Skip to content

[1.3.0] Add documentation on webhook configurations #730

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: 1.3.0
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions en/docs/includes/start-apk.md
Original file line number Diff line number Diff line change
Expand Up @@ -32,15 +32,15 @@ helm install apk wso2apk/apk-helm --version 1.3.0 -f https://raw.githubuserconte
```

!!!Optional
If you want to update an existing Kubernetes Gateway installation, use the following Helm upgrade command. The --no-hooks flag disables the hooks available in the Kubernetes Gateway Helm chart)
If you want to update an existing Kubernetes Gateway installation, use the following Helm upgrade command. The --no-hooks flag disables the hooks available in the Kubernetes Gateway Helm chart.

=== "Command"
```
helm install apk wso2apk/apk-helm --version 1.3.0 -f values.yaml --no-hooks
helm upgrade apk wso2apk/apk-helm --version 1.3.0 -f values.yaml --no-hooks
```
=== "Format"
```
helm install <chart-name> <repository-name>/apk-helm --version <version-of-APK> -f <path-to-values.yaml-file> --no-hooks
helm upgrade <chart-name> <repository-name>/apk-helm --version <version-of-APK> -f <path-to-values.yaml-file> --no-hooks
```

### Verify the deployment
Expand Down
36 changes: 18 additions & 18 deletions en/docs/setup/cert-manager.md
Original file line number Diff line number Diff line change
@@ -1,28 +1,28 @@
# Configuring Cert-Manager in Custom Scenarios

In certain scenarios, you may already have **cert-manager** installed or need to install it in a different namespace. This guide outlines the steps to configure **APK cert-manager** in such cases.
In certain scenarios, you may already have **cert-manager** installed or need to install it in a different namespace. This guide outlines the steps to configure the WSO2 Kubernetes Gateway's **cert-manager** in such cases.

## 1. Ensure Cert-Manager is Installed

Before proceeding, ensure that your **cert-manager** is installed and running in its own namespace. You can refer to the <a href="https://cert-manager.io/docs/installation/" target="_blank">official cert-manager documentation </a> for this.

## 2. Create the Namespace for APK
## 2. Create the Namespace for WSO2 Kubernetes Gateway

We will use this namespace to install APK. For this guide, we will create a namespace named `apk`. Run the following command:
We will use this namespace to install WSO2 Kubernetes Gateway. For this guide, we will create a namespace named `wso2-kg`. Run the following command:

```sh
kubectl create ns apk
kubectl create ns wso2-kg
```

## 3. Create an Issuer for Cert-Manager in the APK namespace
## 3. Create an Issuer for Cert-Manager in the WSO2 Kubernetes Gateway namespace

Create an Issuer required for cert-manager by applying the following configuration:
```
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: custom-issuer
namespace: apk
namespace: wso2-kg
spec:
ca:
secretName: apk-root-certificate
Expand All @@ -33,23 +33,23 @@ You can obtain the <a href="../../assets/files/cert-manager/issuer.yaml" target=
!!! note
### Why Use an Issuer Instead of a ClusterIssuer?

By default, APK installation comes with a ClusterIssuer, which operates cluster-wide. However, the ClusterIssuer looks for the secret named `apk-root-certificate` in the namespace where the cert-manager is installed, whereas APK creates the secret in its own namespace.
By default, WSO2 Kubernetes Gateway installation comes with a ClusterIssuer, which operates cluster-wide. However, the ClusterIssuer looks for the secret named `apk-root-certificate` in the namespace where the cert-manager is installed, whereas WSO2 Kubernetes Gateway creates the secret in its own namespace.

There are two ways to fix this.

1. Modify the cert-manager installation by forcing the ClusterIssuer to check the APK namespace, as in the <a href="https://cert-manager.io/docs/configuration/#cluster-resource-namespace" target="_blank">official cert-manager documentation</a>.
1. Modify the cert-manager installation by forcing the ClusterIssuer to check the WSO2 Kubernetes Gateway namespace, as in the <a href="https://cert-manager.io/docs/configuration/#cluster-resource-namespace" target="_blank">official cert-manager documentation</a>.

2. To avoid modifying cert-manager’s installation, **create an Issuer instead**, which will look for secrets in its own namespace. Then it can correctly reference the secret containing the root certificate.

We will proceed with the **second method** in this guide.

