SpringCloud/spring-cloud-kubernetes
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Editing pass (#337)

Browse Source 
* Editing pass

I edited for spelling, punctuation, grammar, usage, and corporate voice. I also corrected some links and made sure everything points uses https rather than http.

* Accounting for input from Chin Huang

Chin Huang found two issues, and I found another one. This commit fixes all three.
This commit is contained in:
Jay Bryant
2019-02-28 10:48:43 -06:00
committed by Ryan Baxter
parent fda256fc7e
commit f743bab020
11 changed files with 352 additions and 266 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
docs/pom.xml
View File

@@ -1,7 +1,7 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://maven.apache.org/POM/4.0.0"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<project xmlns:xsi="https://www.w3.org/2001/XMLSchema-instance"
xmlns="https://maven.apache.org/POM/4.0.0"
xsi:schemaLocation="https://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-kubernetes-docs</artifactId>
@@ -62,4 +62,3 @@
</profile>
</profiles>
</project>

49
docs/src/main/asciidoc/discovery-client.adoc
View File

@@ -1,15 +1,29 @@
== DiscoveryClient for Kubernetes
This project provides an implementation of https://github.com/spring-cloud/spring-cloud-commons/blob/master/spring-cloud-commons/src/main/java/org/springframework/cloud/client/discovery/DiscoveryClient.java[Discovery Client]
for http://kubernetes.io[Kubernetes].
This allows you to query Kubernetes endpoints *(see http://kubernetes.io/docs/user-guide/services/[services])* by name.
A service is typically exposed by the Kubernetes API server as a collection of endpoints which represent `http`, `https` addresses that a client can
for https://kubernetes.io[Kubernetes].
This client lets you query Kubernetes endpoints (see https://kubernetes.io/docs/user-guide/services/[services]) by name.
A service is typically exposed by the Kubernetes API server as a collection of endpoints that represent `http` and `https` addresses and that a client can
access from a Spring Boot application running as a pod. This discovery feature is also used by the Spring Cloud Kubernetes Ribbon project
to fetch the list of the endpoints defined for an application to be load balanced.
To enable loading of the `DiscoveryClient`, add `@EnableDiscoveryClient` to the according configuration or application class like this:
This is something that you get for free by adding the following dependency inside your project:
```java
====
[source,xml]
----
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-kubernetes</artifactId>
</dependency>
----
====
To enable loading of the `DiscoveryClient`, add `@EnableDiscoveryClient` to the according configuration or application class, as the following example shows:
====
[source,java]
----
@SpringBootApplication
@EnableDiscoveryClient
public class Application {
@@ -17,20 +31,27 @@ public class Application {
SpringApplication.run(Application.class, args);
}
}
```
----
====
Then you can inject the client in your code simply by:
Then you can inject the client in your code simply by autowiring it, as the following example shows:
```java
====
[source,java]
----
@Autowired
private DiscoveryClient discoveryClient;
```
----
====
If for any reason you need to disable the `DiscoveryClient` you can simply set the following property in `application.properties`:
If, for any reason, you need to disable the `DiscoveryClient`, you can set the following property in `application.properties`:
```
====
[source]
----
spring.cloud.kubernetes.discovery.enabled=false
```
----
====
Some Spring Cloud components use the `DiscoveryClient` in order to obtain info about the local service instance. For
this to work you need to align the Kubernetes service name with the `spring.application.name` property.
Some Spring Cloud components use the `DiscoveryClient` in order to obtain information about the local service instance. For
this to work, you need to align the Kubernetes service name with the `spring.application.name` property.

10
docs/src/main/asciidoc/discovery-kubernetes-native.adoc
View File

@@ -1,11 +1,11 @@
== Kubernetes native service discovery
Kubernetes itself is capable of (server side) service discovery (see: https://kubernetes.io/docs/concepts/services-networking/service/#discovering-services).
Using native kubernetes service discovery ensures compatibility with additional tooling, like: istio https://istio.io (service mesh, capable of load balancing, ribbon, circuit breaker, failover and much more).
Using native kubernetes service discovery ensures compatibility with additional tooling, such as Istio (https://istio.io), a service mesh that is capable of load balancing, ribbon, circuit breaker, failover, and much more.
The caller service just needs to refer to names resolvable in particular kubernetes cluster then. Simplest implementation might use the spring `RestTemplate` referring to fully qualified domain name (FQDN) `http://{service-name}.{namespace}.svc.{cluster}.local:{service-port}`.
The caller service then need only refer to names resolvable in a particular Kubernetes cluster. A simple implementation might use a spring `RestTemplate` that refers to a fully qualified domain name (FQDN), such as `https://{service-name}.{namespace}.svc.{cluster}.local:{service-port}`.
Additionally, hystrix can be used for:
Additionally, you can use Hystrix for:
* circuit breaker implementation on the caller side, just by annotating the spring boot application class: `@EnableCircuitBreaker`
* and for the fallback functionality, annotating the respective method via: `@HystrixCommand(fallbackMethod=` does the job.
* Circuit breaker implementation on the caller side, by annotating the spring boot application class with `@EnableCircuitBreaker`
* Fallback functionality, by annotating the respective method with `@HystrixCommand(fallbackMethod=`

