kubernetesValidation
Description
Kubernetes Integration is still experimental.
To create the CustomResourceDefinitions, apply kubernetes-config.yaml from
core/target/classes/com/predic8/membrane/core/config/kubernetes/ or a part (e.g. the 'serviceproxies' CRD) of the file.
Create a key and certificate for TLS for https://membrane-validator.membrane-soa.svc:444/ and setup Membrane to serve
this address. The configuration shown below configures Membrane on a fixed IP address outside of the Kubernetes cluster,
but this is no requirement.
Embed the following serviceProxy and adjust the 'resources' attribute to a comma-separated list of CRDs that you applied.
Note that while the CRDs have plural names, here you need to use the corresponding singular. Configure the "ssl" section
using your key and certificate.
>serviceProxy port="444">
>ssl>
>key>
>private>
-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----
>/private>
>certificate>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
>/certificate>
>/key>
>/ssl>
>kubernetesValidation resources="serviceproxy" />
>/serviceProxy>
Now register a Webhook to validate the new CRDs. (A note to the experts: Membrane's validation schemas are too
complex to fit into the CRD, because they are highly nestable and self-referencing. We therefore use webhooks.)
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
name: membrane
webhooks:
- name: membrane.membrane-soa.org
admissionReviewVersions: ["v1", "v1beta1"]
failurePolicy: Fail
rules:
- operations: [ "*" ]
apiGroups: [ "membrane-soa.org" ]
apiVersions: [ "v1", "v1beta1" ]
resources: [ "*" ]
scope: "*"
clientConfig:
service:
name: membrane-validator
namespace: membrane-soa
port: 444
caBundle: LS0t...LQ0K # base64 encoded, PEM-formatted CA certificate
sideEffects: None
---
apiVersion: v1
kind: Namespace
metadata:
name: membrane-soa
---
apiVersion: v1
kind: Service
metadata:
namespace: membrane-soa
name: membrane-validator
spec:
ports:
- port: 444
---
apiVersion: v1
kind: Endpoints
metadata:
namespace: membrane-soa
name: membrane-validator
subsets:
- addresses:
- ip: 192.168.0.1 # Membrane's IP
ports:
- port: 444
Once this setup is complete, you can enable serviceProxies like this:
apiVersion: membrane-soa.org/v1beta1
kind: serviceproxy
metadata:
name: demo
namespace: membrane-soa
spec:
host: demo.predic8.de
path:
value: /some-path/
interceptors:
- response:
interceptors:
- groovy:
src: |
println "Hello!"
target:
host: thomas-bayer.com
Can be used in
spring:beans, api, bean, if, interceptor, internalProxy, proxy, registration, request, response, serviceProxy, soapProxy, stompProxy, swaggerProxy, transport and wsStompReassembler
Attributes
Name | Required | Default | Description | Example |
---|---|---|---|---|
namespaces | false | membrane-soa | The list of namespaces to watch, comma separated. A single '*' means "watch all namespaces". | * |
resources | false | - | The resources (CustomResourceDefinition Kinds, singular) to watch in the Kubernetes API, comma separated. | serviceproxy,ssl |