Skip to content

Commit e851732

Browse files
eguzkieguzki
authored
Merge pull request #1400 from 3scale/THREESCALE-9193-upstream-tlsv1.3
[THREESCALE-9193] upstream TLS v1.3
2 parents 91f39b1 + f2d8897 commit e851732

20 files changed

+702
-45
lines changed

‎.circleci/config.yml

+2-11
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
perl-cache-paths: &perl-cache-paths
23
paths:
34
- ./local
@@ -29,14 +30,6 @@ commands:
2930
- apicast-cpanm-v2-{{ arch }}-{{ .Branch }}
3031
- apicast-cpanm-v2-{{ arch }}-master
3132

32-
install-docker-compose:
33-
steps:
34-
- run: |
35-
curl -sLO https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-linux-x86_64
36-
chmod +x docker-compose-linux-x86_64
37-
mv docker-compose-linux-x86_64 /usr/local/bin/docker-compose
38-
docker-compose version
39-
4033
setup-docker:
4134
steps:
4235
- setup_remote_docker:
@@ -51,7 +44,6 @@ commands:
5144
setup-build-env:
5245
steps:
5346
- run: apk update && apk add wget make bash curl git openssh-client
54-
- install-docker-compose
5547
- setup-docker
5648
- attach-workspace
5749

@@ -106,10 +98,9 @@ executors:
10698
docker:
10799
working_directory: /opt/app-root/apicast
108100
docker:
109-
- image: docker:stable
101+
- image: docker:23.0.2-cli-alpine3.17
110102
environment:
111103
COMPOSE_TLS_VERSION: "TLSv1_2"
112-
DOCKER_COMPOSE_VERSION: "v2.14.0"
113104

114105
openresty:
115106
working_directory: /opt/app-root/apicast

‎CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
1616
- Opentelemetry support. Opentracing is now deprecated [PR #1379](https://github.com/3scale/APIcast/pull/1379) [THREESCALE-7735](https://issues.redhat.com/browse/THREESCALE-7735)
1717
- `/admin/api/account/proxy_configs` endpoint for configuration loading [PR #1352](https://github.com/3scale/APIcast/pull/1352) [THREESCALE-8508](https://issues.redhat.com/browse/THREESCALE-8508)
1818
- Pagination of services and proxy config endpoints [PR #1397](https://github.com/3scale/APIcast/pull/1397) [THREESCALE-8373](https://issues.redhat.com/browse/THREESCALE-8373)
19+
- Upstream TLS v1.3 [PR #1400](https://github.com/3scale/APIcast/pull/1400) [THREESCALE-9193](https://issues.redhat.com/browse/THREESCALE-9193)
1920

2021
### Removed
2122

‎Makefile

+42-29
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
MKFILE_PATH := $(abspath $(lastword $(MAKEFILE_LIST)))
22
PROJECT_PATH := $(patsubst %/,%,$(dir $(MKFILE_PATH)))
3+
SHELL = /usr/bin/env bash -o pipefail
4+
.SHELLFLAGS = -ec
35
.DEFAULT_GOAL := help
4-
DOCKER_COMPOSE = docker-compose
6+
57
DOCKER ?= $(shell which docker 2> /dev/null || echo "docker")
68
REGISTRY ?= quay.io/3scale
79
export TEST_NGINX_BINARY ?= openresty
810
NGINX = $(shell which $(TEST_NGINX_BINARY))
9-
SHELL=/bin/bash -o pipefail
1011

1112
NPROC ?= $(firstword $(shell nproc 2>/dev/null) 1)
1213

@@ -22,6 +23,8 @@ DEVEL_DOCKER_COMPOSE_VOLMOUNT_MAC_FILE ?= docker-compose-devel-volmount-mac.yml
2223
DEVEL_DOCKER_COMPOSE_VOLMOUNT_DEFAULT_FILE ?= docker-compose-devel-volmount-default.yml
2324

2425
PROVE_DOCKER_COMPOSE_FILE ?= docker-compose.prove.yml
26+
FORWARD_PROXY_DOCKER_COMPOSE_FILE ?= docker-compose.forward-proxy.yml
27+
UPSTREAM_TLS_DOCKER_COMPOSE_FILE ?= docker-compose.upstream-tls.yml
2528

