k8s-infra: server routing strategies & basic TLS #8822

guydc · 2018-02-17T14:32:58Z

Signed-off-by: Guy Daich [email protected]

What does this PR do?

Introduce an External Server Exposer Strategy, responsible for exposing service ports associated with external servers, making them accessible from outside the cluster.

Move server exposure to shared k8s infra level:

Extract Openshift External Server Exposer to dedicated class.
Consolidate Openshift Server Exposer and Server converter with Kubernetes Infra.

Provide three options for exposing external (and secondary) servers in k8s infra:

multi-host: unique hostname for each component, like Che Openshift infrastructure.
single-host: single hostname for all components. Can be used in conjunction with TLS.
default-host: default ingress hostname. Can be used for local development without dynamic DNS (based on ingress IP).

Add basic TLS support:

Integrate with cert-manager in single-host configuration, to issue a LetsEncrypt certificate. Use cluster-wide issuers and ingress-shim annotations.
Add Ingress TLS provisioning.
Move TLS_ENABLED configuration to Kubernetes Infra Level.

Update Docs:

Add example value files for more convenient helm deployment of multi-user, default-host and TLS configurations.
Update readme deployment instructions.

Test PR

Follow instructions to set up minikube, helm, tiller, cert-manager.

Follow specific instructions for single/multi-user, default-host installation on minikube.

Routing strategies tested locally on minikube & minishift.

What issues does this PR fix or reference?

This PR fixes #8694.
This PR is part of kubernetes infrastructure epic #5908.

Release Notes

Docs PR

Currently, documented only in the Che Kubernetes Helm deployment instructions.

Signed-off-by: Guy Daich <[email protected]>

codenvy-ci · 2018-02-17T14:34:01Z

Can one of the admins verify this patch?

codenvy-ci · 2018-02-17T14:34:03Z

Can one of the admins verify this patch?

codenvy-ci · 2018-02-17T14:36:01Z

Can one of the admins verify this patch?

skabashnyuk · 2018-02-17T14:52:26Z

ci-build

codenvy-ci · 2018-02-17T15:13:17Z

Build # 4475 - FAILED

Please check console output at https://ci.codenvycorp.com/job/che-pullrequests-build/4475/ to view the results.

Signed-off-by: Guy Daich <[email protected]>

guydc · 2018-02-18T16:21:13Z

ci-build

skabashnyuk · 2018-02-18T21:07:06Z

ci-build

codenvy-ci · 2018-02-19T06:29:46Z

Build # 4476 - FAILED

Please check console output at https://ci.codenvycorp.com/job/che-pullrequests-build/4476/ to view the results.

sleshchenko · 2018-02-19T07:31:02Z

.../org/eclipse/che/workspace/infrastructure/openshift/provision/OpenShiftServersConverter.java

@@ -36,6 +38,13 @@
 @Singleton
 public class OpenShiftServersConverter implements ConfigurationProvisioner<OpenShiftEnvironment> {

+  ExternalServerExposerStrategy openshiftExternalServerExposer;


Please make this field private and generify it with OpenShiftEnvironment.

class removed.

sleshchenko · 2018-02-19T07:32:37Z

...rg/eclipse/che/workspace/infrastructure/kubernetes/server/ExternalServerExposerStrategy.java

+/** @author Guy Daich */
+public interface ExternalServerExposerStrategy<T extends KubernetesEnvironment> {
+
+  public void exposeExternalServers(


public access modifier can be removed here.

@sleshchenko Strategy is used by the ServerConverter, in another package (k8s.server), and also implemented by OS infra, so should be public.

Sure it should be public. IDE shows me warning that it is redundant because public access modifier is default one for interfaces methods.

sleshchenko · 2018-02-19T07:45:21Z

...n/java/org/eclipse/che/workspace/infrastructure/openshift/server/OpenShiftServerExposer.java

-      String machineName, Pod pod, Container container, OpenShiftEnvironment openShiftEnvironment) {
-    super(Collections.emptyMap(), machineName, pod, container, openShiftEnvironment);
-    this.openShiftEnvironment = openShiftEnvironment;
+      ExternalServerExposerStrategy OpenshiftExternalServerExposerStrategy,