29
docs/src/main/asciidoc/examples.adoc
View File

@@ -1,24 +1,17 @@
== Examples
Spring Cloud Kubernetes tries to make it transparent for your applications to consume Kubernetes Native Services
Spring Cloud Kubernetes tries to make it transparent for your applications to consume Kubernetes Native Services by
following the Spring Cloud interfaces.
In your applications, you need to add the **spring-cloud-kubernetes-discovery** dependency to your classpath and remove any other dependency that contains a **DiscoveryClient** implementation (ie. Eureka Discovery Client).
The same applies for PropertySourceLocator, where you need to add to the classpath the **spring-cloud-kubernetes-config** and remove any other dependency that contains a **PropertySourceLocator** implementation (ie. Config Server Client).
The following projects highlight the usage of these dependencies and demonstrate how these libraries can be used from any Spring Boot application.
List of examples using these projects:
- https://github.com/spring-cloud/spring-cloud-kubernetes/tree/master/spring-cloud-kubernetes-examples[Spring Cloud Kubernetes Examples]: the ones located inside this repository.
- Spring Cloud Kubernetes Full Example: Minions and Boss
- https://github.com/salaboy/spring-cloud-k8s-minion[Minion]
- https://github.com/salaboy/spring-cloud-k8s-boss[Boss]
- Spring Cloud Kubernetes Full Example: https://github.com/salaboy/s1p_docs[SpringOne Platform Tickets Service]
- https://github.com/salaboy/s1p_gateway[Spring Cloud Gateway with Spring Cloud Kubernetes Discovery and Config]
- https://github.com/salaboy/showcase-admin-tool[Spring Boot Admin with Spring Cloud Kubernetes Discovery and Config]
In your applications, you need to add the `spring-cloud-kubernetes-discovery` dependency to your classpath and remove any other dependency that contains a `DiscoveryClient` implementation (that is, a Eureka discovery client).
The same applies for `PropertySourceLocator`, where you need to add to the classpath the `spring-cloud-kubernetes-config` and remove any other dependency that contains a `PropertySourceLocator` implementation (that is, a configuration server client).
The following projects highlight the usage of these dependencies and demonstrate how you can use these libraries from any Spring Boot application:
* https://github.com/spring-cloud/spring-cloud-kubernetes/tree/master/spring-cloud-kubernetes-examples[Spring Cloud Kubernetes Examples]: the ones located inside this repository.
* Spring Cloud Kubernetes Full Example: Minions and Boss
** https://github.com/salaboy/spring-cloud-k8s-minion[Minion]
** https://github.com/salaboy/spring-cloud-k8s-boss[Boss]
* Spring Cloud Kubernetes Full Example: https://github.com/salaboy/s1p_docs[SpringOne Platform Tickets Service]
* https://github.com/salaboy/s1p_gateway[Spring Cloud Gateway with Spring Cloud Kubernetes Discovery and Config]
* https://github.com/salaboy/showcase-admin-tool[Spring Boot Admin with Spring Cloud Kubernetes Discovery and Config]

28
docs/src/main/asciidoc/kubernetes-awareness.adoc
View File

@@ -1,24 +1,24 @@
== Kubernetes Ecosystem Awareness
All of the features described above will work equally well regardless of whether your application is running inside
Kubernetes or not. This is really helpful for development and troubleshooting.
From a development point of view, this is really helpful as you can start your Spring Boot application and debug one
of the modules part of this project. It is not required to deploy it in Kubernetes
All of the features described earlier in this guide work equally well, regardless of whether your application is running inside
Kubernetes. This is really helpful for development and troubleshooting.
From a development point of view, this lets you start your Spring Boot application and debug one
of the modules that is part of this project. You need not deploy it in Kubernetes,
as the code of the project relies on the
https://github.com/fabric8io/kubernetes-client[Fabric8 Kubernetes Java client] which is a fluent DSL able to
communicate using `http` protocol to the REST API of Kubernetes Server.
https://github.com/fabric8io/kubernetes-client[Fabric8 Kubernetes Java client], which is a fluent DSL that can
communicate by using `http` protocol to the REST API of the Kubernetes Server.
=== Kubernetes Profile Autoconfiguration
When the application runs as a pod inside Kubernetes a Spring profile named `kubernetes` will automatically get activated.
This allows the developer to customize the configuration, to define beans that will be applied when the Spring Boot application is deployed
within the Kubernetes platform *(e.g. different dev and prod configuration)*.
When the application runs as a pod inside Kubernetes, a Spring profile named `kubernetes` automatically gets activated.
This lets you customize the configuration, to define beans that are applied when the Spring Boot application is deployed
within the Kubernetes platform (for example, different development and production configuration).
=== Istio Awareness
When including the **spring-cloud-kubernetes-istio** module into the application classpath a new profile will be added to the application,
if the application is running inside a Kubernetes Cluster with http://istio.io[Istio] installed. Then you can use
spring **@Profile("istio")** annotations into your Beans and **@Configuration**'s.
When you include the `spring-cloud-kubernetes-istio` module in the application classpath, a new profile is added to the application,
provided the application is running inside a Kubernetes Cluster with https://istio.io[Istio] installed. You can then use
spring `@Profile("istio")` annotations in your Beans and `@Configuration` classes.
The Istio awareness module uses the **me.snowdrop:istio-client** to interact with Istio APIs enabling us to discover traffic rules, circuit breakers, etc.
Making it easy for our Spring Boot applications to consume this data to dynamically configure themselves according the environment.
The Istio awareness module uses `me.snowdrop:istio-client` to interact with Istio APIs, letting us discover traffic rules, circuit breakers, and so on,
making it easy for our Spring Boot applications to consume this data to dynamically configure themselves according to the environment.

