https://github.com/financial-times/k8s-pub-auth-varnish

https://github.com/financial-times/k8s-pub-auth-varnish

universal-publishing

Last synced: about 1 month ago
JSON representation

• Host: GitHub
• URL: https://github.com/financial-times/k8s-pub-auth-varnish
• Owner: Financial-Times
• Created: 2017-04-14T12:23:44.000Z (over 7 years ago)
• Default Branch: master
• Last Pushed: 2023-06-21T13:53:37.000Z (over 1 year ago)
• Last Synced: 2024-04-08T16:48:17.031Z (9 months ago)
• Topics: universal-publishing
• Language: Shell
• Size: 552 KB
• Stars: 0
• Watchers: 33
• Forks: 2
• Open Issues: 2
• Metadata Files:
  • Readme: README.md
  • Codeowners: .github/CODEOWNERS

Awesome Lists containing this project

README

        
## UPP Publishing Auth Varnish

This is the main entry point in the publish cluster. It performs authentication when needed and routes traffic to the cluster's applications.

See [default.vcl](/default.vcl) for the Varnish routing policies.

## Kubernetes details

It uses a service of type `LoadBalancer` that will provision an ElasticLoadBalancer in AWS.

Every time this service is recreated, a new ELB will be created. 

This does `NOT` happen in normal deploy situations, but only on extreme situations like helm chart delete.

#### ELB DNS registration

Since this is the entry point in the cluster, the ELB needs to be registered at the DNS name of the cluster.

This is done by a Kubernetes job, set to run at `helm install` and `helm  update`, to make sure that the DNS 

name is updated even if the ELB is recreated. See [k8s job file](/helm/k8s-pub-auth-varnish/templates/elb-registrator-job.yaml) for details.

#### Config map keys used

- global-config:

    - dns_subdomain : the DNS name where the cluster should be reachable

    - k8s.app_namespace : the k8s namespace where the app lives

    - aws.region: the aws region of the cluster

#### Secret keys used

- global_secrets:

    - aws.access_key_id: AWS access key id

    - aws.secret_access_key : AWS secret access key

    - kon.dns_api.key: The API key for Konstructor used for setting up the DNS record