Skip to content

Commit b8a05ec

Browse files
adleongEric Solomon
adleong
authored and
Eric Solomon
committed
Make service mirror controller per target cluster (linkerd#4710)
This PR removes the service mirror controller from `linkerd mc install` to `linkerd mc link`, as described in linkerd/rfc#31. For fuller context, please see that RFC. Basic multicluster functionality works here including: * `linkerd mc install` installs the Link CRD but not any service mirror controllers * `linkerd mc link` creates a Link resource and installs a service mirror controller which uses that Link * The service mirror controller creates and manages mirror services, a gateway mirror, and their endpoints. * The `linkerd mc gateways` command lists all linked target clusters, their liveliness, and probe latences. * The `linkerd check` multicluster checks have been updated for the new architecture. Several checks have been rendered obsolete by the new architecture and have been removed. The following are known issues requiring further work: * the service mirror controller uses the existing `mirror.linkerd.io/gateway-name` and `mirror.linkerd.io/gateway-ns` annotations to select which services to mirror. it does not yet support configuring a label selector. * an unlink command is needed for removing multicluster links: see linkerd#4707 * an mc uninstall command is needed for uninstalling the multicluster addon: see linkerd#4708 Signed-off-by: Alex Leong <[email protected]> Signed-off-by: Eric Solomon <[email protected]>
1 parent dc2f331 commit b8a05ec

33 files changed

+1476
-2518
lines changed

‎bin/helm-build‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ bindir=$( cd "${BASH_SOURCE[0]%/*}" && pwd )
2020
rootdir=$( cd "$bindir"/.. && pwd )
2121

2222
"$bindir"/helm lint "$rootdir"/charts/linkerd2-multicluster
23+
"$bindir"/helm lint "$rootdir"/charts/linkerd2-multicluster-link
2324
"$bindir"/helm lint "$rootdir"/charts/partials
2425
"$bindir"/helm dep up "$rootdir"/charts/linkerd2-cni
2526
"$bindir"/helm lint "$rootdir"/charts/linkerd2-cni
@@ -50,6 +51,7 @@ if [ "$1" = package ]; then
5051
"$bindir"/helm --version "$version" --app-version "$tag" -d "$rootdir"/target/helm package "$rootdir"/charts/linkerd2
5152
"$bindir"/helm --version "$version" --app-version "$tag" -d "$rootdir"/target/helm package "$rootdir"/charts/linkerd2-cni
5253
"$bindir"/helm --version "$version" --app-version "$tag" -d "$rootdir"/target/helm package "$rootdir"/charts/linkerd2-multicluster
54+
"$bindir"/helm --version "$version" --app-version "$tag" -d "$rootdir"/target/helm package "$rootdir"/charts/linkerd2-multicluster-link
5355
mv "$rootdir"/target/helm/index-pre.yaml "$rootdir"/target/helm/index-pre-"$version".yaml
5456
"$bindir"/helm repo index --url "https://helm.linkerd.io/$repo/" --merge "$rootdir"/target/helm/index-pre-"$version".yaml "$rootdir"/target/helm
5557

‎charts/linkerd2-multicluster-link/.helmignore‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
OWNERS
6+
# Common VCS dirs
7+
.git/
8+
.gitignore
9+
.bzr/
10+
.bzrignore
11+
.hg/
12+
.hgignore
13+
.svn/
14+
# Common backup files
15+
*.swp
16+
*.bak
17+
*.tmp
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj

‎charts/linkerd2-multicluster-link/Chart.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v1
2+
appVersion: edge-XX.X.X
3+
description: A helm chart containing the resources to enable mirroring of services from a remote cluster
4+
kubeVersion: ">=1.13.0-0"
5+
icon: https://linkerd.io/images/logo-only-200h.png
6+
name: "linkerd2-multicluster-link"
7+
version: 0.1.0

