Install Contour

This topic tells you how to install Contour from the Tanzu Application Platform (commonly known as TAP) package repository.

Note
Follow the steps in this topic if you do not want to use a profile to install Contour. For more information about profiles, see Components and installation profiles.

To install Contour from the Tanzu Application Platform package repository without a profile:

Install cert-manager.

List version information for the package by running:

tanzu package available list contour.tanzu.vmware.com -n tap-install

For example:

$  tanzu package available list contour.tanzu.vmware.com -n tap-install
- Retrieving package versions for contour.tanzu.vmware.com...
  NAME                      VERSION       RELEASED-AT
  contour.tanzu.vmware.com  1.22.0+tap.8  2022-12-05 19:00:00 -0500 EST

Create a file named contour-rbac.yaml by using the following sample and apply the configuration:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: contour-tap-install-cluster-admin-role
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: contour-tap-install-cluster-admin-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: contour-tap-install-cluster-admin-role
subjects:
- kind: ServiceAccount
  name: contour-tap-install-sa
  namespace: tap-install
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: contour-tap-install-sa
  namespace: tap-install

Apply the configuration by running:
```
kubectl apply -f contour-rbac.yaml
```
Create a file named contour-install.yaml by using the following sample and apply the configuration:

Note
The following configuration installs the Contour package with default options. To make changes to the default installation settings, go to the next step.
```
apiVersion: packaging.carvel.dev/v1alpha1
kind: PackageInstall
metadata:
  name: contour
  namespace: tap-install
spec:
  serviceAccountName: contour-tap-install-sa
  packageRef:
    refName: contour.tanzu.vmware.com
    versionSelection:
      constraints: "VERSION-NUMBER"
      prereleases: {}
```
Where VERSION-NUMBER is the version of the package listed earlier.

(Optional) Make changes to the default installation settings:

Gather values schema by running:

tanzu package available get contour.tanzu.vmware.com/1.22.0+tap.8 --values-schema -n tap-install

For example:

$ tanzu package available get contour.tanzu.vmware.com/1.22.0+tap.8 --values-schema -n tap-install

  KEY                                  DEFAULT               TYPE     DESCRIPTION
  kubernetes_version                   0.0.0                 string   Optional. Version of K8s infrastructure being used. Supported Values: valid Kubernetes major.minor.patch versions
  namespace                            tanzu-system-ingress  string   The namespace in which to deploy Contour and Envoy.
  certificates.duration                8760h                 string   If using cert-manager, how long the certificates should be valid for. If useCertManager is false, this field is ignored.
  certificates.renewBefore             360h                  string   If using cert-manager, how long before expiration the certificates should be renewed. If useCertManager is false, this field is ignored.
  contour.configFileContents           <nil>                 <nil>    The YAML contents of the Contour config file. See https://projectcontour.io/docs/v1.22.0/configuration/#configuration-file for more information.
  contour.logLevel                     info                  string   The Contour log level. Valid options are 'info' and 'debug'.
  contour.replicas                     2                     integer  How many Contour pod replicas to have.
  contour.useProxyProtocol             false                 boolean  Whether to enable PROXY protocol for all Envoy listeners.
  envoy.terminationGracePeriodSeconds  300                   integer  The termination grace period, in seconds, for the Envoy pods.
  envoy.workload.replicas              2                     integer  The number of Envoy replicas to deploy when 'type' is set to 'Deployment'. If not specified, it will default to '2'.
  envoy.workload.type                  DaemonSet             string   The type of Kubernetes workload Envoy is deployed as. Options are 'Deployment' or 'DaemonSet'. If not specified, will default to 'DaemonSet'.
  envoy.hostNetwork                    false                 boolean  Whether to enable host networking for the Envoy pods.
  envoy.hostPorts.enable               true                  boolean  Whether to enable host ports. If false, http & https are ignored.
  envoy.hostPorts.http                 80                    integer  If enable == true, the host port number to expose Envoy's HTTP listener on.
  envoy.hostPorts.https                443                   integer  If enable == true, the host port number to expose Envoy's HTTPS listener on.
  envoy.logLevel                       info                  string   The Envoy log level.
  envoy.service.nodePorts.https        0                     integer  The node port number to expose Envoy's HTTPS listener on. If not specified, a node port will be auto-assigned by Kubernetes.
  envoy.service.nodePorts.http         0                     integer  The node port number to expose Envoy's HTTP listener on. If not specified, a node port will be auto-assigned by Kubernetes.
  envoy.service.type                                         string   The type of Kubernetes service to provision for Envoy. If not specified, will default to 'NodePort' for docker and vsphere and 'LoadBalancer' for others.
  envoy.service.annotations            <nil>                 <nil>    Annotations to set on the Envoy service.
  envoy.service.aws.LBType             classic               string   AWS loadbalancer type.
  envoy.service.externalTrafficPolicy                        string   The external traffic policy for the Envoy service. If type is 'ClusterIP', this field is ignored. Otherwise, defaults to 'Cluster' for vsphere and 'Local' for others.
  envoy.service.loadBalancerIP                               string   The desired load balancer IP. If type is not 'LoadBalancer', this field is ignored. It is up to the cloud provider whether to honor this request. If not specified, then load balancer IP will be assigned by the cloud provider.
  infrastructure_provider              vsphere               string   The underlying infrastructure provider. Valid values are `vsphere`, `aws` and `azure`.
  kubernetes_distribution                                    string   Kubernetes distribution that this package is being installed on. Supported values: ['','openshift']