2629
DOCKER_VOLUME_NAME ?= apicast-local-volume
2730

@@ -143,7 +146,7 @@ prove: $(ROVER) dependencies nginx ## Test nginx
143146
prove-docker: export IMAGE_NAME ?= $(DEVEL_IMAGE)
144147
prove-docker: ## Test nginx inside docker
145148
make -C $(PROJECT_PATH) -f $(MKFILE_PATH) apicast-source
146-
$(DOCKER_COMPOSE) -f $(PROVE_DOCKER_COMPOSE_FILE) run --rm -T \
149+
$(DOCKER) compose -f $(PROVE_DOCKER_COMPOSE_FILE) run --rm -T \
147150
-v $(DOCKER_VOLUME_NAME):/opt/app-root/src prove | \
148151
awk '/Result: NOTESTS/ { print "FAIL: NOTESTS"; print; exit 1 }; { print }'
149152

@@ -158,43 +161,51 @@ push: ## Push image to the registry
158161
bash: export IMAGE_NAME ?= $(RUNTIME_IMAGE)
159162
bash: export SERVICE = gateway
160163
bash: ## Run bash inside the runtime image
161-
$(DOCKER_COMPOSE) run --user=root --rm --entrypoint=bash $(SERVICE)
164+
$(DOCKER) compose run --user=root --rm --entrypoint=bash $(SERVICE)
162165

163166
gateway-logs: export IMAGE_NAME = does-not-matter
164167
gateway-logs:
165-
$(DOCKER_COMPOSE) logs gateway
168+
$(DOCKER) compose logs gateway
166169

167170
opentelemetry-gateway: ## run gateway instrumented with opentelemetry
168-
$(DOCKER_COMPOSE) run opentelemetry-instrumented-gateway
171+
$(DOCKER) compose run opentelemetry-instrumented-gateway
169172

170173
opentracing-gateway: ## run gateway instrumented with opentracing
171-
$(DOCKER_COMPOSE) run opentracing-instrumented-gateway
174+
$(DOCKER) compose run opentracing-instrumented-gateway
175+
176+
# Environment described in ./examples/forward-proxy
177+
forward-proxy-gateway: ## run gateway configured to run along with a forward proxy
178+
$(DOCKER) compose -f $(FORWARD_PROXY_DOCKER_COMPOSE_FILE) run gateway
179+
180+
# Environment described in ./examples/tlsv1.3-upstream
181+
upstream-tls-gateway: ## run gateway configured to access upstream powered with TLS
182+
$(DOCKER) compose -f $(UPSTREAM_TLS_DOCKER_COMPOSE_FILE) run gateway
172183