‎charts/linkerd2-multicluster-link/README.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
2+
# Linkerd2-multicluster-link Helm Chart
3+
4+
Linkerd is a *service mesh*, designed to give platform-wide observability,
5+
reliability, and security without requiring configuration or code changes. This
6+
chart provides the components needed to enable communication between clusters.
7+
8+
## Configuration
9+
10+
The following table lists the configurable parameters of the
11+
linkerd2-multicluster chart and their default values.
12+
13+
| Parameter | Description | Default |
14+
|---------------------------------|---------------------------------------------------------------------------------------------|----------------------------------------------|
15+
|`controllerComponentLabel` | Control plane label. Do not edit |`linkerd.io/control-plane-component` |
16+
|`controllerImage` | Docker image for the Service mirror component (uses the Linkerd controller image) |`gcr.io/linkerd-io/controller` |
17+
|`controllerImageVersion` | Tag for the Service Mirror container Docker image |`latest version` |
18+
|`createdByAnnotation` | Annotation label for the proxy create. Do not edit. |`linkerd.io/created-by` |
19+
|`gateway` | If the gateway component should be installed |`true` |
20+
|`gatewayLocalProbePath` | The path that will be used by the local liveness checks to ensure the gateway is alive |`/health-local` |
21+
|`gatewayLocalProbePort` | The port that will be used by the local liveness checks to ensure the gateway is alive |`8888` |
22+
|`gatewayName` | The name of the gateway that will be installed |`linkerd-gateway` |
23+
|`gatewayNginxImage` | The Nginx image |`nginx` |
24+
|`gatewayNginxImageVersion` | The version of the Nginx image |`1.17` |
25+
|`gatewayPort` | The port on which all the gateway will accept incoming traffic |`4143` |
26+
|`gatewayProbePath` | The path that will be used by remote clusters for determining whether the gateway is alive |`/health` |
27+
|`gatewayProbePort` | The port used for liveliness probing |`4181` |
28+
|`gatewayProbeSeconds` | The interval (in seconds) between liveness probes |`3` |
29+
|`identityTrustDomain` | Trust domain used for identity of the existing linkerd installation |`cluster.local` |
30+
|`installNamespace` | If the namespace should be installed |`true` |
31+
|`linkerdNamespace` | The namespace of the existing Linkerd installation |`linkerd` |
32+
|`linkerdVersion` | Control plane version | latest version |
33+
|`namespace` | Service Mirror component namespace |`linkerd-multicluster` |
34+
|`proxyOutboundPort` | The port on which the proxy accepts outbound traffic |`4140` |
35+
|`remoteMirrorServiceAccountName` | The name of the service account used to allow remote clusters to mirror local services |`linkerd-service-mirror-remote-access-default`|
36+
|`remoteMirrorServiceAccount` | If the remote mirror service account should be installed |`true` |
37+
|`serviceMirror` | If the service mirror component should be installed |`true` |
38+
|`logLevel` | Log level for the Multicluster components |`info` |
39+
|`serviceMirrorRetryLimit` | Number of times update from the remote cluster is allowed to be requeued (retried) |`3` |
40+
|`serviceMirrorUID` | User id under which the Service Mirror shall be ran |`2103` |

‎charts/linkerd2-multicluster-link/templates/gateway-mirror.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: probe-gateway-{{.Values.targetClusterName}}
6+
namespace: {{.Values.namespace}}
7+
labels:
8+
mirror.linkerd.io/mirrored-gateway: "true"
9+
mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
10+
spec:
11+
ports:
12+
- name: mc-probe
13+
port: {{.Values.gatewayProbePort}}
14+
protocol: TCP

‎charts/linkerd2-multicluster/templates/service-mirror.yaml‎ renamed to ‎charts/linkerd2-multicluster-link/templates/service-mirror.yaml‎

