Adds kfserving ingressgateway for Istio 1.1.6 (#949)

* Adds kfserving ingressgateway for Istio 1.1.6 Modifies KFServing and KNative Serving config-maps to use this gateway * Updates configs for Istio 1.1.6 * Updates tests for istio 1.1.6 * Adding kfserving gateway to kfdefs having istio-1-1-6 * Gateway name correction for kfserving config * Adds HPA config to gateway
kubeflow · Apr 2, 2020 · a39d7b3 · a39d7b3
1 parent c859984
commit a39d7b3
Show file tree

Hide file tree

Showing 24 changed files with 709 additions and 12 deletions.
diff --git a/istio/kfserving-gateway/base/deployment.yaml b/istio/kfserving-gateway/base/deployment.yaml
@@ -0,0 +1,168 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kfserving-ingressgateway
+  labels:
+    app: kfserving-ingressgateway
+    kfserving: ingressgateway
+spec:
+  selector:
+    matchLabels:
+      app: kfserving-ingressgateway
+      kfserving: ingressgateway
+  template:
+    metadata:
+      labels:
+        app: kfserving-ingressgateway
+        kfserving: ingressgateway
+      annotations:
+        sidecar.istio.io/inject: "false"
+    spec:
+      serviceAccountName: istio-ingressgateway-service-account
+      containers:
+        - name: istio-proxy
+          image: "docker.io/istio/proxyv2:1.1.6"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 15020
+            - containerPort: 80
+            - containerPort: 443
+            - containerPort: 31400
+            - containerPort: 15029
+            - containerPort: 15030
+            - containerPort: 15031
+            - containerPort: 15032
+            - containerPort: 15443
+            - containerPort: 15090
+              protocol: TCP
+              name: http-envoy-prom
+          args:
+          - proxy
+          - router
+          - --domain
+          - $(POD_NAMESPACE).svc.cluster.local
+          - --log_output_level=default:info
+          - --drainDuration
+          - '45s' #drainDuration
+          - --parentShutdownDuration
+          - '1m0s' #parentShutdownDuration
+          - --connectTimeout
+          - '10s' #connectTimeout
+          - --serviceCluster
+          - kfserving-ingressgateway
+          - --zipkinAddress
+          - zipkin:9411
+          - --proxyAdminPort
+          - "15000"
+          - --statusPort
+          - "15020"
+          - --controlPlaneAuthPolicy
+          - NONE
+          - --discoveryAddress
+          - istio-pilot:15010
+          readinessProbe:
+            failureThreshold: 30
+            httpGet:
+              path: /healthz/ready
+              port: 15020
+              scheme: HTTP
+            initialDelaySeconds: 1
+            periodSeconds: 2
+            successThreshold: 1
+            timeoutSeconds: 1
+          resources:
+            limits:
+              cpu: 100m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 40Mi
+
+          env:
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          - name: INSTANCE_IP
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: status.podIP
+          - name: HOST_IP
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: status.hostIP
+          - name: ISTIO_META_POD_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.name
+          - name: ISTIO_META_CONFIG_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
+          - name: ISTIO_META_ROUTER_MODE
+            value: sni-dnat
+          volumeMounts:
+          - name: istio-certs
+            mountPath: /etc/certs
+            readOnly: true
+          - name: ingressgateway-certs
+            mountPath: "/etc/istio/ingressgateway-certs"
+            readOnly: true
+          - name: ingressgateway-ca-certs
+            mountPath: "/etc/istio/ingressgateway-ca-certs"
+            readOnly: true
+      volumes:
+      - name: istio-certs
+        secret:
+          secretName: istio.istio-ingressgateway-service-account
+          optional: true
+      - name: ingressgateway-certs
+        secret:
+          secretName: "istio-ingressgateway-certs"
+          optional: true
+      - name: ingressgateway-ca-certs
+        secret:
+          secretName: "istio-ingressgateway-ca-certs"
+          optional: true
+      affinity:      
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: beta.kubernetes.io/arch
+                operator: In
+                values:
+                - amd64
+                - ppc64le
+                - s390x
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 2
+            preference:
+              matchExpressions:
+              - key: beta.kubernetes.io/arch
+                operator: In
+                values:
+                - amd64
+          - weight: 2
+            preference:
+              matchExpressions:
+              - key: beta.kubernetes.io/arch
+                operator: In
+                values:
+                - ppc64le
+          - weight: 2
+            preference:
+              matchExpressions:
+              - key: beta.kubernetes.io/arch
+                operator: In
+                values:
+                - s390x
diff --git a/istio/kfserving-gateway/base/horizontal-pod-autoscaler.yaml b/istio/kfserving-gateway/base/horizontal-pod-autoscaler.yaml
@@ -0,0 +1,19 @@
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  labels:
+    app: kfserving-ingressgateway
+    kfserving: ingressgateway
+  name: kfserving-ingressgateway
+spec:
+  maxReplicas: 5
+  metrics:
+  - resource:
+      name: cpu
+      targetAverageUtilization: 80
+    type: Resource
+  minReplicas: 1
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: kfserving-ingressgateway
diff --git a/istio/kfserving-gateway/base/kustomization.yaml b/istio/kfserving-gateway/base/kustomization.yaml
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: istio-system
+resources:
+- deployment.yaml
+- horizontal-pod-autoscaler.yaml
+- service.yaml
diff --git a/istio/kfserving-gateway/base/service.yaml b/istio/kfserving-gateway/base/service.yaml
@@ -0,0 +1,50 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: kfserving-ingressgateway
+  labels:
+    app: kfserving-ingressgateway
+    kfserving: ingressgateway
+spec:
+  type: LoadBalancer
+  selector:
+    app: kfserving-ingressgateway
+    kfserving: ingressgateway
+  ports:
+    - name: status-port
+      port: 15020
+      targetPort: 15020
+    - name: http2
+      nodePort: 32380
+      port: 80
+      targetPort: 80
+    - name: https
+      nodePort: 32390
+      port: 443
+    - name: tcp
+      nodePort: 32400
+      port: 31400
+    - name: tcp-pilot-grpc-tls
+      port: 15011
+      targetPort: 15011
+    - name: tcp-citadel-grpc-tls
+      port: 8060
+      targetPort: 8060
+    - name: tcp-dns-tls
+      port: 853
+      targetPort: 853
+    - name: https-kiali
+      port: 15029
+      targetPort: 15029
+    - name: http2-prometheus
+      port: 15030
+      targetPort: 15030
+    - name: http2-grafana
+      port: 15031
+      targetPort: 15031
+    - name: https-tracing
+      port: 15032
+      targetPort: 15032
+    - name: tls
+      port: 15443
+      targetPort: 15443
diff --git a/kfdef/kfctl_gcp_basic_auth.v1.0.0.yaml b/kfdef/kfctl_gcp_basic_auth.v1.0.0.yaml
@@ -28,6 +28,14 @@ spec:
         name: manifests
         path: istio/cluster-local-gateway
     name: cluster-local-gateway
+  - kustomizeConfig:
+      parameters:
+      - name: namespace
+        value: istio-system
+      repoRef:
+        name: manifests
+        path: istio/kfserving-gateway
+    name: kfserving-gateway
   - kustomizeConfig:
       parameters:
       - name: clusterRbacConfig

