Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

APIGOV-26852 - add tls config to kong client #56

Merged
merged 8 commits into from
Dec 15, 2023
Merged

APIGOV-26852 - add tls config to kong client #56

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
b17b1a2
add ssl config settings
jcollins-axway Dec 12, 2023
4144b3b
docs
jcollins-axway Dec 12, 2023
60a2364
Merge remote-tracking branch 'origin/main' into APIGOV-26852
jcollins-axway Dec 14, 2023
01a9979
fix test
jcollins-axway Dec 14, 2023
a5ca182
validte tls config
jcollins-axway Dec 14, 2023
7cfa24d
helm chart updates
jcollins-axway Dec 14, 2023
848c21c
handle npe
jcollins-axway Dec 14, 2023
3d781a7
remove test that is not needed
jcollins-axway Dec 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 28 additions & 23 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,29 +67,34 @@ On startup the Kong traceability agent first validates that it is able to connec

All Kong specific environment variables available are listed below

| Name | Description |
| -------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| Discovery Agent Variables | |
| **KONG_ACL_DISABLE** | Set to true to disable the check for a globally enabled ACL plugin on Kong. False by default. |
| **KONG_ADMIN_URL** | The Kong admin API URL that the agent will query against |
| **KONG_ADMIN_AUTH_APIKEY_HEADER** | The API Key header name the agent will use when authenticating |
| **KONG_ADMIN_AUTH_APIKEY_VALUE** | The API Key value the agent will use when authenticating |
| **KONG_ADMIN_AUTH_BASICAUTH_USERNAME** | The HTTP Basic username that the agent will use when authenticating |
| **KONG_ADMIN_AUTH_BASICAUTH_PASSWORD** | The HTTP Basic password that the agent will use when authenticating |
| **KONG_PROXY_HOST** | The proxy host that the agent will use in API Services when the Kong route does not specify hosts |
| **KONG_PROXY_PORTS_HTTP_VALUE** | The HTTP port value that the agent will set for discovered APIS |
| **KONG_PROXY_PORTS_HTTPS_VALUE** | The HTTPs port value that the agent will set for discovered APIS |
| **KONG_PROXY_PORTS_HTTP_DISABLE** | Set to true if the agent should ignore routes that serve over HTTP |
| **KONG_PROXY_PORTS_HTTPS_DISABLE** | Set to true if the agent should ignore routes that serve over HTTPs |
| **KONG_PROXY_BASEPATH** | The proxy base path that will be added between the proxy host and Kong route path when building endpoints |
| **KONG_SPEC_FILTER** | The Agent SDK specific filter format for filtering out specific Kong services |
| **KONG_SPEC_LOCALPATH** | The local path that the agent will look in for API definitions |
| **KONG_SPEC_URLPATHS** | The URL paths that the agent will query on the gateway service for API definitions |
| **KONG_SPEC_DEVPORTALENABLED** | Set to true if the agent should look for spec files in the Kong Dev Portal (default: `false`) |
| | |
| Traceability Agent Variables | |
| **KONG_LOGS_HTTP_PATH** | The path endpoint that the Traceability agent will listen on (default: `/requestlogs`) |
| **KONG_LOGS_HTTP_PORT** | The port that the Traceability agent HTTP server will listen on (default: `9000`) |
| Name | Description |
| -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Discovery Agent Variables | |
| **KONG_ACL_DISABLE** | Set to true to disable the check for a globally enabled ACL plugin on Kong. False by default. |
| **KONG_ADMIN_URL** | The Kong admin API URL that the agent will query against |
| **KONG_ADMIN_AUTH_APIKEY_HEADER** | The API Key header name the agent will use when authenticating |
| **KONG_ADMIN_AUTH_APIKEY_VALUE** | The API Key value the agent will use when authenticating |
| **KONG_ADMIN_AUTH_BASICAUTH_USERNAME** | The HTTP Basic username that the agent will use when authenticating |
| **KONG_ADMIN_AUTH_BASICAUTH_PASSWORD** | The HTTP Basic password that the agent will use when authenticating |
| **KONG_ADMIN_SSL_NEXTPROTOS** | An array of strings. It is a list of supported application level protocols, in order of preference, based on the ALPN protocol list. Allowed values are: h2, http/1.0, http/1.1, h2c |
jcollins-axway marked this conversation as resolved.
Show resolved Hide resolved
| **KONG_ADMIN_SSL_INSECURESKIPVERIFY** | Controls whether a client verifies the server’s certificate chain and host name. If true, TLS accepts any certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to man-in-the-middle attacks |
| **KONG_ADMIN_SSL_CIPHERSUITES** | An array of strings. It is a list of supported cipher suites for TLS versions up to TLS 1.2. If CipherSuites is nil, a default list of secure cipher suites is used, with a preference order based on hardware performance |
| **KONG_ADMIN_SSL_MAXVERSION** | String value for the maximum SSL/TLS version that is acceptable. If empty, then the maximum version supported by this package is used, which is currently TLS 1.3. Allowed values are: TLS1.0, TLS1.1, TLS1.2, TLS1.3 |
| **KONG_ADMIN_SSL_MINVERSION** | String value for the minimum SSL/TLS version that is acceptable. If empty TLS 1.2 is taken as the minimum. Allowed values are: TLS1.0, TLS1.1, TLS1.2, TLS1.3 |
| **KONG_PROXY_HOST** | The proxy host that the agent will use in API Services when the Kong route does not specify hosts |
| **KONG_PROXY_PORTS_HTTP_VALUE** | The HTTP port value that the agent will set for discovered APIS |
| **KONG_PROXY_PORTS_HTTPS_VALUE** | The HTTPs port value that the agent will set for discovered APIS |
| **KONG_PROXY_PORTS_HTTP_DISABLE** | Set to true if the agent should ignore routes that serve over HTTP |
| **KONG_PROXY_PORTS_HTTPS_DISABLE** | Set to true if the agent should ignore routes that serve over HTTPs |
| **KONG_PROXY_BASEPATH** | The proxy base path that will be added between the proxy host and Kong route path when building endpoints |
| **KONG_SPEC_FILTER** | The Agent SDK specific filter format for filtering out specific Kong services |
| **KONG_SPEC_LOCALPATH** | The local path that the agent will look in for API definitions |
| **KONG_SPEC_URLPATHS** | The URL paths that the agent will query on the gateway service for API definitions |
| **KONG_SPEC_DEVPORTALENABLED** | Set to true if the agent should look for spec files in the Kong Dev Portal (default: `false`) |
| | |
| Traceability Agent Variables | |
| **KONG_LOGS_HTTP_PATH** | The path endpoint that the Traceability agent will listen on (default: `/requestlogs`) |
| **KONG_LOGS_HTTP_PORT** | The port that the Traceability agent HTTP server will listen on (default: `9000`) |

