Skip to content

Commit

Permalink
feat(Traefik Hub): add APIPlans and APIBundles CRDs
Browse files Browse the repository at this point in the history
  • Loading branch information
jspdown authored Sep 20, 2024
1 parent 2d88f57 commit 87d206e
Show file tree
Hide file tree
Showing 11 changed files with 387 additions and 125 deletions.
26 changes: 13 additions & 13 deletions traefik/VALUES.md
Original file line number Diff line number Diff line change
Expand Up @@ -81,19 +81,19 @@ Kubernetes: `>=1.22.0-0`
| hub.apimanagement.admission.listenAddr | string | `""` | WebHook admission server listen address. Default: "0.0.0.0:9943". |
| hub.apimanagement.admission.secretName | string | `""` | Certificate of the WebHook admission server. Default: "hub-agent-cert". |
| hub.apimanagement.enabled | bool | `false` | Set to true in order to enable API Management. Requires a valid license token. |
| hub.ratelimit.redis.cluster | string | `nil` | Enable Redis Cluster. Default: true. |
| hub.ratelimit.redis.database | string | `nil` | Database used to store information. Default: "0". |
| hub.ratelimit.redis.endpoints | string | `""` | Endpoints of the Redis instances to connect to. Default: "". |
| hub.ratelimit.redis.password | string | `""` | The password to use when connecting to Redis endpoints. Default: "". |
| hub.ratelimit.redis.sentinel.masterset | string | `""` | Name of the set of main nodes to use for main selection. Required when using Sentinel. Default: "". |
| hub.ratelimit.redis.sentinel.password | string | `""` | Password to use for sentinel authentication (can be different from endpoint password). Default: "". |
| hub.ratelimit.redis.sentinel.username | string | `""` | Username to use for sentinel authentication (can be different from endpoint username). Default: "". |
| hub.ratelimit.redis.timeout | string | `""` | Timeout applied on connection with redis. Default: "0s". |
| hub.ratelimit.redis.tls.ca | string | `""` | Path to the certificate authority used for the secured connection. |
| hub.ratelimit.redis.tls.cert | string | `""` | Path to the public certificate used for the secure connection. |
| hub.ratelimit.redis.tls.insecureSkipVerify | bool | `false` | When insecureSkipVerify is set to true, the TLS connection accepts any certificate presented by the server. Default: false. |
| hub.ratelimit.redis.tls.key | string | `""` | Path to the private key used for the secure connection. |
| hub.ratelimit.redis.username | string | `""` | The username to use when connecting to Redis endpoints. Default: "". |
| hub.redis.cluster | string | `nil` | Enable Redis Cluster. Default: true. |
| hub.redis.database | string | `nil` | Database used to store information. Default: "0". |
| hub.redis.endpoints | string | `""` | Endpoints of the Redis instances to connect to. Default: "". |
| hub.redis.password | string | `""` | The password to use when connecting to Redis endpoints. Default: "". |
| hub.redis.sentinel.masterset | string | `""` | Name of the set of main nodes to use for main selection. Required when using Sentinel. Default: "". |
| hub.redis.sentinel.password | string | `""` | Password to use for sentinel authentication (can be different from endpoint password). Default: "". |
| hub.redis.sentinel.username | string | `""` | Username to use for sentinel authentication (can be different from endpoint username). Default: "". |
| hub.redis.timeout | string | `""` | Timeout applied on connection with redis. Default: "0s". |
| hub.redis.tls.ca | string | `""` | Path to the certificate authority used for the secured connection. |
| hub.redis.tls.cert | string | `""` | Path to the public certificate used for the secure connection. |
| hub.redis.tls.insecureSkipVerify | bool | `false` | When insecureSkipVerify is set to true, the TLS connection accepts any certificate presented by the server. Default: false. |
| hub.redis.tls.key | string | `""` | Path to the private key used for the secure connection. |
| hub.redis.username | string | `""` | The username to use when connecting to Redis endpoints. Default: "". |
| hub.sendlogs | string | `nil` | |
| hub.token | string | `""` | Name of `Secret` with key 'token' set to a valid license token. It enables API Gateway. |
| image.pullPolicy | string | `"IfNotPresent"` | Traefik image pull policy |
Expand Down
35 changes: 35 additions & 0 deletions traefik/crds/hub.traefik.io_apiaccesses.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,35 @@ spec:
spec:
description: The desired behavior of this APIAccess.
properties:
apiBundles:
description: |-
APIBundles defines a set of APIBundle that will be accessible to the configured audience.
Multiple APIAccesses can select the same APIBundles.
items:
description: APIBundleReference references an APIBundle.
properties:
name:
description: Name of the APIBundle.
maxLength: 253
type: string
required:
- name
type: object
maxItems: 100
type: array
x-kubernetes-validations:
- message: duplicated apiBundles
rule: self.all(x, self.exists_one(y, x.name == y.name))
apiPlan:
description: APIPlan defines which APIPlan will be used.
properties:
name:
description: Name of the APIPlan.
maxLength: 253
type: string
required:
- name
type: object
apiSelector:
description: |-
APISelector selects the APIs that will be accessible to the configured audience.
Expand Down Expand Up @@ -131,6 +160,12 @@ spec:
maxItems: 100
type: array
type: object
weight:
description: Weight specifies the evaluation order of the plan.
type: integer
x-kubernetes-validations:
- message: must be a positive number
rule: self >= 0
type: object
x-kubernetes-validations:
- message: groups and everyone are mutually exclusive
Expand Down
125 changes: 125 additions & 0 deletions traefik/crds/hub.traefik.io_apibundles.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,125 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: apibundles.hub.traefik.io
spec:
group: hub.traefik.io
names:
kind: APIBundle
listKind: APIBundleList
plural: apibundles
singular: apibundle
scope: Namespaced
versions:
- name: v1alpha1
schema:
openAPIV3Schema:
description: APIBundle defines a set of APIs.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
spec:
description: The desired behavior of this APIBundle.
properties:
apiSelector:
description: |-
APISelector selects the APIs that will be accessible to the configured audience.
Multiple APIBundles can select the same set of APIs.
This field is optional and follows standard label selector semantics.
An empty APISelector matches any API.
properties:
matchExpressions:
description: matchExpressions is a list of label selector requirements.
The requirements are ANDed.
items:
description: |-
A label selector requirement is a selector that contains values, a key, and an operator that
relates the key and values.
properties:
key:
description: key is the label key that the selector applies
to.
type: string
operator:
description: |-
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
type: string
values:
description: |-
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: |-
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
type: object
type: object
x-kubernetes-map-type: atomic
apis:
description: |-
APIs defines a set of APIs that will be accessible to the configured audience.
Multiple APIBundles can select the same APIs.
When combined with APISelector, this set of APIs is appended to the matching APIs.
items:
description: APIReference references an API.
properties:
name:
description: Name of the API.
maxLength: 253
type: string
required:
- name
type: object
maxItems: 100
type: array
x-kubernetes-validations:
- message: duplicated apis
rule: self.all(x, self.exists_one(y, x.name == y.name))
type: object
status:
description: The current status of this APIBundle.
properties:
hash:
description: Hash is a hash representing the APIBundle.
type: string
syncedAt:
format: date-time
type: string
version:
type: string
type: object
type: object
served: true
storage: true
103 changes: 103 additions & 0 deletions traefik/crds/hub.traefik.io_apiplans.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,103 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: apiplans.hub.traefik.io
spec:
group: hub.traefik.io
names:
kind: APIPlan
listKind: APIPlanList
plural: apiplans
singular: apiplan
scope: Namespaced
versions:
- name: v1alpha1
schema:
openAPIV3Schema:
description: APIPlan defines API Plan policy.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
spec:
description: The desired behavior of this APIPlan.
properties:
description:
description: Description describes the plan.
type: string
quota:
description: Quota defines the quota policy.
properties:
limit:
description: Limit is the maximum number of token in the bucket.
type: integer
x-kubernetes-validations:
- message: must be a positive number
rule: self >= 0
period:
description: Period is the unit of time for the Limit.
format: duration
type: string
x-kubernetes-validations:
- message: must be between 1s and 9999h
rule: self >= duration('1s') && self <= duration('9999h')
required:
- limit
type: object
rateLimit:
description: RateLimit defines the rate limit policy.
properties:
limit:
description: Limit is the maximum number of token in the bucket.
type: integer
x-kubernetes-validations:
- message: must be a positive number
rule: self >= 0
period:
description: Period is the unit of time for the Limit.
format: duration
type: string
x-kubernetes-validations:
- message: must be between 1s and 1h
rule: self >= duration('1s') && self <= duration('1h')
required:
- limit
type: object
title:
description: Title is the human-readable name of the plan.
type: string
required:
- title
type: object
status:
description: The current status of this APIPlan.
properties:
hash:
description: Hash is a hash representing the APIPlan.
type: string
syncedAt:
format: date-time
type: string
version:
type: string
type: object
type: object
served: true
storage: true
2 changes: 2 additions & 0 deletions traefik/crds/kustomization.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@ resources:
- hub.traefik.io_apiratelimits.yaml
- hub.traefik.io_apis.yaml
- hub.traefik.io_apiversions.yaml
- hub.traefik.io_apiplans.yaml
- hub.traefik.io_apibundles.yaml
- traefik.io_ingressroutes.yaml
- traefik.io_ingressroutetcps.yaml
- traefik.io_ingressrouteudps.yaml
Expand Down
12 changes: 6 additions & 6 deletions traefik/templates/_podtemplate.tpl
Original file line number Diff line number Diff line change
Expand Up @@ -717,24 +717,24 @@
{{- with .platformUrl }}
- "--hub.platformUrl={{ . }}"
{{- end -}}
{{- range $field, $value := .ratelimit.redis }}
{{- range $field, $value := .redis }}
{{- if has $field (list "cluster" "database" "endpoints" "username" "password" "timeout") -}}
{{- with $value }}
- "--hub.ratelimit.redis.{{ $field }}={{ $value }}"
- "--hub.redis.{{ $field }}={{ $value }}"
{{- end }}
{{- end }}
{{- end }}
{{- range $field, $value := .ratelimit.redis.sentinel }}
{{- range $field, $value := .redis.sentinel }}
{{- if has $field (list "masterset" "password" "username") -}}
{{- with $value }}
- "--hub.ratelimit.redis.sentinel.{{ $field }}={{ $value }}"
- "--hub.redis.sentinel.{{ $field }}={{ $value }}"
{{- end }}
{{- end }}
{{- end }}
{{- range $field, $value := .ratelimit.redis.tls }}
{{- range $field, $value := .redis.tls }}
{{- if has $field (list "ca" "cert" "insecureSkipVerify" "key") -}}
{{- with $value }}
- "--hub.ratelimit.redis.tls.{{ $field }}={{ $value }}"
- "--hub.redis.tls.{{ $field }}={{ $value }}"
{{- end }}
{{- end }}
{{- end }}
Expand Down
2 changes: 2 additions & 0 deletions traefik/templates/rbac/clusterrole.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -217,6 +217,8 @@ rules:
- apiratelimits
- apis
- apiversions
- apibundles
- apiplans
verbs:
- list
- watch
Expand Down
Loading

0 comments on commit 87d206e

Please sign in to comment.