173184
test-runtime-image: export IMAGE_NAME ?= $(RUNTIME_IMAGE)
174185
test-runtime-image: clean-containers ## Smoke test the runtime image. Pass any docker image in IMAGE_NAME parameter.
175-
$(DOCKER_COMPOSE) --version
176-
$(DOCKER_COMPOSE) run --rm --user 100001 gateway apicast -l -d
186+
$(DOCKER) compose --version
187+
$(DOCKER) compose run --rm --user 100001 gateway apicast -l -d
177188
@echo -e $(SEPARATOR)
178-
$(DOCKER_COMPOSE) run --rm --user 100002 -e APICAST_CONFIGURATION_LOADER=boot -e THREESCALE_PORTAL_ENDPOINT=https://echo-api.3scale.net gateway bin/apicast -d
189+
$(DOCKER) compose run --rm --user 100002 -e APICAST_CONFIGURATION_LOADER=boot -e THREESCALE_PORTAL_ENDPOINT=https://echo-api.3scale.net gateway bin/apicast -d
179190
@echo -e $(SEPARATOR)
180-
$(DOCKER_COMPOSE) run --rm test sh -c 'sleep 5 && curl --fail http://gateway:8090/status/live'
191+
$(DOCKER) compose run --rm test sh -c 'sleep 5 && curl --fail http://gateway:8090/status/live'
181192
@echo -e $(SEPARATOR)
182-
$(DOCKER_COMPOSE) run --rm --user 100001 gateway bin/apicast --test
193+
$(DOCKER) compose run --rm --user 100001 gateway bin/apicast --test
183194
@echo -e $(SEPARATOR)
184-
$(DOCKER_COMPOSE) run --rm --user 100001 gateway bin/apicast --test --dev
195+
$(DOCKER) compose run --rm --user 100001 gateway bin/apicast --test --dev
185196
@echo -e $(SEPARATOR)
186-
$(DOCKER_COMPOSE) run --rm --user 100001 gateway bin/apicast --daemon
197+
$(DOCKER) compose run --rm --user 100001 gateway bin/apicast --daemon
187198
@echo -e $(SEPARATOR)
188-
$(DOCKER_COMPOSE) run --rm test bash -c 'for i in {1..5}; do curl --fail http://gateway:8090/status/live && break || sleep 1; done'
189-
$(DOCKER_COMPOSE) logs gateway
199+
$(DOCKER) compose run --rm test bash -c 'for i in {1..5}; do curl --fail http://gateway:8090/status/live && break || sleep 1; done'
200+
$(DOCKER) compose logs gateway
190201
@echo -e $(SEPARATOR)
191-
$(DOCKER_COMPOSE) run --rm test curl --fail -X PUT http://gateway:8090/config --data '{"services":[{"id":42}]}'
202+
$(DOCKER) compose run --rm test curl --fail -X PUT http://gateway:8090/config --data '{"services":[{"id":42}]}'
192203
@echo -e $(SEPARATOR)
193-
$(DOCKER_COMPOSE) run --rm test curl --fail http://gateway:8090/status/ready
204+
$(DOCKER) compose run --rm test curl --fail http://gateway:8090/status/ready
194205
@echo -e $(SEPARATOR)
195-
$(DOCKER_COMPOSE) run --rm test curl --fail -X POST http://gateway:8090/boot
206+
$(DOCKER) compose run --rm test curl --fail -X POST http://gateway:8090/boot
196207
@echo -e $(SEPARATOR)
197-
$(DOCKER_COMPOSE) run --rm gateway bin/apicast -c http://echo-api.3scale.net -d -b
208+
$(DOCKER) compose run --rm gateway bin/apicast -c http://echo-api.3scale.net -d -b
198209

199210
$(PROJECT_PATH)/lua_modules $(PROJECT_PATH)/local $(PROJECT_PATH)/.cpanm $(PROJECT_PATH)/vendor/cache $(PROJECT_PATH)/.cache :
200211
mkdir -p $@
@@ -207,9 +218,9 @@ development: GROUP := $(shell id -g $(USER))
207218
endif
208219
development: ## Run bash inside the development image
209220
@echo "Running on $(os)"
210-
- $(DOCKER_COMPOSE) -f $(DEVEL_DOCKER_COMPOSE_FILE) -f $(DEVEL_DOCKER_COMPOSE_VOLMOUNT_FILE) up -d
221+
- $(DOCKER) compose -f $(DEVEL_DOCKER_COMPOSE_FILE) -f $(DEVEL_DOCKER_COMPOSE_VOLMOUNT_FILE) up -d
211222
@ # https://github.com/moby/moby/issues/33794#issuecomment-312873988 for fixing the terminal width
212-
$(DOCKER_COMPOSE) -f $(DEVEL_DOCKER_COMPOSE_FILE) -f $(DEVEL_DOCKER_COMPOSE_VOLMOUNT_FILE) exec -e COLUMNS="`tput cols`" -e LINES="`tput lines`" --user $(USER):$(GROUP) development bash
223+
$(DOCKER) compose -f $(DEVEL_DOCKER_COMPOSE_FILE) -f $(DEVEL_DOCKER_COMPOSE_VOLMOUNT_FILE) exec -e COLUMNS="`tput cols`" -e LINES="`tput lines`" --user $(USER):$(GROUP) development bash
213224

214225
stop-development: clean-containers ## Stop development environment
215226

@@ -233,9 +244,11 @@ lua_modules/bin/rover:
233244
dependencies: dep_folders lua_modules carton ## Install project dependencies
234245

235246
clean-containers:
236-
- $(DOCKER_COMPOSE) down --volumes --remove-orphans
237-
- $(DOCKER_COMPOSE) -f $(PROVE_DOCKER_COMPOSE_FILE) down --volumes --remove-orphans
238-
- $(DOCKER_COMPOSE) -f $(DEVEL_DOCKER_COMPOSE_FILE) -f $(DEVEL_DOCKER_COMPOSE_VOLMOUNT_FILE) down --volumes --remove-orphans
247+
$(DOCKER) compose down --volumes --remove-orphans
248+
$(DOCKER) compose -f $(PROVE_DOCKER_COMPOSE_FILE) down --volumes --remove-orphans
249+
$(DOCKER) compose -f $(DEVEL_DOCKER_COMPOSE_FILE) -f $(DEVEL_DOCKER_COMPOSE_VOLMOUNT_FILE) down --volumes --remove-orphans
250+
$(DOCKER) compose -f $(FORWARD_PROXY_DOCKER_COMPOSE_FILE) down --volumes --remove-orphans
251+
$(DOCKER) compose -f $(UPSTREAM_TLS_DOCKER_COMPOSE_FILE) down --volumes --remove-orphans
239252

240253
clean-deps: ## Remove all local dependency folders
241254
- rm -rf $(PROJECT_PATH)/lua_modules $(PROJECT_PATH)/local $(PROJECT_PATH)/.cpanm $(PROJECT_PATH)/vendor/cache $(PROJECT_PATH)/.cache :
@@ -270,12 +283,12 @@ benchmark: export COMPOSE_PROJECT_NAME = apicast-benchmark
270283
benchmark: export WRK_REPORT ?= $(IMAGE_TAG).csv
271284
benchmark: export DURATION ?= 300
272285
benchmark:
273-
- $(DOCKER_COMPOSE) up --force-recreate -d apicast
274-
$(DOCKER_COMPOSE) run curl
286+
- $(DOCKER) compose up --force-recreate -d apicast
287+
$(DOCKER) compose run curl
275288
## warmup round for $(DURATION)/10 seconds
276-
DURATION=$$(( $(DURATION) / 10 )) $(DOCKER_COMPOSE) run wrk
289+
DURATION=$$(( $(DURATION) / 10 )) $(DOCKER) compose run wrk
277290
## run the real benchmark for $(DURATION) seconds
278-
$(DOCKER_COMPOSE) run wrk
291+
$(DOCKER) compose run wrk
279292

280293
# Check http://marmelab.com/blog/2016/02/29/auto-documented-makefile.html
281294
help: ## Print this help

‎docker-compose.forward-proxy.yml

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
version: '3.8'
3+
services:
4+
gateway:
5+
image: ${IMAGE_NAME:-apicast-test}
6+
depends_on:
7+
- proxy
8+
- upstream
9+
environment:
10+
THREESCALE_CONFIG_FILE: /tmp/config.json
11+
THREESCALE_DEPLOYMENT_ENV: staging
12+
APICAST_CONFIGURATION_LOADER: lazy
13+
APICAST_WORKERS: 1
14+
APICAST_LOG_LEVEL: debug
15+
APICAST_CONFIGURATION_CACHE: "0"
16+
expose:
17+
- "8080"
18+
- "8090"
19+
ports:
20+
- "8080:8080"
21+
- "8090:8090"
22+
volumes:
23+
- ./examples/forward-proxy/apicast-config.json:/tmp/config.json
24+
upstream:
25+
image: nginx:1.23.4
26+
expose:
27+
- "443"
28+
volumes:
29+
- ./examples/forward-proxy/proxy-nginx.conf:/etc/nginx/nginx.conf
30+
- ./examples/forward-proxy/upstream-cert/upstream.key:/etc/pki/tls.key
31+
- ./examples/forward-proxy/upstream-cert/upstream.crt:/etc/pki/tls.crt
32+
proxy:
33+
build:
34+
dockerfile: ./examples/forward-proxy/tinyproxy.Dockerfile
35+
expose:
36+
- "3128:3128"
37+
- "443:443"
38+
volumes:
39+
- ./examples/forward-proxy/tinyproxy.conf:/etc/tinyproxy/tinyproxy.conf

