mirror of https://github.com/knative/docs.git
[release-1.0] Switch to snake-casing for config map properties (#4488)
* update casing for serving's config-deployment * update casing for serving's config-network * PR feedback * consistent usage of autoTLS Co-authored-by: dprotaso <dprotaso@gmail.com>
This commit is contained in:
parent
be246d61e5
commit
ccf398427d
|
@ -45,7 +45,7 @@ Follow the procedure for the networking layer of your choice:
|
||||||
kubectl patch configmap/config-network \
|
kubectl patch configmap/config-network \
|
||||||
--namespace knative-serving \
|
--namespace knative-serving \
|
||||||
--type merge \
|
--type merge \
|
||||||
--patch '{"data":{"ingress.class":"kourier.ingress.networking.knative.dev"}}'
|
--patch '{"data":{"ingress-class":"kourier.ingress.networking.knative.dev"}}'
|
||||||
```
|
```
|
||||||
|
|
||||||
1. Fetch the External IP address or CNAME by running the command:
|
1. Fetch the External IP address or CNAME by running the command:
|
||||||
|
@ -95,7 +95,7 @@ Follow the procedure for the networking layer of your choice:
|
||||||
kubectl patch configmap/config-network \
|
kubectl patch configmap/config-network \
|
||||||
--namespace knative-serving \
|
--namespace knative-serving \
|
||||||
--type merge \
|
--type merge \
|
||||||
--patch '{"data":{"ingress.class":"ambassador.ingress.networking.knative.dev"}}'
|
--patch '{"data":{"ingress-class":"ambassador.ingress.networking.knative.dev"}}'
|
||||||
```
|
```
|
||||||
|
|
||||||
1. Fetch the External IP address or CNAME by running the command:
|
1. Fetch the External IP address or CNAME by running the command:
|
||||||
|
@ -129,7 +129,7 @@ Follow the procedure for the networking layer of your choice:
|
||||||
kubectl patch configmap/config-network \
|
kubectl patch configmap/config-network \
|
||||||
--namespace knative-serving \
|
--namespace knative-serving \
|
||||||
--type merge \
|
--type merge \
|
||||||
--patch '{"data":{"ingress.class":"contour.ingress.networking.knative.dev"}}'
|
--patch '{"data":{"ingress-class":"contour.ingress.networking.knative.dev"}}'
|
||||||
```
|
```
|
||||||
|
|
||||||
1. Fetch the External IP address or CNAME by running the command:
|
1. Fetch the External IP address or CNAME by running the command:
|
||||||
|
@ -241,20 +241,20 @@ The following tabs expand to show instructions for installing each Serving exten
|
||||||
kubectl apply -f {{ artifact(repo="net-http01",file="release.yaml")}}
|
kubectl apply -f {{ artifact(repo="net-http01",file="release.yaml")}}
|
||||||
```
|
```
|
||||||
|
|
||||||
2. Configure the `certificate.class` to use this certificate type by running the command:
|
2. Configure the `certificate-class` to use this certificate type by running the command:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
kubectl patch configmap/config-network \
|
kubectl patch configmap/config-network \
|
||||||
--namespace knative-serving \
|
--namespace knative-serving \
|
||||||
--type merge \
|
--type merge \
|
||||||
--patch '{"data":{"certificate.class":"net-http01.certificate.networking.knative.dev"}}'
|
--patch '{"data":{"certificate-class":"net-http01.certificate.networking.knative.dev"}}'
|
||||||
```
|
```
|
||||||
|
|
||||||
3. Enable auto-TLS by running the command:
|
3. Enable autoTLS by running the command:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
kubectl patch configmap/config-network \
|
kubectl patch configmap/config-network \
|
||||||
--namespace knative-serving \
|
--namespace knative-serving \
|
||||||
--type merge \
|
--type merge \
|
||||||
--patch '{"data":{"autoTLS":"Enabled"}}'
|
--patch '{"data":{"auto-tls":"Enabled"}}'
|
||||||
```
|
```
|
||||||
|
|
|
@ -23,35 +23,35 @@ metadata:
|
||||||
data:
|
data:
|
||||||
# This is the Go import path for the binary that is containerized
|
# This is the Go import path for the binary that is containerized
|
||||||
# and substituted here.
|
# and substituted here.
|
||||||
queueSidecarImage: ko://knative.dev/serving/cmd/queue
|
queue-sidecar-image: ko://knative.dev/serving/cmd/queue
|
||||||
# List of repositories for which tag to digest resolving should be skipped
|
# List of repositories for which tag to digest resolving should be skipped
|
||||||
registriesSkippingTagResolving: "kind.local,ko.local,dev.local"
|
registries-skipping-tag-resolving: "kind.local,ko.local,dev.local"
|
||||||
# digestResolutionTimeout is the maximum time allowed for an image's
|
# digest-resolution-timeout is the maximum time allowed for an image's
|
||||||
# digests to be resolved.
|
# digests to be resolved.
|
||||||
digestResolutionTimeout: "10s"
|
digest-resolution-timeout: "10s"
|
||||||
# ProgressDeadline is the duration we wait for the deployment to
|
# progress-deadline is the duration we wait for the deployment to
|
||||||
# be ready before considering it failed.
|
# be ready before considering it failed.
|
||||||
progressDeadline: "600s"
|
progress-deadline: "600s"
|
||||||
# queueSidecarCPURequest is the requests.cpu to set for the queue proxy sidecar container.
|
# queue-sidecar-cpu-request is the requests.cpu to set for the queue proxy sidecar container.
|
||||||
# If omitted, a default value (currently "25m"), is used.
|
# If omitted, a default value (currently "25m"), is used.
|
||||||
queueSidecarCPURequest: "25m"
|
queue-sidecar-cpu-request: "25m"
|
||||||
# queueSidecarCPULimit is the limits.cpu to set for the queue proxy sidecar container.
|
# queue-sidecar-cpu-limit is the limits.cpu to set for the queue proxy sidecar container.
|
||||||
# If omitted, no value is specified and the system default is used.
|
# If omitted, no value is specified and the system default is used.
|
||||||
queueSidecarCPULimit: "1000m"
|
queue-sidecar-cpu-limit: "1000m"
|
||||||
# queueSidecarMemoryRequest is the requests.memory to set for the queue proxy container.
|
# queue-sidecar-memory-request is the requests.memory to set for the queue proxy container.
|
||||||
# If omitted, no value is specified and the system default is used.
|
# If omitted, no value is specified and the system default is used.
|
||||||
queueSidecarMemoryRequest: "400Mi"
|
queue-sidecar-memory-request: "400Mi"
|
||||||
# queueSidecarMemoryLimit is the limits.memory to set for the queue proxy container.
|
# queue-sidecar-memory-limit is the limits.memory to set for the queue proxy container.
|
||||||
# If omitted, no value is specified and the system default is used.
|
# If omitted, no value is specified and the system default is used.
|
||||||
queueSidecarMemoryLimit: "800Mi"
|
queue-sidecar-memory-limit: "800Mi"
|
||||||
# queueSidecarEphemeralStorageRequest is the requests.ephemeral-storage to
|
# queue-sidecar-ephemeral-storage-request is the requests.ephemeral-storage to
|
||||||
# set for the queue proxy sidecar container.
|
# set for the queue proxy sidecar container.
|
||||||
# If omitted, no value is specified and the system default is used.
|
# If omitted, no value is specified and the system default is used.
|
||||||
queueSidecarEphemeralStorageRequest: "512Mi"
|
queue-sidecar-ephemeral-storage-request: "512Mi"
