[THREESCALE-9193] upstream TLS v1.3 #1400
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,12 +1,13 @@ | ||
| MKFILE_PATH := $(abspath $(lastword $(MAKEFILE_LIST))) | ||
| PROJECT_PATH := $(patsubst %/,%,$(dir $(MKFILE_PATH))) | ||
| SHELL = /usr/bin/env bash -o pipefail | ||
| .SHELLFLAGS = -ec | ||
| .DEFAULT_GOAL := help | ||
|
|
||
| DOCKER ?= $(shell which docker 2> /dev/null || echo "docker") | ||
| REGISTRY ?= quay.io/3scale | ||
| export TEST_NGINX_BINARY ?= openresty | ||
| NGINX = $(shell which $(TEST_NGINX_BINARY)) | ||
|
|
||
| NPROC ?= $(firstword $(shell nproc 2>/dev/null) 1) | ||
|
|
||
|
|
@@ -22,6 +23,8 @@ DEVEL_DOCKER_COMPOSE_VOLMOUNT_MAC_FILE ?= docker-compose-devel-volmount-mac.yml | |
| DEVEL_DOCKER_COMPOSE_VOLMOUNT_DEFAULT_FILE ?= docker-compose-devel-volmount-default.yml | ||
|
|
||
| PROVE_DOCKER_COMPOSE_FILE ?= docker-compose.prove.yml | ||
| FORWARD_PROXY_DOCKER_COMPOSE_FILE ?= docker-compose.forward-proxy.yml | ||
| UPSTREAM_TLS_DOCKER_COMPOSE_FILE ?= docker-compose.upstream-tls.yml | ||
|
|
||
| DOCKER_VOLUME_NAME ?= apicast-local-volume | ||
|
|
||
|
|
@@ -143,7 +146,7 @@ prove: $(ROVER) dependencies nginx ## Test nginx | |
| prove-docker: export IMAGE_NAME ?= $(DEVEL_IMAGE) | ||
| prove-docker: ## Test nginx inside docker | ||
| make -C $(PROJECT_PATH) -f $(MKFILE_PATH) apicast-source | ||
| $(DOCKER) compose -f $(PROVE_DOCKER_COMPOSE_FILE) run --rm -T \ | ||
| -v $(DOCKER_VOLUME_NAME):/opt/app-root/src prove | \ | ||
| awk '/Result: NOTESTS/ { print "FAIL: NOTESTS"; print; exit 1 }; { print }' | ||
|
|
||
|
|
@@ -158,43 +161,51 @@ push: ## Push image to the registry | |
| bash: export IMAGE_NAME ?= $(RUNTIME_IMAGE) | ||
| bash: export SERVICE = gateway | ||
| bash: ## Run bash inside the runtime image | ||
| $(DOCKER) compose run --user=root --rm --entrypoint=bash $(SERVICE) | ||
|
|
||
| gateway-logs: export IMAGE_NAME = does-not-matter | ||
| gateway-logs: | ||
| $(DOCKER) compose logs gateway | ||
|
|
||
| opentelemetry-gateway: ## run gateway instrumented with opentelemetry | ||
| $(DOCKER) compose run opentelemetry-instrumented-gateway | ||
|
|
||
| opentracing-gateway: ## run gateway instrumented with opentracing | ||
| $(DOCKER) compose run opentracing-instrumented-gateway | ||
|
|
||
| # Environment described in ./examples/forward-proxy | ||
| forward-proxy-gateway: ## run gateway configured to run along with a forward proxy | ||
| $(DOCKER) compose -f $(FORWARD_PROXY_DOCKER_COMPOSE_FILE) run gateway | ||
|
|
||
| # Environment described in ./examples/tlsv1.3-upstream | ||
| upstream-tls-gateway: ## run gateway configured to access upstream powered with TLS | ||
| $(DOCKER) compose -f $(UPSTREAM_TLS_DOCKER_COMPOSE_FILE) run gateway | ||
|
|
||
| test-runtime-image: export IMAGE_NAME ?= $(RUNTIME_IMAGE) | ||
| test-runtime-image: clean-containers ## Smoke test the runtime image. Pass any docker image in IMAGE_NAME parameter. | ||
| $(DOCKER) compose --version | ||
| $(DOCKER) compose run --rm --user 100001 gateway apicast -l -d | ||
| @echo -e $(SEPARATOR) | ||
