Skip to content

Commit 425ff0e

Browse files
zr-msftzr-msft
committed
[Dev Spaces] adds how to custom ingress and HTTPS with traefik
1 parent eda55a4 commit 425ff0e

File tree

2 files changed

+293
-0
lines changed

2 files changed

+293
-0
lines changed

‎articles/dev-spaces/how-to/ingress-https-traefik.md

Lines changed: 291 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,291 @@
1+
---
2+
title: "Use a custom traefik ingress controller and configure HTTPS"
3+
titleSuffix: Azure Dev Spaces
4+
services: azure-dev-spaces
5+
ms.service: azure-dev-spaces
6+
author: zr-msft
7+
ms.author: zarhoads
8+
ms.date: "08/13/2019"
9+
ms.topic: "conceptual"
10+
description: "Learn how to configure Azure Dev Spaces to use a custom traefik ingress controller and configure HTTPS using that ingress controller"
11+
keywords: "Docker, Kubernetes, Azure, AKS, Azure Kubernetes Service, containers, Helm, service mesh, service mesh routing, kubectl, k8s"
12+
---
13+
14+
# Use a custom traefik ingress controller and configure HTTPS
15+
16+
This article shows you how to configure Azure Dev Spaces to use a custom traefik ingress controller. This article also shows you how to configure that custom ingress controller to use HTTPS.
17+
18+
## Prerequisites
19+
20+
* An Azure subscription. If you don't have one, you can create a [free account][azure-account-create].
21+
* [Azure CLI installed][az-cli].
22+
* [Azure Kubernetes Service (AKS) cluster with Azure Dev Spaces enabled][qs-cli].
23+
* [kubectl][kubectl] installed.
24+
* [Helm 2.13 or greater installed][helm-installed].
25+
* [A custom domain][custom-domain] with a [DNS Zone][dns-zone] in the same resource group as your AKS cluster.
26+
27+
## Configure a custom traefik ingress controller
28+
29+
Connect to your cluster using [kubectl][kubectl], the Kubernetes command-line client. To configure `kubectl` to connect to your Kubernetes cluster, use the [az aks get-credentials][az-aks-get-credentials] command. This command downloads credentials and configures the Kubernetes CLI to use them.
30+
31+
```azurecli-interactive
32+
az aks get-credentials --resource-group myResourceGroup --name myAKS
33+
```
34+
35+
To verify the connection to your cluster, use the [kubectl get][kubectl-get] command to return a list of the cluster nodes.
36+
37+
```console
38+
$ kubectl get nodes
39+
NAME STATUS ROLES AGE VERSION
40+
aks-nodepool1-12345678-vmssfedcba Ready agent 13m v1.14.1
41+
```
42+
43+
Create a Kubernetes namespace for the traefik ingress controller and install it using `helm`.
44+
45+
```console
46+
kubectl create ns traefik
47+
helm init --wait
48+
helm install stable/traefik --name traefik --namespace traefik --set kubernetes.ingressClass=traefik --set kubernetes.ingressEndpoint.useDefaultPublishedService=true
49+
```
50+
51+
Get the IP address of the traefik ingress controller service using [kubectl get][kubectl-get].
52+
53+
```console
54+
kubectl get svc -n traefik --watch
55+
```
56+
57+
The sample output shows the IP addresses for all the services in the *traefik* name space.
58+
59+
```console
60+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
61+
traefik LoadBalancer 10.0.205.78 <pending> 80:32484/TCP,443:30620/TCP 20s
62+
...
63+
traefik LoadBalancer 10.0.205.78 MY_EXTERNAL_IP 80:32484/TCP,443:30620/TCP 60s
64+
```
65+
66+
Add an *A* record to your DNS zone with the external IP address of the traefik service using [az network dns record-set a add-record][az-network-dns-record-set-a-add-record].
67+
68+
```console
69+
az network dns record-set a add-record \
70+
--resource-group myResourceGroup \
71+
--zone-name MY_CUSTOM_DOMAIN \
72+
--record-set-name *.traefik \
73+
--ipv4-address MY_EXTERNAL_IP
74+
```
75+
76+
The above example adds an *A* record to the *MY_CUSTOM_DOMAIN* DNS zone.
77+
78+
In this article, you use the [Azure Dev Spaces Bike Sharing sample application](https://github.com/Azure/dev-spaces/tree/master/samples/BikeSharingApp) to demonstrate using Azure Dev Spaces. Clone the application from GitHub and navigate into its directory:
79+
80+
```cmd
81+
git clone https://github.com/Azure/dev-spaces
82+
cd dev-spaces/samples/BikeSharingApp/charts
83+
```
84+
85+
Open [values.yaml][values-yaml] and replace all instances of *<REPLACE_ME_WITH_HOST_SUFFIX>* with *traefik.MY_CUSTOM_DOMAIN* using your domain for *MY_CUSTOM_DOMAIN*. Also replace *kubernetes.io/ingress.class: traefik-azds # Dev Spaces-specific* with *kubernetes.io/ingress.class: traefik # Custom Ingress*. Below is an example of an updated `values.yaml` file:
86+
87+
```yaml
88+
# This is a YAML-formatted file.
89+
# Declare variables to be passed into your templates.
90+
91+
bikesharingweb:
92+
ingress:
93+
annotations:
94+
kubernetes.io/ingress.class: traefik # Custom Ingress
95+
hosts:
96+
- dev.bikesharingweb.traefik.MY_CUSTOM_DOMAIN # Assumes deployment to the 'dev' space
97+
98+
gateway:
99+
ingress:
100+
annotations:
101+
kubernetes.io/ingress.class: traefik # Custom Ingress
102+
hosts:
103+
- dev.gateway.traefik.MY_CUSTOM_DOMAIN # Assumes deployment to the 'dev' space
104+
```
105+
106+
Save your changes and close the file.
107+
108+
Deploy the sample application using `helm install`.
109+
110+
```console
111+
helm install -n bikesharing . --dep-up --namespace dev --atomic
112+
```
113+
114+
The above example deploys the sample application to the *dev* namespace.
115+
116+
Select the *dev* space with your sample application using `azds space select` and display the URLs to access the sample application using `azds list-uris`.
117+
118+
```console
119+
azds space select -n dev
120+
azds list-uris
121+
```
122+
123+
The below output shows the example URLs from `azds list-uris`.
124+
125+
```console
126+
Uri Status
127+
--------------------------------------------------- ---------
128+
http://dev.bikesharingweb.traefik.MY_CUSTOM_DOMAIN/ Available
129+
http://dev.gateway.traefik.MY_CUSTOM_DOMAIN/ Available
130+
```
131+
132+
Navigate to the *bikesharingweb* service by opening the public URL from the `azds list-uris` command. In the above example, the public URL for the *bikesharingweb* service is `http://dev.bikesharingweb.traefik.MY_CUSTOM_DOMAIN/`.
133+
134+
Use the `azds space select` command to create a child space under *dev* and list the URLs to access the child dev space.
135+
136+
```console
137+
azds space select -n dev/azureuser1 -y
138+
azds list-uris
139+
```
140+
141+
The below output shows the example URLs from `azds list-uris` to access the sample application in the *azureuser1* child dev space.
142+
143+
```console
144+
Uri Status
145+
--------------------------------------------------- ---------
146+
http://azureuser1.s.dev.bikesharingweb.traefik.MY_CUSTOM_DOMAIN/ Available
147+
http://azureuser1.s.dev.gateway.traefik.MY_CUSTOM_DOMAIN/ Available
148+
```
149+
150+
Navigate to the *bikesharingweb* service in the *azureuser1* child dev space by opening the public URL from the `azds list-uris` command. In the above example, the public URL for the *bikesharingweb* service in the *azureuser1* child dev space is `http://azureuser1.s.dev.bikesharingweb.traefik.MY_CUSTOM_DOMAIN/`.
151+
152+
## Configure the traefik ingress controller to use HTTPS
153+
154+
Create a `dev-spaces/samples/BikeSharingApp/traefik-values.yaml` file similar to the below example. Update the *email* value with your own email, which is used to generate the certificate with Let's Encrypt.
155+
156+
```yaml
157+
fullnameOverride: traefik
158+
replicas: 1
159+
cpuLimit: 400m
160+
memoryRequest: 200Mi
161+
memoryLimit: 500Mi
162+
externalTrafficPolicy: Local
163+
kubernetes:
164+
ingressClass: traefik
165+
ingressEndpoint:
166+
useDefaultPublishedService: true
167+
dashboard:
168+
enabled: false
169+
debug:
170+
enabled: false
171+
accessLogs:
172+
enabled: true
173+
fields:
174+
defaultMode: keep
175+
headers:
176+
defaultMode: keep
177+
names:
178+
Authorization: redact
179+
acme:
180+
enabled: true
181+
email: "someone@example.com"
182+
staging: false
183+
challengeType: tls-alpn-01
184+
ssl:
185+
enabled: true
186+
enforced: true
187+
permanentRedirect: true
188+
tlsMinVersion: VersionTLS12
189+
cipherSuites:
190+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
191+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
192+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
193+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
194+
- TLS_RSA_WITH_AES_128_GCM_SHA256
195+
- TLS_RSA_WITH_AES_256_GCM_SHA384
196+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
197+
```
198+
199+
Update your *traefik* service using `helm repo update` and including the *traefik-values.yaml* file you created.
200+
201+
```console
202+
cd ..
203+
helm upgrade traefik stable/traefik --namespace traefik --values traefik-values.yaml
204+
```
205+
206+
The above command runs a new version of the traefik service using the values from *traefik-values.yaml* and removes the previous service. The traefik service also creates a TLS certificate using Let's Encrypt and starts redirecting web traffic to use HTTPS.