10
docs/src/main/asciidoc/other-resources.adoc
View File

@@ -1,11 +1,9 @@
== Other Resources
Here you can find other resources such as presentations(slides) and videos about Spring Cloud Kubernetes.
This section lists other resources, such as presentations (slides) and videos about Spring Cloud Kubernetes.
- https://salaboy.com/2018/09/27/the-s1p-experience/[S1P Spring Cloud on PKS]
- https://salaboy.com/2018/07/18/ljc-july-18-spring-cloud-docker-k8s/[Spring Cloud, Docker, Kubernetes -> London Java Community July 2018]
Please feel free to submit other resources via PR to http://github.com/spring-cloud/spring-cloud-kubernetes[this repository].
* https://salaboy.com/2018/09/27/the-s1p-experience/[S1P Spring Cloud on PKS]
* https://salaboy.com/2018/07/18/ljc-july-18-spring-cloud-docker-k8s/[Spring Cloud, Docker, Kubernetes -> London Java Community July 2018]
Please feel free to submit other resources through pull requests to https://github.com/spring-cloud/spring-cloud-kubernetes[this repository].

11
docs/src/main/asciidoc/pod-health-indicator.adoc
View File

@@ -1,10 +1,9 @@
== Pod Health Indicator
Spring Boot uses https://github.com/spring-projects/spring-boot/blob/master/spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/health/HealthEndpoint.java[HealthIndicator] to expose info about the health of an application.
That makes it really useful for exposing health related information to the user and are also a good fit for use as https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/[readiness probes].
Spring Boot uses https://github.com/spring-projects/spring-boot/blob/master/spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/health/HealthEndpoint.java[`HealthIndicator`] to expose info about the health of an application.
That makes it really useful for exposing health-related information to the user and makes it a good fit for use as https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/[readiness probes].
The Kubernetes health indicator which is part of the core module exposes the following info:
- pod name, ip address, namespace, service account, node name and its ip address
- flag that indicates if the Spring Boot application is internal or external to Kubernetes
The Kubernetes health indicator (which is part of the core module) exposes the following info:
* Pod name, IP address, namespace, service account, node name, and its IP address
* A flag that indicates whether the Spring Boot application is internal or external to Kubernetes

