Skip to content

Commit 15ab80c

Browse files
vramperezvramperez
authored
Merge pull request #1 from FIWARE/refactor/bitnami/apixis
Remove bitnami apisix dependency
2 parents 1af1f03 + f889827 commit 15ab80c

8 files changed

Lines changed: 367 additions & 166 deletions

File tree

‎README.md‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,12 @@ This project is part of [FIWARE](https://www.fiware.org/). For more information
2525
- [Local Deployment](#local-deployment)
2626
- [Deployment with Helm](#deployment-with-helm)
2727
- [Testing](#testing)
28+
- [APISIX Deployment Modes](#apisix-deployment-modes)
29+
- [Comparison Table](#comparison-table)
30+
- [1. With ETCD and with the Ingress Controller](#1-with-etcd-and-with-the-ingress-controller)
31+
- [2. With ETCD and without the Ingress Controller](#2-with-etcd-and-without-the-ingress-controller)
32+
- [3. Without ETCD and with the Ingress Controller](#3-without-etcd-and-with-the-ingress-controller)
33+
- [4. Without ETCD and without the Ingress Controller](#4-without-etcd-and-without-the-ingress-controller)
2834
- [How to contribute](#how-to-contribute)
2935
- [License](#license)
3036

@@ -118,6 +124,106 @@ The tests can be executed via:
118124
They will spin up the [Local Deployment](#local-deployment) and run
119125
the [test-scenarios](./it/src/test/resources/it/mvds_basic.feature) against it.
120126

127+
128+
## APISIX Deployment Modes
129+
130+
APISIX can operate in four distinct deployment modes. Each mode determines how routes are stored, managed, and persisted, as well as which components are responsible for maintaining the routing configuration.
131+
132+
### Comparison Table
133+
134+
| Mode | ETCD | Ingress Controller | Route Source | Persistence | Notes |
135+
| -------------------------------------------------- | ---- | ------------------ | ------------------------------------------ | ------------------------------ | ------------------------------------------ |
136+
| **1. With ETCD and with Ingress Controller** | ✔️ | ✔️ | APISIX CRDs, Kubernetes Ingress, Admin API | ✔️ Persisted in ETCD | Recommended for Kubernetes-native setups |
137+
| **2. With ETCD and without Ingress Controller** | ✔️ | ❌ | Admin API only | ✔️ Persisted in ETCD | Chart-defined routes are *not* initialized |
138+
| **3. Without ETCD and with Ingress Controller** | ❌ | ✔️ | APISIX CRDs, Kubernetes Ingress, Admin API | ❌ In-memory only | Requires at least one route to start |
139+
| **4. Without ETCD and without Ingress Controller** | ❌ | ❌ | Static ConfigMap (`apisix.yaml`) | ✔️ Persisted only in ConfigMap | **Under development**; installation may fail but upgrades will work |
140+
141+
---
142+
143+
### 1. With ETCD and with the Ingress Controller
144+
145+
In this mode, APISIX persists all route definitions in ETCD. Routes may be defined via APISIX CRDs, standard Kubernetes Ingress resources, or the Admin API.
146+
Because the configuration is stored in ETCD, all routes—including those created through the Admin API—will **remain available after restarts**.
147+
148+
```yaml
149+
apisix:
150+
ingress-controller:
151+
enabled: true
152+
apisix:
153+
deployment:
154+
role: traditional
155+
role_traditional:
156+
config_provider: yaml
157+
etcd:
158+
enabled: true
159+
```
160+
161+
---
162+
163+
### 2. With ETCD and without the Ingress Controller
164+
165+
In this configuration, ETCD persists the routes, but no Ingress Controller is available to manage them. As a result, routes can **only** be created or updated using the APISIX Admin API.
166+
Chart-defined routes are **not** initialized automatically.
167+
168+
```yaml
169+
apisix:
170+
ingress-controller:
171+
enabled: false
172+
apisix:
173+
deployment:
174+
role: traditional
175+
role_traditional:
176+
config_provider: yaml
177+
etcd:
178+
enabled: true
179+
```
180+
181+
---
182+
183+
### 3. Without ETCD and with the Ingress Controller
184+
185+
When ETCD is disabled, APISIX loads all routes from APISIX CRDs and stores them in memory. The Ingress Controller continuously synchronizes APISIX with these CRDs.
186+
Although the Admin API can still modify routes, such changes **will not persist across restarts**.
187+
Kubernetes Ingress objects may also be used to define new routes.
188+
189+
> [!WARNING]
190+
> APISIX requires at least one route to exist for the service to start correctly.
191+
192+
```yaml
193+
apisix:
194+
ingress-controller:
195+
enabled: true
196+
apisix:
197+
deployment:
198+
role: traditional
199+
role_traditional:
200+
config_provider: yaml
201+
etcd:
202+
enabled: false
203+
```
204+
205+
---
206+
207+
### 4. Without ETCD and without the Ingress Controller
208+
209+
In this mode, routes are defined statically within the `apisix.yaml` ConfigMap. APISIX loads these routes at startup, and the configuration remains unchanged unless the ConfigMap or Helm values are manually updated.
210+
This mode is suitable for simple or fully static environments.
211+
212+
> [!WARNING]
213+
> This mode is currently under development. Installation may fail, but upgrades will function correctly.
214+
215+
```yaml
216+
apisix:
217+
ingress-controller:
218+
enabled: false
219+
apisix:
220+
deployment:
221+
mode: standalone
222+
role: data_plane
223+
etcd:
224+
enabled: false
225+
```
226+
121227
## How to contribute
122228

