apiVersion: v1
data:
  healthcheck_route.yaml: |
    apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: default-routes
      namespace: kubeflow
    spec:
      hosts:
      - "*"
      gateways:
      - kubeflow-gateway
      http:
      - match:
        - uri:
            exact: /healthz
        route:
        - destination:
            port:
              number: 80
            host: whoami-app.kubeflow.svc.cluster.local
      - match:
        - uri:
            exact: /whoami
        route:
        - destination:
            port:
              number: 80
            host: whoami-app.kubeflow.svc.cluster.local
    ---
    apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: kubeflow-gateway
      namespace: kubeflow
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 80
          name: http
          protocol: HTTP
        hosts:
        - "*"
  setup_backend.sh: "#!/usr/bin/env bash\n#\n# A simple shell script to configure
    the JWT audience used with ISTIO\nset -x\n[ -z ${NAMESPACE} ] && echo Error NAMESPACE
    must be set && exit 1\n[ -z ${SERVICE} ] && echo Error SERVICE must be set &&
    exit 1\n[ -z ${INGRESS_NAME} ] && echo Error INGRESS_NAME must be set && exit
    1\n\nPROJECT=$(curl -s -H \"Metadata-Flavor: Google\" http://metadata.google.internal/computeMetadata/v1/project/project-id)\nif
    [ -z ${PROJECT} ]; then\n  echo Error unable to fetch PROJECT from compute metadata\n
    \ exit 1\nfi\n\nPROJECT_NUM=$(curl -s -H \"Metadata-Flavor: Google\" http://metadata.google.internal/computeMetadata/v1/project/numeric-project-id)\nif
    [ -z ${PROJECT_NUM} ]; then\n  echo Error unable to fetch PROJECT_NUM from compute
    metadata\n  exit 1\nfi\n\n# Activate the service account\nif [ ! -z \"${GOOGLE_APPLICATION_CREDENTIALS}\"
    ]; then\n  # As of 0.7.0 we should be using workload identity and never setting
    GOOGLE_APPLICATION_CREDENTIALS.\n  # But we kept this for backwards compatibility
    but can remove later.\n  gcloud auth activate-service-account --key-file=${GOOGLE_APPLICATION_CREDENTIALS}\nfi\n\n#
    Print out the config for debugging\ngcloud config list\ngcloud auth list\n\nset_jwt_policy
    () {\n  NODE_PORT=$(kubectl --namespace=${NAMESPACE} get svc ${SERVICE} -o jsonpath='{.spec.ports[?(@.name==\"http2\")].nodePort}')\n
    \ echo \"node port is ${NODE_PORT}\"\n\n  BACKEND_NAME=\"\"\n  while [[ -z ${BACKEND_NAME}
    ]]; do\n    BACKENDS=$(kubectl --namespace=${NAMESPACE} get ingress ${INGRESS_NAME}
    -o jsonpath='{.metadata.annotations.ingress\\.kubernetes\\.io/backends}')\n    echo
    \"fetching backends info with ${INGRESS_NAME}: ${BACKENDS}\"\n    BACKEND_NAME=$(echo
    $BACKENDS | grep -o \"k8s-be-${NODE_PORT}--[0-9a-z]\\+\")\n    echo \"backend
    name is ${BACKEND_NAME}\"\n    sleep 2\n  done\n\n  BACKEND_ID=\"\"\n  while [[
    -z ${BACKEND_ID} ]]; do\n    BACKEND_ID=$(gcloud compute --project=${PROJECT}
    backend-services list --filter=name~${BACKEND_NAME} --format='value(id)')\n    echo
    \"Waiting for backend id PROJECT=${PROJECT} NAMESPACE=${NAMESPACE} SERVICE=${SERVICE}
    filter=name~${BACKEND_NAME}\"\n    sleep 2\n  done\n  echo BACKEND_ID=${BACKEND_ID}\n\n
    \ JWT_AUDIENCE=\"/projects/${PROJECT_NUM}/global/backendServices/${BACKEND_ID}\"\n
    \ \n  # Use kubectl patch.\n  echo patch JWT audience: ${JWT_AUDIENCE}\n  kubectl
    -n ${NAMESPACE} patch policy ingress-jwt --type json -p '[{\"op\": \"replace\",
    \"path\": \"/spec/origins/0/jwt/audiences/0\", \"value\": \"'${JWT_AUDIENCE}'\"}]'\n\n
    \ echo \"Clearing lock on service annotation\"\n  kubectl patch svc \"${SERVICE}\"
    -p \"{\\\"metadata\\\": { \\\"annotations\\\": {\\\"backendlock\\\": \\\"\\\"
    }}}\"\n}\n\nwhile true; do\n  set_jwt_policy\n  # Every 5 minutes recheck the
    JWT policy and reset it if the backend has changed for some reason.\n  # This
    follows Kubernetes level based design.\n  # We have at least one report see \n
