diff --git a/README.md b/README.md index 7db5dd6..6591dad 100644 --- a/README.md +++ b/README.md @@ -67,29 +67,34 @@ On startup the Kong traceability agent first validates that it is able to connec All Kong specific environment variables available are listed below -| Name | Description | -| -------------------------------------- | --------------------------------------------------------------------------------------------------------- | -| Discovery Agent Variables | | -| **KONG_ACL_DISABLE** | Set to true to disable the check for a globally enabled ACL plugin on Kong. False by default. | -| **KONG_ADMIN_URL** | The Kong admin API URL that the agent will query against | -| **KONG_ADMIN_AUTH_APIKEY_HEADER** | The API Key header name the agent will use when authenticating | -| **KONG_ADMIN_AUTH_APIKEY_VALUE** | The API Key value the agent will use when authenticating | -| **KONG_ADMIN_AUTH_BASICAUTH_USERNAME** | The HTTP Basic username that the agent will use when authenticating | -| **KONG_ADMIN_AUTH_BASICAUTH_PASSWORD** | The HTTP Basic password that the agent will use when authenticating | -| **KONG_PROXY_HOST** | The proxy host that the agent will use in API Services when the Kong route does not specify hosts | -| **KONG_PROXY_PORTS_HTTP_VALUE** | The HTTP port value that the agent will set for discovered APIS | -| **KONG_PROXY_PORTS_HTTPS_VALUE** | The HTTPs port value that the agent will set for discovered APIS | -| **KONG_PROXY_PORTS_HTTP_DISABLE** | Set to true if the agent should ignore routes that serve over HTTP | -| **KONG_PROXY_PORTS_HTTPS_DISABLE** | Set to true if the agent should ignore routes that serve over HTTPs | -| **KONG_PROXY_BASEPATH** | The proxy base path that will be added between the proxy host and Kong route path when building endpoints | -| **KONG_SPEC_FILTER** | The Agent SDK specific filter format for filtering out specific Kong services | -| **KONG_SPEC_LOCALPATH** | The local path that the agent will look in for API definitions | -| **KONG_SPEC_URLPATHS** | The URL paths that the agent will query on the gateway service for API definitions | -| **KONG_SPEC_DEVPORTALENABLED** | Set to true if the agent should look for spec files in the Kong Dev Portal (default: `false`) | -| | | -| Traceability Agent Variables | | -| **KONG_LOGS_HTTP_PATH** | The path endpoint that the Traceability agent will listen on (default: `/requestlogs`) | -| **KONG_LOGS_HTTP_PORT** | The port that the Traceability agent HTTP server will listen on (default: `9000`) | +| Name | Description | +| -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Discovery Agent Variables | | +| **KONG_ACL_DISABLE** | Set to true to disable the check for a globally enabled ACL plugin on Kong. False by default. | +| **KONG_ADMIN_URL** | The Kong admin API URL that the agent will query against | +| **KONG_ADMIN_AUTH_APIKEY_HEADER** | The API Key header name the agent will use when authenticating | +| **KONG_ADMIN_AUTH_APIKEY_VALUE** | The API Key value the agent will use when authenticating | +| **KONG_ADMIN_AUTH_BASICAUTH_USERNAME** | The HTTP Basic username that the agent will use when authenticating | +| **KONG_ADMIN_AUTH_BASICAUTH_PASSWORD** | The HTTP Basic password that the agent will use when authenticating | +| **KONG_ADMIN_SSL_NEXTPROTOS** | An array of strings. It is a list of supported application level protocols, in order of preference, based on the ALPN protocol list. Allowed values are: h2, http/1.0, http/1.1, h2c | +| **KONG_ADMIN_SSL_INSECURESKIPVERIFY** | Controls whether a client verifies the server’s certificate chain and host name. If true, TLS accepts any certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to