123229
Please, check the doc [here](doc/CONTRIBUTING.md).

‎charts/odrl-authorization/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,5 @@ dependencies:
1111
repository: https://fiware.github.io/helm-charts
1212
- name: apisix
1313
condition: apisix.enabled
14-
version: 3.5.1
15-
repository: https://charts.bitnami.com/bitnami
14+
version: 2.12.2
15+
repository: https://apache.github.io/apisix-helm-chart

‎charts/odrl-authorization/templates/_helpers.tpl‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,4 +42,29 @@ app.kubernetes.io/instance: {{ .Release.Name }}
4242
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
4343
{{- end }}
4444
app.kubernetes.io/managed-by: {{ .Release.Service }}
45+
{{- end -}}
46+
47+
{{- /*
48+
Helper to parse a URL and return host and port.
49+
*/ -}}
50+
{{- define "odrl-auth.parseURL" -}}
51+
{{- $raw := . -}}
52+
{{- $isService := not ( regexMatch "https?\\:\\/\\/" $raw ) }}
53+
{{- $isHttps := $raw | hasPrefix "https://" -}}
54+
{{- $noScheme := $raw | replace "https://" "" | replace "http://" "" -}}
55+
{{- $parts := splitList ":" $noScheme -}}
56+
{{- $host := $parts | first -}}
57+
{{- $port := 0 -}}
58+
{{- if eq (len $parts) 2 }}
59+
{{- $port = $parts | last | int -}}
60+
{{- else }}
61+
{{- if $isHttps }}
62+
{{- $port = 443 -}}
63+
{{- else }}
64+
{{- $port = 80 -}}
65+
{{- end -}}
66+
{{- end -}}
67+
host: {{ $host }}
68+
port: {{ $port }}
69+
isService: {{ $isService }}
4570
{{- end -}}

‎charts/odrl-authorization/templates/apisix-cm.yaml‎

Lines changed: 0 additions & 31 deletions
This file was deleted.