    \ # https://github.com/kubeflow/kubeflow/issues/4342#issuecomment-544653657\n
    \ # of the backend id changing over time.\n  sleep 300\ndone\n"
  update_backend.sh: "#!/bin/bash\n#\n# A simple shell script to configure the health
    checks by using gcloud.\nset -x\n\n[ -z ${NAMESPACE} ] && echo Error NAMESPACE
    must be set && exit 1\n[ -z ${SERVICE} ] && echo Error SERVICE must be set &&
    exit 1\n[ -z ${INGRESS_NAME} ] && echo Error INGRESS_NAME must be set && exit
    1\n\nPROJECT=$(curl -s -H \"Metadata-Flavor: Google\" http://metadata.google.internal/computeMetadata/v1/project/project-id)\nif
    [ -z ${PROJECT} ]; then\n  echo Error unable to fetch PROJECT from compute metadata\n
    \ exit 1\nfi\n\nif [[ ! -z \"${GOOGLE_APPLICATION_CREDENTIALS}\" ]]; then\n  #
    TODO(jlewi): As of 0.7 we should always be using workload identity. We can remove
    it post 0.7.0 once we have workload identity\n  # fully working\n  # Activate
    the service account, allow 5 retries\n  for i in {1..5}; do gcloud auth activate-service-account
    --key-file=${GOOGLE_APPLICATION_CREDENTIALS} && break || sleep 10; done\nfi      \n\nset_health_check
    () {\n  NODE_PORT=$(kubectl --namespace=${NAMESPACE} get svc ${SERVICE} -o jsonpath='{.spec.ports[?(@.name==\"http2\")].nodePort}')\n
    \ echo node port is ${NODE_PORT}\n\n  while [[ -z ${BACKEND_NAME} ]]; do\n    BACKENDS=$(kubectl
    --namespace=${NAMESPACE} get ingress ${INGRESS_NAME} -o jsonpath='{.metadata.annotations.ingress\\.kubernetes\\.io/backends}')\n
    \   echo \"fetching backends info with ${INGRESS_NAME}: ${BACKENDS}\"\n    BACKEND_NAME=$(echo
    $BACKENDS | grep -o \"k8s-be-${NODE_PORT}--[0-9a-z]\\+\")\n    echo \"backend
    name is ${BACKEND_NAME}\"\n    sleep 2\n  done\n\n  while [[ -z ${BACKEND_SERVICE}
    ]];\n  do BACKEND_SERVICE=$(gcloud --project=${PROJECT} compute backend-services
    list --filter=name~${BACKEND_NAME} --uri);\n  echo \"Waiting for the backend-services
    resource PROJECT=${PROJECT} BACKEND_NAME=${BACKEND_NAME} SERVICE=${SERVICE}...\";\n
    \ sleep 2;\n  done\n\n  while [[ -z ${HEALTH_CHECK_URI} ]];\n  do HEALTH_CHECK_URI=$(gcloud
    compute --project=${PROJECT} health-checks list --filter=name~${BACKEND_NAME}
    --uri);\n  echo \"Waiting for the healthcheck resource PROJECT=${PROJECT} NODEPORT=${NODE_PORT}
    SERVICE=${SERVICE}...\";\n  sleep 2;\n  done\n\n  echo health check URI is ${HEALTH_CHECK_URI}\n\n
    \ # Since we create the envoy-ingress ingress object before creating the envoy\n
    \ # deployment object, healthcheck will not be configured correctly in the GCP\n
    \ # load balancer. It will default the healthcheck request path to a value of\n
    \ # / instead of the intended /healthz.\n  # Manually update the healthcheck request
    path to /healthz\n  if [[ ${HEALTHCHECK_PATH} ]]; then\n    # This is basic auth\n
    \   echo Running health checks update ${HEALTH_CHECK_URI} with ${HEALTHCHECK_PATH}\n
    \   gcloud --project=${PROJECT} compute health-checks update http ${HEALTH_CHECK_URI}
    --request-path=${HEALTHCHECK_PATH}\n  else\n    # /healthz/ready is the health
    check path for istio-ingressgateway\n    echo Running health checks update ${HEALTH_CHECK_URI}
    with /healthz/ready\n    gcloud --project=${PROJECT} compute health-checks update
    http ${HEALTH_CHECK_URI} --request-path=/healthz/ready\n    # We need the nodeport
    for istio-ingressgateway status-port\n    STATUS_NODE_PORT=$(kubectl -n istio-system
    get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name==\"status-port\")].nodePort}')\n
    \   gcloud --project=${PROJECT} compute health-checks update http ${HEALTH_CHECK_URI}
    --port=${STATUS_NODE_PORT}\n  fi      \n}\n\nwhile true; do\n  set_health_check\n
    \ echo \"Backend updated successfully. Waiting 1 hour before updating again.\"\n
    \ sleep 3600\ndone\n"
kind: ConfigMap
metadata:
  labels:
    kustomize.component: iap-ingress
  name: envoy-config
  namespace: kubeflow
