Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix ingress exposure missing information for it to work #440

Merged
merged 1 commit into from
Jan 25, 2025
Merged

Fix ingress exposure missing information for it to work #440

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions examples/exposed-monopod/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,14 @@ func main() {
Files: pulumi.StringMap{
"/app/flag.txt": variated,
},
// The following fits for a Traefik-based use case
IngressAnnotations: pulumi.ToStringMap(map[string]string{
"traefik.ingress.kubernetes.io/router.entrypoints": "web, websecure",
}),
IngressNamespace: pulumi.String("networking"),
IngressLabels: pulumi.ToStringMap(map[string]string{
"app": "traefik",
}),
}, opts...)
if err != nil {
return err
Expand Down
106 changes: 79 additions & 27 deletions sdk/kubernetes/exposed-monopod.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,11 @@ type (
// WARNING: provisionning a file in a directory makes adjacent
// files unavailable.
// For more info, refer to https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#populate-a-volume-with-data-stored-in-a-configmap
Files pulumi.StringMapInput
Files pulumi.StringMapInput

// FromCIDR can be configured to specify an IP range that will
// be able to access the pod.
// TODO @NicoFgrx support it when ExposeIngress too
FromCIDR pulumi.StringPtrInput
fromCIDR pulumi.StringOutput

Expand All @@ -61,6 +65,14 @@ type (
// put on the ingress, if the `ExposeType` is set to
// `ExposeIngress`.
IngressAnnotations pulumi.StringMapInput

// IngressNamespace must be configured to the namespace in
// which the ingress (e.g. nginx, traefik) is deployed.
IngressNamespace pulumi.StringInput

// IngressLabels must be configured to the labels of the ingress
// pods (e.g. app=traefik, ...).
IngressLabels pulumi.StringMapInput
}

ExposeType int
Expand Down Expand Up @@ -264,6 +276,41 @@ func (emp *ExposedMonopod) provision(ctx *pulumi.Context, args *ExposedMonopodAr

// Specific exposures
switch args.ExposeType {
case ExposeNodePort:
emp.ntp, err = netwv1.NewNetworkPolicy(ctx, "emp-ntp", &netwv1.NetworkPolicyArgs{
Metadata: metav1.ObjectMetaArgs{
Labels: labels,
Name: pulumi.Sprintf("emp-ntp-%s", args.Identity),
},
Spec: netwv1.NetworkPolicySpecArgs{
PodSelector: metav1.LabelSelectorArgs{
MatchLabels: labels,
},
PolicyTypes: pulumi.ToStringArray([]string{
"Ingress",
}),
Ingress: netwv1.NetworkPolicyIngressRuleArray{
netwv1.NetworkPolicyIngressRuleArgs{
From: netwv1.NetworkPolicyPeerArray{
netwv1.NetworkPolicyPeerArgs{
IpBlock: &netwv1.IPBlockArgs{
Cidr: args.fromCIDR,
},
},
},
Ports: netwv1.NetworkPolicyPortArray{
netwv1.NetworkPolicyPortArgs{
Port: args.Port,
},
},
},
},
},
}, opts...)
if err != nil {
return err
}

case ExposeIngress:
emp.ing, err = netwv1.NewIngress(ctx, "emp-ing", &netwv1.IngressArgs{
Metadata: metav1.ObjectMetaArgs{
Expand Down Expand Up @@ -309,40 +356,45 @@ func (emp *ExposedMonopod) provision(ctx *pulumi.Context, args *ExposedMonopodAr
if err != nil {
return err
}
}