388
docs/src/main/asciidoc/property-source-config.adoc
View File

@@ -1,27 +1,30 @@
== Kubernetes PropertySource implementations
The most common approach to configure your Spring Boot application is to create an `application.properties|yaml` or
an `application-profile.properties|yaml` file containing key-value pairs providing customization values to your
application or Spring Boot starters. Users may override these properties by specifying system properties or environment
The most common approach to configuring your Spring Boot application is to create an `application.properties` or `applicaiton.yaml` or
an `application-profile.properties` or `application-profile.yaml` file that contains key-value pairs that provide customization values to your
application or Spring Boot starters. You can override these properties by specifying system properties or environment
variables.
=== ConfigMap PropertySource
[[configmap-propertysource]]
=== Using a `ConfigMap` `PropertySource`
Kubernetes provides a resource named http://kubernetes.io/docs/user-guide/configmap/[ConfigMap] to externalize the
parameters to pass to your application in the form of key-value pairs or embedded `application.properties|yaml` files.
The link:./spring-cloud-kubernetes-config[Spring Cloud Kubernetes Config] project makes Kubernetes `ConfigMap`s available
Kubernetes provides a resource named https://kubernetes.io/docs/user-guide/configmap/[`ConfigMap`] to externalize the
parameters to pass to your application in the form of key-value pairs or embedded `application.properties` or `application.yaml` files.
The link:./spring-cloud-kubernetes-config[Spring Cloud Kubernetes Config] project makes Kubernetes `ConfigMap` instances available
during application bootstrapping and triggers hot reloading of beans or Spring context when changes are detected on
observed `ConfigMap`s.
observed `ConfigMap` instances.
The default behavior is to create a `ConfigMapPropertySource` based on a Kubernetes `ConfigMap` which has `metadata.name` of either the name of
The default behavior is to create a `ConfigMapPropertySource` based on a Kubernetes `ConfigMap` that has a `metadata.name` value of either the name of
your Spring application (as defined by its `spring.application.name` property) or a custom name defined within the
`bootstrap.properties` file under the following key `spring.cloud.kubernetes.config.name`.
`bootstrap.properties` file under the following key: `spring.cloud.kubernetes.config.name`.
However, more advanced configuration are possible where multiple ConfigMaps can be used
This is made possible by the `spring.cloud.kubernetes.config.sources` list.
For example one could define the following ConfigMaps
However, more advanced configuration is possible where you can use multiple `ConfigMap` instances.
The `spring.cloud.kubernetes.config.sources` list makes this possible.
For example, you could define the following `ConfigMap` instances:
```yaml
====
[source,yaml]
----
spring:
application:
name: cloud-k8s-app
@@ -31,42 +34,48 @@ spring:
name: default-name
namespace: default-namespace
sources:
# Spring Cloud Kubernetes will lookup a ConfigMap named c1 in namespace default-namespace
# Spring Cloud Kubernetes looks up a ConfigMap named c1 in namespace default-namespace
- name: c1
# Spring Cloud Kubernetes will lookup a ConfigMap named default-name in whatever namespace n2
# Spring Cloud Kubernetes looks up a ConfigMap named default-name in whatever namespace n2
- namespace: n2
# Spring Cloud Kubernetes will lookup a ConfigMap named c3 in namespace n3
# Spring Cloud Kubernetes looks up a ConfigMap named c3 in namespace n3
- namespace: n3
name: c3
```
----
====
In the example above, it `spring.cloud.kubernetes.config.namespace` had not been set,
then the ConfigMap named `c1` would be looked up in the namespace that the application runs
In the preceding example, if `spring.cloud.kubernetes.config.namespace` had not been set,
the `ConfigMap` named `c1` would be looked up in the namespace that the application runs.
Any matching `ConfigMap` that is found, will be processed as follows:
Any matching `ConfigMap` that is found is processed as follows:
- apply individual configuration properties.
- apply as `yaml` the content of any property named `application.yaml`
- apply as properties file the content of any property named `application.properties`
* Apply individual configuration properties.
* Apply as `yaml` the content of any property named `application.yaml`.
* Apply as a properties file the content of any property named `application.properties`.
The single exception to the aforementioned flow is when the `ConfigMap` contains a **single** key that indicates
the file is a YAML or Properties file. In that case the name of the key does NOT have to be `application.yaml` or
`application.properties` (it can be anything) and the value of the property will be treated correctly.
This features facilitates the use case where the `ConfigMap` was created using something like:
The single exception to the aforementioned flow is when the `ConfigMap` contains a *single* key that indicates
the file is a YAML or properties file. In that case, the name of the key does NOT have to be `application.yaml` or
`application.properties` (it can be anything) and the value of the property is treated correctly.
This features facilitates the use case where the `ConfigMap` was created by using something like the following:
`kubectl create configmap game-config --from-file=/path/to/app-config.yaml`
====
[source]
----
kubectl create configmap game-config --from-file=/path/to/app-config.yaml
----
====
Example:
Let's assume that we have a Spring Boot application named ``demo`` that uses properties to read its thread pool
Assume that we have a Spring Boot application named `demo` that uses the following properties to read its thread pool
configuration.
- `pool.size.core`
- `pool.size.maximum`
* `pool.size.core`
* `pool.size.maximum`
This can be externalized to config map in `yaml` format:
This can be externalized to config map in `yaml` format as follows:
```yaml
====
[source,yaml]
----
kind: ConfigMap
apiVersion: v1
metadata:
@@ -74,12 +83,15 @@ metadata:
data:
pool.size.core: 1
pool.size.max: 16
```
----
====
Individual properties work fine for most cases but sometimes embedded `yaml` is more convenient. In this case we will
use a single property named `application.yaml` to embed our `yaml`:
Individual properties work fine for most cases. However, sometimes, embedded `yaml` is more convenient. In this case, we
use a single property named `application.yaml` to embed our `yaml`, as follows:
```yaml
====
[source,yaml]
----
kind: ConfigMap
apiVersion: v1
metadata:
@@ -90,11 +102,14 @@ data:
size:
core: 1
max:16
```
----
====
The following also works:
The following example also works:
```yaml
====
[source,yaml]
----
kind: ConfigMap
apiVersion: v1
metadata:
@@ -105,14 +120,17 @@ data:
size:
core: 1
max:16
```
----
====