Please generify this variable with OpenShiftEnvironment.
Also please rename this variable, it's quite unusual for java to name variable with first upper character.

sleshchenko · 2018-02-19T07:47:42Z

...n/java/org/eclipse/che/workspace/infrastructure/openshift/server/OpenShiftServerExposer.java

+      Container container,
+      OpenShiftEnvironment kubernetesEnvironment) {
+    super(
+        OpenshiftExternalServerExposerStrategy, machineName, pod, container, kubernetesEnvironment);
  }

  @Override
  protected void exposeExternalServers(


Since KubernetesServerExposer#exposeExternalServers method implementation is the same as in OpenShiftServerExposer, looks like we can remove this overriding.

sleshchenko · 2018-02-19T07:50:53Z

...n/java/org/eclipse/che/workspace/infrastructure/openshift/server/OpenShiftServerExposer.java

@@ -91,95 +87,22 @@
 */
 public class OpenShiftServerExposer extends KubernetesServerExposer<OpenShiftEnvironment> {


This class looks like useless. The one possible reason to have it - defining docs for exposing external servers on OpenShift.
Maybe after adding java doc into OpenShiftExternalServerExposer this class can be removed. WDYT?

I'll try consolidating it with k8s infra, by using k8s server converter in OpenShiftEnvironmentProvisioner, and move the docs like you suggest.

garagatyi

Great PR, @guydaichs! I like how you simplified code and caught overall code design of the infrastructures subsystem. Could you take a look at my inlined comments about minor things I spotted in the PR?

garagatyi · 2018-02-19T09:04:53Z

dockerfiles/init/modules/che-kubernetes-helm/templates/configmap.yaml

@@ -44,3 +44,10 @@ data:
 {{- else }}
  CHE_INFRA_KUBERNETES_INGRESS_ANNOTATIONS__JSON: '{"nginx.ingress.kubernetes.io/rewrite-target": "/","nginx.ingress.kubernetes.io/ssl-redirect": "false","nginx.ingress.kubernetes.io/proxy-connect-timeout": "3600","nginx.ingress.kubernetes.io/proxy-read-timeout": "3600"}'
 {{- end }}
+{{- if .Values.isHostBased }}
+  CHE_INFRA_KUBERNETES_SERVER_STRATEGY: "host"


Consider renaming var to CHE_INFRA_KUBERNETES_SERVER__STRATEGY. We have vars naming policy:

dots in properties separate components (in case of env vars single underscores)

underscores in properties separate words in a single component term (in case of env vars double underscores)

E.g.
che.component1.sub_component_2_mb -> CHE_COMPONENT1_SUB__COMPONENT__2__MB
where MB is unit of measurement in case when property is a number

garagatyi · 2018-02-19T09:17:20Z

...org/eclipse/che/workspace/infrastructure/kubernetes/server/ExternalServerIngressBuilder.java

+
+    IngressRule ingressRule = ingressRuleBuilder.build();
+
+    IngressSpec ingressSpec = new IngressSpecBuilder().withRules(ingressRule).build();


@guydaichs Would you be willing to contribute unit tests for this class?

garagatyi · 2018-02-19T09:18:10Z

...rg/eclipse/che/workspace/infrastructure/kubernetes/server/ExternalServerExposerStrategy.java

+import org.eclipse.che.api.core.model.workspace.config.ServerConfig;
+import org.eclipse.che.workspace.infrastructure.kubernetes.environment.KubernetesEnvironment;
+
+/** @author Guy Daich */


Could you add javadocs to this class and/or the method?

garagatyi · 2018-02-19T09:18:27Z

...org/eclipse/che/workspace/infrastructure/kubernetes/server/ExternalServerIngressBuilder.java

+import org.eclipse.che.api.core.model.workspace.config.ServerConfig;
+import org.eclipse.che.workspace.infrastructure.kubernetes.Annotations;
+
+/** @author Guy Daich */


Could you add javadocs to this class?

Could you please merge two java docs here. I mean

/** * Doc... * * @author */

garagatyi · 2018-02-19T09:32:21Z

...eclipse/che/workspace/infrastructure/kubernetes/server/IngressHostExternalServerExposer.java

+  @Inject
+  public IngressHostExternalServerExposer(
+      @Named("infra.kubernetes.ingress.annotations") Map<String, String> ingressAnnotations,
+      @Named("che.domain") String domain) {


Can you elaborate if che.domain is a new variable? Does it differ from che.host?

