namespace: '{{ .Release.Namespace }}' labels: {{- include "eg.labels" . | nindent 4 }} --- @@ -9,6 +10,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: envoy-gateway + namespace: '{{ .Release.Namespace }}' labels: control-plane: envoy-gateway {{- include "eg.labels" . | nindent 4 }} diff --git a/charts/gateway-helm/templates/envoy-gateway-metrics-service.yaml b/charts/gateway-helm/templates/envoy-gateway-metrics-service.yaml index b19069eec0c..bd5f1c6b8e2 100644 --- a/charts/gateway-helm/templates/envoy-gateway-metrics-service.yaml +++ b/charts/gateway-helm/templates/envoy-gateway-metrics-service.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: Service metadata: name: envoy-gateway-metrics-service + namespace: '{{ .Release.Namespace }}' labels: control-plane: envoy-gateway {{- include "eg.labels" . | nindent 4 }} diff --git a/charts/gateway-helm/templates/envoy-gateway-service.yaml b/charts/gateway-helm/templates/envoy-gateway-service.yaml index 1b1a0c283a4..b9dd4cd5f22 100644 --- a/charts/gateway-helm/templates/envoy-gateway-service.yaml +++ b/charts/gateway-helm/templates/envoy-gateway-service.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: Service metadata: name: envoy-gateway + namespace: '{{ .Release.Namespace }}' labels: control-plane: envoy-gateway {{- include "eg.labels" . | nindent 4 }} diff --git a/charts/gateway-helm/templates/infra-manager-rbac.yaml b/charts/gateway-helm/templates/infra-manager-rbac.yaml index 95b8669bc31..6f3e5a4677f 100644 --- a/charts/gateway-helm/templates/infra-manager-rbac.yaml +++ b/charts/gateway-helm/templates/infra-manager-rbac.yaml @@ -2,6 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: {{ include "eg.fullname" . }}-infra-manager + namespace: '{{ .Release.Namespace }}' labels: {{- include "eg.labels" . | nindent 4 }} rules: @@ -29,6 +30,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: {{ include "eg.fullname" . }}-infra-manager + namespace: '{{ .Release.Namespace }}' labels: {{- include "eg.labels" . | nindent 4 }} roleRef: diff --git a/charts/gateway-helm/templates/leader-election-rbac.yaml b/charts/gateway-helm/templates/leader-election-rbac.yaml index ffd849f4272..5b59f34c7ca 100644 --- a/charts/gateway-helm/templates/leader-election-rbac.yaml +++ b/charts/gateway-helm/templates/leader-election-rbac.yaml @@ -2,6 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: {{ include "eg.fullname" . }}-leader-election-role + namespace: '{{ .Release.Namespace }}' labels: {{- include "eg.labels" . | nindent 4 }} rules: @@ -41,6 +42,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: {{ include "eg.fullname" . }}-leader-election-rolebinding + namespace: '{{ .Release.Namespace }}' labels: {{- include "eg.labels" . | nindent 4 }} roleRef: diff --git a/charts/gateway-helm/templates/metrics-reader-rbac.yaml b/charts/gateway-helm/templates/metrics-reader-rbac.yaml index b3bec93b99b..3b77e714185 100644 --- a/charts/gateway-helm/templates/metrics-reader-rbac.yaml +++ b/charts/gateway-helm/templates/metrics-reader-rbac.yaml @@ -2,6 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: {{ include "eg.fullname" . }}-metrics-reader + namespace: '{{ .Release.Namespace }}' labels: {{- include "eg.labels" . | nindent 4 }} rules: diff --git a/charts/gateway-helm/templates/namespace.yaml b/charts/gateway-helm/templates/namespace.yaml new file mode 100644 index 00000000000..0361b229daa --- /dev/null +++ b/charts/gateway-helm/templates/namespace.yaml @@ -0,0 +1,6 @@ +{{ if .Values.createNamespace }} +apiVersion: v1 +kind: Namespace +metadata: + name: '{{ .Release.Namespace }}' +{{ end }} diff --git a/charts/gateway-helm/values.tmpl.yaml b/charts/gateway-helm/values.tmpl.yaml index 94bbd583d27..d1fdd1979d9 100644 --- a/charts/gateway-helm/values.tmpl.yaml +++ b/charts/gateway-helm/values.tmpl.yaml @@ -42,3 +42,4 @@ envoyGatewayMetricsService: protocol: TCP targetPort: https +createNamespace: false diff --git a/docs/latest/user/customize-envoyproxy.md b/docs/latest/user/customize-envoyproxy.md index b17ee01745c..c8ca9b357fc 100644 --- a/docs/latest/user/customize-envoyproxy.md +++ b/docs/latest/user/customize-envoyproxy.md @@ -171,13 +171,82 @@ metadata: namespace: envoy-gateway-system spec: bootstrap: | - xxxxxxxxxx - + admin: + access_log: + - name: envoy.access_loggers.file + typed_config: + "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog + path: /dev/null + address: + socket_address: + address: 127.0.0.1 + port_value: 20000 + dynamic_resources: + ads_config: + api_type: DELTA_GRPC + transport_api_version: V3 + grpc_services: + - envoy_grpc: + cluster_name: xds_cluster + set_node_on_first_message_only: true + lds_config: + ads: {} + cds_config: + ads: {} + static_resources: + clusters: + - connect_timeout: 10s + load_assignment: + cluster_name: xds_cluster + endpoints: + - lb_endpoints: + - endpoint: + address: + socket_address: + address: envoy-gateway + port_value: 18000 + typed_extension_protocol_options: + "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": + "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions" + "explicit_http_config": + "http2_protocol_options": {} + name: xds_cluster + type: STRICT_DNS + transport_socket: + name: envoy.transport_sockets.tls + typed_config: + "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + common_tls_context: + tls_params: + tls_maximum_protocol_version: TLSv1_3 + tls_certificate_sds_secret_configs: + - name: xds_certificate + sds_config: + path_config_source: + path: "/sds/xds-certificate.json" + resource_api_version: V3 + validation_context_sds_secret_config: + name: xds_trusted_ca + sds_config: + path_config_source: + path: "/sds/xds-trusted-ca.json" + resource_api_version: V3 + layered_runtime: + layers: + - name: runtime-0 + rtds_layer: + rtds_config: + ads: {} + name: runtime-0 EOF ``` +You can use [egctl translate](https://gateway.envoyproxy.io/latest/user/egctl.html#validating-gateway-api-configuration) +to get the default xDS Bootstrap configuration used by Envoy Gateway. + After applying the config, the bootstrap config will be overridden by the new config you provided. -Envoy Gateway will use Webhook to validate the bootstrap config you provided. +Any errors in the configuration will be surfaced as status within the `GatewayClass` resource. +You can also validate this configuration using [egctl translate](https://gateway.envoyproxy.io/latest/user/egctl.html#validating-gateway-api-configuration). [Gateway API documentation]: https://gateway-api.sigs.k8s.io/ -[EnvoyProxy]: https://www.envoyproxy.io/ +[EnvoyProxy]: https://gateway.envoyproxy.io/latest/api/config_types.html#envoyproxy diff --git a/docs/latest/user/egctl.md b/docs/latest/user/egctl.md index b32c4a2c285..76693eb2609 100644 --- a/docs/latest/user/egctl.md +++ b/docs/latest/user/egctl.md @@ -391,12 +391,14 @@ dynamicRouteConfigs: resourceType: route ``` +### Add Missing Resources + You can pass the `--add-missing-resources` flag to use dummy non Gateway API resources instead of specifying them explicitly. For example, this will provide the same result as the above: ```shell -cat < $(OUTPUT_DIR)/install.yaml + helm template --set createNamespace=true eg charts/gateway-helm --include-crds --set deployment.envoyGateway.imagePullPolicy=$(IMAGE_PULL_POLICY) --namespace envoy-gateway-system > $(OUTPUT_DIR)/install.yaml @$(call log, "Added: $(OUTPUT_DIR)/install.yaml") cp examples/kubernetes/quickstart.yaml $(OUTPUT_DIR)/quickstart.yaml @$(call log, "Added: $(OUTPUT_DIR)/quickstart.yaml")