|
||||||
# queueSidecarEphemeralStorageLimit is the limits.ephemeral-storage to set
|
# queue-sidecar-ephemeral-storage-limit is the limits.ephemeral-storage to set
|
||||||
# for the queue proxy sidecar container.
|
# for the queue proxy sidecar container.
|
||||||
# If omitted, no value is specified and the system default is used.
|
# If omitted, no value is specified and the system default is used.
|
||||||
queueSidecarEphemeralStorageLimit: "1024Mi"
|
queue-sidecar-ephemeral-storage-limit: "1024Mi"
|
||||||
```
|
```
|
||||||
|
|
||||||
## Configuring progress deadlines
|
## Configuring progress deadlines
|
||||||
|
@ -83,12 +83,12 @@ metadata:
|
||||||
annotations:
|
annotations:
|
||||||
knative.dev/example-checksum: "fa67b403"
|
knative.dev/example-checksum: "fa67b403"
|
||||||
data:
|
data:
|
||||||
progressDeadline: "10m"
|
progress-deadline: "10m"
|
||||||
```
|
```
|
||||||
|
|
||||||
## Skipping tag resolution
|
## Skipping tag resolution
|
||||||
|
|
||||||
You can configure Knative Serving to skip tag resolution for Deployments by modifying the `registriesSkippingTagResolving` ConfigMap setting.
|
You can configure Knative Serving to skip tag resolution for Deployments by modifying the `registries-skipping-tag-resolving` ConfigMap setting.
|
||||||
|
|
||||||
The following example shows how to disable tag resolution for `registry.example.com`:
|
The following example shows how to disable tag resolution for `registry.example.com`:
|
||||||
|
|
||||||
|
@ -104,5 +104,5 @@ metadata:
|
||||||
knative.dev/example-checksum: "fa67b403"
|
knative.dev/example-checksum: "fa67b403"
|
||||||
data:
|
data:
|
||||||
# List of repositories for which tag to digest resolving should be skipped
|
# List of repositories for which tag to digest resolving should be skipped
|
||||||
registriesSkippingTagResolving: registry.example.com
|
registries-skipping-tag-resolving: registry.example.com
|
||||||
```
|
```
|
||||||
|
|
|
@ -12,7 +12,7 @@ You can configure the `rollout-duration` parameter by modifying the `config-netw
|
||||||
name: config-network
|
name: config-network
|
||||||
namespace: knative-serving
|
namespace: knative-serving
|
||||||
data:
|
data:
|
||||||
rolloutDuration: "380s" # Value in seconds.
|
rollout-duration: "380s" # Value in seconds.
|
||||||
```
|
```
|
||||||
|
|
||||||
=== "Operator configuration"
|
=== "Operator configuration"
|
||||||
|
|
|
@ -194,7 +194,7 @@ kubectl get cm -n knative-serving config-network -o yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
{% raw %}
|
{% raw %}
|
||||||
Then look for the value for `domainTemplate`. If it is
|
Then look for the value for `domain-template`. If it is
|
||||||
`{{.Name}}-{{.Namespace}}.{{.Domain}}`, you need to change
|
`{{.Name}}-{{.Namespace}}.{{.Domain}}`, you need to change
|
||||||
`search-service.default` into `search-service-default` and
|
`search-service.default` into `search-service-default` and
|
||||||
`login-service.default` into `login-service-default` as well in `routing.yaml`.
|
`login-service.default` into `login-service-default` as well in `routing.yaml`.
|
||||||
|
@ -259,7 +259,7 @@ The Gateway proxy checks the updated host, and forwards it to `Search` or
|
||||||
|
|
||||||

|

|
||||||
|
|
||||||
## Using internal services and `"httpProtocol": "Redirected"`
|
## Using internal services and `"http-protocol": "Redirected"`
|
||||||
|
|
||||||
Using the approach explained in the previous section, services will be available using two entrypoints into the cluster:
|
Using the approach explained in the previous section, services will be available using two entrypoints into the cluster:
|
||||||
The original ones provided by Knative Serving (`search-service.default.example.com` and `login-service.default.example.com`),
|
The original ones provided by Knative Serving (`search-service.default.example.com` and `login-service.default.example.com`),
|
||||||
|
@ -290,8 +290,8 @@ kubectl apply --filename docs/serving/samples/knative-routing-go/routing-interna
|
||||||
will replace the custom routing rule with one that uses the `knative-local-gateway`, enabling access
|
will replace the custom routing rule with one that uses the `knative-local-gateway`, enabling access
|
||||||
via `example.com/search` and `example.com/login` again.