Lines changed: 24 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
{{if .Values.serviceMirror -}}
21
---
32
kind: ClusterRole
43
apiVersion: rbac.authorization.k8s.io/v1
54
metadata:
6-
name: linkerd-service-mirror-access-local-resources
5+
name: linkerd-service-mirror-access-local-resources-{{.Values.targetClusterName}}
76
labels:
87
{{.Values.controllerComponentLabel}}: linkerd-service-mirror
8+
mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
99
rules:
1010
- apiGroups: [""]
1111
resources: ["endpoints", "services"]
@@ -17,85 +17,96 @@ rules:
1717
kind: ClusterRoleBinding
1818
apiVersion: rbac.authorization.k8s.io/v1
1919
metadata:
20-
name: linkerd-service-mirror-access-local-resources
20+
name: linkerd-service-mirror-access-local-resources-{{.Values.targetClusterName}}
2121
labels:
2222
{{.Values.controllerComponentLabel}}: linkerd-service-mirror
23+
mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
2324
roleRef:
2425
apiGroup: rbac.authorization.k8s.io
2526
kind: ClusterRole
26-
name: linkerd-service-mirror-access-local-resources
27+
name: linkerd-service-mirror-access-local-resources-{{.Values.targetClusterName}}
2728
subjects:
2829
- kind: ServiceAccount
29-
name: linkerd-service-mirror
30+
name: linkerd-service-mirror-{{.Values.targetClusterName}}
3031
namespace: {{.Values.namespace}}
3132
---
3233
kind: Role
3334
apiVersion: rbac.authorization.k8s.io/v1
3435
metadata:
35-
name: linkerd-service-mirror-read-remote-creds
36+
name: linkerd-service-mirror-read-remote-creds-{{.Values.targetClusterName}}
3637
namespace: {{.Values.namespace}}
3738
labels:
3839
{{.Values.controllerComponentLabel}}: linkerd-service-mirror
40+
mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
3941
rules:
4042
- apiGroups: [""]
4143
resources: ["secrets"]
44+
resourceNames: ["cluster-credentials-{{.Values.targetClusterName}}"]
45+
verbs: ["list", "get", "watch"]
46+
- apiGroups: ["multicluster.linkerd.io"]
47+
resources: ["links"]
4248
verbs: ["list", "get", "watch"]
4349
---
4450
kind: RoleBinding
4551
apiVersion: rbac.authorization.k8s.io/v1
4652
metadata:
47-
name: linkerd-service-mirror-read-remote-creds
53+
name: linkerd-service-mirror-read-remote-creds-{{.Values.targetClusterName}}
4854
namespace: {{.Values.namespace}}
4955
labels:
5056
{{.Values.controllerComponentLabel}}: linkerd-service-mirror
57+
mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
5158
roleRef:
5259
apiGroup: rbac.authorization.k8s.io
5360
kind: Role
54-
name: linkerd-service-mirror-read-remote-creds
61+
name: linkerd-service-mirror-read-remote-creds-{{.Values.targetClusterName}}
5562
subjects:
5663
- kind: ServiceAccount
57-
name: linkerd-service-mirror
64+
name: linkerd-service-mirror-{{.Values.targetClusterName}}
5865
namespace: {{.Values.namespace}}
5966
---
6067
kind: ServiceAccount
6168
apiVersion: v1
6269
metadata:
63-
name: linkerd-service-mirror
70+
name: linkerd-service-mirror-{{.Values.targetClusterName}}
6471
namespace: {{.Values.namespace}}
6572
labels:
6673
{{.Values.controllerComponentLabel}}: linkerd-service-mirror
74+
mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
6775
---
6876
apiVersion: apps/v1
6977
kind: Deployment
7078
metadata:
7179
labels:
7280
{{.Values.controllerComponentLabel}}: linkerd-service-mirror
73-
name: linkerd-service-mirror
81+
mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
82+
name: linkerd-service-mirror-{{.Values.targetClusterName}}
7483
namespace: {{.Values.namespace}}
7584
spec:
7685
replicas: 1
7786
selector:
7887
matchLabels:
7988
{{.Values.controllerComponentLabel}}: linkerd-service-mirror
89+
mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
8090
template:
8191
metadata:
8292
annotations:
8393
linkerd.io/inject: enabled
8494
labels:
8595
{{.Values.controllerComponentLabel}}: linkerd-service-mirror
96+
mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
8697
spec:
8798
containers:
8899
- args:
89100
- service-mirror
90101
- -log-level={{.Values.logLevel}}
91102
- -event-requeue-limit={{.Values.serviceMirrorRetryLimit}}
92103
- -namespace={{.Values.namespace}}
104+
- {{.Values.targetClusterName}}
93105
image: {{.Values.controllerImage}}:{{.Values.controllerImageVersion}}
94106
name: service-mirror
95107
securityContext:
96108
runAsUser: {{.Values.serviceMirrorUID}}
97109
ports:
98110
- containerPort: 9999
99111
name: admin-http
100-
serviceAccountName: linkerd-service-mirror
101-
{{end -}}
112+
serviceAccountName: linkerd-service-mirror-{{.Values.targetClusterName}}

