Skip to content

Commit

Permalink
APIGOV-26852 - add tls config to kong client (#56)
Browse files Browse the repository at this point in the history 
* add ssl config settings

* docs

* fix test

* validte tls config

* helm chart updates

* handle npe

* remove test that is not needed
  • Loading branch information
@jcollins-axway
jcollins-axway authored Dec 15, 2023
1 parent 37dc140 commit 6c03b45
Show file tree
Hide file tree
Showing 10 changed files with 120 additions and 64 deletions.
51 changes: 28 additions & 23 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -67,29 +67,34 @@ On startup the Kong traceability agent first validates that it is able to connec

All Kong specific environment variables available are listed below

| Name | Description |
| -------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| Discovery Agent Variables | |
| **KONG_ACL_DISABLE** | Set to true to disable the check for a globally enabled ACL plugin on Kong. False by default. |
| **KONG_ADMIN_URL** | The Kong admin API URL that the agent will query against |
| **KONG_ADMIN_AUTH_APIKEY_HEADER** | The API Key header name the agent will use when authenticating |
| **KONG_ADMIN_AUTH_APIKEY_VALUE** | The API Key value the agent will use when authenticating |
| **KONG_ADMIN_AUTH_BASICAUTH_USERNAME** | The HTTP Basic username that the agent will use when authenticating |
| **KONG_ADMIN_AUTH_BASICAUTH_PASSWORD** | The HTTP Basic password that the agent will use when authenticating |
| **KONG_PROXY_HOST** | The proxy host that the agent will use in API Services when the Kong route does not specify hosts |
| **KONG_PROXY_PORTS_HTTP_VALUE** | The HTTP port value that the agent will set for discovered APIS |
| **KONG_PROXY_PORTS_HTTPS_VALUE** | The HTTPs port value that the agent will set for discovered APIS |
| **KONG_PROXY_PORTS_HTTP_DISABLE** | Set to true if the agent should ignore routes that serve over HTTP |
| **KONG_PROXY_PORTS_HTTPS_DISABLE** | Set to true if the agent should ignore routes that serve over HTTPs |
| **KONG_PROXY_BASEPATH** | The proxy base path that will be added between the proxy host and Kong route path when building endpoints |
| **KONG_SPEC_FILTER** | The Agent SDK specific filter format for filtering out specific Kong services |
| **KONG_SPEC_LOCALPATH** | The local path that the agent will look in for API definitions |
| **KONG_SPEC_URLPATHS** | The URL paths that the agent will query on the gateway service for API definitions |
| **KONG_SPEC_DEVPORTALENABLED** | Set to true if the agent should look for spec files in the Kong Dev Portal (default: `false`) |
| | |
| Traceability Agent Variables | |
| **KONG_LOGS_HTTP_PATH** | The path endpoint that the Traceability agent will listen on (default: `/requestlogs`) |
| **KONG_LOGS_HTTP_PORT** | The port that the Traceability agent HTTP server will listen on (default: `9000`) |
| Name | Description |
| -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Discovery Agent Variables | |
| **KONG_ACL_DISABLE** | Set to true to disable the check for a globally enabled ACL plugin on Kong. False by default. |
| **KONG_ADMIN_URL** | The Kong admin API URL that the agent will query against |
| **KONG_ADMIN_AUTH_APIKEY_HEADER** | The API Key header name the agent will use when authenticating |
| **KONG_ADMIN_AUTH_APIKEY_VALUE** | The API Key value the agent will use when authenticating |
| **KONG_ADMIN_AUTH_BASICAUTH_USERNAME** | The HTTP Basic username that the agent will use when authenticating |
| **KONG_ADMIN_AUTH_BASICAUTH_PASSWORD** | The HTTP Basic password that the agent will use when authenticating |
| **KONG_ADMIN_SSL_NEXTPROTOS** | An array of strings. It is a list of supported application level protocols, in order of preference, based on the ALPN protocol list. Allowed values are: h2, http/1.0, http/1.1, h2c |
| **KONG_ADMIN_SSL_INSECURESKIPVERIFY** | Controls whether a client verifies the server’s certificate chain and host name. If true, TLS accepts any certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to man-in-the-middle attacks |
| **KONG_ADMIN_SSL_CIPHERSUITES** | An array of strings. It is a list of supported cipher suites for TLS versions up to TLS 1.2. If CipherSuites is nil, a default list of secure cipher suites is used, with a preference order based on hardware performance |
| **KONG_ADMIN_SSL_MAXVERSION** | String value for the maximum SSL/TLS version that is acceptable. If empty, then the maximum version supported by this package is used, which is currently TLS 1.3. Allowed values are: TLS1.0, TLS1.1, TLS1.2, TLS1.3 |
| **KONG_ADMIN_SSL_MINVERSION** | String value for the minimum SSL/TLS version that is acceptable. If empty TLS 1.2 is taken as the minimum. Allowed values are: TLS1.0, TLS1.1, TLS1.2, TLS1.3 |
| **KONG_PROXY_HOST** | The proxy host that the agent will use in API Services when the Kong route does not specify hosts |
| **KONG_PROXY_PORTS_HTTP_VALUE** | The HTTP port value that the agent will set for discovered APIS |
| **KONG_PROXY_PORTS_HTTPS_VALUE** | The HTTPs port value that the agent will set for discovered APIS |
| **KONG_PROXY_PORTS_HTTP_DISABLE** | Set to true if the agent should ignore routes that serve over HTTP |
| **KONG_PROXY_PORTS_HTTPS_DISABLE** | Set to true if the agent should ignore routes that serve over HTTPs |
| **KONG_PROXY_BASEPATH** | The proxy base path that will be added between the proxy host and Kong route path when building endpoints |
| **KONG_SPEC_FILTER** | The Agent SDK specific filter format for filtering out specific Kong services |
| **KONG_SPEC_LOCALPATH** | The local path that the agent will look in for API definitions |
| **KONG_SPEC_URLPATHS** | The URL paths that the agent will query on the gateway service for API definitions |
| **KONG_SPEC_DEVPORTALENABLED** | Set to true if the agent should look for spec files in the Kong Dev Portal (default: `false`) |
| | |
| Traceability Agent Variables | |
| **KONG_LOGS_HTTP_PATH** | The path endpoint that the Traceability agent will listen on (default: `/requestlogs`) |
| **KONG_LOGS_HTTP_PORT** | The port that the Traceability agent HTTP server will listen on (default: `9000`) |