Spring Boot applications can also be configured differently depending on active profiles which will be merged together
when the ConfigMap is read. It is possible to provide different property values for different profiles using an
`application.properties|yaml` property, specifying profile-specific values each in their own document
(indicated by the `---` sequence) as follows:
You can also configure Spring Boot applications differently depending on active profiles that are merged together
when the `ConfigMap` is read. You can provide different property values for different profiles by using an
`application.properties` or `application.yaml` property, specifying profile-specific values, each in their own document
(indicated by the `---` sequence), as follows:
```yaml
====
[source,yaml]
----
kind: ConfigMap
apiVersion: v1
metadata:
@@ -135,31 +153,43 @@ data:
profiles: production
greeting:
message: Say Hello to the Ops
```
----
====
In the above case, the configuration loaded into your Spring Application with the `development` profile will be:
```yaml
In the preceding case, the configuration loaded into your Spring Application with the `development` profile is as follows:
====
[source,yaml]
----
greeting:
message: Say Hello to the Developers
farewell:
message: Say Goodbye to the Developers
```
whereas if the `production` profile is active, the configuration will be:
```yaml
----
====
However, if the `production` profile is active, the configuration becomes:
====
[source,yaml]
----
greeting:
message: Say Hello to the Ops
farewell:
message: Say Goodbye
```
----
====
If both profiles are active, the property which appears last within the configmap will overwrite preceding values.
If both profiles are active, the property that appears last within the `ConfigMap` overwrites any preceding values.
To tell to Spring Boot which `profile` should be enabled at bootstrap, a system property can be passed to the Java
command launching your Spring Boot application using an env variable that you will define with the OpenShift
`DeploymentConfig` or Kubernetes `ReplicationConfig` resource file as follows:
To tell Spring Boot which `profile` should be enabled at bootstrap, you can pass a system property to the Java
command. To do so, you can launch your Spring Boot application with an environment variable that you can define with the OpenShift
`DeploymentConfig` or Kubernetes `ReplicationConfig` resource file, as follows:
```yaml
====
[source,yaml]
----
apiVersion: v1
kind: DeploymentConfig
spec:
@@ -172,63 +202,65 @@ spec:
value: /deployments
- name: JAVA_OPTIONS
value: -Dspring.profiles.active=developer
```
----
====
**Notes:**
- check the security configuration section, to access config maps from inside a pod you need to have the correct
NOTE: You should check the security configuration section. To access config maps from inside a pod you need to have the correct
Kubernetes service accounts, roles and role bindings.
Another option for using ConfigMaps, is to mount them into the Pod running the Spring Cloud Kubernetes application
and have Spring Cloud Kubernetes read them from the file system.
This behavior is controlled by the `spring.cloud.kubernetes.config.paths` property and can be used in
Another option for using `ConfigMap` instances is to mount them into the Pod by running the Spring Cloud Kubernetes application
and having Spring Cloud Kubernetes read them from the file system.
This behavior is controlled by the `spring.cloud.kubernetes.config.paths` property. You can use it in
addition to or instead of the mechanism described earlier.
Multiple (exact) file paths can be specified in `spring.cloud.kubernetes.config.paths` by using the `,` delimiter
You can specify multiple (exact) file paths in `spring.cloud.kubernetes.config.paths` by using the `,` delimiter.
**Notes:**
You have to provide full exact path to each property file, because directories are not being recursively parsed.
NOTE: You have to provide the full exact path to each property file, because directories are not being recursively parsed.
.Properties:
[options="header,footer"]
|===
| Name | Type | Default | Description
| spring.cloud.kubernetes.config.enabled | Boolean | true | Enable Secrets PropertySource
| spring.cloud.kubernetes.config.name | String | ${spring.application.name} | Sets the name of ConfigMap to lookup
| spring.cloud.kubernetes.config.namespace | String | Client namespace | Sets the Kubernetes namespace where to lookup
| spring.cloud.kubernetes.config.paths | List | null | Sets the paths where ConfigMaps are mounted
| spring.cloud.kubernetes.config.enableApi | Boolean | true | Enable/Disable consuming ConfigMaps via APIs
| Name | Type | Default | Description
| `spring.cloud.kubernetes.config.enabled` | `Boolean` | `true` | Enable Secrets `PropertySource`
| `spring.cloud.kubernetes.config.name` | `String` | `${spring.application.name}` | Sets the name of `ConfigMap` to look up
| `spring.cloud.kubernetes.config.namespace` | `String` | Client namespace | Sets the Kubernetes namespace where to lookup
| `spring.cloud.kubernetes.config.paths` | `List` | `null` | Sets the paths where `ConfigMap` instances are mounted
| `spring.cloud.kubernetes.config.enableApi` | `Boolean` | `true` | Enable or disable consuming `ConfigMap` instances through APIs
|===
=== Secrets PropertySource
Kubernetes has the notion of https://kubernetes.io/docs/concepts/configuration/secret/[Secrets] for storing
sensitive data such as password, OAuth tokens, etc. This project provides integration with `Secrets` to make secrets
accessible by Spring Boot applications. This feature can be explicitly enabled/disabled using the `spring.cloud.kubernetes.secrets.enabled` property.
sensitive data such as passwords, OAuth tokens, and so on. This project provides integration with `Secrets` to make secrets
accessible by Spring Boot applications. You can explicitly enable or disable This feature by setting the `spring.cloud.kubernetes.secrets.enabled` property.
The `SecretsPropertySource` when enabled will lookup Kubernetes for `Secrets` from the following sources:
When enabled, the `SecretsPropertySource` looks up Kubernetes for `Secrets` from the following sources:
. reading recursively from secrets mounts
. named after the application (as defined by `spring.application.name`)
. matching some labels
. Reading recursively from secrets mounts
. Named after the application (as defined by `spring.application.name`)
. Matching some labels
Please note that by default, consuming Secrets via API (points 2 and 3 above) **is not enabled** for security reasons
and it is recommended that containers share secrets via mounted volumes.
If you enable consuming Secrets via API, then it is recommended access to Secrets is limited by an
[authorization policy such as RBAC](https://kubernetes.io/docs/concepts/configuration/secret/#best-practices).
Note that, by default, consuming Secrets through the API (points 2 and 3 above) *is not enabled* for security reasons.
Further, we recommend that containers share secrets through mounted volumes.