In host-based routing, we assume that che-master and all workspaces are accessed through different sub-domains of the same domain. For example:

Che-server would be available at this address: master.che.my-k8s.com

The workspace agent of a specific workspace would be available at this address: server-4401-serverofflzacl-dev-machine.che.my-k8s.com

The user app for the same workspace would be available at this address: server-8080-serverofflzacl-dev-machine.che.my-k8s.com

Other workspaces and corresponding agents

In the example above che.host is master.che.my-k8s.com, whereas che.domain is che.my-k8s.com.

We chose this approach for several reasons:

In certain landscapes you might want to serve more than one che-master. This is especially true in continuous integration scenarios, staging environments, etc. In this case che.domain could be che-test.my-k8s.com, che-prod.my-k8s.com and so on.

For TLS, we would want to issue a single wildcard certificate for each Che deployment. E.g. *.che.my-k8s.com.

We could consider not setting the CHE_HOST environment variable upon deployment of che-master, and instead setting it programmatically based on CHE_DOMAIN, but we don't know what effect this would have on the Docker- and OpenShift-based Che infrastructures.

I see. Thank you for the detailed explanation!
From what I see it is used by k8s infra only. So shouldn't we rename it to something k8s infra specific, e.g. che.infra.kubernetes.che_domain?

I understand the reason why you decided to add it. But can you change the name to be compliant with the naming of other properties? For example che.infra.kubernetes.ingress.domain.

@garagatyi - agreed. I'll fix it.

garagatyi · 2018-02-19T09:41:21Z

...java/org/eclipse/che/workspace/infrastructure/kubernetes/server/KubernetesServerExposer.java

@@ -114,6 +102,21 @@
 *               servicePort: [8080|web-app]  ---->> Service.spec.ports[0].[port|name]
 * </pre>
 *
+ * <pre>
+ *   Host-Based Ingress exposing service's port:


Maybe it worth to move examples to different strategies and add {@see StrategyInterfaceClass} link to the class? WDYT @sleshchenko @guydaichs ?

@garagatyi I think it would be better to move examples to different strategies.

garagatyi · 2018-02-19T09:43:58Z

...rg/eclipse/che/workspace/infrastructure/openshift/server/OpenShiftExternalServerExposer.java

+ * @author Sergii Leshchenko
+ * @author Alexander Garagatyi
+ */
+public class OpenShiftExternalServerExposer


Could you add javadocs to this class?

skabashnyuk · 2018-02-23T10:36:07Z

ci-test

codenvy-ci · 2018-02-23T11:11:12Z

ci-test build report:
Build details
Test report
selenium tests report data
docker image: eclipseche/che-server:8822
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

Signed-off-by: Guy Daich <[email protected]>

Signed-off-by: Eyal Barlev <[email protected]>

Signed-off-by: Guy Daich <[email protected]>

* Add sample values files * Fix merge issues Signed-off-by: Guy Daich <[email protected]>

* rename TLS default value in che.env * remove openshift server exposer (consolidated with k8s) Signed-off-by: Guy Daich <[email protected]>

guydc · 2018-03-12T18:37:08Z

@sleshchenko @garagatyi I reworked this PR, and added some functionality to support TLS. Can you review?

Signed-off-by: Guy Daich <[email protected]>

l0rd · 2018-03-15T10:22:55Z

dockerfiles/init/modules/che-kubernetes-helm/readme.md


+#### Default Host


Shouldn't Default Host be at the same level than Single User and Multi User (a section of Deployment Options)? Same for TLS Enabled.

l0rd · 2018-03-15T10:26:21Z

dockerfiles/init/modules/che-kubernetes-helm/readme.md

+
+* Master: `https://che-<che-namespace>.your-domain/`
+* Keycloak:  `https://che-<che-namespace>.your-domain/auth/`
+* Workspaces servers: `https://<che-namespace>.your-domain/<path-to-server>`


Workspaces servers should be in the format https://che- too (with the che- prefix) or am I missing something?

sleshchenko

Generally, I like server exposing strategies approach 👍
Please take a look my minor comments how it can be improved.

sleshchenko · 2018-03-15T08:32:13Z

dockerfiles/init/manifests/che.env

@@ -433,6 +433,10 @@ CHE_SINGLE_PORT=false
 #####                              Kubernetes Infrastructure                       #####
 #####                                                                              #####
 #
+
+# Create routes with Transport Layer Security (TLS) enabled


Previously Routes here meant Routes OpenShift objects. Do you think it is OK to leave the same comment for Kubernetes infrastructure?

