Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SCHEMATIC-215] Enable ingress for SigNoz UI #51

Merged
merged 4 commits into from
Dec 5, 2024
Merged

[SCHEMATIC-215] Enable ingress for SigNoz UI #51

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f5d2896
Enable ingress for SigNoz UI
BryanFauble Dec 3, 2024
b274c4a
Apply new rule for Referer header
BryanFauble Dec 3, 2024
1e9e1cb
Swap to exact match
BryanFauble Dec 3, 2024
30947fe
Use root prefix
BryanFauble Dec 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion modules/envoy-gateway/resources/envoy-proxy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,10 @@ kind: EnvoyProxy
metadata:
name: custom-proxy-config
spec:
mergeGateways: false
mergeGateways: false
provider:
type: Kubernetes
kubernetes:
envoyService:
annotations:
service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
3 changes: 2 additions & 1 deletion modules/envoy-gateway/resources/traffic-policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,5 @@ spec:
kind: Gateway
name: eg
tls:
minVersion: "1.3"
minVersion: "1.3"
enableProxyProtocol: true
1 change: 1 addition & 0 deletions modules/signoz/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -251,6 +251,7 @@ spec:
value: ${var.namespace}
- target:
kind: SecurityPolicy
name: require-jwt-for-collector
patch: |-
- op: replace
path: /metadata/namespace
Expand Down
21 changes: 21 additions & 0 deletions modules/signoz/resources-otel-ingress/http-route.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,3 +24,24 @@ spec:
- path:
type: PathPrefix
value: /telemetry/v1
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: signoz-ui-route
namespace: envoy-gateway
spec:
parentRefs:
- name: eg
rules:
- backendRefs:
- group: ""
kind: Service
name: signoz-frontend
namespace: signoz
port: 3301
weight: 1
matches:
- path:
type: PathPrefix
value: /
Comment on lines +27 to +47
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SigNoz only supports working at the root URL of the domain it's running on. In favor of getting a solution I am going to use the ${environment}.sagedpe.org URLs. If we want to swap to using a different sub-domain later we'll be able to do that, for example Sage-Bionetworks-IT/organizations-infra#1302 shows what we might do on the Sage IT infra stack.

On this side it's going to be a larger shift (And why I didn't want to worry about doing it now). It's because we'll need to make sure that we request SSL certs from Let's Encrypt and make sure it all works with the Listeners in the Envoy Gateway.

4 changes: 4 additions & 0 deletions modules/signoz/resources-otel-ingress/reference-grant-signoz.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,7 @@ spec:
- group: ""
kind: Service
name: signoz-otel-collector
- group: ""
kind: Service
name: signoz-frontend

21 changes: 20 additions & 1 deletion modules/signoz/resources-otel-ingress/security-policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: require-audience-for-authorization
name: require-jwt-for-collector
namespace: envoy-gateway
spec:
targetRef:
Expand All @@ -11,3 +11,22 @@ spec:
jwt:
providers: <replaced-by-kustomize>
authorization: <replaced-by-kustomize>
---
apiVersion: gateway.envoyproxy.io/v1alpha1
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

alpha version?

Copy link
Contributor Author

@BryanFauble BryanFauble Dec 3, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's the latest at the moment (https://gateway.envoyproxy.io/latest/api/extension_types/#gatewayenvoyproxyiov1alpha1)

The gateway itself is past the v1.x.x mark, but the APIs (aka definition of this YAML) are subject to updates. I've been impressed with the changes this project has been publishing out and they have smoothed out a bunch of rough edges for shaping traffic into the K8s cluster. I've worked with other tools like Istio, and Traefik Proxy before & were a huge pain to manage at the time.

kind: SecurityPolicy
metadata:
name: restrict-ui-to-sage-vpn
namespace: envoy-gateway
spec:
targetRef:
group: gateway.networking.k8s.io
kind: HTTPRoute
name: signoz-ui-route
authorization:
defaultAction: Deny
rules:
- action: Allow
principal:
clientCIDRs:
# Public IP address for the Sage VPN. `/32` CIDR mask means a single IP address.
- 52.44.61.21/32
Comment on lines +25 to +32
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i do't know about the rest but this looks like what we want.

Loading