‎charts/linkerd2-multicluster-link/values.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
controllerComponentLabel: linkerd.io/control-plane-component
2+
controllerImage: gcr.io/linkerd-io/controller
3+
controllerImageVersion: linkerdVersionValue
4+
createdByAnnotation: linkerd.io/created-by
5+
gatewayProbePort: 4181
6+
namespace: linkerd-multicluster
7+
logLevel: info
8+
serviceMirrorRetryLimit: 3
9+
serviceMirrorUID: 2103

‎charts/linkerd2-multicluster/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v1
22
appVersion: edge-XX.X.X
3-
description: A helm chart containing the resources to enable mirroring of services on remote clusters
3+
description: A helm chart containing the resources to support multicluster linking to remote clusters
44
kubeVersion: ">=1.13.0-0"
55
icon: https://linkerd.io/images/logo-only-200h.png
66
name: "linkerd2-multicluster"
7-
version: 0.1.0
7+
version: 0.1.0

‎charts/linkerd2-multicluster/templates/link-crd.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
###
3+
### Link CRD
4+
###
5+
---
6+
apiVersion: apiextensions.k8s.io/v1beta1
7+
kind: CustomResourceDefinition
8+
metadata:
9+
name: links.multicluster.linkerd.io
10+
annotations:
11+
{{.Values.createdByAnnotation}}: {{default (printf "linkerd/helm %s" .Values.linkerdVersion) .Values.cliVersion}}
12+
spec:
13+
group: multicluster.linkerd.io
14+
versions:
15+
- name: v1alpha1
16+
served: true
17+
storage: true
18+
scope: Namespaced
19+
names:
20+
plural: links
21+
singular: link
22+
kind: Link

‎charts/linkerd2-multicluster/values.yaml‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
1-
controllerComponentLabel: linkerd.io/control-plane-component
2-
controllerImage: gcr.io/linkerd-io/controller
3-
controllerImageVersion: linkerdVersionValue
41
createdByAnnotation: linkerd.io/created-by
52
gateway: true
63
gatewayLocalProbePath: /health-local
@@ -12,15 +9,9 @@ gatewayPort: 4143
129
gatewayProbePath: /health
1310
gatewayProbePort: 4181
1411
gatewayProbeSeconds: 3
15-
identityTrustDomain: cluster.local
1612
installNamespace: true
17-
linkerdNamespace: linkerd
1813
linkerdVersion: linkerdVersionValue
1914
namespace: linkerd-multicluster
2015
proxyOutboundPort: 4140
21-
serviceMirror: true
22-
logLevel: info
23-
serviceMirrorRetryLimit: 3
24-
serviceMirrorUID: 2103
2516
remoteMirrorServiceAccount: true
2617
remoteMirrorServiceAccountName: linkerd-service-mirror-remote-access-default

0 commit comments

Comments
 (0)