diff --git a/kfdef/kfctl_gcp_basic_auth.yaml b/kfdef/kfctl_gcp_basic_auth.yaml
@@ -28,6 +28,14 @@ spec:
         name: manifests
         path: istio/cluster-local-gateway
     name: cluster-local-gateway
+  - kustomizeConfig:
+      parameters:
+      - name: namespace
+        value: istio-system
+      repoRef:
+        name: manifests
+        path: istio/kfserving-gateway
+    name: kfserving-gateway
   - kustomizeConfig:
       parameters:
       - name: clusterRbacConfig

diff --git a/kfdef/kfctl_gcp_iap.v1.0.0.yaml b/kfdef/kfctl_gcp_iap.v1.0.0.yaml
@@ -28,6 +28,14 @@ spec:
         name: manifests
         path: istio/cluster-local-gateway
     name: cluster-local-gateway
+  - kustomizeConfig:
+      parameters:
+      - name: namespace
+        value: istio-system
+      repoRef:
+        name: manifests
+        path: istio/kfserving-gateway
+    name: kfserving-gateway
   - kustomizeConfig:
       parameters:
       - name: clusterRbacConfig

diff --git a/kfdef/kfctl_gcp_iap.yaml b/kfdef/kfctl_gcp_iap.yaml
@@ -28,6 +28,14 @@ spec:
         name: manifests
         path: istio/cluster-local-gateway
     name: cluster-local-gateway
+  - kustomizeConfig:
+      parameters:
+      - name: namespace
+        value: istio-system
+      repoRef:
+        name: manifests
+        path: istio/kfserving-gateway
+    name: kfserving-gateway
   - kustomizeConfig:
       parameters:
       - name: clusterRbacConfig

diff --git a/kfdef/kfctl_ibm.v1.0.0.yaml b/kfdef/kfctl_ibm.v1.0.0.yaml
@@ -28,6 +28,14 @@ spec:
         name: manifests
         path: istio/cluster-local-gateway
     name: cluster-local-gateway
+  - kustomizeConfig:
+      parameters:
+      - name: namespace
+        value: istio-system
+      repoRef:
+        name: manifests
+        path: istio/kfserving-gateway
+    name: kfserving-gateway
   - kustomizeConfig:
       parameters:
       - name: clusterRbacConfig

diff --git a/kfdef/kfctl_ibm.yaml b/kfdef/kfctl_ibm.yaml
@@ -28,6 +28,14 @@ spec:
         name: manifests
         path: istio/cluster-local-gateway
     name: cluster-local-gateway
+  - kustomizeConfig:
+      parameters:
+      - name: namespace
+        value: istio-system
+      repoRef:
+        name: manifests
+        path: istio/kfserving-gateway
+    name: kfserving-gateway
   - kustomizeConfig:
       parameters:
       - name: clusterRbacConfig

diff --git a/kfdef/kfctl_k8s_istio.v1.0.0.yaml b/kfdef/kfctl_k8s_istio.v1.0.0.yaml
@@ -28,6 +28,14 @@ spec:
         name: manifests
         path: istio/cluster-local-gateway
     name: cluster-local-gateway
+  - kustomizeConfig:
+      parameters:
+      - name: namespace
+        value: istio-system
+      repoRef:
+        name: manifests
+        path: istio/kfserving-gateway
+    name: kfserving-gateway
   - kustomizeConfig:
       parameters:
       - name: clusterRbacConfig

diff --git a/kfdef/kfctl_k8s_istio.yaml b/kfdef/kfctl_k8s_istio.yaml
@@ -28,6 +28,14 @@ spec:
         name: manifests
         path: istio/cluster-local-gateway
     name: cluster-local-gateway
+  - kustomizeConfig:
+      parameters:
+      - name: namespace
+        value: istio-system
+      repoRef:
+        name: manifests
+        path: istio/kfserving-gateway
+    name: kfserving-gateway
   - kustomizeConfig:
       parameters:
       - name: clusterRbacConfig

diff --git a/kfdef/source/master/kfctl_gcp_basic_auth.yaml b/kfdef/source/master/kfctl_gcp_basic_auth.yaml
@@ -29,6 +29,14 @@ spec:
         name: manifests
         path: istio/cluster-local-gateway
     name: cluster-local-gateway
+  - kustomizeConfig:
+      parameters:
+      - name: namespace
+        value: istio-system
+      repoRef:
+        name: manifests
+        path: istio/kfserving-gateway
+    name: kfserving-gateway
   - kustomizeConfig:
       parameters:
       - name: clusterRbacConfig

diff --git a/kfdef/source/master/kfctl_gcp_iap.yaml b/kfdef/source/master/kfctl_gcp_iap.yaml
@@ -30,6 +30,14 @@ spec:
         name: manifests
         path: istio/cluster-local-gateway
     name: cluster-local-gateway
+  - kustomizeConfig:
+      parameters:
+      - name: namespace
+        value: istio-system
+      repoRef:
+        name: manifests
+        path: istio/kfserving-gateway
+    name: kfserving-gateway
   - kustomizeConfig:
       parameters:
       - name: clusterRbacConfig