| $(DOCKER) compose run --rm --user 100002 -e APICAST_CONFIGURATION_LOADER=boot -e THREESCALE_PORTAL_ENDPOINT=https://echo-api.3scale.net gateway bin/apicast -d | ||
| @echo -e $(SEPARATOR) | ||
| $(DOCKER) compose run --rm test sh -c 'sleep 5 && curl --fail http://gateway:8090/status/live' | ||
| @echo -e $(SEPARATOR) | ||
| $(DOCKER) compose run --rm --user 100001 gateway bin/apicast --test | ||
| @echo -e $(SEPARATOR) | ||
| $(DOCKER) compose run --rm --user 100001 gateway bin/apicast --test --dev | ||
| @echo -e $(SEPARATOR) | ||
| $(DOCKER) compose run --rm --user 100001 gateway bin/apicast --daemon | ||
| @echo -e $(SEPARATOR) | ||
| $(DOCKER) compose run --rm test bash -c 'for i in {1..5}; do curl --fail http://gateway:8090/status/live && break || sleep 1; done' | ||
| $(DOCKER) compose logs gateway | ||
| @echo -e $(SEPARATOR) | ||
| $(DOCKER) compose run --rm test curl --fail -X PUT http://gateway:8090/config --data '{"services":[{"id":42}]}' | ||
| @echo -e $(SEPARATOR) | ||
| $(DOCKER) compose run --rm test curl --fail http://gateway:8090/status/ready | ||
| @echo -e $(SEPARATOR) | ||
| $(DOCKER) compose run --rm test curl --fail -X POST http://gateway:8090/boot | ||
| @echo -e $(SEPARATOR) | ||
| $(DOCKER) compose run --rm gateway bin/apicast -c http://echo-api.3scale.net -d -b | ||
|
|
||
| $(PROJECT_PATH)/lua_modules $(PROJECT_PATH)/local $(PROJECT_PATH)/.cpanm $(PROJECT_PATH)/vendor/cache $(PROJECT_PATH)/.cache : | ||
| mkdir -p $@ | ||
|
|
@@ -207,9 +218,9 @@ development: GROUP := $(shell id -g $(USER)) | |
| endif | ||
| development: ## Run bash inside the development image | ||
| @echo "Running on $(os)" | ||
| - $(DOCKER) compose -f $(DEVEL_DOCKER_COMPOSE_FILE) -f $(DEVEL_DOCKER_COMPOSE_VOLMOUNT_FILE) up -d | ||
| @ # https://github.com/moby/moby/issues/33794#issuecomment-312873988 for fixing the terminal width | ||
| $(DOCKER) compose -f $(DEVEL_DOCKER_COMPOSE_FILE) -f $(DEVEL_DOCKER_COMPOSE_VOLMOUNT_FILE) exec -e COLUMNS="`tput cols`" -e LINES="`tput lines`" --user $(USER):$(GROUP) development bash | ||
|
|
||
| stop-development: clean-containers ## Stop development environment | ||
|
|
||
|
|
@@ -233,9 +244,11 @@ lua_modules/bin/rover: | |
| dependencies: dep_folders lua_modules carton ## Install project dependencies | ||
|
|
||
| clean-containers: | ||
| $(DOCKER) compose down --volumes --remove-orphans | ||
|
Contributor
There was a problem hiding this comment. I think this removes any potential compatibility with
Member
Author
There was a problem hiding this comment. In this repo, we use This is about moving forward to docker compose V2. Docker compose V1 is deprecated https://www.docker.com/blog/new-docker-compose-v2-and-v1-deprecation/ |
||
| $(DOCKER) compose -f $(PROVE_DOCKER_COMPOSE_FILE) down --volumes --remove-orphans | ||
| $(DOCKER) compose -f $(DEVEL_DOCKER_COMPOSE_FILE) -f $(DEVEL_DOCKER_COMPOSE_VOLMOUNT_FILE) down --volumes --remove-orphans | ||
| $(DOCKER) compose -f $(FORWARD_PROXY_DOCKER_COMPOSE_FILE) down --volumes --remove-orphans | ||