If you enable consuming Secrets through the API, we recommend that you limit access to Secrets by using an
[authorization policy, such as RBAC](https://kubernetes.io/docs/concepts/configuration/secret/#best-practices).
If the secrets are found their data is made available to the application.
If the secrets are found, their data is made available to the application.
**Example:**
Assume that we have a spring boot application named `demo` that uses properties to read its database
configuration. We can create a Kubernetes secret by using the following command:
Let's assume that we have a spring boot application named ``demo`` that uses properties to read its database
configuration. We can create a Kubernetes secret using the following command:
```
====
[source]
----
oc create secret generic db-secret --from-literal=username=user --from-literal=password=p455w0rd
```
----
====
This would create the following secret (shown using `oc get secrets db-secret -o yaml`):
The preceding command would create the following secret (which you can see by using `oc get secrets db-secret -o yaml`):
```yaml
====
[source,yaml]
----
apiVersion: v1
data:
password: cDQ1NXcwcmQ=
@@ -242,14 +274,16 @@ metadata:
selfLink: /api/v1/namespaces/default/secrets/db-secret
uid: 63c89263-6099-11e7-b3da-76d6186905a8
type: Opaque
```
----
====
Note that the data contains Base64-encoded versions of the literal provided by the `create` command.
Note that the data contains Base64-encoded versions of the literal provided by the create command.
Your application can then use this secret -- for example, by exporting the secret's value as environment variables:
This secret can then be used by your application for example by exporting the secret's value as environment variables:
```yaml
====
[source,yaml]
----
apiVersion: v1
kind: Deployment
metadata:
@@ -269,78 +303,91 @@ spec:
secretKeyRef:
name: db-secret
key: password
```
----
====
You can select the Secrets to consume in a number of ways:
1. By listing the directories where secrets are mapped:
. By listing the directories where secrets are mapped:
+
```
====
[source,bash]
----
-Dspring.cloud.kubernetes.secrets.paths=/etc/secrets/db-secret,etc/secrets/postgresql
```
----
====
+
If you have all the secrets mapped to a common root, you can set them like:
+
```
====
[source,bash]
----
-Dspring.cloud.kubernetes.secrets.paths=/etc/secrets
```
----
====
2. By setting a named secret:
. By setting a named secret:
+
```
====
[source,bash]
----
-Dspring.cloud.kubernetes.secrets.name=db-secret
```
----
====
3. By defining a list of labels:
. By defining a list of labels:
+
```
====
[source,bash]
----
-Dspring.cloud.kubernetes.secrets.labels.broker=activemq
-Dspring.cloud.kubernetes.secrets.labels.db=postgresql
```
----
====
.Properties:
[options="header,footer"]
|===
| Name | Type | Default | Description
| spring.cloud.kubernetes.secrets.enabled | Boolean | true | Enable Secrets PropertySource
| spring.cloud.kubernetes.secrets.name | String | ${spring.application.name} | Sets the name of the secret to lookup
| spring.cloud.kubernetes.secrets.namespace | String | Client namespace | Sets the Kubernetes namespace where to lookup
| spring.cloud.kubernetes.secrets.labels | Map | null | Sets the labels used to lookup secrets
| spring.cloud.kubernetes.secrets.paths | List | null | Sets the paths where secrets are mounted (example 1)
| spring.cloud.kubernetes.secrets.enableApi | Boolean | false | Enable/Disable consuming secrets via APIs (examples 2 and 3)
| Name | Type | Default | Description
| `spring.cloud.kubernetes.secrets.enabled` | `Boolean` | `true` | Enable Secrets `PropertySource`
| `spring.cloud.kubernetes.secrets.name` | `String` | `${spring.application.name}` | Sets the name of the secret to look up
| `spring.cloud.kubernetes.secrets.namespace` | `String` | Client namespace | Sets the Kubernetes namespace where to look up
| `spring.cloud.kubernetes.secrets.labels` | `Map` | `null` | Sets the labels used to lookup secrets
| `spring.cloud.kubernetes.secrets.paths` | `List` | `null` | Sets the paths where secrets are mounted (example 1)
| `spring.cloud.kubernetes.secrets.enableApi` | `Boolean` | `false` | Enables or disables consuming secrets through APIs (examples 2 and 3)
|===
**Notes:**
- The property `spring.cloud.kubernetes.secrets.labels` behaves as defined by
https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-Configuration-Binding#map-based-binding[Map-based binding].
- The property `spring.cloud.kubernetes.secrets.paths` behaves as defined by
https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-Configuration-Binding#collection-based-binding[Collection-based binding].
- Access to secrets via API may be restricted for security reasons, the preferred way is to mount secret to the POD.
Example of application using secrets (though it hasn't been updated to use the new `spring-cloud-kubernetes` project):
Notes:
* The `spring.cloud.kubernetes.secrets.labels` property behaves as defined by
https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-Configuration-Binding#map-based-binding[Map-based binding].
* The `spring.cloud.kubernetes.secrets.paths` property behaves as defined by
https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-Configuration-Binding#collection-based-binding[Collection-based binding].
* Access to secrets through the API may be restricted for security reasons. The preferred way is to mount secrets to the Pod.
You can find an example of an application that uses secrets (though it has not been updated to use the new `spring-cloud-kubernetes` project) at
https://github.com/fabric8-quickstarts/spring-boot-camel-config[spring-boot-camel-config]
=== PropertySource Reload
=== `PropertySource` Reload
Some applications may need to detect changes on external property sources and update their internal status to reflect the new configuration.
The reload feature of Spring Cloud Kubernetes is able to trigger an application reload when a related `ConfigMap` or
`Secret` changes.
This feature is disabled by default and can be enabled using the configuration property `spring.cloud.kubernetes.reload.enabled=true`
(eg. in the *application.properties* file).
By default, this feature is disabled. You can enable it by using the `spring.cloud.kubernetes.reload.enabled=true` configuration property (for example, in the `application.properties` file).
The following levels of reload are supported (property `spring.cloud.kubernetes.reload.strategy`):
- **`refresh` (default)**: only configuration beans annotated with `@ConfigurationProperties` or `@RefreshScope` are reloaded.
The following levels of reload are supported (by setting the `spring.cloud.kubernetes.reload.strategy` property):
* `refresh` (default): Only configuration beans annotated with `@ConfigurationProperties` or `@RefreshScope` are reloaded.
This reload level leverages the refresh feature of Spring Cloud Context.
