Skip to content

Commit c2befd5

Browse files
mjudeikismjudeikis
committed
Add production deployment documentation
Signed-off-by: Mangirdas Judeikis <[email protected]> On-behalf-of: @SAP [email protected]
1 parent fa4e118 commit c2befd5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+4870
-6
lines changed

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,3 +49,6 @@ dex/
4949
*.pem
5050

5151
index.html
52+
contrib/production/cert-manager/cloudflare-secret.yaml
53+
contrib/production/cert-manager/cluster-issuer.yaml
54+
contrib/production/oidc-dex/values.yaml

‎contrib/production/README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Production Deployment Assets
2+
3+
This directory contains assets and configuration files for production deployment of kcp.
4+
5+
!!! Note: We understand that maintaining static assets in the repository can be challenging. If you have noticed any discrepancies between these assets and the latest version of the kcp - please open an issue or submit a pull request to help us keep them up to date.
6+
7+
## Usage
8+
9+
These assets are referenced by the production deployment documentation in `docs/content/setup/production/`.
10+
11+
Each deployment type (dekker, vespucci, comer) has its own subdirectory with complete configuration files and deployment manifests.
12+
13+
## Deployment Types
14+
15+
- **kcp-dekker**: Self-signed certificates, simple single-cluster deployment
16+
- **kcp-vespucci**: External certificates with Let's Encrypt, public shard access
17+
- **kcp-comer**: CDN integration with dual front-proxy configuration
18+
19+
See the corresponding documentation in `docs/content/setup/production/` for detailed deployment instructions.

‎contrib/production/cert-manager/certificate-example.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
apiVersion: cert-manager.io/v1
3+
kind: Certificate
4+
metadata:
5+
name: dex-tls-cert
6+
namespace: oidc
7+
spec:
8+
# Secret where the certificate will be stored
9+
secretName: dex-tls
10+
11+
# Reference to the ClusterIssuer
12+
issuerRef:
13+
name: kcp-comerletsencrypt-prod
14+
kind: ClusterIssuer
15+
16+
# Domains for the certificate
17+
dnsNames:
18+
- auth.example.com

‎contrib/production/cert-manager/cloudflare-secret.yaml.template‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: cloudflare-api-key-secret
6+
namespace: cert-manager
7+
type: Opaque
8+
data:
9+
# Replace with your base64 encoded Cloudflare Global API Key
10+
# Get your API key from: https://dash.cloudflare.com/profile/api-tokens
11+
# Then encode it: echo -n "xxxxxxxxxxxxx" | base64
12+
api-key: xxxxxxxxxxxx

‎contrib/production/cert-manager/cluster-issuer.yaml.template‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
apiVersion: cert-manager.io/v1
3+
kind: ClusterIssuer
4+
metadata:
5+
name: letsencrypt-prod
6+
spec:
7+
acme:
8+
# You must replace this email address with your own.
9+
email: [email protected]
10+
server: https://acme-v02.api.letsencrypt.org/directory
11+
privateKeySecretRef:
12+
# Secret resource that will be used to store the account's private key.
13+
name: le-issuer-account-key
14+
solvers:
15+
- dns01:
16+
cloudflare:
17+
email: [email protected]
18+
apiKeySecretRef:
19+
name: cloudflare-api-key-secret
20+
key: api-key

‎contrib/production/etcd-druid/certificate-etcd-issuer.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# CA authority for etcd components.
2+
---
3+
apiVersion: cert-manager.io/v1
4+
kind: Issuer
5+
metadata:
6+
name: selfsigned
7+
namespace: cert-manager
8+
spec:
9+
selfSigned: {}
10+
---
11+
apiVersion: cert-manager.io/v1
12+
kind: Certificate
13+
metadata:
14+
name: etcd-ca
15+
namespace: cert-manager
16+
spec:
17+
secretName: etcd-ca-tls
18+
isCA: true
19+
commonName: etcd-ca
20+
issuerRef:
21+
name: selfsigned
22+
kind: Issuer
23+
---
24+
apiVersion: cert-manager.io/v1
25+
kind: ClusterIssuer
26+
metadata:
27+
name: etcd-ca
28+
spec:
29+
ca:
30+
secretName: etcd-ca-tls

‎contrib/production/etcd-druid/etcdcopybackupstasks.druid.gardener.cloud.yaml‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.16.5
7+
name: etcdcopybackupstasks.druid.gardener.cloud
8+
spec:
9+
group: druid.gardener.cloud
10+
names:
11+
kind: EtcdCopyBackupsTask
12+
listKind: EtcdCopyBackupsTaskList
13+
plural: etcdcopybackupstasks
14+
singular: etcdcopybackupstask
15+
scope: Namespaced
16+
versions:
17+
- additionalPrinterColumns:
18+
- jsonPath: .metadata.creationTimestamp
19+
name: Age
20+
type: date
21+
name: v1alpha1
22+
schema:
23+
openAPIV3Schema:
24+
description: EtcdCopyBackupsTask is a task for copying etcd backups from a
25+
source to a target store.
26+
properties:
27+
apiVersion:
28+
description: |-
29+
APIVersion defines the versioned schema of this representation of an object.
30+
Servers should convert recognized schemas to the latest internal value, and
31+
may reject unrecognized values.
32+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
33+
type: string
34+
kind:
35+
description: |-
36+
Kind is a string value representing the REST resource this object represents.
37+
Servers may infer this from the endpoint the client submits requests to.
38+
Cannot be updated.
39+
In CamelCase.
40+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
41+
type: string
42+
metadata:
43+
type: object
44+
spec:
45+
description: EtcdCopyBackupsTaskSpec defines the parameters for the copy
46+
backups task.
47+
properties:
48+
maxBackupAge:
49+
description: |-
50+
MaxBackupAge is the maximum age in days that a backup must have in order to be copied.
51+
By default, all backups will be copied.
52+
format: int32
53+
minimum: 0
54+
type: integer
55+
maxBackups:
56+
description: MaxBackups is the maximum number of backups that will
57+
be copied starting with the most recent ones.
58+
format: int32
59+
minimum: 0
60+
type: integer
61+
podLabels:
62+
additionalProperties:
63+
type: string
64+
description: PodLabels is a set of labels that will be added to pod(s)
65+
created by the copy backups task.
66+
type: object
67+
sourceStore:
68+
description: SourceStore defines the specification of the source object
69+
store provider for storing backups.
70+
properties:
71+
container:
72+
description: Container is the name of the container the backup
73+
is stored at.
74+
type: string
75+
prefix:
76+
description: Prefix is the prefix used for the store.
77+
type: string
78+
provider:
79+
description: Provider is the name of the backup provider.
80+
type: string
81+
secretRef:
82+
description: SecretRef is the reference to the secret which used
83+
to connect to the backup store.
84+
properties:
85+
name:
86+
description: name is unique within a namespace to reference
87+
a secret resource.
88+
type: string
89+
namespace:
90+
description: namespace defines the space within which the
91+
secret name must be unique.
92+
type: string
93+
type: object
94+
x-kubernetes-map-type: atomic
95+
required:
96+
- prefix
97+
type: object
98+
targetStore:
99+
description: TargetStore defines the specification of the target object
100+
store provider for storing backups.
101+
properties:
102+
container:
103+
description: Container is the name of the container the backup
104+
is stored at.
105+
type: string
106+
prefix:
107+
description: Prefix is the prefix used for the store.
108+
type: string
109+
provider:
110+
description: Provider is the name of the backup provider.
111+
type: string
112+
secretRef:
113+
description: SecretRef is the reference to the secret which used
114+
to connect to the backup store.
115+
properties:
116+
name:
117+
description: name is unique within a namespace to reference
118+
a secret resource.
119+
type: string
120+
namespace:
121+
description: namespace defines the space within which the
122+
secret name must be unique.
123+
type: string
124+
type: object
125+
x-kubernetes-map-type: atomic
126+
required:
127+
- prefix
128+
type: object
129+
waitForFinalSnapshot:
130+
description: WaitForFinalSnapshot defines the parameters for waiting
131+
for a final full snapshot before copying backups.
132+
properties:
133+
enabled:
134+
description: Enabled specifies whether to wait for a final full
135+
snapshot before copying backups.
136+
type: boolean
137+
timeout:
138+
description: |-
139+
Timeout is the timeout for waiting for a final full snapshot. When this timeout expires, the copying of backups
140+
will be performed anyway. No timeout or 0 means wait forever.
141+
pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+)$
142+
type: string
143+
required:
144+
- enabled
145+
type: object
146+
required:
147+
- sourceStore
148+
- targetStore
149+
type: object
150+
status:
151+
description: EtcdCopyBackupsTaskStatus defines the observed state of the
152+
copy backups task.
153+
properties:
154+
conditions:
155+
description: Conditions represents the latest available observations
156+
of an object's current state.
157+
items:
158+
description: Condition holds the information about the state of
159+
a resource.
160+
properties:
161+
lastTransitionTime:
162+
description: Last time the condition transitioned from one status
163+
to another.
164+
format: date-time
165+
type: string
166+
lastUpdateTime:
167+
description: Last time the condition was updated.
168+
format: date-time
169+
type: string
170+
message:
171+
description: A human-readable message indicating details about
172+
the transition.
173+
type: string
174+
reason:
175+
description: The reason for the condition's last transition.
176+
type: string
177+
status:
178+
description: Status of the condition, one of True, False, Unknown.
179+
type: string
180+
type:
181+
description: Type of the Etcd condition.
182+
type: string
183+
required:
184+
- lastTransitionTime
185+
- lastUpdateTime
186+
- message
187+
- reason
188+
- status
189+
- type
190+
type: object
191+
type: array
192+
lastError:
193+
description: LastError represents the last occurred error.
194+
type: string
195+
observedGeneration:
196+
description: ObservedGeneration is the most recent generation observed
197+
for this resource.
198+
format: int64
199+
type: integer
200+
type: object
201+
type: object
202+
served: true
203+
storage: true
204+
subresources:
205+
status: {}

0 commit comments

Comments
 (0)