| $(DOCKER) compose -f $(UPSTREAM_TLS_DOCKER_COMPOSE_FILE) down --volumes --remove-orphans | ||
|
|
||
| clean-deps: ## Remove all local dependency folders | ||
| - rm -rf $(PROJECT_PATH)/lua_modules $(PROJECT_PATH)/local $(PROJECT_PATH)/.cpanm $(PROJECT_PATH)/vendor/cache $(PROJECT_PATH)/.cache : | ||
|
|
@@ -270,12 +283,12 @@ benchmark: export COMPOSE_PROJECT_NAME = apicast-benchmark | |
| benchmark: export WRK_REPORT ?= $(IMAGE_TAG).csv | ||
| benchmark: export DURATION ?= 300 | ||
| benchmark: | ||
| - $(DOCKER) compose up --force-recreate -d apicast | ||
| $(DOCKER) compose run curl | ||
| ## warmup round for $(DURATION)/10 seconds | ||
| DURATION=$$(( $(DURATION) / 10 )) $(DOCKER) compose run wrk | ||
| ## run the real benchmark for $(DURATION) seconds | ||
| $(DOCKER) compose run wrk | ||
|
|
||
| # Check http://marmelab.com/blog/2016/02/29/auto-documented-makefile.html | ||
| help: ## Print this help | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| --- | ||
| version: '3.8' | ||
| services: | ||
| gateway: | ||
| image: ${IMAGE_NAME:-apicast-test} | ||
| depends_on: | ||
| - proxy | ||
| - upstream | ||
| environment: | ||
| THREESCALE_CONFIG_FILE: /tmp/config.json | ||
| THREESCALE_DEPLOYMENT_ENV: staging | ||
| APICAST_CONFIGURATION_LOADER: lazy | ||
| APICAST_WORKERS: 1 | ||
| APICAST_LOG_LEVEL: debug | ||
| APICAST_CONFIGURATION_CACHE: "0" | ||
| expose: | ||
| - "8080" | ||
| - "8090" | ||
| ports: | ||
| - "8080:8080" | ||
| - "8090:8090" | ||
| volumes: | ||
| - ./examples/forward-proxy/apicast-config.json:/tmp/config.json | ||
| upstream: | ||
| image: nginx:1.23.4 | ||
| expose: | ||
| - "443" | ||
| volumes: | ||
| - ./examples/forward-proxy/proxy-nginx.conf:/etc/nginx/nginx.conf | ||
| - ./examples/forward-proxy/upstream-cert/upstream.key:/etc/pki/tls.key | ||
| - ./examples/forward-proxy/upstream-cert/upstream.crt:/etc/pki/tls.crt | ||
| proxy: | ||
| build: | ||
| dockerfile: ./examples/forward-proxy/tinyproxy.Dockerfile | ||
| expose: | ||
| - "3128:3128" | ||
| - "443:443" | ||
| volumes: | ||
| - ./examples/forward-proxy/tinyproxy.conf:/etc/tinyproxy/tinyproxy.conf |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| --- | ||
| version: '3.8' | ||
| services: | ||
| gateway: | ||
| image: ${IMAGE_NAME:-apicast-test} | ||
| depends_on: | ||
| - one.upstream | ||
| environment: | ||
| THREESCALE_CONFIG_FILE: /tmp/config.json | ||
| THREESCALE_DEPLOYMENT_ENV: staging | ||
| APICAST_CONFIGURATION_LOADER: lazy | ||
| APICAST_WORKERS: 1 | ||
| APICAST_LOG_LEVEL: debug | ||
| APICAST_CONFIGURATION_CACHE: "0" | ||
| expose: | ||
| - "8080" | ||
| - "8090" | ||
| ports: | ||
| - "8080:8080" | ||
| - "8090:8090" | ||
| volumes: | ||
| - ./examples/tlsv1.3-upstream/apicast-config.json:/tmp/config.json | ||
| one.upstream: | ||
| image: nginx:1.23.4 | ||
| expose: | ||
| - "443" | ||
| volumes: | ||
| - ./examples/tlsv1.3-upstream/proxy-nginx.conf:/etc/nginx/nginx.conf | ||
| - ./examples/tlsv1.3-upstream/upstream-cert/one.upstream.key:/etc/pki/tls.key | ||