man-in-the-middle attacks | +| **KONG_ADMIN_SSL_CIPHERSUITES** | An array of strings. It is a list of supported cipher suites for TLS versions up to TLS 1.2. If CipherSuites is nil, a default list of secure cipher suites is used, with a preference order based on hardware performance | +| **KONG_ADMIN_SSL_MAXVERSION** | String value for the maximum SSL/TLS version that is acceptable. If empty, then the maximum version supported by this package is used, which is currently TLS 1.3. Allowed values are: TLS1.0, TLS1.1, TLS1.2, TLS1.3 | +| **KONG_ADMIN_SSL_MINVERSION** | String value for the minimum SSL/TLS version that is acceptable. If empty TLS 1.2 is taken as the minimum. Allowed values are: TLS1.0, TLS1.1, TLS1.2, TLS1.3 | +| **KONG_PROXY_HOST** | The proxy host that the agent will use in API Services when the Kong route does not specify hosts | +| **KONG_PROXY_PORTS_HTTP_VALUE** | The HTTP port value that the agent will set for discovered APIS | +| **KONG_PROXY_PORTS_HTTPS_VALUE** | The HTTPs port value that the agent will set for discovered APIS | +| **KONG_PROXY_PORTS_HTTP_DISABLE** | Set to true if the agent should ignore routes that serve over HTTP | +| **KONG_PROXY_PORTS_HTTPS_DISABLE** | Set to true if the agent should ignore routes that serve over HTTPs | +| **KONG_PROXY_BASEPATH** | The proxy base path that will be added between the proxy host and Kong route path when building endpoints | +| **KONG_SPEC_FILTER** | The Agent SDK specific filter format for filtering out specific Kong services | +| **KONG_SPEC_LOCALPATH** | The local path that the agent will look in for API definitions | +| **KONG_SPEC_URLPATHS** | The URL paths that the agent will query on the gateway service for API definitions | +| **KONG_SPEC_DEVPORTALENABLED** | Set to true if the agent should look for spec files in the Kong Dev Portal (default: `false`) | +| | | +| Traceability Agent Variables | | +| **KONG_LOGS_HTTP_PATH** | The path endpoint that the Traceability agent will listen on (default: `/requestlogs`) | +| **KONG_LOGS_HTTP_PORT** | The port that the Traceability agent HTTP server will listen on (default: `9000`) | ## Setup diff --git a/helm/kong-agents/templates/_helpers.tpl b/helm/kong-agents/templates/_helpers.tpl index 9db6e43..3a9935c 100644 --- a/helm/kong-agents/templates/_helpers.tpl +++ b/helm/kong-agents/templates/_helpers.tpl @@ -70,8 +70,22 @@ Create the name of the service account to use {{- end }} {{/* -Create the name of the service account to use +Create the env var value for spec download paths */}} -{{- define "kong-agents.specDownloadPathsString" -}} +{{- define "kong-agents.spec.urlPaths.string" -}} {{- join "," .Values.kong.spec.urlPaths }} +{{- end -}} + +{{/* +Create the env var value for ssl next protos +*/}} +{{- define "kong-agents.admin.ssl.nextProtos.string" -}} +{{- join "," .Values.kong.admin.ssl.nextProtos }} +{{- end -}} + +{{/* +Create the env var value for ssl cipher suites +*/}} +{{- define "kong-agents.admin.ssl.cipherSuites.string" -}} +{{- join "," .Values.kong.admin.ssl.cipherSuites }} {{- end -}} \ No newline at end of file diff --git a/helm/kong-agents/templates/discovery-deployment.yaml b/helm/kong-agents/templates/discovery-deployment.yaml index a5cc374..6af4e61 100644 --- a/helm/kong-agents/templates/discovery-deployment.yaml +++ b/helm/kong-agents/templates/discovery-deployment.yaml @@ -82,9 +82,19 @@ spec: value: "{{ .Values.kong.proxy.ports.https.disable }}" - name: KONG_ADMIN_URL value: "{{ .Values.kong.admin.url }}" - {{- if (include "kong-agents.specDownloadPathsString" .) }} + - name: KONG_ADMIN_SSL_NEXTPROTOS + value: {{ include "kong-agents.admin.ssl.nextProtos.string" . }} + - name: KONG_ADMIN_SSL_CIPHERSUITES + value: {{ include "kong-agents.admin.ssl.cipherSuites.string" . }} + - name: KONG_ADMIN_SSL_INSECURESKIPVERIFY + value: "{{ .Values.kong.admin.ssl.insecureSkipVerify }}" + - name: KONG_ADMIN_SSL_MAXVERSION + value: "{{ .Values.kong.admin.ssl.maxVersion }}" + - name: KONG_ADMIN_SSL_MINVERSION + value: "{{ .Values.kong.admin.ssl.minVersion }}" + {{- if (include "kong-agents.spec.urlPaths.string" .) }} - name: KONG_SPEC_URLPATHS - value: {{ include "kong-agents.specDownloadPathsString" . }} + value: {{ include "kong-agents.spec.urlPaths.string" . }} {{- end }} {{- if .Values.kong.spec.localPath }} - name: KONG_SPEC_LOCALPATH @@ -128,6 +138,11 @@ spec: "KONG_ADMIN_AUTH_APIKEY_VALUE" "KONG_ADMIN_AUTH_BASICAUTH_USERNAME" "KONG_ADMIN_AUTH_BASICAUTH_PASSWORD" + "KONG_ADMIN_SSL_NEXTPROTOS" + "KONG_ADMIN_SSL_CIPHERSUITES" + "KONG_ADMIN_SSL_INSECURESKIPVERIFY" + "KONG_ADMIN_SSL_MAXVERSION" + "KONG_ADMIN_SSL_MINVERSION" "KONG_PROXY_HOST" "KONG_PROXY_BASEPATH" "KONG_PROXY_PORTS_HTTP_VALUE" diff --git a/helm/kong-agents/templates/traceability-statefulset.yaml b/helm/kong-agents/templates/traceability-statefulset.yaml index fddc2fc..47b281a 100644 --- a/helm/kong-agents/templates/traceability-statefulset.yaml +++ b/helm/kong-agents/templates/traceability-statefulset.yaml @@ -84,6 +84,11 @@ spec: "KONG_ADMIN_AUTH_APIKEY_VALUE" "KONG_ADMIN_AUTH_BASICAUTH_USERNAME" "KONG_ADMIN_AUTH_BASICAUTH_PASSWORD" + "KONG_ADMIN_SSL_NEXTPROTOS" + "KONG_ADMIN_SSL_CIPHERSUITES" + "KONG_ADMIN_SSL_INSECURESKIPVERIFY" + "KONG_ADMIN_SSL_MAXVERSION" + "KONG_ADMIN_SSL_MINVERSION" "KONG_PROXY_HOST" "KONG_PROXY_BASEPATH" "KONG_PROXY_PORTS_HTTP_VALUE" diff --git a/helm/kong-agents/values.yaml b/helm/kong-agents/values.yaml index 89fbb50..1443ebc 100644 --- a/helm/kong-agents/values.yaml +++ b/helm/kong-agents/values.yaml @@ -34,6 +34,12 @@ kong: basicAuth: username: password: + ssl: + nextProtos: [] + insecureSkipVerify: + cipherSuites: [] + minVersion: + maxVersion: proxy: host: basePath: diff --git a/pkg/discovery/config/config.go b/pkg/discovery/config/config.go index 508d0f8..d1dca64 100644 --- a/pkg/discovery/config/config.go +++ b/pkg/discovery/config/config.go @@ -21,22 +21,27 @@ type props interface { } const ( - cfgKongACLDisable = "kong.acl.disable" - cfgKongAdminUrl = "kong.admin.url" - cfgKongAdminAPIKey = "kong.admin.auth.apiKey.value" - cfgKongAdminAPIKeyHeader = "kong.admin.auth.apiKey.header" - cfgKongAdminBasicUsername = "kong.admin.auth.basicauth.username" - cfgKongAdminBasicPassword = "kong.admin.auth.basicauth.password" - cfgKongProxyHost = "kong.proxy.host" - cfgKongProxyPortHttp = "kong.proxy.ports.http.value" - cfgKongProxyPortHttpDisable = "kong.proxy.ports.http.disable" - cfgKongProxyPortHttps = "kong.proxy.ports.https.value" - cfgKongProxyPortHttpsDisable = "kong.proxy.ports.https.disable" - cfgKongProxyBasePath = "kong.proxy.basePath" - cfgKongSpecURLPaths = "kong.spec.urlPaths" - cfgKongSpecLocalPath = "kong.spec.localPath" - cfgKongSpecFilter = "kong.spec.filter" - cfgKongSpecDevPortal = "kong.spec.devPortalEnabled" + cfgKongACLDisable = "kong.acl.disable" + cfgKongAdminUrl = "kong.admin.url" + cfgKongAdminAPIKey = "kong.admin.auth.apiKey.value" + cfgKongAdminAPIKeyHeader = "kong.admin.auth.apiKey.header" + cfgKongAdminBasicUsername = "kong.admin.auth.basicauth.username" + cfgKongAdminBasicPassword = "kong.admin.auth.basicauth.password" + cfgKongAdminSSLNextProto = "kong.admin.ssl.nextProtos" + cfgKongAdminSSLInsecureSkipVerify = "kong.admin.ssl.insecureSkipVerify" + cfgKongAdminSSLCipherSuites = "kong.admin.ssl.cipherSuites" + cfgKongAdminSSLMinVersion = "kong.admin.ssl.minVersion" + cfgKongAdminSSLMaxVersion = "kong.admin.ssl.maxVersion" + cfgKongProxyHost = "kong.proxy.host" + cfgKongProxyPortHttp = "kong.proxy.ports.http.value" + cfgKongProxyPortHttpDisable = "kong.proxy.ports.http.disable" + cfgKongProxyPortHttps = "kong.proxy.ports.https.value" + cfgKongProxyPortHttpsDisable = "kong.proxy.ports.https.disable" + cfgKongProxyBasePath = "kong.proxy.basePath" + cfgKongSpecURLPaths = "kong.spec.urlPaths" + cfgKongSpecLocalPath = "kong.spec.localPath" + cfgKongSpecFilter = "kong.spec.filter" + cfgKongSpecDevPortal = "kong.spec.devPortalEnabled" ) func AddKongProperties(rootProps props) { @@ -46,6 +51,11 @@ func AddKongProperties(rootProps props) { rootProps.AddStringProperty(cfgKongAdminAPIKeyHeader, "", "API Key header to authenticate with Kong Gateway") rootProps.AddStringProperty(cfgKongAdminBasicUsername, "", "Username for basic auth to authenticate with Kong Admin API") rootProps.AddStringProperty(cfgKongAdminBasicPassword, "", "Password for basic auth to authenticate with Kong Admin API") + rootProps.AddStringSliceProperty(cfgKongAdminSSLNextProto, []string{}, "List of supported application level protocols, comma separated") + rootProps.AddBoolProperty(cfgKongAdminSSLInsecureSkipVerify, false, "Controls whether a client verifies the server's certificate chain and host name") + rootProps.AddStringSliceProperty(cfgKongAdminSSLCipherSuites, corecfg.TLSDefaultCipherSuitesStringSlice(), "List of supported cipher suites, comma separated") + rootProps.AddStringProperty(cfgKongAdminSSLMinVersion, corecfg.TLSDefaultMinVersionString(), "Minimum acceptable SSL/TLS protocol version") + rootProps.AddStringProperty(cfgKongAdminSSLMaxVersion, "0", "Maximum acceptable SSL/TLS protocol version") rootProps.AddStringProperty(cfgKongProxyHost, "", "The Kong proxy endpoint") rootProps.AddIntProperty(cfgKongProxyPortHttp, 80, "The Kong proxy http port") rootProps.AddBoolProperty(cfgKongProxyPortHttpDisable, false, "Set to true to disable adding an http endpoint to discovered routes") @@ -67,6 +77,7 @@ type AgentConfig struct { type KongAdminConfig struct { Url string `config:"url"` Auth KongAdminAuthConfig `config:"auth"` + TLS corecfg.TLSConfig `config:"ssl"` } type KongAdminAuthConfig struct { @@ -163,6 +174,11 @@ func (c *KongGatewayConfig) ValidateCfg() error { if invalidCredentialConfig(c) { return fmt.Errorf(credentialConfigErr) } + if tlsValidate, validator := c.Admin.TLS.(corecfg.IConfigValidator); validator { + if err := tlsValidate.ValidateCfg(); err != nil { + return fmt.Errorf("kong.admin.%s", err.Error()) + } + } return nil } @@ -234,6 +250,13 @@ func ParseProperties(rootProps props) *KongGatewayConfig { Password: rootProps.StringPropertyValue(cfgKongAdminBasicPassword), }, }, + TLS: &corecfg.TLSConfiguration{ + NextProtos: rootProps.StringSlicePropertyValue(cfgKongAdminSSLNextProto), + InsecureSkipVerify: rootProps.BoolPropertyValue(cfgKongAdminSSLInsecureSkipVerify), + CipherSuites: corecfg.NewCipherArray(rootProps.StringSlicePropertyValue(cfgKongAdminSSLCipherSuites)), + MinVersion: corecfg.TLSVersionAsValue(rootProps.StringPropertyValue(cfgKongAdminSSLMinVersion)), + MaxVersion: corecfg.TLSVersionAsValue(rootProps.StringPropertyValue(cfgKongAdminSSLMaxVersion)), + }, }, Proxy: KongProxyConfig{ Host: rootProps.StringPropertyValue(cfgKongProxyHost), diff --git a/pkg/discovery/kong/kongclient.go b/pkg/discovery/kong/kongclient.go index 9b39f29..d2d0ebd 100644 --- a/pkg/discovery/kong/kongclient.go +++ b/pkg/discovery/kong/kongclient.go @@ -2,7 +2,6 @@ package kong import ( "context" - "crypto/tls" "encoding/base64" "encoding/json" "fmt" @@ -69,9 +68,9 @@ type KongClient struct { func NewKongClient(baseClient *http.Client, kongConfig *config.KongGatewayConfig) (*KongClient, error) { headers := make(http.Header) var kongEndpoint string - defaultTransport := http.DefaultTransport.