‎docker-compose.upstream-tls.yml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
version: '3.8'
3+
services:
4+
gateway:
5+
image: ${IMAGE_NAME:-apicast-test}
6+
depends_on:
7+
- one.upstream
8+
environment:
9+
THREESCALE_CONFIG_FILE: /tmp/config.json
10+
THREESCALE_DEPLOYMENT_ENV: staging
11+
APICAST_CONFIGURATION_LOADER: lazy
12+
APICAST_WORKERS: 1
13+
APICAST_LOG_LEVEL: debug
14+
APICAST_CONFIGURATION_CACHE: "0"
15+
expose:
16+
- "8080"
17+
- "8090"
18+
ports:
19+
- "8080:8080"
20+
- "8090:8090"
21+
volumes:
22+
- ./examples/tlsv1.3-upstream/apicast-config.json:/tmp/config.json
23+
one.upstream:
24+
image: nginx:1.23.4
25+
expose:
26+
- "443"
27+
volumes:
28+
- ./examples/tlsv1.3-upstream/proxy-nginx.conf:/etc/nginx/nginx.conf
29+
- ./examples/tlsv1.3-upstream/upstream-cert/one.upstream.key:/etc/pki/tls.key
30+
- ./examples/tlsv1.3-upstream/upstream-cert/one.upstream.crt:/etc/pki/tls.crt

‎docker-compose.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
version: '2.1'
1+
---
2+
version: '3.8'
23
services:
34
gateway:
45
image: ${IMAGE_NAME:-apicast-test}

‎examples/forward-proxy/README.md

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# PROXY with upstream using TLSv1.3
2+
3+
APIcast --> tiny proxy (connect to 443 but no cert installed) --> upstream (TLSv1.3)
4+
5+
APicast starts SSL tunnel (via HTTP Connect method) against proxy to access upstream configured with TLSv1.3
6+
7+
```
8+
curl -v -H "Host: one" http://${APICAST_IP}:8080/get?user_key=foo
9+
```

‎examples/forward-proxy/apicast-config.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"services": [
3+
{
4+
"backend_version": "1",
5+
"proxy": {
6+
"hosts": ["one"],
7+
"api_backend": "https://upstream:443/",
8+
"backend": {
9+
"endpoint": "http://127.0.0.1:8081",
10+
"host": "backend"
11+
},
12+
"policy_chain": [
13+
{
14+
"name": "apicast.policy.apicast"
15+
},
16+
{
17+
"name": "apicast.policy.http_proxy",
18+
"configuration": {
19+
"https_proxy": "http://proxy:443/"
20+
}
21+
}
22+
],
23+
"proxy_rules": [
24+
{
25+
"http_method": "GET",
26+
"pattern": "/",
27+
"metric_system_name": "hits",
28+
"delta": 1,
29+
"parameters": [],
30+
"querystring_parameters": {}
31+
}
32+
]
33+
}
34+
}
35+
]
36+
}

‎examples/forward-proxy/proxy-nginx.conf

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
worker_processes auto;
2+
3+
error_log /var/log/nginx/error.log warn;
4+
pid /var/run/nginx.pid;
5+
6+
events { worker_connections 1024; }
7+
8+
http {
9+
server {
10+
listen 443 ssl;
11+
12+
server_name upstream;
13+
14+
resolver 8.8.8.8;
15+
16+
access_log /dev/stdout;
17+
error_log /dev/stdout info;
18+
19+
ssl_certificate /etc/pki/tls.crt;
20+
ssl_certificate_key /etc/pki/tls.key;
21+
ssl_protocols TLSv1.3;
22+
23+
location ~ ^/(.*)$ {
24+
proxy_pass https://postman-echo.com/get/$1$is_args$args;
25+
}
26+
}
27+
}

‎examples/forward-proxy/tinyproxy.Dockerfile

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM alpine:3.17.3
2+
3+
LABEL summary="Forward proxy based on tinyproxy for development purposes" \
4+
description="Forward proxy based on tinyproxy for development purposes" \
5+
io.k8s.description="Forward proxy based on tinyproxy for development purposes" \
6+
io.k8s.display-name="Forward Proxy (Tinyproxy)" \
7+
io.openshift.tags="tinyproxy, proxy" \
8+
maintainer="[email protected]"
9+
10+
RUN apk --no-cache add tinyproxy=1.11.1-r2
11+
ENTRYPOINT ["/usr/bin/tinyproxy"]
12+
CMD ["-d"]

0 commit comments

Comments
 (0)