## Setup

Expand Down
18 changes: 16 additions & 2 deletions helm/kong-agents/templates/_helpers.tpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -70,8 +70,22 @@ Create the name of the service account to use
{{- end }}

{{/*
Create the name of the service account to use
Create the env var value for spec download paths
*/}}
{{- define "kong-agents.specDownloadPathsString" -}}
{{- define "kong-agents.spec.urlPaths.string" -}}
{{- join "," .Values.kong.spec.urlPaths }}
{{- end -}}

{{/*
Create the env var value for ssl next protos
*/}}
{{- define "kong-agents.admin.ssl.nextProtos.string" -}}
{{- join "," .Values.kong.admin.ssl.nextProtos }}
{{- end -}}

{{/*
Create the env var value for ssl cipher suites
*/}}
{{- define "kong-agents.admin.ssl.cipherSuites.string" -}}
{{- join "," .Values.kong.admin.ssl.cipherSuites }}
{{- end -}}
19 changes: 17 additions & 2 deletions helm/kong-agents/templates/discovery-deployment.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -82,9 +82,19 @@ spec:
value: "{{ .Values.kong.proxy.ports.https.disable }}"
- name: KONG_ADMIN_URL
value: "{{ .Values.kong.admin.url }}"
{{- if (include "kong-agents.specDownloadPathsString" .) }}
- name: KONG_ADMIN_SSL_NEXTPROTOS
value: {{ include "kong-agents.admin.ssl.nextProtos.string" . }}
- name: KONG_ADMIN_SSL_CIPHERSUITES
value: {{ include "kong-agents.admin.ssl.cipherSuites.string" . }}
- name: KONG_ADMIN_SSL_INSECURESKIPVERIFY
value: "{{ .Values.kong.admin.ssl.insecureSkipVerify }}"
- name: KONG_ADMIN_SSL_MAXVERSION
value: "{{ .Values.kong.admin.ssl.maxVersion }}"
- name: KONG_ADMIN_SSL_MINVERSION
value: "{{ .Values.kong.admin.ssl.minVersion }}"
{{- if (include "kong-agents.spec.urlPaths.string" .) }}
- name: KONG_SPEC_URLPATHS
value: {{ include "kong-agents.specDownloadPathsString" . }}
value: {{ include "kong-agents.spec.urlPaths.string" . }}
{{- end }}
{{- if .Values.kong.spec.localPath }}
- name: KONG_SPEC_LOCALPATH
Expand Down Expand Up @@ -128,6 +138,11 @@ spec:
"KONG_ADMIN_AUTH_APIKEY_VALUE"
"KONG_ADMIN_AUTH_BASICAUTH_USERNAME"
"KONG_ADMIN_AUTH_BASICAUTH_PASSWORD"
"KONG_ADMIN_SSL_NEXTPROTOS"
"KONG_ADMIN_SSL_CIPHERSUITES"
"KONG_ADMIN_SSL_INSECURESKIPVERIFY"
"KONG_ADMIN_SSL_MAXVERSION"
"KONG_ADMIN_SSL_MINVERSION"
"KONG_PROXY_HOST"
"KONG_PROXY_BASEPATH"
"KONG_PROXY_PORTS_HTTP_VALUE"
Expand Down
5 changes: 5 additions & 0 deletions helm/kong-agents/templates/traceability-statefulset.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,11 @@ spec:
"KONG_ADMIN_AUTH_APIKEY_VALUE"
"KONG_ADMIN_AUTH_BASICAUTH_USERNAME"
"KONG_ADMIN_AUTH_BASICAUTH_PASSWORD"
"KONG_ADMIN_SSL_NEXTPROTOS"
"KONG_ADMIN_SSL_CIPHERSUITES"
"KONG_ADMIN_SSL_INSECURESKIPVERIFY"
"KONG_ADMIN_SSL_MAXVERSION"
"KONG_ADMIN_SSL_MINVERSION"
"KONG_PROXY_HOST"
"KONG_PROXY_BASEPATH"
"KONG_PROXY_PORTS_HTTP_VALUE"
Expand Down
6 changes: 6 additions & 0 deletions helm/kong-agents/values.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,12 @@ kong:
basicAuth:
username:
password:
ssl:
nextProtos: []
insecureSkipVerify:
cipherSuites: []
minVersion:
maxVersion:
proxy:
host:
basePath:
Expand Down
Loading

0 comments on commit 6c03b45

Please sign in to comment.