|
via `example.com/search` and `example.com/login` again.
|
||||||
|
|
||||||
With these changes, you can also use [the `autoTLS` feature](../../using-auto-tls.md) in combination with the global setting
|
With these changes, you can also use [the `auto-tls` feature](../../using-auto-tls.md) in combination with the global setting
|
||||||
`"httpProtocol": "Redirected"`, which would otherwise try to redirect the `entry-route`
|
`"http-protocol": "Redirected"`, which would otherwise try to redirect the `entry-route`
|
||||||
VirtualService requests from HTTP to HTTPS, failing the request.
|
VirtualService requests from HTTP to HTTPS, failing the request.
|
||||||
|
|
||||||
## Clean Up
|
## Clean Up
|
||||||
|
|
|
@ -194,7 +194,7 @@ kubectl get svc $INGRESSGATEWAY -n kong --output yaml
|
||||||
kubectl get cm config-network -n knative-serving -o yaml
|
kubectl get cm config-network -n knative-serving -o yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
Then, look for the value for `domainTemplate`. If it is {% raw
|
Then, look for the value for `domain-template`. If it is {% raw
|
||||||
%}`{{.Name}}-{{.Namespace}}.{{.Domain}}`{% endraw %}, you need to change
|
%}`{{.Name}}-{{.Namespace}}.{{.Domain}}`{% endraw %}, you need to change
|
||||||
`search-service.default` into `search-service-default` and
|
`search-service.default` into `search-service-default` and
|
||||||
`login-service.default` into `login-service-default` as well in
|
`login-service.default` into `login-service-default` as well in
|
||||||
|
|
|
@ -1,5 +1,7 @@
|
||||||
# Configuring a custom certificate class for a Service
|
# Configuring a custom certificate class for a Service
|
||||||
|
|
||||||
|
<!-- TODO: Update this page when new 'certificate-class' annotation is available -->
|
||||||
|
|
||||||
When autoTLS is enabled and Knative Services are created, a certificate class (`certificate.class`) is automatically chosen based on the value in the `config-network` ConfigMap located inside the `knative-serving` namespace. This ConfigMap is part of Knative Serving installation. If the certificate class is not specified, this defaults to `cert-manager.certificate.networking.knative.dev`. After `certificate.class` is configured, it is used for all Knative Services unless it is overridden with a `certificate.class` annotation.
|
When autoTLS is enabled and Knative Services are created, a certificate class (`certificate.class`) is automatically chosen based on the value in the `config-network` ConfigMap located inside the `knative-serving` namespace. This ConfigMap is part of Knative Serving installation. If the certificate class is not specified, this defaults to `cert-manager.certificate.networking.knative.dev`. After `certificate.class` is configured, it is used for all Knative Services unless it is overridden with a `certificate.class` annotation.
|
||||||
|
|
||||||
## Using the certificate class annotation
|
## Using the certificate class annotation
|
||||||
|
|
|
@ -53,7 +53,7 @@ DomainMappings in that namespace to use the domain name.
|
||||||
```
|
```
|
||||||
Where `<filename>` is the name of the file you created in the previous step.
|
Where `<filename>` is the name of the file you created in the previous step.
|
||||||
|
|
||||||
* To create ClusterDomainClaims automatically: set the `autocreateClusterDomainClaims` property
|
* To create ClusterDomainClaims automatically: set the `autocreate-cluster-domain-claims` property
|
||||||
to `true` in the `config-network` ConfigMap in the `knative-serving` namespace.
|
to `true` in the `config-network` ConfigMap in the `knative-serving` namespace.
|
||||||
This allows any user, in any namespace, to map any domain name, including ones in other
|
This allows any user, in any namespace, to map any domain name, including ones in other
|
||||||
namespaces or for domain names that they do not own.