+1 to fix the comment

sleshchenko · 2018-03-15T08:34:43Z

assembly/assembly-wsmaster-war/src/main/webapp/WEB-INF/classes/che/che.properties

@@ -447,7 +447,7 @@ che.infra.kubernetes.client.http.connection_pool.keep_alive_min=5
 che.infra.openshift.project=

 # Create routes with Transport Layer Security (TLS) enabled
-che.infra.openshift.tls_enabled=false
+che.infra.kubernetes.tls_enabled=false


Please consider adding the corresponding alias in https://github.com/eclipse/che/blob/master/assembly/assembly-wsmaster-war/src/main/webapp/WEB-INF/classes/che_aliases.properties

sleshchenko · 2018-03-15T12:16:31Z

...ava/org/eclipse/che/workspace/infrastructure/kubernetes/provision/IngressTlsProvisioner.java

+ */
+public class IngressTlsProvisioner implements ConfigurationProvisioner<KubernetesEnvironment> {
+
+  protected final boolean isTlsEnabled;


Do you mind making these fields private?

sleshchenko · 2018-03-15T12:59:30Z

...se/che/workspace/infrastructure/kubernetes/server/MultiHostIngressExternalServerExposer.java

+
+  @Inject
+  public MultiHostIngressExternalServerExposer(
+      @Named("infra.kubernetes.ingress.annotations") Map<String, String> ingressAnnotations,


Looks like it is named infra.kubernetes.ingress.annotations by mistake.
I think it's good time to rename it to che.infra.kubernetes.ingress.annotations. @garagatyi WDYT?

It was done on purpose. I didn't use che. prefix to make it clear that it is not injectable from properties and should be provided by a special provider instead. The reason is that we inject it as a property in a different format and that property gets converted into this injection on Che start.
So -1 to rename it.

agree with @garagatyi

sleshchenko · 2018-03-15T13:01:25Z

...org/eclipse/che/workspace/infrastructure/kubernetes/server/ExternalServerIngressBuilder.java

+import org.eclipse.che.api.core.model.workspace.config.ServerConfig;
+import org.eclipse.che.workspace.infrastructure.kubernetes.Annotations;
+
+/** @author Guy Daich */


Could you please merge two java docs here. I mean

/** * Doc... * * @author */

sleshchenko · 2018-03-15T13:05:51Z

...se/che/workspace/infrastructure/kubernetes/server/MultiHostIngressExternalServerExposer.java

+  public MultiHostIngressExternalServerExposer(
+      @Named("infra.kubernetes.ingress.annotations") Map<String, String> ingressAnnotations,
+      @Named("che.infra.kubernetes.ingress.domain") String domain) {
+    if (ingressAnnotations == null) {


Previously this check was placed in one class, now in three classes. Maybe it makes sense to move it in IngressAnnotationsProvider

We have such provider and it provides this binding. We can either inject provider instead of a map here or not check the map for nullability since it is injected as a not nullable dependency.
I think injecting of Provider instead of binding it to a map would make code clearer.
I had to do this in the first place. @guydaichs @sleshchenko WDYT?

moved check to provider.

sleshchenko · 2018-03-15T13:09:27Z

...java/org/eclipse/che/workspace/infrastructure/kubernetes/server/KubernetesServerExposer.java

@@ -130,24 +104,19 @@
  public static final int SERVER_UNIQUE_PART_SIZE = 8;
  public static final String SERVER_PREFIX = "server";

-  private final Map<String, String> ingressAnnotations;
+  protected final ExternalServerExposerStrategy kubernetesExternalServerExposerStrategy;


