Merge pull request #271 from StrongMonkey/uninstall

improve uninstall experience, cli tweaks

README.md

@@ -228,15 +228,18 @@ default/external-fqdn   3 seconds ago   my.app.com
 `rio domain` allows you to create your own domain pointing to a specific service or route
 
 ```bash
-# Create a domain that points to route1
+# Create a domain that points to route1. You have to setup a cname record from your domain to clusrer domain.
+# For example, foo.bar -> CNAME -> iazlia.on-rio.io
 $ rio domain add foo.bar default/route1
 default/foo-bar
 
-$ rio domain
-DOMAIN    TARGET
-foo.bar   default/route1
+# Use your own certs by providing a secret that contain tls cert and key instead of provisioning by letsencrypts. The secret has to be created first in system namespace.
+$ rio domain add --secret $name foo.bar default/route1
 ```
 
+Note: By default Rio will automatically configure Letsencrypt HTTP-01 challenge to provision certs for your publicdomain. This need you to install rio on standard ports.
+Try `rio install --httpport 80 --httpsport 443`.
+
 ## Autoscaling
 
 By default, Rio enables autoscaling for workloads. Depends on QPS and current active requests on your workload,
@@ -354,6 +357,15 @@ $ rio run -p 8080/http --build-secret webhook -n build-webhook https://github.co
 default/build-webhook
 ```
 
+To view logs from your builds
+```bash
+$ rio builds
+NAME                                                                     SERVICE                   REVISION                                   CREATED        SUCCEED   REASON
+default/fervent-swartz6-ee709-786b366d5d44de6b547939f51d467437e45c5ee1   default/fervent-swartz6   786b366d5d44de6b547939f51d467437e45c5ee1   23 hours ago   True    
+
+$ rio logs -f default/fervent-swartz6-ee709-786b366d5d44de6b547939f51d467437e45c5ee1
+```
+
 ## Monitoring
 
 By default, Rio will deploy [Grafana](https://grafana.com/) and [Kiali](https://www.kiali.io/) to give users the ability to watch all metrics of the service mesh.

cli/cmd/publicdomain/add.go

@@ -6,9 +6,11 @@ import (
 	"github.com/rancher/rio/cli/pkg/stack"
 	adminv1 "github.com/rancher/rio/pkg/apis/admin.rio.cattle.io/v1"
 	name2 "github.com/rancher/rio/pkg/name"
+	v1 "k8s.io/api/core/v1"
 )
 
 type Add struct {
+	Secret string `desc:"use specified secret that contains TLS certs and key instead of build-in letsencrypt. The secret has to be created first in your system namespace(default: rio-system)"`
 }
 
 func (a *Add) Run(ctx *clicontext.CLIContext) error {
@@ -19,11 +21,19 @@ func (a *Add) Run(ctx *clicontext.CLIContext) error {
 	target := ctx.CLI.Args().Get(1)
 
 	namespace, name := stack.NamespaceAndName(ctx, target)
-
-	return ctx.Create(adminv1.NewPublicDomain(namespace, name2.PublicDomain(domainName), adminv1.PublicDomain{
+	pd := adminv1.PublicDomain{
 		Spec: adminv1.PublicDomainSpec{
 			DomainName:        domainName,
 			TargetServiceName: name,
 		},
-	}))
+	}
+	if a.Secret != "" {
+		pd.Spec.SecretRef = v1.SecretReference{
+			Namespace: ctx.SystemNamespace,
+			Name:      a.Secret,
+		}
+		pd.Spec.DisableLetsencrypt = true
+	}
+
