gardener-extension-shoot-traefik/examples/shoot.yaml at main · gardener/gardener-extension-shoot-traefik · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
apiVersion: core.gardener.cloud/v1beta1
kind: Shoot
metadata:
  name: local
  namespace: garden-local
  annotations:
    shoot.gardener.cloud/cloud-config-execution-max-delay-seconds: "0"
    authentication.gardener.cloud/issuer: "managed"
spec:
  # Purpose must be "evaluation" to enable the Traefik extension.
  # This is validated by the admission webhook.
  purpose: evaluation
  extensions:
    # Traefik extension deploys Traefik ingress controller to the shoot cluster
    # as a replacement for nginx-ingress-controller which is out of maintenance.
    - type: shoot-traefik
      providerConfig:
        apiVersion: traefik.extensions.gardener.cloud/v1alpha1
        kind: TraefikConfig
        spec:
          # Optional: Number of Traefik replicas
          replicas: 2

          # Optional: Log level (default: "Info")
          # Valid values: Debug, Info, Warn, Error, Fatal, Panic
          # logLevel: Info

          # Optional: Ingress provider type (default: "KubernetesIngress")
          # Valid values:
          # - "KubernetesIngress": Standard Kubernetes Ingress provider (ingress class: "traefik")
          # - "KubernetesIngressNGINX": NGINX-compatible provider with support for NGINX annotations (ingress class: "nginx")
          #
          # Use KubernetesIngressNGINX when migrating from NGINX Ingress Controller to maintain
          # compatibility with existing NGINX-specific annotations.
          # ingressProvider: KubernetesIngress
          #
          # Example for NGINX-compatible mode:
          # ingressProvider: KubernetesIngressNGINX
          #
          # Optional: HTTP entrypoint behavior (default: "Enabled")
          # Valid values:
          # - "Enabled": expose Service port 80 and serve plain HTTP
          # - "Redirect": expose Service port 80 and redirect HTTP to HTTPS (301)
          # - "Disabled": do not expose Service port 80 (HTTPS only)
          # httpEntrypoint: Enabled
  cloudProfile:
    name: local
    kind: CloudProfile
  credentialsBindingName: local # dummy, doesn't contain any credentials
  region: local
  networking:
    type: calico
    # Must be within 10.0.0.0/16 (subnet of kind pod CIDR 10.0.0.0/15, but disjoint with seed pod CIDR 10.1.0.0/16).
    nodes: 10.0.0.0/16
  provider:
    type: local
    workers:
    - name: local
      machine:
        type: local
      cri:
        name: containerd
      minimum: 1
      maximum: 2
      maxSurge: 1
      maxUnavailable: 0
  kubernetes:
    kubelet:
      seccompDefault: true
      serializeImagePulls: false
      registryPullQPS: 10
      registryBurst: 20
      protectKernelDefaults: true
      streamingConnectionIdleTimeout: 5m