Could you generify this field with <T> to avoid unchecked call here https://github.com/eclipse/che/pull/8822/files#diff-ff394ec17243637d9571b51b4aa23b99R206

sleshchenko · 2018-03-15T13:32:32Z

...ava/org/eclipse/che/workspace/infrastructure/kubernetes/provision/IngressTlsProvisioner.java

+  @Inject
+  public IngressTlsProvisioner(
+      @Named("che.infra.kubernetes.tls_enabled") boolean isTlsEnabled,
+      @Named("che.infra.kubernetes.tls_secret") String tlsSecretName) {


I'd say that new configuration properties should be added to che.properties with default values and docs.

sleshchenko · 2018-03-15T13:41:52Z

.../che/workspace/infrastructure/kubernetes/server/DefaultHostIngressExternalServerExposer.java

+  }
+
+  @Override
+  public void exposeExternalServers(


Looks like three strategies classes have very similar code with ingress builders. Maybe it would be better (maybe not) to create abstract IngressExternalServerExposerStrategy with a protected method like #createIngress(String name, @Nullable String host, String path, ...)

Like the idea to reduce the amount of the code and not repeat yourself but it depends on how simple would be the code. @guydaichs up to you to decide whether it is better or not

created AbstractIngressExternalServerExposerStrategy, where shared logic resides.

garagatyi

Sorry that you have faced such a strict PR review process but there are reasons for that:

you are changing components that are in a core of new architecture and our previous core was a mess because we had not enough review. So we are trying to do our best now to keep it clear and maintainable.
your PRs quality is good and we treat you as a person who wants to commit clean solution that doesn't need to be sanitized by maintainers after the merge.

We have such reviews usually for PRs on a maintainers level or with significant changes to the core components.

garagatyi · 2018-03-15T14:14:35Z

...ava/org/eclipse/che/workspace/infrastructure/kubernetes/provision/IngressTlsProvisioner.java

+    // when working in single-host mode, nginx controller wil reuse the che-master secret
+    // https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/api/extensions/v1beta1/types.go
+    if (!isNullOrEmpty(tlsSecretName)) {
+      ingressTLSBuilder.withSecretName(tlsSecretName);


Not sure I got it right but it seems that is called twice - both in any case and when the secret name is neither null nor empty. Shouldn't we delete first call of this method?

Refactor mistake. fixed.

garagatyi · 2018-03-15T14:16:48Z

...ava/org/eclipse/che/workspace/infrastructure/kubernetes/provision/IngressTlsProvisioner.java

+    }
+
+    IngressTLS ingressTLS = ingressTLSBuilder.build();
+    List<IngressTLS> ingressTLSList = new ArrayList<>(Arrays.asList(ingressTLS));


I think some IDE might show warning because of usage of Arrays.asList instead of Collections.singletonList here. Consider the last variant.

garagatyi · 2018-03-15T16:03:59Z

assembly/assembly-wsmaster-war/src/main/webapp/WEB-INF/classes/che/che.properties

@@ -447,7 +447,7 @@ che.infra.kubernetes.client.http.connection_pool.keep_alive_min=5
 che.infra.openshift.project=

 # Create routes with Transport Layer Security (TLS) enabled
-che.infra.openshift.tls_enabled=false
+che.infra.kubernetes.tls_enabled=false


garagatyi · 2018-03-15T16:04:28Z

dockerfiles/init/manifests/che.env

@@ -433,6 +433,10 @@ CHE_SINGLE_PORT=false
 #####                              Kubernetes Infrastructure                       #####
 #####                                                                              #####
 #
+
+# Create routes with Transport Layer Security (TLS) enabled


+1 to fix the comment

garagatyi · 2018-03-15T16:08:43Z

...ava/org/eclipse/che/workspace/infrastructure/kubernetes/provision/IngressTlsProvisioner.java

+  @Inject
+  public IngressTlsProvisioner(
+      @Named("che.infra.kubernetes.tls_enabled") boolean isTlsEnabled,
+      @Named("che.infra.kubernetes.tls_secret") String tlsSecretName) {


garagatyi · 2018-03-15T16:24:01Z

...se/che/workspace/infrastructure/kubernetes/server/MultiHostIngressExternalServerExposer.java

+
+  @Inject
+  public MultiHostIngressExternalServerExposer(
+      @Named("infra.kubernetes.ingress.annotations") Map<String, String> ingressAnnotations,


It was done on purpose. I didn't use che. prefix to make it clear that it is not injectable from properties and should be provided by a special provider instead. The reason is that we inject it as a property in a different format and that property gets converted into this injection on Che start.
So -1 to rename it.

garagatyi · 2018-03-15T16:30:11Z

...se/che/workspace/infrastructure/kubernetes/server/MultiHostIngressExternalServerExposer.java

+  public MultiHostIngressExternalServerExposer(
+      @Named("infra.kubernetes.ingress.annotations") Map<String, String> ingressAnnotations,
+      @Named("che.infra.kubernetes.ingress.domain") String domain) {
+    if (ingressAnnotations == null) {


We have such provider and it provides this binding. We can either inject provider instead of a map here or not check the map for nullability since it is injected as a not nullable dependency.
I think injecting of Provider instead of binding it to a map would make code clearer.
I had to do this in the first place. @guydaichs @sleshchenko WDYT?

garagatyi · 2018-03-15T16:33:15Z

.../che/workspace/infrastructure/kubernetes/server/DefaultHostIngressExternalServerExposer.java

+  }
+
+  @Override
+  public void exposeExternalServers(


Like the idea to reduce the amount of the code and not repeat yourself but it depends on how simple would be the code. @guydaichs up to you to decide whether it is better or not

garagatyi · 2018-03-15T16:42:26Z

...org/eclipse/che/workspace/infrastructure/kubernetes/provision/IngressTlsProvisionerTest.java

+    Map<String, ServerConfigImpl> ingressServers =
+        Annotations.newDeserializer(ingress.getMetadata().getAnnotations()).servers();
+    assertEquals(ingressServers.get("http-server").getProtocol(), "https");
+    assertEquals(ingressServers.get("ws-server").getProtocol(), "wss");


Looks like there are 3 things that can be covered in addition:

secret name if it is neither null nor empty

secret name if it is null

secret name if it is empty

garagatyi · 2018-03-15T17:05:05Z

...test/java/org/eclipse/che/workspace/infrastructure/openshift/OpenShiftServerExposerTest.java

- *
- * @author Sergii Leshchenko
- */
-public class OpenShiftServerExposerTest {


I don't quite understand why these tests should be removed. @guydaichs can you elaborate on that?

You're right. OpenshiftServerExposer doesn't exist as a class, but openshift server exposure logic in KubernetesServerExposer should still be tested. I adapted the test class.

guydc · 2018-03-15T18:19:07Z

@l0rd @garagatyi @sleshchenko : Thanks for the thorough review and meaningful comments. I'll make the required changes and let you know.

garagatyi · 2018-03-20T20:24:52Z

@guydaichs I'm sorry but I've merged PR that moves deployment files to another folder. This has affected your PR. I think that the easiest way to adapt your PR is to rebase it against master and then move files that would be left from dockerfiles/init/modules/che-kubernetes-helm to deploy/kubernetes/helm/che. I hope you won't get any rebase conflicts.

garagatyi · 2018-03-30T11:44:59Z

@guydaichs If you need assistance with the changes caused by my PR I can do required changes in your branch.

guydc · 2018-04-04T13:41:01Z

Opened a fresh PR: #9329.
closing this one.

k8s-infra: add host/path-based ingress strategies

3c2bbe5

Signed-off-by: Guy Daich <[email protected]>

guydc requested review from benoitf, garagatyi and riuvshin as code owners February 17, 2018 14:32

riuvshin requested a review from sleshchenko February 17, 2018 16:52

Adapt OS infra to use external server exposer

cf4faba

Signed-off-by: Guy Daich <[email protected]>

sleshchenko reviewed Feb 19, 2018

View reviewed changes

garagatyi reviewed Feb 19, 2018

View reviewed changes

guydc added 2 commits February 20, 2018 13:31

reuse k8s ServersConverter in OS infra

3ceebee

Merge remote-tracking branch 'upstream/master' into CHE-8694

33cd04f

guydc added 2 commits February 23, 2018 14:19

Merge remote-tracking branch 'upstream/master' into CHE-8694

dcc1a0b

Merge remote-tracking branch 'upstream/master' into CHE-8694

49459f5

slemeur removed the kind/epic A long-lived, PM-driven feature request. Must include a checklist of items that must be completed. label Feb 26, 2018