+	return ctx.Create(adminv1.NewPublicDomain(namespace, name2.PublicDomain(domainName), pd))
 }

cli/cmd/publicdomain/publicdomain.go

@@ -13,11 +13,11 @@ func PublicDomain(app *cli.App) cli.Command {
 		"")
 	add := builder.Command(&Add{},
 		"Add public domains",
-		app.Name+" domain add $Name",
+		app.Name+" domain add $NAME $NAMESPACE/$SERVICE",
 		"")
 	rm := builder.Command(&Rm{},
 		"Remove public domains",
-		app.Name+" domain rm NAME",
+		app.Name+" domain rm $NAME",
 		"")
 	return cli.Command{
 		Name:      "domains",

cli/cmd/uninstall/uninstall.go

@@ -5,12 +5,15 @@ import (
 	"strings"
 	"time"
 
+	"github.com/rancher/rio/cli/cmd/install"
+
 	"k8s.io/apimachinery/pkg/api/errors"
 
 	certmanagerv1alpha1 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha1"
 	buildv1alpha1 "github.com/knative/build/pkg/apis/build/v1alpha1"
 	gitwatcherv1 "github.com/rancher/gitwatcher/pkg/apis/gitwatcher.cattle.io/v1"
 	"github.com/rancher/rio/cli/pkg/clicontext"
+	"github.com/rancher/rio/cli/pkg/up/questions"
 	adminv1 "github.com/rancher/rio/pkg/apis/admin.rio.cattle.io/v1"
 	autoscalev1 "github.com/rancher/rio/pkg/apis/autoscale.rio.cattle.io/v1"
 	riov1 "github.com/rancher/rio/pkg/apis/rio.cattle.io/v1"
@@ -46,7 +49,13 @@ func (u Uninstall) Run(ctx *clicontext.CLIContext) error {
 		break
 	}
 
-	// admin.rio.cattle.io
+	fmt.Println("Deleting system component services")
+	for _, systemSvc := range install.SystemComponents {
+		if err := ctx.K8s.AppsV1().Deployments(u.Namespace).Delete(systemSvc, &metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+	}
+
 	fmt.Println("Cleaning up finalizers for resource Feature, group admin.rio.cattle.io...")
 	features, err := ctx.Project.Features("").List(metav1.ListOptions{})
 	if err != nil && !errors.IsNotFound(err) {
@@ -119,9 +128,21 @@ func (u Uninstall) Run(ctx *clicontext.CLIContext) error {
 		}
 	}
 
+	fmt.Println("Cleaning up finalizers for resource ServiceRecommendation, group autoscale.rio.cattle.io...")
+	ssrs, err := ctx.Autoscale.ServiceScaleRecommendations("").List(metav1.ListOptions{})
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	for _, ssr := range ssrs.Items {
+		ssr.Finalizers = nil
+		if _, err := ctx.Autoscale.ServiceScaleRecommendations(ssr.Namespace).Update(&ssr); err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+	}
+
 	fmt.Println("Cleaning up finalizers for resource Build, group build.knative.dev...")
 	builds, err := ctx.Build.Builds("").List(metav1.ListOptions{})
-	if err != nil {
+	if err != nil && !errors.IsNotFound(err) {
 		return err
 	}
 	for _, build := range builds.Items {
@@ -157,76 +178,104 @@ func (u Uninstall) Run(ctx *clicontext.CLIContext) error {
 		}
 	}
 
-	configv1resources, err := ctx.K8s.Discovery().ServerResourcesForGroupVersion("config.istio.io/v1alpha2")
-	if err != nil && !errors.IsNotFound(err) {
+	if ok, err := confirmDelete("config.istio.io/v1alpha2"); err != nil {
 		return err
-	}
-	if configv1resources != nil {
-		for _, resource := range configv1resources.APIResources {
-			toDelete = append(toDelete, fmt.Sprintf("%s.%s", resource.Name, "config.istio.io"))
+	} else if ok {
+		configv1resources, err := ctx.K8s.Discovery().ServerResourcesForGroupVersion("config.istio.io/v1alpha2")
+		if err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+		if configv1resources != nil {
+			for _, resource := range configv1resources.APIResources {
+				toDelete = append(toDelete, fmt.Sprintf("%s.%s", resource.Name, "config.istio.io"))
+			}
 		}
 	}
 
-	knativebuildresource, err := ctx.K8s.Discovery().ServerResourcesForGroupVersion(buildv1alpha1.SchemeGroupVersion.String())
-	if err != nil && !errors.IsNotFound(err) {
+	if ok, err := confirmDelete(buildv1alpha1.SchemeGroupVersion.String()); err != nil {
 		return err
-	}
-	if knativebuildresource != nil {
-		for _, resource := range knativebuildresource.APIResources {
-			if strings.Contains(resource.Name, "/") {
-				continue
+	} else if ok {
+		knativebuildresource, err := ctx.K8s.Discovery().ServerResourcesForGroupVersion(buildv1alpha1.SchemeGroupVersion.String())
+		if err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+		if knativebuildresource != nil {
+			for _, resource := range knativebuildresource.APIResources {
+				if strings.Contains(resource.Name, "/") {
+					continue
+				}
+				toDelete = append(toDelete, fmt.Sprintf("%s.%s", resource.Name, buildv1alpha1.SchemeGroupVersion.Group))
 			}
-			toDelete = append(toDelete, fmt.Sprintf("%s.%s", resource.Name, buildv1alpha1.SchemeGroupVersion.Group))
 		}
 	}
 
-	knativeinternalresources, err := ctx.K8s.Discovery().ServerResourcesForGroupVersion("caching.internal.knative.dev/v1alpha1")
-	if err != nil && !errors.IsNotFound(err) {
+	if ok, err := confirmDelete("caching.internal.knative.dev/v1alpha1"); err != nil {
 		return err
-	}
-	if knativeinternalresources != nil {
-		for _, resource := range knativeinternalresources.APIResources {
-			toDelete = append(toDelete, fmt.Sprintf("%s.%s", resource.Name, "caching.internal.knative.dev"))
+	} else if ok {
+		knativeinternalresources, err := ctx.K8s.Discovery().ServerResourcesForGroupVersion("caching.internal.knative.dev/v1alpha1")
+		if err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+		if knativeinternalresources != nil {
+			for _, resource := range knativeinternalresources.APIResources {
+				toDelete = append(toDelete, fmt.Sprintf("%s.%s", resource.Name, "caching.internal.knative.dev"))
+			}
 		}
 	}
 
-	certmanagerresource, err := ctx.K8s.Discovery().ServerResourcesForGroupVersion(certmanagerv1alpha1.SchemeGroupVersion.String())
-	if err != nil && !errors.IsNotFound(err) {
+	if ok, err := confirmDelete(certmanagerv1alpha1.SchemeGroupVersion.String()); err != nil {
 		return err
-	}
-	if certmanagerresource != nil {
-		for _, resource := range certmanagerresource.APIResources {
-			toDelete = append(toDelete, fmt.Sprintf("%s.%s", resource.Name, certmanagerv1alpha1.SchemeGroupVersion.Group))
+	} else if ok {
+		certmanagerresource, err := ctx.K8s.Discovery().ServerResourcesForGroupVersion(certmanagerv1alpha1.SchemeGroupVersion.String())
+		if err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+		if certmanagerresource != nil {
+			for _, resource := range certmanagerresource.APIResources {
