update ingresses for staging and production

DARPA-ASKEM · Jun 5, 2024 · 75c6eb7 · 75c6eb7
1 parent 900ecbe
commit 75c6eb7
Show file tree

Hide file tree

Showing 9 changed files with 71 additions and 40 deletions.
diff --git a/kubernetes/overlays/prod/overlays/askem-production/ingress/private-web-ingress.yaml b/kubernetes/overlays/prod/overlays/askem-production/ingress/private-web-ingress.yaml
@@ -4,11 +4,11 @@ kind: Ingress
 metadata:
  name: private-web-ingress
  annotations:
+ alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
+ alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
  alb.ingress.kubernetes.io/scheme: internet-facing
- alb.ingress.kubernetes.io/target-type: instance
  alb.ingress.kubernetes.io/security-groups: askem-prod-web-private, askem-prod-k8s
- alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
- alb.ingress.kubernetes.io/actions.ssl-redirect: '443'
+ alb.ingress.kubernetes.io/target-type: instance
 spec:
  ingressClassName: alb
  rules:
@@ -19,21 +19,17 @@ spec:
  pathType: Prefix
  backend:
  service:
- name: hmi-server
+ name: ssl-redirect
  port:
- number: 3000
-
- - host: 'beaker.terarium.ai'
- http:
- paths:
+ name: use-annotation
  - path: /
  pathType: Prefix
  backend:
  service:
- name: beaker
+ name: hmi-server
  port:
- number: 3050
+ number: 3000
+
  tls:
  - hosts:
  - 'server.terarium.ai'
- - 'beaker.terarium.ai'
diff --git a/kubernetes/overlays/prod/overlays/askem-production/ingress/private-web-non-ssl-ingress.yaml b/kubernetes/overlays/prod/overlays/askem-production/ingress/private-web-non-ssl-ingress.yaml
@@ -0,0 +1,26 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+ name: private-web-non-ssl-ingress
+ annotations:
+ alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
+ alb.ingress.kubernetes.io/scheme: internet-facing
+ alb.ingress.kubernetes.io/security-groups: askem-prod-web-private, askem-prod-k8s
+ alb.ingress.kubernetes.io/target-type: instance
+spec:
+ ingressClassName: alb
+ rules:
+ - host: 'beaker.terarium.ai'
+ http:
+ paths:
+ - path: /
+ pathType: Prefix
+ backend:
+ service:
+ name: beaker
+ port:
+ number: 3050
+ tls:
+ - hosts:
+ - 'beaker.terarium.ai'
diff --git a/kubernetes/overlays/prod/overlays/askem-production/ingress/public-web-ingress.yaml b/kubernetes/overlays/prod/overlays/askem-production/ingress/public-web-ingress.yaml
@@ -4,11 +4,11 @@ kind: Ingress
 metadata:
  name: public-web-ingress
  annotations:
+ alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
+ alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
  alb.ingress.kubernetes.io/scheme: internet-facing
- alb.ingress.kubernetes.io/target-type: instance
  alb.ingress.kubernetes.io/security-groups: askem-prod-web, askem-prod-k8s
- alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
- alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
+ alb.ingress.kubernetes.io/target-type: instance
 spec:
  ingressClassName: alb
  rules:

diff --git a/kubernetes/overlays/prod/overlays/askem-production/ingress/public-web-ssl-ingress.yaml b/kubernetes/overlays/prod/overlays/askem-production/ingress/public-web-ssl-ingress.yaml
@@ -4,12 +4,12 @@ kind: Ingress
 metadata:
  name: public-web-ssl-ingress
  annotations:
+ alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
+ alb.ingress.kubernetes.io/backend-protocol: HTTPS
+ alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
  alb.ingress.kubernetes.io/scheme: internet-facing
- alb.ingress.kubernetes.io/target-type: instance
  alb.ingress.kubernetes.io/security-groups: askem-prod-web, askem-prod-k8s
- alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
- alb.ingress.kubernetes.io/actions.ssl-redirect: '443'
- alb.ingress.kubernetes.io/backend-protocol: HTTPS
+ alb.ingress.kubernetes.io/target-type: instance
 spec:
  ingressClassName: alb
  rules:

diff --git a/kubernetes/overlays/prod/overlays/askem-production/kustomization.yaml b/kubernetes/overlays/prod/overlays/askem-production/kustomization.yaml
@@ -5,6 +5,7 @@ namespace: terarium
 resources:
  - ../../base
  - ingress/private-web-ingress.yaml
+ - ingress/private-web-non-ssl-ingress.yaml
  - ingress/public-web-ingress.yaml
  - ingress/public-web-ssl-ingress.yaml
  - secrets/secrets-adobe-api-key.yaml

diff --git a/kubernetes/overlays/prod/overlays/askem-staging/ingress/private-web-ingress.yaml b/kubernetes/overlays/prod/overlays/askem-staging/ingress/private-web-ingress.yaml
@@ -7,7 +7,7 @@ metadata:
  alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
  alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
  alb.ingress.kubernetes.io/scheme: internet-facing
- alb.ingress.kubernetes.io/security-groups: askem-staging-web-private
+ alb.ingress.kubernetes.io/security-groups: askem-staging-web-private, askem-staging-k8s
  alb.ingress.kubernetes.io/target-type: instance
 spec:
  ingressClassName: alb
@@ -66,24 +66,6 @@ spec:
  port:
  number: 4046
 
- - host: 'beaker.staging.terarium.ai'
- http:
- paths:
- - path: /
- pathType: Prefix
- backend:
- service:
- name: ssl-redirect
- port:
- name: use-annotation
- - path: /
- pathType: Prefix
- backend:
- service:
- name: beaker
- port:
- number: 3050
-
  - host: 'pyciemss.staging.terarium.ai'
  http:
  paths:
@@ -212,7 +194,6 @@ spec:
 
  tls:
  - hosts:
- - 'beaker.staging.terarium.ai'
  - 'climate-data.staging.terarium.ai'
  - 'funman.staging.terarium.ai'
  - 'graphdb.staging.terarium.ai'

diff --git a/kubernetes/overlays/prod/overlays/askem-staging/ingress/private-web-non-ssl-ingress.yaml b/kubernetes/overlays/prod/overlays/askem-staging/ingress/private-web-non-ssl-ingress.yaml
@@ -0,0 +1,26 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+ name: private-web-non-ssl-ingress
+ annotations:
+ alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
+ alb.ingress.kubernetes.io/scheme: internet-facing
+ alb.ingress.kubernetes.io/security-groups: askem-staging-web-private, askem-staging-k8s
+ alb.ingress.kubernetes.io/target-type: instance
+spec:
+ ingressClassName: alb
+ rules:
+ - host: 'beaker.staging.terarium.ai'
+ http:
+ paths:
+ - path: /
+ pathType: Prefix
+ backend:
+ service:
+ name: beaker
+ port:
+ number: 3050
+ tls:
+ - hosts:
+ - 'beaker.staging.terarium.ai'
diff --git a/kubernetes/overlays/prod/overlays/askem-staging/ingress/public-web-ssl-ingress.yaml b/kubernetes/overlays/prod/overlays/askem-staging/ingress/public-web-ssl-ingress.yaml
@@ -4,7 +4,7 @@ kind: Ingress
 metadata:
  name: public-web-ssl-ingress
  annotations:
- alb.ingress.kubernetes.io/actions.ssl-redirect: '443'
+ alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
  alb.ingress.kubernetes.io/backend-protocol: HTTPS
  alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
  alb.ingress.kubernetes.io/scheme: internet-facing

diff --git a/kubernetes/overlays/prod/overlays/askem-staging/kustomization.yaml b/kubernetes/overlays/prod/overlays/askem-staging/kustomization.yaml
@@ -7,6 +7,7 @@ resources:
  - check-latest
  - ingress/private-web-grpc-ingress.yaml
  - ingress/private-web-ingress.yaml
+ - ingress/private-web-non-ssl-ingress.yaml
  - ingress/public-web-ingress.yaml
  - ingress/public-web-ssl-ingress.yaml
  - secrets/secrets-adobe-api-key.yaml