|
namespaces or for domain names that they do not own.
|
||||||
|
|
|
@ -1,12 +1,12 @@
|
||||||
# HTTPS redirection
|
# HTTPS redirection
|
||||||
|
|
||||||
Operators can force HTTPS redirection for all Services. See the `httpProtocol` mentioned in the [Turn on AutoTLS](../using-auto-tls.md) page for more details.
|
Operators can force HTTPS redirection for all Services. See the `http-protocol` mentioned in the [Turn on AutoTLS](../using-auto-tls.md) page for more details.
|
||||||
|
|
||||||
## Overriding the default HTTP behavior
|
## Overriding the default HTTP behavior
|
||||||
|
|
||||||
You can override the default behavior for each Service or global configuration.
|
You can override the default behavior for each Service or global configuration.
|
||||||
|
|
||||||
* **Global key:** `httpProtocol`
|
* **Global key:** `http-protocol`
|
||||||
* **Per-revision annotation key:** `networking.knative.dev/httpOption`
|
* **Per-revision annotation key:** `networking.knative.dev/httpOption`
|
||||||
* **Possible values:**
|
* **Possible values:**
|
||||||
* `enabled` — Services accept HTTP traffic.
|
* `enabled` — Services accept HTTP traffic.
|
||||||
|
@ -36,7 +36,7 @@ You can override the default behavior for each Service or global configuration.
|
||||||
name: config-network
|
name: config-network
|
||||||
namespace: knative-serving
|
namespace: knative-serving
|
||||||
data:
|
data:
|
||||||
httpProtocol: "enabled"
|
http-protocol: "enabled"
|
||||||
```
|
```
|
||||||
|
|
||||||
=== "Global (Operator)"
|
=== "Global (Operator)"
|
||||||
|
|
|
@ -1,5 +1,7 @@
|
||||||
# Configuring Services custom ingress class
|
# Configuring Services custom ingress class
|
||||||
|
|
||||||
|
<!-- TODO: Update this page when new 'ingress-class' annotation is available -->
|
||||||
|
|
||||||
When a Knative Service is created an ingress class (`ingress.class`) is automatically assigned to it, based on the value in the `config-network` ConfigMap located inside the `knative-serving` namespace. This ConfigMap is part of Knative Serving installation. If the ingress class is not specified, this defaults to `istio.ingress.networking.knative.dev`. Once configured the `ingress.class` is used for all Knative Services unless it is overridden with an `ingress.class` annotation.
|
When a Knative Service is created an ingress class (`ingress.class`) is automatically assigned to it, based on the value in the `config-network` ConfigMap located inside the `knative-serving` namespace. This ConfigMap is part of Knative Serving installation. If the ingress class is not specified, this defaults to `istio.ingress.networking.knative.dev`. Once configured the `ingress.class` is used for all Knative Services unless it is overridden with an `ingress.class` annotation.
|
||||||
|
|
||||||
!!! warning
|
!!! warning
|
||||||
|
|
|
@ -184,7 +184,7 @@ follow the steps in the relevant tab to manually add a certificate:
|
||||||
Where `<filename>` is the name of the file you created in the previous step.
|
Where `<filename>` is the name of the file you created in the previous step.
|
||||||
|
|
||||||
1. Update the Knative Contour plugin to use the certificate as a fallback
|
1. Update the Knative Contour plugin to use the certificate as a fallback
|
||||||
when auto-TLS is disabled by running the command:
|
when autoTLS is disabled by running the command:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
kubectl patch configmap config-contour -n knative-serving \
|
kubectl patch configmap config-contour -n knative-serving \
|
||||||
|
|
|
@ -225,7 +225,7 @@ in the `knative-serving` namespace to reference your new `ClusterIssuer`.