+				toDelete = append(toDelete, fmt.Sprintf("%s.%s", resource.Name, certmanagerv1alpha1.SchemeGroupVersion.Group))
+			}
 		}
 	}
 
-	rbacistioresource, err := ctx.K8s.Discovery().ServerResourcesForGroupVersion("rbac.istio.io/v1alpha1")
-	if err != nil && !errors.IsNotFound(err) {
+	if ok, err := confirmDelete("rbac.istio.io/v1alpha1"); err != nil {
 		return err
-	}
-	if rbacistioresource != nil {
-		for _, resource := range rbacistioresource.APIResources {
-			toDelete = append(toDelete, fmt.Sprintf("%s.%s", resource.Name, "rbac.istio.io"))
+	} else if ok {
+		rbacistioresource, err := ctx.K8s.Discovery().ServerResourcesForGroupVersion("rbac.istio.io/v1alpha1")
+		if err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+		if rbacistioresource != nil {
+			for _, resource := range rbacistioresource.APIResources {
+				toDelete = append(toDelete, fmt.Sprintf("%s.%s", resource.Name, "rbac.istio.io"))
+			}
 		}
 	}
 
-	authistioresource, err := ctx.K8s.Discovery().ServerResourcesForGroupVersion("authentication.istio.io/v1alpha1")
-	if err != nil && !errors.IsNotFound(err) {
+	if ok, err := confirmDelete("authentication.istio.io/v1alpha1"); err != nil {
 		return err
-	}
-	if authistioresource != nil {
-		for _, resource := range authistioresource.APIResources {
-			toDelete = append(toDelete, fmt.Sprintf("%s.%s", resource.Name, "authentication.istio.io"))
+	} else if ok {
+		authistioresource, err := ctx.K8s.Discovery().ServerResourcesForGroupVersion("authentication.istio.io/v1alpha1")
+		if err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+		if authistioresource != nil {
+			for _, resource := range authistioresource.APIResources {
+				toDelete = append(toDelete, fmt.Sprintf("%s.%s", resource.Name, "authentication.istio.io"))
+			}
 		}
 	}
 
-	networkingistioresource, err := ctx.K8s.Discovery().ServerResourcesForGroupVersion("networking.istio.io/v1alpha3")
-	if err != nil && !errors.IsNotFound(err) {
+	if ok, err := confirmDelete("networking.istio.io/v1alpha3"); err != nil {
 		return err
-	}
-	if networkingistioresource != nil {
-		for _, resource := range networkingistioresource.APIResources {
-			toDelete = append(toDelete, fmt.Sprintf("%s.%s", resource.Name, "networking.istio.io"))
+	} else if ok {
+		networkingistioresource, err := ctx.K8s.Discovery().ServerResourcesForGroupVersion("networking.istio.io/v1alpha3")
+		if err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+		if networkingistioresource != nil {
+			for _, resource := range networkingistioresource.APIResources {
+				toDelete = append(toDelete, fmt.Sprintf("%s.%s", resource.Name, "networking.istio.io"))
+			}
 		}
 	}
 
@@ -264,3 +313,23 @@ func (u Uninstall) Run(ctx *clicontext.CLIContext) error {
 	fmt.Println("Rio is uninstalled from your cluster")
 	return nil
 }
+
+func confirmDelete(resource string) (bool, error) {
+	msg := fmt.Sprintf("Do you want to delete CRD group %v? some CRDs might be shared with your existing system components(istio, knative, cert-manager)\n", resource)
+
+	options := []string{
+		"[1] Yes\n",
+		"[2] No\n",
+	}
+
+	num, err := questions.PromptOptions(msg, -1, options...)
