Skip to content

Commit 935d28b

Browse files
rileyfiretailrileyfiretail
authored
Merge pull request #19 from FireTail-io/kubernetes-example
Kubernetes example
2 parents d0ac1db + f858c4a commit 935d28b

File tree

3 files changed

+168
-0
lines changed

3 files changed

+168
-0
lines changed

‎Dockerfile‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,3 +44,15 @@ COPY dev/appspec.yml /etc/nginx/appspec.yml
4444
COPY dev/nginx.conf /etc/nginx/nginx.conf
4545
COPY dev/index.html /usr/share/nginx/html/
4646
CMD ["nginx-debug", "-g", "daemon off;"]
47+
48+
# An image for Kubernetes ingress
49+
FROM nginx/nginx-ingress:3.7.0 as firetail-nginx-ingress
50+
USER root
51+
RUN mkdir -p /var/lib/apt/lists/partial && apt-get update && apt-get install -y libjson-c-dev
52+
COPY --from=build-golang /dist/firetail-validator.so /etc/nginx/modules/
53+
COPY --from=build-c /tmp/nginx-${NGINX_VERSION}/objs/ngx_firetail_module.so /etc/nginx/modules/
54+
USER nginx
55+
56+
# A dev image for Kubernetes ingress
57+
FROM firetail-nginx-ingress AS firetail-nginx-ingress-dev
58+
COPY --chown=nginx:nginx examples/kubernetes/appspec.yml /etc/nginx/appspec.yml

‎README.md‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,141 @@ Once you've configured your `nginx.conf` you will also need to provide an OpenAP
4343