Create a contour-install.yaml file by using the following sample as a guide:

Note
This sample is for installation in an AWS public cloud with LoadBalancer services.
```
apiVersion: packaging.carvel.dev/v1alpha1
kind: PackageInstall
metadata:
  name: contour
  namespace: tap-install
spec:
  serviceAccountName: contour-tap-install-sa
  packageRef:
    refName: contour.tanzu.vmware.com
    versionSelection:
      constraints: 1.22.0+tap.8
      prereleases: {}
  values:
  - secretRef:
      name: contour-values
---
apiVersion: v1
kind: Secret
metadata:
  name: contour-values
  namespace: tap-install
stringData:
  values.yaml: |
    envoy:
      service:
        type: LoadBalancer
    infrastructure_provider: aws
```
The LoadBalancer type is appropriate for most installations, but local clusters such as kind or minikube can fail to complete the package install if LoadBalancer services are not supported.

For local clusters, you can configure contour.evnoy.service.type to be NodePort. If your local cluster is set up with extra port mappings on the nodes, you might also need configure envoy.service.nodePorts.http and envoy.service.nodePorts.https to match the port mappings from your local machine into one of the nodes of your local cluster. This pattern is seen when using the Learning Center on Kind.

Contour provides an Ingress implementation by default. If you have another Ingress implementation in your cluster, you must explicitly specify an IngressClass to select a particular implementation.

Cloud Native Runtimes programs Contour HTTPRoutes are based on the installed namespace. The default installation of CNR uses a single Contour to provide internet-visible services. You can install a second Contour instance with service type ClusterIP if you want to expose some services to only the local cluster. The second instance must be installed in a separate namespace. You must set the CNR value ingress.internal.namespace to point to this namespace.

Install the package by running:
```
kubectl apply -f contour-install.yaml
```

Verify the package install by running:

tanzu package installed get contour -n tap-install

For example:

$ tanzu package installed get contour -n tap-install
/ Retrieving installation details for contour...
NAME:                    contour
PACKAGE-NAME:            contour.tanzu.vmware.com
PACKAGE-VERSION:         1.22.0+tap.8
STATUS:                  Reconcile succeeded
CONDITIONS:              [{ReconcileSucceeded True  }]
USEFUL-ERROR-MESSAGE:

Verify that STATUS is Reconcile succeeded

Verify the installation by running:

kubectl get po -n tanzu-system-ingress

For example:

$  kubectl get po -n tanzu-system-ingress
NAME                       READY   STATUS    RESTARTS   AGE
contour-857d46c845-4r6c5   1/1     Running   1          18d
contour-857d46c845-p6bbq   1/1     Running   1          18d
envoy-mxkjk                2/2     Running   2          18d
envoy-qlg8l                2/2     Running   2          18d

Ensure that all pods are Running with all containers ready.