Skip to content

Commit 6b6e829

Browse files
daniel-goldsteindaniel-goldstein
authored
[guide-analysis] Host guide browser in hail-vdc (hail-is#14078)
This adds the k8s config necessary to host the [guide browser](https://hub.docker.com/r/gneak123/guide_browser/tags) in our k8s cluster. You can see it running in dev [here](https://internal.hail.is/dgoldste/guide-analysis/). There's not much special here, a deployment with the browser app and an envoy sidecar to handle TLS. Once this merges and the `ssl-config-guide-analysis` is created in `default` I can `make -C guide deploy NAMESPACE=default` and then recreate the certs to pick up the new subdomain, after which it should be live. Resolves hail-is#14067
1 parent 8d566ee commit 6b6e829

File tree

4 files changed

+177
-0
lines changed

4 files changed

+177
-0
lines changed

‎guide/Makefile

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
include ../config.mk
2+
3+
.PHONY: deploy
4+
deploy:
5+
! [ -z $(NAMESPACE) ] # call this like: make deploy NAMESPACE=default
6+
python3 ../ci/jinja2_render.py \
7+
'{"global":{"docker_prefix":"$(DOCKER_PREFIX)"},"default_ns":{"name":"$(NAMESPACE)"}}' \
8+
deployment.yaml deployment.yaml.out
9+
kubectl -n $(NAMESPACE) apply -f deployment.yaml.out

‎guide/deployment.yaml

+163
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: guide-sidecar-envoy-config
5+
data:
6+
envoy.yaml: |
7+
static_resources:
8+
listeners:
9+
- address:
10+
socket_address:
11+
address: 0.0.0.0
12+
port_value: 8443
13+
filter_chains:
14+
- filters:
15+
- name: envoy.filters.network.http_connection_manager
16+
typed_config:
17+
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
18+
codec_type: AUTO
19+
stat_prefix: ingress_http
20+
upgrade_configs:
21+
- upgrade_type: websocket
22+
route_config:
23+
name: local_route
24+
virtual_hosts:
25+
- name: guide-analysis
26+
domains: ["*"]
27+
routes:
28+
{% if default_ns.name != "default" %}
29+
- match:
30+
prefix: "/{{ default_ns.name }}/guide-analysis/"
31+
route:
32+
prefix_rewrite: "/"
33+
timeout: 0s
34+
cluster: guide-analysis
35+
{% endif %}
36+
- match:
37+
prefix: "/"
38+
route:
39+
timeout: 0s
40+
cluster: guide-analysis
41+
http_filters:
42+
- name: envoy.filters.http.router
43+
typed_config:
44+
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
45+
transport_socket:
46+
name: envoy.transport_sockets.tls
47+
typed_config:
48+
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
49+
common_tls_context:
50+
tls_certificates:
51+
- certificate_chain:
52+
filename: /ssl-config/guide-analysis-cert.pem
53+
private_key:
54+
filename: /ssl-config/guide-analysis-key.pem
55+
clusters:
56+
- name: guide-analysis
57+
type: STRICT_DNS
58+
lb_policy: ROUND_ROBIN
59+
load_assignment:
60+
cluster_name: guide-analysis
61+
endpoints:
62+
- lb_endpoints:
63+
- endpoint:
64+
address:
65+
socket_address:
66+
address: 127.0.0.1
67+
port_value: 8000
68+
admin:
69+
address:
70+
socket_address:
71+
address: 127.0.0.1
72+
port_value: 8001
73+
---
74+
apiVersion: apps/v1
75+
kind: Deployment
76+
metadata:
77+
name: guide-analysis
78+
labels:
79+
name: guide-analysis
80+
spec:
81+
selector:
82+
matchLabels:
83+
app: guide-analysis
84+
replicas: 1
85+
template:
86+
metadata:
87+
labels:
88+
app: guide-analysis
89+
spec:
90+
nodeSelector:
91+
preemptible: "false"
92+
containers:
93+
- name: guide-analysis
94+
image: gneak123/guide_browser:amd@sha256:d3801eb2ff08ac0b5e9587ee3780dfa491bc087c367bc8bf3d252b2e60fae5b6
95+
imagePullPolicy: Always
96+
resources:
97+
requests:
98+
cpu: "100m"
99+
memory: "200M"
100+
limits:
101+
cpu: "1"
102+
memory: "1G"
103+
ports:
104+
- containerPort: 8000
105+
protocol: TCP
106+
- name: envoy
107+
image: "{{ global.docker_prefix }}/envoyproxy/envoy:v1.22.3"
108+
command:
109+
- /usr/local/bin/envoy
110+
- --config-path
111+
- /etc/envoy/envoy.yaml
112+
- --concurrency
113+
- "2"
114+
resources:
115+
requests:
116+
cpu: "20m"
117+
memory: "20M"
118+
limits:
119+
cpu: "1"
120+
memory: "1G"
121+
ports:
122+
- containerPort: 8443
123+
volumeMounts:
124+
- name: ssl-config-guide-analysis
125+
mountPath: /ssl-config
126+
readOnly: true
127+
- name: guide-sidecar-envoy-config
128+
mountPath: /etc/envoy
129+
readOnly: true
130+
readinessProbe:
131+
httpGet:
132+
{% if default_ns.name == "default" %}
133+
path: /
134+
{% else %}
135+
path: /{{ default_ns.name }}/guide-analysis/
136+
{% endif %}
137+
port: 8443
138+
scheme: HTTPS
139+
initialDelaySeconds: 5
140+
periodSeconds: 10
141+
timeoutSeconds: 10
142+
volumes:
143+
- name: ssl-config-guide-analysis
144+
secret:
145+
optional: false
146+
secretName: ssl-config-guide-analysis
147+
- name: guide-sidecar-envoy-config
148+
configMap:
149+
name: guide-sidecar-envoy-config
150+
---
151+
apiVersion: v1
152+
kind: Service
153+
metadata:
154+
name: guide-analysis
155+
labels:
156+
app: guide-analysis
157+
spec:
158+
ports:
159+
- port: 443
160+
protocol: TCP
161+
targetPort: 8443
162+
selector:
163+
app: guide-analysis

‎letsencrypt/subdomains.txt

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ blog
66
monitoring
77
auth
88
ukbb-rg
9+
guide-analysis
910
grafana
1011
prometheus
1112
hello

‎tls/config.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -62,3 +62,7 @@ principals:
6262
domains:
6363
- prometheus
6464
kind: nginx
65+
- name: guide-analysis
66+
domains:
67+
- guide-analysis
68+
kind: nginx

0 commit comments

Comments
 (0)