4444

4545

46+
## Kubernetes Example Setup
47+
48+
An example setup for the Firetail NGINX plugin installed on an NGINX-ingress image for Kubernetes is included in the [Dockerfile](./Dockerfile) in this repository. You can build it as follows:
49+
50+
```bash
51+
git clone git@github.com:FireTail-io/firetail-nginx-module.git
52+
cd firetail-nginx-module
53+
docker build -t firetail-nginx-ingress-dev . --target firetail-nginx-ingress-dev --build-arg="NGINX_VERSION=1.27.1"
54+
```
55+
56+
You can then modify the [complete example](https://github.com/nginxinc/kubernetes-ingress/tree/main/examples/ingress-resources/complete-example) in the [nginxinc/kubernetes-ingress repository](https://github.com/nginxinc/kubernetes-ingress) to use the NGINX-ingress image you just built. First, clone the repository:
57+
58+
```bash
59+
git clone git@github.com:nginxinc/kubernetes-ingress.git
60+
cd kubernetes-ingress
61+
```
62+
63+
You'll then need to change the image used in `deployments/daemon-set/nginx-ingress.yaml` for the `nginx-ingress` container to `firetail-nginx-ingress-dev`.
64+
65+
```yaml
66+
...
67+
containers:
68+
- image: firetail-nginx-ingress-dev
69+
name: nginx-ingress
70+
...
71+
```
72+
73+
Follow [the instructions linked from the example](https://docs.nginx.com/nginx-ingress-controller/installation/installing-nic/installation-with-manifests/) to setup the nginx-ingress:
74+
75+
```bash
76+
kubectl apply -f deployments/common/ns-and-sa.yaml
77+
kubectl apply -f deployments/rbac/rbac.yaml
78+
kubectl apply -f examples/shared-examples/default-server-secret/default-server-secret.yaml
79+
kubectl apply -f deployments/common/nginx-config.yaml
80+
kubectl apply -f deployments/common/ingress-class.yaml
81+
kubectl apply -f https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/v3.7.0/deploy/crds.yaml
82+
kubectl apply -f deployments/daemon-set/nginx-ingress.yaml
83+
kubectl create -f deployments/service/nodeport.yaml
84+
```
85+
86+
You should then be able to see the `nginx-ingress` pod in a `Running` state:
87+
88+
```bash
89+
kubectl get pods --namespace=nginx-ingress
90+
```
91+
92+
```bash
93+
NAME READY STATUS RESTARTS AGE
94+
nginx-ingress-g6tss 1/1 Running 0 7s
95+
```
96+
97+
Then follow the instructions for the [complete example](https://github.com/nginxinc/kubernetes-ingress/tree/main/examples/ingress-resources/complete-example) in the [nginxinc/kubernetes-ingress repository](https://github.com/nginxinc/kubernetes-ingress):
98+
99+
```bash
100+
kubectl create -f examples/ingress-resources/complete-example/cafe.yaml
101+
kubectl create -f examples/ingress-resources/complete-example/cafe-secret.yaml
102+
kubectl create -f examples/ingress-resources/complete-example/cafe-ingress.yaml
103+
```
104+
105+
Find the port used by the `nginx-ingress`:
106+
107+
```bash
108+
kubectl get service --namespace=nginx-ingress
109+
```
110+
111+
```bash
112+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
113+
nginx-ingress NodePort 10.106.182.250 <none> 80:32724/TCP,443:32334/TCP 13s
114+
```
115+
116+
You should then be able to `curl` the tea or coffee endpoint as follows:
117+
118+
```bash
119+
export CAFE_PORT=32334
120+
curl --resolve cafe.example.com:$CAFE_PORT:0.0.0.0 https://cafe.example.com:$CAFE_PORT/tea --insecure
121+
```
122+
123+
```
124+
Server address: 10.1.0.78:8080
125+
Server name: tea-df5655878-7blfk
126+
Date: 08/Oct/2024:11:06:13 +0000
127+
URI: /tea
128+
Request ID: 8292a274a2774d7e5257c53dcb8adbe6
129+
```
130+
131+
In order for the `nginx-ingest` to load the FireTail module we need to add a `load_module` directive to the main block, and `firetail_api_token` and `firetail_url` directives to the `nginx.conf`. This can be done using a `ConfigMap` like this:
132+
133+
```yaml
134+
kind: ConfigMap
135+
apiVersion: v1
136+
metadata:
137+
name: nginx-config
138+
namespace: nginx-ingress
139+
data:
140+
main-snippets: |
141+
load_module modules/ngx_firetail_module.so;
142+
http-snippets: |
143+
firetail_api_token "YOUR_API_TOKEN_HERE";
144+
firetail_url "https://api.logging.eu-west-1.prod.firetail.app/logs/bulk";
145+
```
146+
147+
Modify this file to include your own API token from the FireTail platform, and update the Firetail URL to match the region you're using. You can then save it and apply it like so:
148+
149+
```bash
150+
kubectl apply -f my-firetail-config-map.yaml
151+
```
152+
153+
This will update the `nginx.conf` file in the `nginx-ingress` container to load the FireTail module and provide your API token and FireTail URL.
154+
155+
You should still be able to curl the `/tea` endpoint, as it is included in [the example OpenAPI specification used in the `firetail-nginx-ingress-dev` image](./dev/appspec.yml):
156+
157+
```bash
158+
curl --resolve cafe.example.com:$CAFE_PORT:0.0.0.0 https://cafe.example.com:$CAFE_PORT/tea --insecure
159+
```
160+
161+
```
162+
Server address: 10.1.0.77:8080
163+
Server name: tea-df5655878-s5rbl
164+
Date: 08/Oct/2024:11:09:40 +0000
165+
URI: /tea
166+
Request ID: 2a094910b76a06a3a11a5820df10d56c
167+
```
168+
169+
However, if you try and curl the `/coffee` endpoint your request should be blocked by the FireTail module as it is not defined in the OpenAPI specification.
170+
171+
```bash
172+
curl --resolve cafe.example.com:$CAFE_PORT:0.0.0.0 https://cafe.example.com:$CAFE_PORT/coffee --insecure
173+
```
174+
175+
```json
176+
{"code":404,"title":"the resource \"/coffee\" could not be found","detail":"a path for \"/coffee\" could not be found in your appspec"}
177+
```
178+
179+
180+
46181
## Local Development
47182

48183
A [Dockerfile](./Dockerfile) is provided which will build the module, install it in [an NGINX docker image](https://hub.docker.com/_/nginx), and setup a custom [nginx.conf](./dev/nginx.conf) and [index.html](./dev/index.html). It should be as simple as:

‎examples/kubernetes/appspec.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
openapi: 3.0.1
2+
info:
3+
title: Firetail Nginx Ingest Example
4+
version: "0.1"
5+
paths:
6+
/tea:
7+
get:
8+
summary: Returns a cup of tea
9+
responses:
10+
"200":
11+
description: A cup of tea
12+
content:
13+
text/plain:
14+
schema:
15+
type: string
16+
example: |
17+
Server address: 10.1.0.64:8080
18+
Server name: tea-df5655878-smhzt
19+
Date: 08/Oct/2024:10:55:42 +0000
20+
URI: /tea
21+
Request ID: fc99c0eb87b19fef8de34d8c7c7e1424

0 commit comments

Comments
 (0)