|
||||||
|
|
||||||
Update the
|
Update the
|
||||||
[`config-network` ConfigMap](https://github.com/knative/serving/blob/main/config/core/configmaps/network.yaml)
|
[`config-network` ConfigMap](https://github.com/knative/serving/blob/main/config/core/configmaps/network.yaml)
|
||||||
in the `knative-serving` namespace to enable `autoTLS`and specify how HTTP
|
in the `knative-serving` namespace to enable `auto-tls` and specify how HTTP
|
||||||
requests are handled:
|
requests are handled:
|
||||||
|
|
||||||
1. Run the following command to edit your `config-network` ConfigMap:
|
1. Run the following command to edit your `config-network` ConfigMap:
|
||||||
|
@ -234,11 +234,11 @@ requests are handled:
|
||||||
kubectl edit configmap config-network --namespace knative-serving
|
kubectl edit configmap config-network --namespace knative-serving
|
||||||
```
|
```
|
||||||
|
|
||||||
1. Add the `autoTLS: Enabled` attribute under the `data` section:
|
1. Add the `auto-tls: Enabled` attribute under the `data` section:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
data:
|
data:
|
||||||
autoTLS: Enabled
|
auto-tls: Enabled
|
||||||
```
|
```
|
||||||
|
|
||||||
Example:
|
Example:
|
||||||
|
@ -251,20 +251,20 @@ requests are handled:
|
||||||
namespace: knative-serving
|
namespace: knative-serving
|
||||||
data:
|
data:
|
||||||
...
|
...
|
||||||
autoTLS: Enabled
|
auto-tls: Enabled
|
||||||
...
|
...
|
||||||
```
|
```
|
||||||
|
|
||||||
1. Configure how HTTP and HTTPS requests are handled in the
|
1. Configure how HTTP and HTTPS requests are handled in the
|
||||||
[`httpProtocol`](https://github.com/knative/serving/blob/main/config/core/configmaps/network.yaml#L109)
|
[`http-protocol`](https://github.com/knative/serving/blob/main/config/core/configmaps/network.yaml#L109)
|
||||||
attribute.
|
attribute.
|
||||||
|
|
||||||
By default, Knative ingress is configured to serve HTTP traffic
|
By default, Knative ingress is configured to serve HTTP traffic
|
||||||
(`httpProtocol: Enabled`). Now that your cluster is configured to use TLS
|
(`http-protocol: Enabled`). Now that your cluster is configured to use TLS
|
||||||
certificates and handle HTTPS traffic, you can specify whether or not any
|
certificates and handle HTTPS traffic, you can specify whether or not any
|
||||||
HTTP traffic is allowed.
|
HTTP traffic is allowed.
|
||||||
|
|
||||||
Supported `httpProtocol` values:
|
Supported `http-protocol` values:
|
||||||
|
|
||||||
- `Enabled`: Serve HTTP traffic.
|
- `Enabled`: Serve HTTP traffic.
|
||||||
- `Disabled`: Rejects all HTTP traffic.
|
- `Disabled`: Rejects all HTTP traffic.
|
||||||
|
@ -273,7 +273,7 @@ requests are handled:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
data:
|
data:
|
||||||
httpProtocol: Redirected
|
http-protocol: Redirected
|
||||||
```
|
```
|
||||||
|
|
||||||
Example:
|
Example:
|
||||||
|
@ -286,13 +286,13 @@ requests are handled:
|
||||||
namespace: knative-serving
|
namespace: knative-serving
|
||||||
data:
|
data:
|
||||||
...
|
...
|
||||||
autoTLS: Enabled
|
auto-tls: Enabled
|
||||||
httpProtocol: Redirected
|
http-protocol: Redirected
|
||||||
...
|
...
|
||||||
```
|
```
|
||||||
|
|
||||||
**Note:**
|
**Note:**
|
||||||
When using HTTP-01 challenge, `httpProtocol` field has to be set to `Enabled` to make sure HTTP-01 challenge requests can be accepted by the cluster.
|
When using HTTP-01 challenge, `http-protocol` field has to be set to `Enabled` to make sure HTTP-01 challenge requests can be accepted by the cluster.
|
||||||
|
|
||||||
1. Ensure that the file was updated successfully:
|
1. Ensure that the file was updated successfully:
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue