Example of how to set up Relay with kube manifest files

[sentryadam0000345]

Core or SDK?

Core Sentry product

Which part? Which one?

Relay, https://docs.sentry.io/product/relay/

Description

Right now we do not have docs or samples on how to setup Sentry Relay with Kubernetes. Please find the below kube manifest samples. These should serve as a good starting point to help folks out.

Suggested Solution

Kube manifest code examples are below, feel free to use whatever is helpful:

secret.yml

apiVersion: v1
kind: Secret
metadata:
  name: sentry-relay
  namespace: sentry-relay
type: Opaque
stringData: 
  credentials.json: |
    {
      "secret_key": "****",
      "public_key": "****",
      "id": "****"
    }

config_map.yml:

apiVersion: v1
kind: ConfigMap
metadata:
  namespace: sentry-relay
  name: sentry-relay
  labels:
    app: sentry
data:
  config.yml: |-
    sentry:
      # internal error reporting https://docs.sentry.io/product/relay/options/#internal-error-reporting
      enabled: true
      dsn: ****
    relay:
      mode: managed
      upstream: ****
      host: 0.0.0.0
      port: 3000
      override_project_ids: true
    logging:
      level: debug
      format: json
    metrics:
      statsd: 127.0.0.1:8126
      prefix: sentry.relay

deployment.yml:

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: sentry-relay
  name: sentry-relay
  labels:
    app: sentry
spec:
  replicas: 2
  selector:
    matchLabels:
      app: sentry
      role: relay
  revisionHistoryLimit: 10
  template:
    metadata:
      labels:
        app: sentry
        role: relay
    spec:
      containers:
        - name: sentry-relay
          image: getsentry/relay:22.2.0
          imagePullPolicy: IfNotPresent
          args: ["run", "--config",  "/etc/sentry"]
          ports:
            - containerPort: 3000
          env:
            - name: RELAY_PORT
              value: "3000"
          volumeMounts:
            - name: credentials
              mountPath: /etc/sentry/credentials.json
              subPath: credentials.json
              readOnly: true
            - name: config
              mountPath: /etc/sentry/config.yml
              subPath: config.yml
              readOnly: true
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /api/relay/healthcheck/live/
              port: 3000
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 10
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /api/relay/healthcheck/ready/
              port: 3000
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 10
          resources:
            limits:
              # Note: max_thread_count will default to the number of logical cores
              cpu: 3
              memory: 4000Mi
            requests:
              cpu: 3
              memory: 2000Mi
      volumes:
        - name: config
          configMap:
            name: sentry-relay
        - name: credentials
          secret:
            secretName: sentry-relay

service.yml

apiVersion: v1
kind: Service
metadata:
  namespace: sentry-relay
  name: sentry-relay
  labels:
    app: sentry
spec:
  type: ClusterIP
  ports:
  - port: 3000
    targetPort: 3000
    protocol: TCP
    name: sentry-relay
  selector:
    app: sentry
    role: relay

ingress.yml ("nginx" annotations may not be relevant for everyone but if you are using an ingress-nginx as your ingress controller it should be useful)

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: sentry-relay
  name: sentry-relay
  labels:
    app: sentry
  annotations:
    ingress.kubernetes.io/service-upstream: "true"
    ingress.kubernetes.io/upstream-max-fails: "0"
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/use-regex: "true"
spec:
  rules:
    - host: "****"
      http:
        paths:
          - backend:
              service:
                name: sentry-relay
                port:
                  number: 3000
            path: /api/store
            pathType: ImplementationSpecific
          - backend:
              service:
                name: sentry-relay
                port:
                  number: 3000
            path: /api/[1-9][0-9]*/(.*)
            pathType: ImplementationSpecific
  tls:
  - hosts:
    - "****"
    secretName: ****

pdb.yml

apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  labels:
    app: sentry
  name: sentry-relay
  namespace: sentry-relay
spec:
  maxUnavailable: 50%
  selector:
    matchLabels:
      app: sentry
      role: relay

[imatwawana]

@sentryadam0000345 - is this a pretty common use case? How often does this come up?

[adam000034]

@imatwawana It may not be common but I think it is worth including these examples for folks who need. @jan-auer also mentioned it would be helpful too, not sure if he wants to add more color here

[imatwawana]

@imatwawana It may not be common but I think it is worth including these examples for folks who need. @jan-auer also mentioned it would be helpful too, not sure if he wants to add more color here

My concern is that if there are a number of these use cases that we're not documenting (and have no intention of documenting), then documenting one or two of them conceivably makes the docs look less complete rather than more complete. @jan-auer can you speak to why this should be there vs other use cases or if we should be looking at adding more use cases? Happy to talk offline if that makes more sense as well.

[github-actions[bot]]

This issue has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you label it Status: Backlog or Status: In Progress, I will leave it alone ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[github-actions[bot]]

This issue has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you label it Status: Backlog or Status: In Progress, I will leave it alone ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[imatwawana]

I realize you're being pulled in a lot of different directions at the moment @jan-auer, so I'm going to add the Backlog label for now so I don't need to keep triaging this.

[jernejstrasner]

Closing this due to inactivity. Please reopen if necessary!

[realkosty]

An enterprise customer just requested this.