- **`restart_context`**: the whole Spring _ApplicationContext_ is gracefully restarted. Beans are recreated with the new configuration.
- **`shutdown`**: the Spring _ApplicationContext_ is shut down to activate a restart of the container.
When using this level, make sure that the lifecycle of all non-daemon threads is bound to the ApplicationContext
and that a replication controller or replica set is configured to restart the pod.
* `restart_context`: the whole Spring `ApplicationContext` is gracefully restarted. Beans are recreated with the new configuration.
* `shutdown`: the Spring `ApplicationContext` is shut down to activate a restart of the container.
When you use this level, make sure that the lifecycle of all non-daemon threads is bound to the `ApplicationContext`
and that a replication controller or replica set is configured to restart the pod.
Example:
Assuming that the reload feature is enabled with default settings (`refresh` mode), the following bean is refreshed when the config map changes:
Assuming that the reload feature is enabled with default settings (*`refresh`* mode), the following bean will be refreshed when the config map changes:
```java
====
[java, source]
----
@Configuration
@ConfigurationProperties(prefix = "bean")
public class MyConfig {
@@ -350,11 +397,14 @@ public class MyConfig {
// getter and setters
}
```
----
====
A way to see that changes effectively happen is creating another bean that prints the message periodically.
To see that changes effectively happen, you can create another bean that prints the message periodically, as follows
```java
====
[source,java]
----
@Component
public class MyBean {
@@ -366,11 +416,14 @@ public class MyBean {
System.out.println("The message is: " + config.getMessage());
}
}
```
----
====
The message printed by the application can be changed using a `ConfigMap` as follows:
You can change the message printed by the application by using a `ConfigMap`, as follows:
```yaml
====
[source,yaml]
----
apiVersion: v1
kind: ConfigMap
metadata:
@@ -378,37 +431,38 @@ metadata:
data:
application.properties: |-
bean.message=Hello World!
```
----
====
Any change to the property named `bean.message` in the `ConfigMap` associated to the pod will be reflected in the
Any change to the property named `bean.message` in the `ConfigMap` associated with the pod is reflected in the
output. More generally speaking, changes associated to properties prefixed with the value defined by the `prefix`
field of the `@ConfigurationProperties` annotation will be detected and reflected in the application.
[Associating a `ConfigMap` to a pod](#configmap-propertysource) is explained above.
field of the `@ConfigurationProperties` annotation are detected and reflected in the application.
<<configmap-propertysource,Associating a `ConfigMap` with a pod>> is explained earlier in this chapter.
The full example is available in [spring-cloud-kubernetes-reload-example](spring-cloud-kubernetes-examples/kubernetes-reload-example).
The full example is available in https://github.com/fabric8io/spring-cloud-kubernetes/tree/master/spring-cloud-kubernetes-examples/kubernetes-reload-example[`spring-cloud-kubernetes-reload-example`].
The reload feature supports two operating modes:
- **event (default)**: watches for changes in config maps or secrets using the Kubernetes API (web socket).
Any event will produce a re-check on the configuration and a reload in case of changes.
The `view` role on the service account is required in order to listen for config map changes. A higher level role (eg. `edit`) is required for secrets
(secrets are not monitored by default).
- **polling**: re-creates the configuration periodically from config maps and secrets to see if it has changed.
The polling period can be configured using the property `spring.cloud.kubernetes.reload.period` and defaults to *15 seconds*.
* Event (default): Watches for changes in config maps or secrets by using the Kubernetes API (web socket).
Any event produces a re-check on the configuration and, in case of changes, a reload.
The `view` role on the service account is required in order to listen for config map changes. A higher level role (such as `edit`) is required for secrets
(by default, secrets are not monitored).
* Polling: Oeriodically re-creates the configuration from config maps and secrets to see if it has changed.
You can configure the polling period by using the `spring.cloud.kubernetes.reload.period` property and defaults to 15 seconds.
It requires the same role as the monitored property source.
This means, for example, that using polling on file mounted secret sources does not require particular privileges.
This means, for example, that using polling on file-mounted secret sources does not require particular privileges.
.Properties:
[options="header,footer"]
|===
| Name | Type | Default | Description
| spring.cloud.kubernetes.reload.enabled | Boolean | false | Enables monitoring of property sources and configuration reload
| spring.cloud.kubernetes.reload.monitoring-config-maps | Boolean | true | Allow monitoring changes in config maps
| spring.cloud.kubernetes.reload.monitoring-secrets | Boolean | false | Allow monitoring changes in secrets
| spring.cloud.kubernetes.reload.strategy | Enum | refresh | The strategy to use when firing a reload (*refresh*, *restart_context*, *shutdown*)
| spring.cloud.kubernetes.reload.mode | Enum | event | Specifies how to listen for changes in property sources (*event*, *polling*)
| spring.cloud.kubernetes.reload.period | Duration| 15s | The period for verifying changes when using the *polling* strategy
| Name | Type | Default | Description
| `spring.cloud.kubernetes.reload.enabled` | `Boolean` | `false` | Enables monitoring of property sources and configuration reload
| `spring.cloud.kubernetes.reload.monitoring-config-maps` | `Boolean` | `true` | Allow monitoring changes in config maps
| `spring.cloud.kubernetes.reload.monitoring-secrets` | `Boolean` | `false` | Allow monitoring changes in secrets
| `spring.cloud.kubernetes.reload.strategy ` | `Enum` | `refresh` | The strategy to use when firing a reload (`refresh`, `restart_context`, or `shutdown`)
| `spring.cloud.kubernetes.reload.mode` | `Enum` | `event` | Specifies how to listen for changes in property sources (`event` or `polling`)
| `spring.cloud.kubernetes.reload.period` | `Duration`| `15s` | The period for verifying changes when using the `polling` strategy
|===
**Notes**:
- Properties under *spring.cloud.kubernetes.reload.* should not be used in config maps or secrets: changing such properties at runtime may lead to unexpected results;
- Deleting a property or the whole config map does not restore the original state of the beans when using the *refresh* level.
Notes:
* You should not use properties under `spring.cloud.kubernetes.reload` in config maps or secrets. Changing such properties at runtime may lead to unexpected results.
* Deleting a property or the whole config map does not restore the original state of the beans when you use the `refresh` level.