## Setup

Expand Down
45 changes: 29 additions & 16 deletions pkg/discovery/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,22 +21,27 @@ type props interface {
}

const (
cfgKongACLDisable = "kong.acl.disable"
cfgKongAdminUrl = "kong.admin.url"
cfgKongAdminAPIKey = "kong.admin.auth.apiKey.value"
cfgKongAdminAPIKeyHeader = "kong.admin.auth.apiKey.header"
cfgKongAdminBasicUsername = "kong.admin.auth.basicauth.username"
cfgKongAdminBasicPassword = "kong.admin.auth.basicauth.password"
cfgKongProxyHost = "kong.proxy.host"
cfgKongProxyPortHttp = "kong.proxy.ports.http.value"
cfgKongProxyPortHttpDisable = "kong.proxy.ports.http.disable"
cfgKongProxyPortHttps = "kong.proxy.ports.https.value"
cfgKongProxyPortHttpsDisable = "kong.proxy.ports.https.disable"
cfgKongProxyBasePath = "kong.proxy.basePath"
cfgKongSpecURLPaths = "kong.spec.urlPaths"
cfgKongSpecLocalPath = "kong.spec.localPath"
cfgKongSpecFilter = "kong.spec.filter"
cfgKongSpecDevPortal = "kong.spec.devPortalEnabled"
cfgKongACLDisable = "kong.acl.disable"
cfgKongAdminUrl = "kong.admin.url"
cfgKongAdminAPIKey = "kong.admin.auth.apiKey.value"
cfgKongAdminAPIKeyHeader = "kong.admin.auth.apiKey.header"
cfgKongAdminBasicUsername = "kong.admin.auth.basicauth.username"
cfgKongAdminBasicPassword = "kong.admin.auth.basicauth.password"
cfgKongAdminSSLNextProto = "kong.admin.ssl.nextProtos"
cfgKongAdminSSLInsecureSkipVerify = "kong.admin.ssl.insecureSkipVerify"
cfgKongAdminSSLCipherSuites = "kong.admin.ssl.cipherSuites"
cfgKongAdminSSLMinVersion = "kong.admin.ssl.minVersion"
cfgKongAdminSSLMaxVersion = "kong.admin.ssl.maxVersion"
cfgKongProxyHost = "kong.proxy.host"
cfgKongProxyPortHttp = "kong.proxy.ports.http.value"
cfgKongProxyPortHttpDisable = "kong.proxy.ports.http.disable"
cfgKongProxyPortHttps = "kong.proxy.ports.https.value"
cfgKongProxyPortHttpsDisable = "kong.proxy.ports.https.disable"
cfgKongProxyBasePath = "kong.proxy.basePath"
cfgKongSpecURLPaths = "kong.spec.urlPaths"
cfgKongSpecLocalPath = "kong.spec.localPath"
cfgKongSpecFilter = "kong.spec.filter"
cfgKongSpecDevPortal = "kong.spec.devPortalEnabled"
)