emp.ntp, err = netwv1.NewNetworkPolicy(ctx, "emp-ntp", &netwv1.NetworkPolicyArgs{
Metadata: metav1.ObjectMetaArgs{
Labels: labels,
Name: pulumi.Sprintf("emp-ntp-%s", args.Identity),
},
Spec: netwv1.NetworkPolicySpecArgs{
PodSelector: metav1.LabelSelectorArgs{
MatchLabels: labels,
emp.ntp, err = netwv1.NewNetworkPolicy(ctx, "emp-ntp", &netwv1.NetworkPolicyArgs{
Metadata: metav1.ObjectMetaArgs{
Labels: labels,
Name: pulumi.Sprintf("emp-ntp-%s", args.Identity),
},
PolicyTypes: pulumi.ToStringArray([]string{
"Ingress",
}),
Ingress: netwv1.NetworkPolicyIngressRuleArray{
netwv1.NetworkPolicyIngressRuleArgs{
From: netwv1.NetworkPolicyPeerArray{
netwv1.NetworkPolicyPeerArgs{
IpBlock: &netwv1.IPBlockArgs{
Cidr: args.fromCIDR,
Spec: netwv1.NetworkPolicySpecArgs{
PodSelector: metav1.LabelSelectorArgs{
MatchLabels: labels,
},
PolicyTypes: pulumi.ToStringArray([]string{
"Ingress",
}),
Ingress: netwv1.NetworkPolicyIngressRuleArray{
netwv1.NetworkPolicyIngressRuleArgs{
From: netwv1.NetworkPolicyPeerArray{
netwv1.NetworkPolicyPeerArgs{
NamespaceSelector: metav1.LabelSelectorArgs{
MatchLabels: pulumi.StringMap{
"kubernetes.io/metadata.name": args.IngressNamespace,
},
},
PodSelector: metav1.LabelSelectorArgs{
MatchLabels: args.IngressLabels,
},
},
},
},
Ports: netwv1.NetworkPolicyPortArray{
netwv1.NetworkPolicyPortArgs{
Port: args.Port,
Ports: netwv1.NetworkPolicyPortArray{
netwv1.NetworkPolicyPortArgs{
Port: args.Port,
},
},
},
},
},
},
}, opts...)
if err != nil {
return err
}, opts...)
if err != nil {
return
}
}

return nil
Expand Down
4 changes: 2 additions & 2 deletions webdocs/challmaker-guides/software-development-kit/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,15 +62,15 @@ func main() {
cm, err := kubernetes.NewExposedMonopod(req.Ctx, &kubernetes.ExposedMonopodArgs{
Image: pulumi.String("myprofile/my-challenge:latest"),
Port: pulumi.Int(8080),
ExposeType: kubernetes.ExposeIngress,
ExposeType: kubernetes.ExposeNodePort,
Hostname: pulumi.String("brefctf.ctfer.io"),
Identity: pulumi.String(req.Config.Identity),
}, opts...)
if err != nil {
return err
}

resp.ConnectionInfo = pulumi.Sprintf("curl -v https://%s", cm.URL)
resp.ConnectionInfo = pulumi.Sprintf("curl -v http://%s", cm.URL)
return nil
})
}
Expand Down
17 changes: 12 additions & 5 deletions webdocs/tutorials/a-complete-example/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,11 +92,18 @@ import (
func main() {
sdk.Run(func(req *sdk.Request, resp *sdk.Response, opts ...pulumi.ResourceOption) error {
cm, err := kubernetes.NewExposedMonopod(req.Ctx, &kubernetes.ExposedMonopodArgs{
Image: pulumi.String("account/challenge:latest"), // challenge Docker image
Port: pulumi.Int(8080), // pod listens on port 8080
ExposeType: kubernetes.ExposeIngress, // expose the challenge through an ingress (HTTP)
Hostname: pulumi.String("brefctf.ctfer.io"), // CTF hostname
Identity: pulumi.String(req.Config.Identity), // identity will be prepended to hostname
Image: pulumi.String("account/challenge:latest"), // challenge Docker image
Port: pulumi.Int(8080), // pod listens on port 8080
ExposeType: kubernetes.ExposeIngress, // expose the challenge through an ingress (HTTP)
Hostname: pulumi.String("brefctf.ctfer.io"), // CTF hostname
Identity: pulumi.String(req.Config.Identity), // identity will be prepended to hostname
IngressAnnotations: pulumi.ToStringMap(map[string]string{ // annotations for the ingress to target the service
"traefik.ingress.kubernetes.io/router.entrypoints": "web, websecure",
}),
IngressNamespace: pulumi.String("networking"), // the namespace in which the ingress is deployed
IngressLabels: pulumi.ToStringMap(map[string]string{ // the labels of the ingress pods
"app": "traefik",
}),
}, opts...)
if err != nil {
return err
Expand Down
Loading