62
docs/src/main/asciidoc/ribbon-integration.adoc
View File

@@ -1,40 +1,54 @@
== Ribbon discovery in Kubernetes
== Ribbon Discovery in Kubernetes
Spring Cloud client applications calling a microservice should be interested on relying on a client load-balancing
Spring Cloud client applications that call a microservice should be interested on relying on a client load-balancing
feature in order to automatically discover at which endpoint(s) it can reach a given service. This mechanism has been
implemented within the [spring-cloud-kubernetes-ribbon](spring-cloud-kubernetes-ribbon/pom.xml) project where a
Kubernetes client will populate a https://github.com/Netflix/ribbon[Ribbon] `ServerList` containing information
implemented within the https://github.com/spring-cloud/spring-cloud-kubernetes/tree/master/spring-cloud-kubernetes-ribbon[spring-cloud-kubernetes-ribbon] project, where a
Kubernetes client populates a https://github.com/Netflix/ribbon[Ribbon] `ServerList` that contains information
about such endpoints.
When the list of the endpoints is populated, the Kubernetes client will search the registered endpoints living in
the current namespace/project matching the service name defined using the Ribbon Client annotation:
The implementation is part of the following starter that you can use by adding its dependency to your pom file:
```java
====
[source,xml]
----
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-kubernetes-ribbon</artifactId>
<version>${latest.version}</version>
</dependency>
----
====
When the list of the endpoints is populated, the Kubernetes client searches the registered endpoints that live in
the current namespace or project by matching the service name defined in the Ribbon Client annotation, as follows:
====
[source,java]
----
@RibbonClient(name = "name-service")
```
----
====
You can configure Ribbon's behavior by providing properties in your `application.properties` (via your application's
dedicated `ConfigMap`) using the following format: `<name of your service>.ribbon.<Ribbon configuration key>` where:
You can configure Ribbon's behavior by providing properties in your `application.properties` (through your application's
dedicated `ConfigMap`) by using the following format: `<name of your service>.ribbon.<Ribbon configuration key>`, where:
- `<name of your service>` corresponds to the service name you're accessing over Ribbon, as configured using the
`@RibbonClient` annotation (e.g. `name-service` in the example above)
- `<Ribbon configuration key>` is one of the Ribbon configuration key defined by
https://github.com/Netflix/ribbon/blob/master/ribbon-core/src/main/java/com/netflix/client/config/CommonClientConfigKey.java[Ribbon's CommonClientConfigKey class]
* `<name of your service>` corresponds to the service name you access over Ribbon, as configured by using the
`@RibbonClient` annotation (such as `name-service` in the preceding example).
* `<Ribbon configuration key>` is one of the Ribbon configuration keys defined by
https://github.com/Netflix/ribbon/blob/master/ribbon-core/src/main/java/com/netflix/client/config/CommonClientConfigKey.java[Ribbon's `CommonClientConfigKey` class].
Additionally, the `spring-cloud-kubernetes-ribbon` project defines two additional configuration keys to further
control how Ribbon interacts with Kubernetes. In particular, if an endpoint defines multiple ports, the default
behavior is to use the first one found. To select more specifically which port to use, in a multi-port service, use
the `PortName` key. If you want to specify in which Kubernetes' namespace the target service should be looked up, use
behavior is to use the first one found. To select more specifically which port to use in a multi-port service, you can use
the `PortName` key. If you want to specify in which Kubernetes namespace the target service should be looked up, you can use
the `KubernetesNamespace` key, remembering in both instances to prefix these keys with your service name and
`ribbon` prefix as specified above.
`ribbon` prefix, as specified earlier.
Examples that are using this module for ribbon discovery are:
The following examples use this module for ribbon discovery:
- link:./spring-cloud-kubernetes-examples/kubernetes-circuitbreaker-ribbon-example[Spring Cloud Circuitbreaker and Ribbon]
- https://github.com/fabric8-quickstarts/spring-boot-ribbon[fabric8-quickstarts - Spring Boot - Ribbon]
- https://github.com/fabric8io/kubeflix/tree/master/examples/loanbroker/bank[Kubeflix - LoanBroker - Bank]
*Note*: The Ribbon discovery client can be disabled by setting this key within the application properties file
`spring.cloud.kubernetes.ribbon.enabled=false`.
* link:./spring-cloud-kubernetes-examples/kubernetes-circuitbreaker-ribbon-example[Spring Cloud Circuitbreaker and Ribbon]
* https://github.com/fabric8-quickstarts/spring-boot-ribbon[fabric8-quickstarts - Spring Boot - Ribbon]
* https://github.com/fabric8io/kubeflix/tree/master/examples/loanbroker/bank[Kubeflix - LoanBroker - Bank]
NOTE: You can disable the Ribbon discovery client by setting the `spring.cloud.kubernetes.ribbon.enabled=false` key within the application properties file.

18
docs/src/main/asciidoc/security-service-accounts.adoc
View File

@@ -1,17 +1,23 @@
== Security Configurations inside Kubernetes
== Security Configurations Inside Kubernetes
=== Namespace
Most of the components provided in this project need to know the namespace. For Kubernetes (1.3+) the namespace is made available to pod as part of the service account secret and automatically detected by the client.
For earlier version it needs to be specified as an env var to the pod. A quick way to do this is:
Most of the components provided in this project need to know the namespace. For Kubernetes (1.3+), the namespace is made available to the pod as part of the service account secret and is automatically detected by the client.
For earlier versions, it needs to be specified as an environment variable to the pod. A quick way to do this is as follows:
====
[source]
----
env:
- name: "KUBERNETES_NAMESPACE"
valueFrom:
fieldRef:
fieldPath: "metadata.namespace"
----
====
=== Service Account
For distros of Kubernetes that support more fine-grained role-based access within the cluster, you need to make sure a pod that runs with spring-cloud-kubernetes has access to the Kubernetes API.
For any service accounts you assign to a deployment/pod, you need to make sure it has the correct roles. For example, you can add `cluster-reader` permissions to your `default` service account depending on the project you're in:
For distributions of Kubernetes that support more fine-grained role-based access within the cluster, you need to make sure a pod that runs with `spring-cloud-kubernetes` has access to the Kubernetes API.
For any service accounts you assign to a deployment or pod, you need to make sure they have the correct roles. For example, you can add `cluster-reader` permissions to your `default` service account, depending on the project you're in.

6
docs/src/main/asciidoc/spring-cloud-kubernetes.adoc
View File

@@ -1,9 +1,11 @@
= Spring Cloud Kubernetes
This reference guide covers how to use Spring Cloud Kubernetes.
== Why do you need Spring Cloud Kubernetes?
Spring Cloud Kubernetes provide Spring Cloud common interfaces implementations to consume Kubernetes native services.
The main objective of the projects provided in this repository is to facilitate the integration of Spring Cloud/Spring Boot applications running inside Kubernetes.
Spring Cloud Kubernetes provide Spring Cloud common interface implementations that consume Kubernetes native services.
The main objective of the projects provided in this repository is to facilitate the integration of Spring Cloud and Spring Boot applications running inside Kubernetes.
include::getting-started.adoc[]