Cannot configure admin/manager hostname from kubernetes secrets/config maps about charts

[rainest]

Generally, the env block is the only section of values.yaml that accepts either plain values or valueFrom+secretKeyRefs. There are some complexities to handling multiple value types in the template, so we typically either handle only plain values or only secretKeyRefs for sensitive configuration, but not both.

In this case, valueFrom isn't actually an option: whether or not it is available is determined by the Kubernetes API: environment variables have valueFrom, whereas Ingress only supports string hosts.

https://github.com/kubernetes/enhancements/blob/master/keps/sig-network/20190125-ingress-api-group.md#hostname-proposal doesn't indicate that this will change in the upcoming v1 version of Ingress, so we wouldn't be able to implement it. I'd recommend simply configuring the hostname directly in values.yaml, but if you have a case where using a ConfigMap or Secret is necessary, you'll need to talk with SIG-Network about adding it.

[hbagdi]

@moconno I'm curious, what's the motivation behind this?

[moconno]

Thanks for the explanation @rainest . @hbagdi I am setting up infrastructure with pulumi (pulumi is creating the config/secrets) and deploying kong in multiple environments. My assumption is that I would need to configure hostnames like so: api.$env.$domain for proxy, kongmanager.$env.$domain for manager, and kongadmin.$env.$domain for admin.

[moconno]

@rainest Can you link me the documentation so that I can configure the correct env vars?

[moconno]

It looks like I may need to make pulumi in charge of helm deployments as well since I will need to dynamically override plain values. Unfortunate there isn't a simpler solution.

[rainest]

Yeah--Pulumi would need some means of invoking Helm with --set flags for the various things you want to populate from ConfigMaps/Secrets. Helm does not have its own support for retrieving values from ConfigMaps and injecting them into the rendered templates, though it has been proposed: helm/helm#6520

https://github.com/Kong/charts/blob/master/charts/kong/README.md#the-env-section shows an example of using references in the env block, but that wouldn't be useful here: those can only control Kong's configuration, whereas this is K8S configuration. We do set KONG_ADMIN_GUI_URL and such automatically based on the Ingress rule, but those are only to inform Kong what the rule is; changing them won't change the configuration generated from the Ingress.