(*http.Transport) - http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true} - baseClient.Transport = defaultTransport + kongTransport := http.DefaultTransport.(*http.Transport) + kongTransport.TLSClientConfig = kongConfig.Admin.TLS.BuildTLSConfig() + baseClient.Transport = kongTransport kongEndpoint = kongConfig.Admin.Url if kongConfig.Admin.Auth.APIKey.Value != "" { diff --git a/pkg/discovery/kong/provisioning_test.go b/pkg/discovery/kong/provisioning_test.go index 6527a73..d3bd7e0 100644 --- a/pkg/discovery/kong/provisioning_test.go +++ b/pkg/discovery/kong/provisioning_test.go @@ -14,6 +14,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/Axway/agent-sdk/pkg/apic/provisioning" + corecfg "github.com/Axway/agent-sdk/pkg/config" "github.com/Axway/agents-kong/pkg/common" config "github.com/Axway/agents-kong/pkg/discovery/config" @@ -105,6 +106,7 @@ func createClient(responses map[string]response) KongAPIClient { }, Admin: config.KongAdminConfig{ Url: s.URL, + TLS: corecfg.NewTLSConfig(), }, } if err := cfg.ValidateCfg(); err != nil { diff --git a/pkg/traceability/processor/mock/collector_mock.go b/pkg/traceability/processor/mock/collector_mock.go index 1ab9d1a..27cec73 100644 --- a/pkg/traceability/processor/mock/collector_mock.go +++ b/pkg/traceability/processor/mock/collector_mock.go @@ -1,7 +1,6 @@ package mock import ( - "fmt" "sync" "github.com/Axway/agent-sdk/pkg/transaction/metric" @@ -19,11 +18,11 @@ func SetMockCollector(c *CollectorMock) { type CollectorMock struct { sync.WaitGroup - Details []metric.Detail + Details []metric.Detail + Expected int } func (c *CollectorMock) AddMetricDetail(metricDetail metric.Detail) { - fmt.Printf("%v\n", metricDetail) c.Details = append(c.Details, metricDetail) c.Done() } diff --git a/pkg/traceability/processor/processor_test.go b/pkg/traceability/processor/processor_test.go index 48605af..5864a13 100644 --- a/pkg/traceability/processor/processor_test.go +++ b/pkg/traceability/processor/processor_test.go @@ -2,7 +2,6 @@ package processor import ( "context" - "sync" "testing" "github.com/Axway/agent-sdk/pkg/traceability/redaction" @@ -43,11 +42,9 @@ var testData = []byte(`[{ }]`) func TestNewHandler(t *testing.T) { - testLock := sync.Mutex{} cases := map[string]struct { data []byte constructorErr bool - setupSampling bool expectedEvents int expectedMetricDetails int }{ @@ -58,27 +55,18 @@ func TestNewHandler(t *testing.T) { "expect no error when empty array data sent into handler": { data: []byte("[]"), }, - "handle data without sampling setup": { - data: testData, - }, "handle data with sampling setup": { data: testData, - setupSampling: true, expectedEvents: 4, expectedMetricDetails: 2, }, } for name, tc := range cases { t.Run(name, func(t *testing.T) { - testLock.Lock() - defer testLock.Unlock() - ctx := context.WithValue(context.Background(), "test", name) redaction.SetupGlobalRedaction(redaction.DefaultConfig()) - if tc.setupSampling { - sampling.SetupSampling(sampling.DefaultConfig(), false) - } + sampling.SetupSampling(sampling.DefaultConfig(), false) // create the handler h, err := NewEventsHandler(ctx, tc.data) @@ -91,7 +79,7 @@ func TestNewHandler(t *testing.T) { assert.NotNil(t, h) // setup collector - collector := &mock.CollectorMock{Details: make([]metric.Detail, 0)} + collector := &mock.CollectorMock{Details: make([]metric.Detail, 0), Expected: tc.expectedMetricDetails} mock.SetMockCollector(collector) h.collectorGetter = func() metricCollector { return mock.GetMockCollector()