+	if err != nil {
+		return false, err
+	}
+
+	if num == 0 {
+		fmt.Printf("Adding CRD %v to delete list\n", resource)
+		return true, nil
+	}
+	return false, err
+}

cli/main.go

@@ -180,7 +180,7 @@ func main() {
 			""),
 		builder.Command(&logs.Logs{},
 			"Print logs from containers",
-			appName+" logs [OPTIONS] [CONTAINER_OR_SERVICE...]",
+			appName+" logs [OPTIONS] [CONTAINER_OR_SERVICE_OR_BUILD...]",
 			""),
 
 		builder.Command(&install.Install{},

cli/pkg/clicontext/config.go

@@ -9,6 +9,7 @@ import (
 	"github.com/pkg/errors"
 	"github.com/rancher/rio/pkg/constants"
 	projectv1 "github.com/rancher/rio/pkg/generated/clientset/versioned/typed/admin.rio.cattle.io/v1"
+	autoscalev1 "github.com/rancher/rio/pkg/generated/clientset/versioned/typed/autoscale.rio.cattle.io/v1"
 	riov1 "github.com/rancher/rio/pkg/generated/clientset/versioned/typed/rio.cattle.io/v1"
 	"github.com/rancher/wrangler/pkg/apply"
 	"github.com/sirupsen/logrus"
@@ -36,10 +37,11 @@ type Config struct {
 	RestConfig *rest.Config
 	K8s        *kubernetes.Clientset
 
-	Core    corev1.CoreV1Interface
-	Build   buildv1alpha1.BuildV1alpha1Interface
-	Rio     riov1.RioV1Interface
-	Project projectv1.AdminV1Interface
+	Core      corev1.CoreV1Interface
+	Build     buildv1alpha1.BuildV1alpha1Interface
+	Rio       riov1.RioV1Interface
+	Project   projectv1.AdminV1Interface
+	Autoscale autoscalev1.AutoscaleV1Interface
 }
 
 func (c *Config) findKubeConfig() {
@@ -113,6 +115,11 @@ func (c *Config) Validate() error {
 		return err
 	}
 
+	autoscale, err := autoscalev1.NewForConfig(restConfig)
+	if err != nil {
+		return err
+	}
+
 	k8s := kubernetes.NewForConfigOrDie(restConfig)
 
 	c.Apply = apply.New(k8s.Discovery(), apply.NewClientFactory(restConfig))
@@ -122,6 +129,7 @@ func (c *Config) Validate() error {
 	c.Project = project
 	c.Core = core
 	c.Build = build
+	c.Autoscale = autoscale
 
 	if info, err := project.RioInfos().Get("rio", metav1.GetOptions{}); err != nil {
 		return ErrNoConfig

cli/pkg/clicontext/types.go

@@ -38,7 +38,7 @@ func init() {
 	lookup.RegisterType(types.PodType, lookup.FourPartsNameType, lookup.ThreePartsNameType)
 	lookup.RegisterType(types.NamespaceType, lookup.SingleNameNameType)
 	lookup.RegisterType(types.FeatureType, lookup.SingleNameNameType)
-	lookup.RegisterType(types.PublicDomainType, lookup.FullDomainNameTypeNameType)
+	lookup.RegisterType(types.PublicDomainType, lookup.StackScopedNameType, lookup.FullDomainNameTypeNameType)
 	lookup.RegisterType(types.BuildType, lookup.StackScopedNameType)
 }
 

cli/pkg/tables/publicdomain.go

@@ -6,6 +6,7 @@ import (
 
 func NewPublicDomain(cfg Config) TableWriter {
 	writer := table.NewWriter([][]string{
+		{"NAME", "{{stackScopedName .Obj.Namespace .Obj.Name ``}}"},
 		{"DOMAIN", "Obj.Spec.DomainName"},
 		{"TARGET", "{{stackScopedName .Obj.Namespace .Obj.Spec.TargetServiceName ``}}"},
 	}, cfg)

modules/istio/controllers/istio/populate/gateway.go

@@ -66,7 +66,7 @@ func Gateway(systemNamespace string, clusterDomain string, publicdomains []*v1.P
 			Port: v1alpha3.Port{
 				Protocol: v1alpha3.ProtocolHTTPS,
 				Number:   int(httpsPort),
-				Name:     fmt.Sprintf("%v-%v", strings.ToLower(string(v1alpha3.ProtocolHTTPS)), httpsPort),
+				Name:     fmt.Sprintf("%v-%v-%v", pd.Name, strings.ToLower(string(v1alpha3.ProtocolHTTPS)), httpsPort),
 			},
 			Hosts: []string{pd.Spec.DomainName},
 			TLS: &v1alpha3.TLSOptions{

modules/istio/controllers/publicdomain/populate/populate.go

+package populate
+
+import (
+	"fmt"
+	"hash/adler32"
+
+	"github.com/knative/pkg/apis/istio/v1alpha3"
+	adminv1 "github.com/rancher/rio/pkg/apis/admin.rio.cattle.io/v1"
+	"github.com/rancher/rio/pkg/constructors"
+	"github.com/rancher/wrangler/pkg/objectset"
+)
+
+func DestionationRule(pd *adminv1.PublicDomain, systemNamespace string, os *objectset.ObjectSet) error {
+	name := fmt.Sprintf("cm-acme-http-solver-%d", adler32.Checksum([]byte(pd.Spec.DomainName)))
+	os.Add(constructors.NewDestinationRule(systemNamespace, name, v1alpha3.DestinationRule{
+		Spec: v1alpha3.DestinationRuleSpec{
+			Host: fmt.Sprintf("%s.%s.svc.cluster.local", name, systemNamespace),
+			Subsets: []v1alpha3.Subset{
+				{
+					Name: "latest",
+				},
+			},
+		},
+	}))
+	return nil
+}

modules/istio/controllers/publicdomain/publicdomain.go

+package publicdomain
+
+import (
+	"context"
+
+	"github.com/rancher/rio/modules/istio/controllers/publicdomain/populate"
+	adminv1 "github.com/rancher/rio/pkg/apis/admin.rio.cattle.io/v1"
+	"github.com/rancher/rio/pkg/stackobject"
+	"github.com/rancher/rio/types"
+	"github.com/rancher/wrangler/pkg/objectset"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func Register(ctx context.Context, rContext *types.Context) error {
+	c := stackobject.NewGeneratingController(ctx, rContext, "routing-publicdomain", rContext.Global.Admin().V1().PublicDomain())
+	c.Apply = c.Apply.WithCacheTypes(rContext.Networking.Networking().V1alpha3().DestinationRule())
+	p := populator{
+		systemNamespace: rContext.Namespace,
+	}
+	c.Populator = p.populate
+	return nil
+}
+
+type populator struct {
+	systemNamespace string
+}
+
+func (p populator) populate(obj runtime.Object, ns *corev1.Namespace, os *objectset.ObjectSet) error {
+	return populate.DestionationRule(obj.(*adminv1.PublicDomain), p.systemNamespace, os)
+}

modules/istio/controllers/service/controller.go

@@ -138,7 +138,7 @@ func updateAppDomain(app *riov1.App, clusterDomain *adminv1.ClusterDomain) {
 			endpoints[i] = fmt.Sprintf("%s:%s", endpoint, constants.DefaultHTTPOpenPort)
 		}
 
-		if protocol == "https" && constants.DefaultHTTPOpenPort != "443" {
+		if protocol == "https" && constants.DefaultHTTPSOpenPort != "443" {
 			endpoints[i] = fmt.Sprintf("%s:%s", endpoint, constants.DefaultHTTPSOpenPort)
 		}
 	}

modules/istio/controllers/service/populate/virtualservice.go

@@ -2,8 +2,10 @@ package populate
 
 import (
 	"fmt"
+	"hash/adler32"
 	"strconv"
 
+	"github.com/knative/pkg/apis/istio/common/v1alpha1"
 	"github.com/knative/pkg/apis/istio/v1alpha3"
 	"github.com/rancher/rio/modules/istio/pkg/domains"
 	projectv1 "github.com/rancher/rio/pkg/apis/admin.rio.cattle.io/v1"
@@ -33,6 +35,31 @@ func virtualServices(namespace string, clusterDomain *projectv1.ClusterDomain, s
 func httpRoutes(systemNamespace string, service *v1.Service, dests []Dest) ([]v1alpha3.HTTPRoute, bool) {
 	external := false
 	var result []v1alpha3.HTTPRoute
+
+	// add https challenge match
+	pb := v1.ContainerPort{
+		Port:       8089,
+		TargetPort: 8089,
+		Protocol:   v1.ProtocolHTTP,
+	}
