ingress.yaml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: apisix-ingress
  name: apisix-ingress-controller-manager
  namespace: {{ .Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: apisix-ingress
  name: apisix-ingress-leader-election-role
  namespace: {{ .Namespace }}
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ .Namespace }}-apisix-ingress-manager-role
rules:
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - services
  - pods
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apisix.apache.org
  resources:
  - apisixconsumers
  - apisixglobalrules
  - apisixpluginconfigs
  - apisixroutes
  - apisixtlses
  - apisixupstreams
  - backendtrafficpolicies
  - consumers
  - gatewayproxies
  - httproutepolicies
  - pluginconfigs
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apisix.apache.org
  resources:
  - apisixconsumers/status
  - apisixglobalrules/status
  - apisixpluginconfigs/status
  - apisixroutes/status
  - apisixtlses/status
  - apisixupstreams/status
  - backendtrafficpolicies/status
  - consumers/status
  - httproutepolicies/status
  verbs:
  - get
  - update
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - gatewayclasses
  verbs:
  - get
  - list
  - update
  - watch
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - gatewayclasses/status
  verbs:
  - get
  - update
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - gateways
  verbs:
  - get
  - list
  - update
  - watch
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - gateways/status
  verbs:
  - get
  - update
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - httproutes
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - httproutes/status
  verbs:
  - get
  - update
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - referencegrants
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - referencegrants/status
  verbs:
  - get
- apiGroups:
  - networking.k8s.io
  resources:
  - ingressclasses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - get
  - list
  - update
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses/status
  verbs:
  - get
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ .Namespace }}-apisix-ingress-metrics-auth-role
rules:
- apiGroups:
  - authentication.k8s.io
  resources:
  - tokenreviews
  verbs:
  - create
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ .Namespace }}-apisix-ingress-metrics-reader
rules:
- nonResourceURLs:
  - /metrics
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: apisix-ingress
  name: apisix-ingress-leader-election-rolebinding
  namespace: {{ .Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ .Namespace }}-apisix-ingress-leader-election-role
subjects:
- kind: ServiceAccount
  name: apisix-ingress-controller-manager
  namespace: {{ .Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: apisix-ingress
  name: {{ .Namespace }}-apisix-ingress-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ .Namespace }}-apisix-ingress-manager-role
subjects:
- kind: ServiceAccount
  name: apisix-ingress-controller-manager
  namespace: {{ .Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ .Namespace }}-apisix-ingress-metrics-auth-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ .Namespace }}-apisix-ingress-metrics-auth-role
subjects:
- kind: ServiceAccount
  name: apisix-ingress-controller-manager
  namespace: {{ .Namespace }}
---

apiVersion: v1
kind: ConfigMap
metadata:
  name: ingress-config
  namespace: {{ .Namespace }}
data:
  config.yaml: |
    log_level: "debug"
    controller_name: {{ .ControllerName | default "apisix.apache.org/apisix-ingress-controller" }}
    leader_election_id: "apisix-ingress-controller-leader"
    exec_adc_timeout: 5s
    provider:
      type: {{ .ProviderType | default "apisix" }}
      sync_period: {{ .ProviderSyncPeriod | default "0s" }}
                                        # The period between two consecutive syncs.
                                        # The default value is 0 seconds, which means the controller will not sync.
                                        # If you want to enable the sync, set it to a positive value.
      init_sync_delay: {{ .InitSyncDelay | default "20m" }}
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: apisix-ingress
    control-plane: controller-manager
  name: apisix-ingress-controller-manager-metrics-service
  namespace: {{ .Namespace }}
spec:
  ports:
  - name: metrics
    port: 8080
    protocol: TCP
    targetPort: 8080
  selector:
    control-plane: controller-manager
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: apisix-ingress
    app: apisix-ingress-controller
    control-plane: controller-manager
  name: apisix-ingress-controller-manager
  namespace: {{ .Namespace }}
spec:
  replicas: {{ .Replicas | default 1 }}
  selector:
    matchLabels:
      app: apisix-ingress-controller
      control-plane: controller-manager
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: manager
      labels:
        app: apisix-ingress-controller
        control-plane: controller-manager
    spec:
      containers:
      - image: apache/apisix-ingress-controller:dev
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        volumeMounts:
        - name: ingress-config
          mountPath: /app/conf/config.yaml
          subPath: config.yaml
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
          initialDelaySeconds: 15
          periodSeconds: 20
        name: manager
        ports:
        - name: metrics
          containerPort: 8080
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 10
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
      - image: ghcr.io/api7/adc:dev
        env:
        - name: ADC_RUNNING_MODE
          value: ingress
        - name: ADC_EXPERIMENTAL_FEATURE_FLAGS 
          value: remote-state-file,parallel-backend-request
        - name: ADC_INGRESS_LOG_LEVEL
          value: debug
        name: adc-server
        args:
        - "server"
        - "--listen"
        - "http://127.0.0.1:3000"
        - "--listen-status"
        - "3001"
        ports:
        - name: http
          containerPort: 3000
          protocol: TCP
        - name: http-status
          containerPort: 3001
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /healthz/ready
            port: 3001
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 10
        readinessProbe:
          httpGet:
            path: /healthz/ready
            port: 3001
          initialDelaySeconds: 5
          periodSeconds: 5
      volumes:
      - name: ingress-config
        configMap:
          name: ingress-config
      serviceAccountName: apisix-ingress-controller-manager
      terminationGracePeriodSeconds: 10