guydc added 4 commits March 5, 2018 19:34

begin tls for path-based k8s infra

d451c14

Signed-off-by: Guy Daich <[email protected]>

continue k8s tls support

d28892f

Signed-off-by: Guy Daich <[email protected]>

Add single-host strategy, cert-manager support

c7d4f24

Signed-off-by: Guy Daich <[email protected]>

Merge remote-tracking branch 'upstream/master' into CHE-8694

7951103

guydc and others added 7 commits March 8, 2018 08:29

fix charts, add single-host strategy, add TLS test

c2db0f5

Signed-off-by: Guy Daich <[email protected]>

TLS: changed cert-manager certficiate issuer to be ClusterIssuer

cfeb1e6

Signed-off-by: Eyal Barlev <[email protected]>

add resolved values.yaml

7d6eb96

Signed-off-by: Guy Daich <[email protected]>

Merge remote-tracking branch 'upstream/master' into CHE-8694

b0d0481

Signed-off-by: Guy Daich <[email protected]>

Adapt to k8s Multiuser

e25ddf1

* Add sample values files * Fix merge issues Signed-off-by: Guy Daich <[email protected]>

Merge remote-tracking branch 'upstream/master' into CHE-8694

c026d21

Cleanup OpenShift Infra

b5fe1ed

* rename TLS default value in che.env * remove openshift server exposer (consolidated with k8s) Signed-off-by: Guy Daich <[email protected]>

guydc requested a review from skabashnyuk as a code owner March 12, 2018 18:23

guydc changed the title ~~k8s-infra: add host/path-based ingress strategies~~ k8s-infra: server routing strategies & basic TLS Mar 12, 2018

remove uintended automation changes

b5b2832

Signed-off-by: Guy Daich <[email protected]>

skabashnyuk requested a review from l0rd March 13, 2018 08:07

l0rd reviewed Mar 15, 2018

View reviewed changes

sleshchenko reviewed Mar 15, 2018

View reviewed changes

garagatyi reviewed Mar 15, 2018

View reviewed changes

l0rd mentioned this pull request Mar 19, 2018

SPI Kubernetes infrastructure #5908

Closed

19 tasks

garagatyi mentioned this pull request Mar 20, 2018

Move deployment files out of dockerfiles folder #9143

Merged

guydc mentioned this pull request Apr 4, 2018

k8s-infra: routing, TLS (rebased) #9329

Merged

guydc closed this Apr 4, 2018

		@@ -91,95 +87,22 @@
		*/
		public class OpenShiftServerExposer extends KubernetesServerExposer<OpenShiftEnvironment> {


		IngressRule ingressRule = ingressRuleBuilder.build();

		IngressSpec ingressSpec = new IngressSpecBuilder().withRules(ingressRule).build();

k8s-infra: server routing strategies & basic TLS #8822

k8s-infra: server routing strategies & basic TLS #8822

Conversation

guydc commented Feb 17, 2018 • edited Loading

What does this PR do?

What issues does this PR fix or reference?

Release Notes

Docs PR

codenvy-ci commented Feb 17, 2018

codenvy-ci commented Feb 17, 2018

codenvy-ci commented Feb 17, 2018

skabashnyuk commented Feb 17, 2018

codenvy-ci commented Feb 17, 2018

guydc commented Feb 18, 2018

skabashnyuk commented Feb 18, 2018

codenvy-ci commented Feb 19, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sleshchenko Feb 19, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sleshchenko Feb 19, 2018 • edited Loading

Choose a reason for hiding this comment

sleshchenko Feb 19, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

garagatyi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

skabashnyuk commented Feb 23, 2018

codenvy-ci commented Feb 23, 2018

guydc commented Mar 12, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sleshchenko left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sleshchenko Mar 15, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

guydc commented Feb 17, 2018 •

edited

Loading

sleshchenko Feb 19, 2018 •

edited

Loading

sleshchenko Feb 19, 2018 •

edited

Loading

sleshchenko Feb 19, 2018 •

edited

Loading

sleshchenko Mar 15, 2018 •

edited

Loading