+	for _, publicDomain := range service.Status.PublicDomains {
+		ds := []Dest{
+			{
+				Host:   fmt.Sprintf("cm-acme-http-solver-%d", adler32.Checksum([]byte(publicDomain))),
+				Subset: "latest",
+				Weight: 100,
+			},
+		}
+		_, route := newRoute(systemNamespace, domains.GetPublicGateway(systemNamespace), true, pb, ds, false, false, nil)
+		route.Match[0].URI = &v1alpha1.StringMatch{
+			Prefix: "/.well-known/acme-challenge/",
+		}
+		route.Match[0].Authority = &v1alpha1.StringMatch{
+			Prefix: publicDomain,
+		}
+		result = append(result, route)
+	}
+
 	autoscale := false
 	if service.Spec.MaxScale != nil && service.Spec.Concurrency != nil && service.Spec.MinScale != nil && *service.Spec.MaxScale != *service.Spec.MinScale {
 		autoscale = true
@@ -110,9 +137,13 @@ func newRoute(systemNamespace, externalGW string, published bool, portBinding v1
 				Weight: 100,
 			})
 		} else {
+			ns := systemNamespace
+			if svc != nil {
+				ns = svc.Namespace
+			}
 			route.Route = append(route.Route, v1alpha3.HTTPRouteDestination{
 				Destination: v1alpha3.Destination{
-					Host:   fmt.Sprintf("%s.%s.svc.cluster.local", dest.Host, svc.Namespace),
+					Host:   fmt.Sprintf("%s.%s.svc.cluster.local", dest.Host, ns),
 					Subset: dest.Subset,
 					Port: v1alpha3.PortSelector{
 						Number: uint32(portBinding.Port),

modules/istio/features/routing/feature.go

@@ -4,14 +4,14 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/rancher/rio/pkg/constants"
-
 	"github.com/rancher/rio/modules/istio/controllers/app"
 	"github.com/rancher/rio/modules/istio/controllers/externalservice"
 	"github.com/rancher/rio/modules/istio/controllers/istio"
+	"github.com/rancher/rio/modules/istio/controllers/publicdomain"
 	"github.com/rancher/rio/modules/istio/controllers/routeset"
 	"github.com/rancher/rio/modules/istio/controllers/service"
 	projectv1 "github.com/rancher/rio/pkg/apis/admin.rio.cattle.io/v1"
+	"github.com/rancher/rio/pkg/constants"
 	"github.com/rancher/rio/pkg/features"
 	"github.com/rancher/rio/pkg/systemstack"
 	"github.com/rancher/rio/types"
@@ -35,6 +35,7 @@ func Register(ctx context.Context, rContext *types.Context) error {
 			routeset.Register,
 			service.Register,
 			app.Register,
+			publicdomain.Register,
 		},
 		FixedAnswers: map[string]string{
 			"HTTP_PORT":         constants.DefaultHTTPOpenPort,

modules/service/controllers/publicdomain/populate/ingress.go

+package populate
+
+import (
+	adminv1 "github.com/rancher/rio/pkg/apis/admin.rio.cattle.io/v1"
+	"github.com/rancher/rio/pkg/constants"
+	"github.com/rancher/rio/pkg/constructors"
+	"github.com/rancher/wrangler/pkg/name"
+	"github.com/rancher/wrangler/pkg/objectset"
+	"k8s.io/api/extensions/v1beta1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+)
+
+func Ingress(systemNamespace string, publicdomain *adminv1.PublicDomain, os *objectset.ObjectSet) {
+	os.Add(constructors.NewIngress(systemNamespace, name.SafeConcatName(publicdomain.Name, name.Hex(publicdomain.Spec.DomainName, 5)), v1beta1.Ingress{
+		Spec: v1beta1.IngressSpec{
+			Backend: &v1beta1.IngressBackend{
+				ServiceName: constants.IstioGateway,
+				ServicePort: intstr.FromInt(80),
+			},
+		},
+	}))
+}

modules/service/controllers/publicdomain/publicdomain.go

@@ -3,21 +3,33 @@ package publicdomain
