75 lines
2.6 KiB
Text
75 lines
2.6 KiB
Text
let _concerns_lib = import "schemas/lib/concerns.ncl" in
|
|
let _context_lib = import "schemas/catalog/context.ncl" in
|
|
|
|
{
|
|
RouteSpec = {
|
|
host | String,
|
|
upstream | String,
|
|
port | Number,
|
|
tls_skip_verify | Bool | default = false,
|
|
},
|
|
|
|
PrivateIngress = {
|
|
context | _context_lib.ComponentContext | optional,
|
|
|
|
name | String,
|
|
namespace | String | default = "ingress-private",
|
|
|
|
# sozu proxy image — ghcr.io/sozu-proxy/sozu:<tag>
|
|
image | String,
|
|
|
|
# sozuctl-sidecar image: alpine + inotify-tools + sozuctl binary.
|
|
# Must be pre-built and pushed to reg.librecloud.online/cluster/sozuctl-sidecar.
|
|
sidecar_image | String,
|
|
|
|
# Cilium LB-IPAM private IP for the L4 LoadBalancer Service.
|
|
# Must be in the 10.200.3.0/28 pool and not already assigned.
|
|
private_lb_ip | String,
|
|
|
|
# How TLS certificates are rotated:
|
|
# 'csi_driver — cert-manager CSI driver mounts certs as ephemeral tmpfs;
|
|
# sozuctl sidecar hot-reloads sozu on file change (Pattern B).
|
|
# Requires csi_driver_enabled = true in cert_manager component.
|
|
# 'reloader — cert-manager issues Certificate + Secret; stakater/Reloader
|
|
# triggers rollout on Secret rotation.
|
|
# 'sozu_managed — sozu's built-in ACME client manages certs natively.
|
|
tls_rotation | [| 'csi_driver, 'reloader, 'sozu_managed |] | default = 'reloader,
|
|
|
|
# ClusterIssuer to reference in CSI volume attributes (tls_rotation = 'csi_driver).
|
|
cluster_issuer | String | default = "letsencrypt-prod-librecloud",
|
|
|
|
# Host-based routes served by this ingress.
|
|
# upstream: K8s Service FQDN (svc.libre-wuji.local) or ClusterIP.
|
|
routes | Array RouteSpec | default = [],
|
|
|
|
requires | {
|
|
ports | Array {
|
|
port | Number,
|
|
exposure | [| 'public, 'private, 'internal |] | default = 'private,
|
|
} | default = [],
|
|
credentials | Array String | default = [],
|
|
} | default = {},
|
|
|
|
provides | {
|
|
service | String | optional,
|
|
port | Number | optional,
|
|
endpoints | Array String | default = [],
|
|
} | default = {},
|
|
|
|
operations | {
|
|
install | Bool | default = true,
|
|
update | Bool | default = true,
|
|
delete | Bool | default = true,
|
|
health | Bool | default = true,
|
|
} | default = {},
|
|
|
|
live_check | {
|
|
strategy | [| 'k8s_pods, 'http_get |] | default = 'k8s_pods,
|
|
scope | [| 'cp_only, 'all_nodes |] | default = 'cp_only,
|
|
} | default = {},
|
|
|
|
concerns | _concerns_lib.ServiceConcerns | optional,
|
|
|
|
..
|
|
},
|
|
}
|