‎charts/odrl-authorization/templates/catchall-route.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{{- if .Values.apisix.catchAllRoute.enabled }}
2+
{{- $url := include "odrl-auth.parseURL" .Values.apisix.catchAllRoute.upstream.url | fromYaml -}}
3+
{{- if not $url.isService }}
4+
apiVersion: apisix.apache.org/v2
5+
kind: ApisixUpstream
6+
metadata:
7+
name: catchall-upstream
8+
spec:
9+
ingressClassName: {{ (index .Values.apisix "ingress-controller").config.kubernetes.ingressClass }}
10+
externalNodes:
11+
- name: {{ $url.host }}
12+
port: {{ $url.port }}
13+
type: {{ default "Domain" .Values.apisix.catchAllRoute.upstream.type | title }}
14+
weight: 1
15+
type: roundrobin
16+
---
17+
{{- end }}
18+
apiVersion: apisix.apache.org/v2
19+
kind: ApisixRoute
20+
metadata:
21+
name: catchall-route
22+
spec:
23+
ingressClassName: {{ (index .Values.apisix "ingress-controller").config.kubernetes.ingressClass }}
24+
http:
25+
- name: catchall
26+
match:
27+
paths:
28+
- "/*"
29+
{{- if $url.isService }}
30+
backends:
31+
- serviceName: {{ $url.host }}
32+
servicePort: {{ $url.port }}
33+
weight: 1
34+
{{- else }}
35+
upstreams:
36+
- name: catchall-upstream
37+
weight: 1
38+
{{- end }}
39+
plugins:
40+
- name: openid-connect
41+
enable: true
42+
config:
43+
client_id: "{{ .Values.apisix.catchAllRoute.oidc.clientId }}"
44+
client_secret: the-secret
45+
bearer_only: true
46+
use_jwks: true
47+
discovery: "{{ .Values.apisix.catchAllRoute.oidc.discoveryEndpoint }}"
48+
- name: opa
49+
enable: true
50+
config:
51+
host: "{{ required "Open Agent Policy host is required when catchAllRoute is enabled" .Values.apisix.catchAllRoute.opa.host }}"
52+
policy: policy/main
53+
{{- end }}

‎charts/odrl-authorization/templates/routes.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{{ $ingressConfig := (index .Values.apisix "ingress-controller") }}
2+
{{- if $ingressConfig.enabled }}
3+
{{ $ingressClassName := default "apisix" $ingressConfig.config.kubernetes.ingressClass }}
4+
{{- range $idx, $route := .Values.apisix.routes }}
5+
{{ $routeName := default (printf "%s-%d" ($route.host | replace "." "-") $idx) $route.name }}
6+
{{ $upstreamName := printf "%s-%s" $routeName "upstream" }}
7+
apiVersion: apisix.apache.org/v2
8+
kind: ApisixRoute
9+
metadata:
10+
name: {{ printf "%s-%s" $routeName "route" }}
11+
spec:
12+
ingressClassName: {{ $ingressClassName }}
13+
http:
14+
- name: {{ printf "%s-%s" $routeName "route" }}
15+
match:
16+
hosts:
17+
- {{ $route.host }}
18+
paths:
19+
- {{ $route.uri }}
20+
{{- range $key, $value := $route.upstream.nodes }}
21+
{{- $url := include "odrl-auth.parseURL" $key | fromYaml }}
22+
backends:
23+
- serviceName: {{ $url.host }}
24+
servicePort: {{ $url.port }}
25+
weight: {{ $value }}
26+
{{- end }}
27+
plugins:
28+
{{- range $key, $value := $route.plugins }}
29+
- name: {{ $key }}
30+
enable: true
31+
config:
32+
{{- $value | toYaml | nindent 10 }}
33+
{{- end }}
34+
---
35+
{{- end }}
36+
{{- else }}
37+
apiVersion: v1
38+
kind: ConfigMap
39+
metadata:
40+
name: apisix.yaml
41+
namespace: {{ $.Release.Namespace | quote }}
42+
labels:
43+
{{- include "odrl-auth.labels" . | nindent 4 }}
44+
data:
45+
apisix.yaml: |-
46+
routes:
47+
{{- if .Values.apisix.catchAllRoute.enabled }}
48+
- uri: /*
49+
upstream:
50+
nodes:
51+
{{ .Values.apisix.catchAllRoute.upstream.url}}: 1
52+
type: roundrobin
53+
plugins:
54+
openid-connect:
55+
client_id: {{ .Values.apisix.catchAllRoute.oidc.clientId }}
56+
client_secret: the-secret
57+
bearer_only: true
58+
use_jwks: true
59+
discovery: {{ .Values.apisix.catchAllRoute.oidc.discoveryEndpoint }}
60+
opa:
61+
host: {{ required "Open Agent Policy host is required when catchAllRoute is enabled" .Values.apisix.catchAllRoute.opa.host}}
62+
policy: policy/main
63+
{{- end }}
64+
{{- if .Values.apisix.routes }}
65+
{{- .Values.apisix.routes | toYaml | nindent 6 }}
66+
{{- end }}
67+
#END
68+
{{- end }}

0 commit comments

Comments
 (0)