| - ./examples/tlsv1.3-upstream/upstream-cert/one.upstream.crt:/etc/pki/tls.crt |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,5 @@ | ||
| --- | ||
| version: '3.8' | ||
| services: | ||
| gateway: | ||
| image: ${IMAGE_NAME:-apicast-test} | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| # PROXY with upstream using TLSv1.3 | ||
|
|
||
| APIcast --> tiny proxy (connect to 443 but no cert installed) --> upstream (TLSv1.3) | ||
|
|
||
| APicast starts SSL tunnel (via HTTP Connect method) against proxy to access upstream configured with TLSv1.3 | ||
|
|
||
| ``` | ||
| curl -v -H "Host: one" http://${APICAST_IP}:8080/get?user_key=foo | ||
| ``` |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| { | ||
| "services": [ | ||
| { | ||
| "backend_version": "1", | ||
| "proxy": { | ||
| "hosts": ["one"], | ||
| "api_backend": "https://upstream:443/", | ||
| "backend": { | ||
| "endpoint": "http://127.0.0.1:8081", | ||
| "host": "backend" | ||
| }, | ||
| "policy_chain": [ | ||
| { | ||
| "name": "apicast.policy.apicast" | ||
| }, | ||
| { | ||
| "name": "apicast.policy.http_proxy", | ||
| "configuration": { | ||
| "https_proxy": "http://proxy:443/" | ||
| } | ||
| } | ||
| ], | ||
| "proxy_rules": [ | ||
| { | ||
| "http_method": "GET", | ||
| "pattern": "/", | ||
| "metric_system_name": "hits", | ||
| "delta": 1, | ||
| "parameters": [], | ||
| "querystring_parameters": {} | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ] | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| worker_processes auto; | ||
|
|
||
| error_log /var/log/nginx/error.log warn; | ||
| pid /var/run/nginx.pid; | ||
|
|
||
| events { worker_connections 1024; } | ||
|
|
||
| http { | ||
| server { | ||
| listen 443 ssl; | ||
|
|
||
| server_name upstream; | ||
|
|
||
| resolver 8.8.8.8; | ||
|
|
||
| access_log /dev/stdout; | ||
| error_log /dev/stdout info; | ||
|
|
||
| ssl_certificate /etc/pki/tls.crt; | ||
| ssl_certificate_key /etc/pki/tls.key; | ||
| ssl_protocols TLSv1.3; | ||
|
|
||
| location ~ ^/(.*)$ { | ||
| proxy_pass https://postman-echo.com/get/$1$is_args$args; | ||
| } | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| FROM alpine:3.17.3 | ||
|
|
||
| LABEL summary="Forward proxy based on tinyproxy for development purposes" \ | ||
| description="Forward proxy based on tinyproxy for development purposes" \ | ||
| io.k8s.description="Forward proxy based on tinyproxy for development purposes" \ | ||
| io.k8s.display-name="Forward Proxy (Tinyproxy)" \ | ||
| io.openshift.tags="tinyproxy, proxy" \ | ||
| maintainer="3scale-engineering@redhat.com" | ||
|
|
||
| RUN apk --no-cache add tinyproxy=1.11.1-r2 | ||
| ENTRYPOINT ["/usr/bin/tinyproxy"] | ||
| CMD ["-d"] |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why make it multi-doc?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This header does not make it multi-doc, it is just a document start marker that does not do any harm and pleases my IDE because I have a lint tool that requires document start markers. https://yamllint.readthedocs.io/en/stable/rules.html#module-yamllint.rules.document_start