## 4. Apply the Issuer

Run the following command to apply the issuer in the apk namespace:
Run the following command to apply the issuer in the wso2-kg namespace:

=== "Command"
```
kubectl apply -f issuer.yaml -n apk
kubectl apply -f issuer.yaml -n wso2-kg
```
=== "Format"
```
Expand All @@ -59,14 +59,14 @@ Run the following command to apply the issuer in the apk namespace:
At this stage, if you run
=== "Command"
```
kubectl describe issuer custom-issuer -n apk
kubectl describe issuer custom-issuer -n wso2-kg
```
=== "Format"
```
kubectl describe <issuer-name> -n <namespace>
```

it may show a "False" Ready status. This is expected, as the root certificate secret is not created yet. The secret will be generated when APK is installed.
it may show a "False" Ready status. This is expected, as the root certificate secret is not created yet. The secret will be generated when WSO2 Kubernetes Gateway is installed.

## 5. Update `values.yaml`

Expand All @@ -88,29 +88,29 @@ certmanager:

This configuration

- disables the cert-manager included with APK
- disables the cert-manager included with WSO2 Kubernetes Gateway
- creates the root certificate for the Issuer
- refers to an Issuer for the certificate management instead of a ClusterIssuer

## 5. Install APK

Now, install APK using Helm with the modified values.yaml file.
Now, install WSO2 Kubernetes Gateway using Helm with the modified values.yaml file.

=== "Command"
```
helm install apk wso2apk/apk-helm --version 1.3.0 -f values.yaml -n apk
helm install apk wso2apk/apk-helm --version 1.3.0 -f values.yaml -n wso2-kg
```
=== "Format"
```
helm install <chart-name> <repository-name>/apk-helm --version <version-of-APK> -f <path-to-values.yaml-file> -n <namespace>
helm install <chart-name> <repository-name>/apk-helm --version <version-of-WSO2-Kubernetes-Gateway> -f <path-to-values.yaml-file> -n <namespace>
```

## 5. Verify the Certificate Status

Once APK is installed, check the certificates by running:
Once WSO2 Kubernetes Gateway is installed, check the certificates by running:
=== "Command"
```
kubectl get certificates -n apk
kubectl get certificates -n wso2-kg
```
=== "Format"
```
Expand Down
45 changes: 45 additions & 0 deletions en/docs/setup/webhook-customization.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
# Configuring Webhooks

The WSO2 Kubernetes Gateway installs three types of webhooks by default.

- **Validation Webhooks**: Ensure CRDs meet specific rules before being accepted.
- **Mutation Webhooks**: Modify or add default values to CRDs before they are stored.
- **Conversion Webhooks**: Convert CRD objects between different API versions for backward compatibility.

## Enabling/Disabling webhooks

There are two sections in which webhooks are configured in the values.yaml file.

1. **wso2.apk.webhooks section**

This section handles the custom validation, mutation and conversion webhooks developed for WSO2 Kubernetes Gateway specific CRDs. These can be individually enabled/disabled from the below configuration in the values.yaml file.

```
wso2:
.
apk:
.
webhooks:
validatingwebhookconfigurations: true
mutatingwebhookconfigurations: true
conversionwebhookconfigurations: true
```
2. **gatewaySystem section**

This section enables the installation of gateway system components. This can be enabled/disabled using the below configuration in the values.yaml file.

```
gatewaySystem:
enabled: true
```

After doing changes to the values.yaml file, you can redeploy the WSO2 Kubernetes Gateway installation with

=== "Command"
```
helm upgrade apk wso2apk/apk-helm --version 1.3.0 -f values.yaml --no-hooks
```
=== "Format"
```
helm upgrade <chart-name> <repository-name>/apk-helm --version <version-of-WSO2-Kubernetes-Gateway> -f <path-to-values.yaml-file> --no-hooks
```
1 change: 1 addition & 0 deletions en/mkdocs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -301,6 +301,7 @@ nav:
- Customize Configurations: setup/Customize-Configurations.md
- Production Deployment Guidelines: setup/production-deployment-guideline.md
- Customize Cert-Manager: setup/cert-manager.md
- Customize Webhook Configurations: setup/webhook-customization.md
- Configure HPA for gateway: setup/configure-hpa.md
- Deploy in OpenShift: setup/deploy-in-openshift.md
- Multi-environment Deployment on Gateway: setup/multi-env-deployment-on-apk.md
Expand Down