 import (
 	"context"
 
+	"github.com/rancher/rio/modules/service/controllers/publicdomain/populate"
 	adminv1 "github.com/rancher/rio/pkg/apis/admin.rio.cattle.io/v1"
 	riov1 "github.com/rancher/rio/pkg/apis/rio.cattle.io/v1"
 	adminv1controller "github.com/rancher/rio/pkg/generated/controllers/admin.rio.cattle.io/v1"
 	riov1controller "github.com/rancher/rio/pkg/generated/controllers/rio.cattle.io/v1"
+	"github.com/rancher/rio/pkg/stackobject"
 	"github.com/rancher/rio/types"
+	"github.com/rancher/wrangler/pkg/objectset"
 	"github.com/rancher/wrangler/pkg/relatedresource"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
 const (
-	servicePublicdomain = "service-publicdomain"
+	appPublicdomain    = "app-publicdomain"
+	routerPublicdomain = "router-publicdomain"
 )
 
 func Register(ctx context.Context, rContext *types.Context) error {
+	c := stackobject.NewGeneratingController(ctx, rContext, "stack-public-domain", rContext.Global.Admin().V1().PublicDomain())
+	c.Apply = c.Apply.WithCacheTypes(rContext.Extensions.Extensions().V1beta1().Ingress())
+	p := populator{
+		systemNamespace: rContext.Namespace,
+	}
+
+	c.Populator = p.populate
 	h := handler{
 		services: rContext.Rio.Rio().V1().Service(),
 		routers:  rContext.Rio.Rio().V1().Router(),
@@ -26,10 +38,10 @@ func Register(ctx context.Context, rContext *types.Context) error {
 	}
 
 	svcUpdator := riov1controller.UpdateAppOnChange(rContext.Rio.Rio().V1().App().Updater(), h.syncApp)
-	rContext.Rio.Rio().V1().App().OnChange(ctx, servicePublicdomain, svcUpdator)
+	rContext.Rio.Rio().V1().App().OnChange(ctx, appPublicdomain, svcUpdator)
 
 	routerUpdator := riov1controller.UpdateRouterOnChange(rContext.Rio.Rio().V1().Router().Updater(), h.syncRouter)
-	rContext.Rio.Rio().V1().Router().OnChange(ctx, servicePublicdomain, routerUpdator)
+	rContext.Rio.Rio().V1().Router().OnChange(ctx, routerPublicdomain, routerUpdator)
 
 	relatedresource.Watch(ctx, "publicdomain-app", h.resolve,
 		rContext.Rio.Rio().V1().App(),
@@ -42,6 +54,15 @@ func Register(ctx context.Context, rContext *types.Context) error {
 	return nil
 }
 
+type populator struct {
+	systemNamespace string
+}
+
+func (p populator) populate(obj runtime.Object, namespace *corev1.Namespace, os *objectset.ObjectSet) error {
+	populate.Ingress(p.systemNamespace, obj.(*adminv1.PublicDomain), os)
+	return nil
+}
+
 type handler struct {
 	services riov1controller.ServiceController
 	apps     riov1controller.AppController
@@ -75,7 +96,7 @@ func (h handler) syncApp(key string, obj *riov1.App) (*riov1.App, error) {
 
 	var publicdomains []string
 	for _, pd := range pds {
-		if pd.Spec.TargetServiceName == obj.Name {
+		if pd.Spec.TargetServiceName == obj.Name && pd.DeletionTimestamp == nil {
 			publicdomains = append(publicdomains, pd.Spec.DomainName)
 		}
 	}

modules/system/features/letsencrypt/feature.go

@@ -37,8 +37,8 @@ func Register(ctx context.Context, rContext *types.Context) error {
 				},
 			},
 			Answers: map[string]string{
-				constants.RioWildcardType:  constants.StagingType,
-				constants.PublicDomainType: constants.StagingType,
+				constants.RioWildcardType:  constants.ProductionType,
+				constants.PublicDomainType: constants.ProductionType,
 			},
 		},
 		FixedAnswers: map[string]string{