func AddKongProperties(rootProps props) {
Expand Down Expand Up @@ -67,6 +72,7 @@ type AgentConfig struct {
type KongAdminConfig struct {
Url string `config:"url"`
Auth KongAdminAuthConfig `config:"auth"`
TLS corecfg.TLSConfig `config:"ssl"`
}

type KongAdminAuthConfig struct {
Expand Down Expand Up @@ -234,6 +240,13 @@ func ParseProperties(rootProps props) *KongGatewayConfig {
Password: rootProps.StringPropertyValue(cfgKongAdminBasicPassword),
},
},
TLS: &corecfg.TLSConfiguration{
NextProtos: rootProps.StringSlicePropertyValue(cfgKongAdminSSLNextProto),
InsecureSkipVerify: rootProps.BoolPropertyValue(cfgKongAdminSSLInsecureSkipVerify),
CipherSuites: corecfg.NewCipherArray(rootProps.StringSlicePropertyValue(cfgKongAdminSSLCipherSuites)),
MinVersion: corecfg.TLSVersionAsValue(rootProps.StringPropertyValue(cfgKongAdminSSLMinVersion)),
MaxVersion: corecfg.TLSVersionAsValue(rootProps.StringPropertyValue(cfgKongAdminSSLMaxVersion)),
},
},
Proxy: KongProxyConfig{
Host: rootProps.StringPropertyValue(cfgKongProxyHost),
Expand Down
7 changes: 3 additions & 4 deletions pkg/discovery/kong/kongclient.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ package kong

import (
"context"
"crypto/tls"
"encoding/base64"
"encoding/json"
"fmt"
Expand Down Expand Up @@ -69,9 +68,9 @@ type KongClient struct {
func NewKongClient(baseClient *http.Client, kongConfig *config.KongGatewayConfig) (*KongClient, error) {
headers := make(http.Header)
var kongEndpoint string
defaultTransport := http.DefaultTransport.(*http.Transport)
http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
baseClient.Transport = defaultTransport
kongTransport := http.DefaultTransport.(*http.Transport)
kongTransport.TLSClientConfig = kongConfig.Admin.TLS.BuildTLSConfig()
baseClient.Transport = kongTransport
kongEndpoint = kongConfig.Admin.Url

if kongConfig.Admin.Auth.APIKey.Value != "" {
Expand Down
2 changes: 2 additions & 0 deletions pkg/discovery/kong/provisioning_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ import (
"github.com/stretchr/testify/assert"

"github.com/Axway/agent-sdk/pkg/apic/provisioning"
corecfg "github.com/Axway/agent-sdk/pkg/config"

"github.com/Axway/agents-kong/pkg/common"
config "github.com/Axway/agents-kong/pkg/discovery/config"
Expand Down Expand Up @@ -105,6 +106,7 @@ func createClient(responses map[string]response) KongAPIClient {
},
Admin: config.KongAdminConfig{
Url: s.URL,
TLS: corecfg.NewTLSConfig(),
},
}
if err := cfg.ValidateCfg(); err != nil {
Expand Down