207+
208+
> [!NOTE]
209+
> It may take a few minutes for the new version of the traefik service to start. You can check the progress using `kubectl get pods --namespace traefik --watch`.
210+
211+
Navigate to the sample application in the *dev/azureuser1* child space and notice you are redirected to use HTTPS. Also notice that the page loads, but the browser shows some errors. Opening the browser console shows the error relates to an HTTPS page trying to load HTTP resources. For example:
212+
213+
```console
214+
Mixed Content: The page at 'https://azureuser1.s.dev.bikesharingweb.traefik.MY_CUSTOM_DOMAIN/devsignin' was loaded over HTTPS, but requested an insecure resource 'http://azureuser1.s.dev.gateway.traefik.MY_CUSTOM_DOMAIN/api/user/allUsers'. This request has been blocked; the content must be served over HTTPS.
215+
```
216+
217+
To fix this error, update [BikeSharingWeb/azds.yaml][azds-yaml] to use *traefik* for *kubernetes.io/ingress.class* and your custom domain for *$(hostSuffix)*. For example:
218+
219+
```yaml
220+
...
221+
ingress:
222+
annotations:
223+
kubernetes.io/ingress.class: traefik
224+
hosts:
225+
# This expands to [space.s.][rootSpace.]bikesharingweb.<random suffix>.<region>.azds.io
226+
- $(spacePrefix)$(rootSpacePrefix)bikesharingweb.traefik.MY_CUSTOM_DOMAIN
227+
...
228+
```
229+
230+
Update [BikeSharingWeb/package.json][package-json] with a dependency for the *url* package.
231+
232+
```json
233+
{
234+
...
235+
"react-responsive": "^6.0.1",
236+
"universal-cookie": "^3.0.7",
237+
"url": "0.11.0"
238+
},
239+
...
240+
```
241+
242+
Update the *getApiHostAsync* method in [BikeSharingWeb/pages/helpers.js][helpers-js] to use HTTPS:
243+
244+
```javascript
245+
...
246+
getApiHostAsync: async function() {
247+
const apiRequest = await fetch('/api/host');
248+
const data = await apiRequest.json();
249+
250+
var urlapi = require('url');
251+
var url = urlapi.parse(data.apiHost);
252+
253+
console.log('apiHost: ' + "https://"+url.host);
254+
return "https://"+url.host;
255+
},
256+
...
257+
```
258+
259+
Navigate to the `BikeSharingWeb` directory and use `azds up` to run your updated BikeSharingWeb service.
260+
261+
```console
262+
cd BikeSharingWeb/
263+
azds up
264+
```
265+
266+
Navigate to the sample application in the *dev/azureuser1* child space and notice you are redirected to use HTTPS without any errors.
267+
268+
## Next steps
269+
270+
Learn how Azure Dev Spaces helps you develop more complex applications across multiple containers, and how you can simplify collaborative development by working with different versions or branches of your code in different spaces.
271+
272+
> [!div class="nextstepaction"]
273+
> [Team development in Azure Dev Spaces][team-development-qs]
274+
275+
276+
[az-cli]: /cli/azure/install-azure-cli?view=azure-cli-latest
277+
[az-aks-get-credentials]: /cli/azure/aks?view=azure-cli-latest#az-aks-get-credentials
278+
[az-network-dns-record-set-a-add-record]: /cli/azure/network/dns/record-set/a?view=azure-cli-latest#az-network-dns-record-set-a-add-record
279+
[custom-domain]: ../../app-service/manage-custom-dns-buy-domain.md#buy-the-domain
280+
[dns-zone]: ../../dns/dns-getstarted-cli.md
281+
[qs-cli]: ../quickstart-cli.md
282+
[team-development-qs]: ../quickstart-team-development.md
283+
284+
[azds-yaml]: https://github.com/Azure/dev-spaces/blob/master/samples/BikeSharingApp/BikeSharingWeb/azds.yaml
285+
[azure-account-create]: https://azure.microsoft.com/free
286+
[helm-installed]: https://github.com/helm/helm/blob/master/docs/install.md
287+
[helpers-js]: https://github.com/Azure/dev-spaces/blob/master/samples/BikeSharingApp/BikeSharingWeb/pages/helpers.js#L7
288+
[kubectl]: https://kubernetes.io/docs/user-guide/kubectl/
289+
[kubectl-get]: https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#get
290+
[package-json]: https://github.com/Azure/dev-spaces/blob/master/samples/BikeSharingApp/BikeSharingWeb/package.json
291+
[values-yaml]: https://github.com/Azure/dev-spaces/blob/master/samples/BikeSharingApp/charts/values.yaml

‎articles/dev-spaces/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,5 +85,7 @@
8585
href: how-to/dev-spaces-business-continuity.md
8686
- name: Interact with Windows containers
8787
href: how-to/run-dev-spaces-windows-containers.md
88+
- name: Use traefik for custom ingress and HTTPS
89+
href: how-to/ingress-https-traefik.md
8890
- name: Troubleshooting
8991
href: troubleshooting.md

0 commit comments

Comments
 (0)