Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: add snappcloud to adopters #6056

Merged
merged 1 commit into from
Jan 8, 2024
Merged

chore: add snappcloud to adopters #6056

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 23 additions & 4 deletions site/content/resources/adopters.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,24 +17,27 @@ If you're using Contour and want to add your organization to this list, please

<a href="https://daocloud.io/" target="_blank"><img alt="daocloud.io" src="../../img/adopters/daocloud.png" height="50"></a>

<a href="https://snapp.ir/" target="_blank"><img alt="snapp.ir" src="../../img/adopters/snappcloud.png" height="50"></a>

## Success Stories

Below is a list of adopters of Contour in **production environments** that have
publicly shared the details of how they use it.

_Add yours here!_
**Migrating from Openshift Router to Contour in SnappCloud**
SnappCloud is the private cloud infrastructure provider for Snapp, the largest ride-hailing platform in the Middle East. In addition to ride-hailing, Snapp supports a range of services including online doctor consultations, food shopping, and more. Within our infrastructure, we utilize multiple OKD (OpenShift) clusters. We have successfully transitioned from the OpenShift Router Controller to Contour for our ingress needs. To maintain consistent behavior during this migration, we employed the route-to-contour-httpproxy project. This Kubernetes controller is designed for converting OpenShift HAProxy Route to Contour HTTPProxy, incorporating default values of OpenShift Router HAProxy and converting OpenShift-specific annotations to HTTPProxy configurations.

## Solutions built with Contour

Below is a list of solutions where Contour is being used as a component.

**[Knative](https://knative.dev)**
**[Knative](https://knative.dev)**
Knative can use Contour to serve all incoming traffic via the `net-contour` ingress Gateway. The [net-contour](https://github.com/knative-sandbox/net-contour) controller enables Contour to satisfy the networking needs of Knative Serving by bridging Knative's KIngress resources to Contour's HTTPProxy resources.

**[VMware](https://tanzu.vmware.com/tanzu)**
**[VMware](https://tanzu.vmware.com/tanzu)**
All four [VMware Tanzu](https://tanzu.vmware.com/content/blog/simplify-your-approach-to-application-modernization-with-4-simple-editions-for-the-tanzu-portfolio) editions make the best possible use of various open source projects, starting with putting Kubernetes at their core. We’ve included leading projects to provide our customers with flexibility and a range of necessary capabilities, including Harbor (for image registry), Antrea (for container networking), Contour (for ingress control), and Cluster API (for lifecycle management).

**[Flyte](https://flyte.org/)**
**[Flyte](https://flyte.org/)**
Flyte's [sandbox environment](https://docs.flyte.org/en/latest/deployment/sandbox.html#deployment-sandbox) is powered by Contour and this is the default Ingress Controller. Sandbox environment has made it possible for data scientists all over to try out Flyte quickly and without contour that would not have been easy.

**[Gojek](https://gojek.io/)**
Expand All @@ -51,6 +54,22 @@ DaoCloud is an innovation leader in the cloud-native field. With the competitive

DaoCloud build Next Generation Microservices Gateway based on Contour, and also contribute in Contour Community deeply.

**[SnappCloud](https://snapp.ir)**

SnappCloud has developed several solutions to provide a complete self-service and multi-tenant API-GW solution with Contour:

1. [Cerberus](https://github.com/snapp-incubator/Cerberus): Cerberos is a powerful authorization server designed to seamlessly integrate with Contour by implementing the auth_ext interface of Envoy. In the world of modern application deployment and microservices architecture, ensuring secure and controlled access to services is paramount. Cerberos fills this role by providing a dynamic and flexible access control solution tailored to the unique demands of Contour-based applications.

2. [Contour Global Rate Limit Operator](https://github.com/snapp-incubator/contour-global-ratelimit-operator): This project provides a Kubernetes operator that allows users to configure global ratelimits in their HTTPProxy and it configures a RLS service based on [envoyproxy/ratelimit](https://github.com/envoyproxy/ratelimit).

3. [Contour Admission Webhook](https://github.com/snapp-incubator/contour-admission-webhook): This webhook facilitates the validation and mutation of Contour's HTTPProxy resources, ensuring configurations adhere to defined policies and standards. For example, it blocks creation of HTTPProxies with conflicting FQDNs, to prevent a user to invalidate other HTTPProxies in other namespaces.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@projectcontour/maintainers we are also finding the need to build this.

Should we bring in an implementation of this into projecontour organization? Should we open an issue for that?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤔 we have some examples of using Gatekeeper for this -- see https://projectcontour.io/guides/gatekeeper/ and https://github.com/projectcontour/contour/tree/main/examples/gatekeeper. I think we would also prefer to make more use of CEL validation where possible, since they don't require deploying an additional component.

That said, if there is still a need for a custom admission webhook and is something that there is shared community interest in, we could definitely look at creating a repo for it in the projectcontour org.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TIL, that is great

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let me digest that but seems really useful!

Copy link
Contributor Author

@m-yosefpor m-yosefpor Jan 6, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Regarding CEL, AFAIK, CEL validation in CRDs are generally limited to the properties of the resource itself. So for HTTPProxy host FQDN conflicts, it's not possible to do so. It is possible to do it with other policy engines such as Gatekeeper and kyverno ( as it support apiCall ), however it still requires to get all HTTPProxies in all namespaces with every update on HTTPProxies. We implemented a custom webhook, so we can cache all FQDNs to avoid such heavy lookups for every operation.

Copy link

@ssttehrani ssttehrani Feb 19, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

JFYI:
We're pleased to inform you about the release of the new version of our custom admission webhook. This update focuses on improving stability, making it a dependable choice for production environments. The admission webhook maintains its commitment to enforcing security standards for Contour in multi-tenant clusters.

https://github.com/snapp-incubator/contour-admission-webhook/tree/v2.0.1


4. [Contour Console Plugin](https://github.com/snapp-incubator/contour-console-plugin): A plugin based on [Openshift Dynamic Plugins](https://www.redhat.com/blog/dynamic-plugins-now-available) designed to integrate with Openshift consoles, providing a user-friendly interface to manage and visualize Contour resources, and to have a form based creation of HTTPProxies, same as `Route` experience in openshift.

5. [Contour Auth Multi-Tenant](https://github.com/snapp-incubator/contour-auth-multi-tenant): This project is an Envoy-compatible authorization server that builds upon the foundation of [contour-authserver](https://github.com/projectcontour/contour-authserver), enabling multi-tenancy by allowing different tenants to manage their authentication services independently, and referencing their own secrets in the same namespace of HTTPProxy.

At SnappCloud, we are dedicated to enriching the open-source community by developing additional components and plugins, contributing to various projects, and weaving together open-source solutions to create integrated, full-fledged products that rival enterprise solutions. Our commitment is focused on building robust toolchains that enhance and extend the capabilities of the open-source ecosystem.

## Adding a logo to projectcontour.io

If you would like to add your logo to a future `Adopters of Contour` section
Expand Down
Binary file added site/themes/contour/static/img/adopters/snappcloud.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.