prototype: e2e encryption all the way to the task

efekarakus · Sep 20, 2022 · 7b2a5e3 · 7b2a5e3 · coingraham · Sep 21, 2022
1 parent ad2f4ad
commit 7b2a5e3
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 4 deletions.
diff --git a/internal/pkg/deploy/cloudformation/stack/lb_web_svc.go b/internal/pkg/deploy/cloudformation/stack/lb_web_svc.go
@@ -189,17 +189,22 @@ func (s *LoadBalancedWebService) Template() (string, error) {
 	if s.manifest.RoutingRule.RedirectToHTTPS != nil {
 		httpRedirect = aws.BoolValue(s.manifest.RoutingRule.RedirectToHTTPS)
 	}
+	tgContainer, tgPort := s.httpLoadBalancerTarget()
 	content, err := s.parser.ParseLoadBalancedWebService(template.WorkloadOpts{
 		AppName:            s.app,
 		EnvName:            s.env,
 		WorkloadName:       s.name,
 		SerializedManifest: string(s.rawManifest),
 		EnvVersion:         s.rc.EnvVersion,
 
-		Variables:                s.manifest.TaskConfig.Variables,
-		Secrets:                  convertSecrets(s.manifest.TaskConfig.Secrets),
-		Aliases:                  aliases,
-		HTTPSListener:            s.httpsEnabled,
+		Variables:     s.manifest.TaskConfig.Variables,
+		Secrets:       convertSecrets(s.manifest.TaskConfig.Secrets),
+		Aliases:       aliases,
+		HTTPSListener: s.httpsEnabled,
+		TargetContainer: &template.TargetContainer{
+			Name: aws.StringValue(tgContainer),
+			Port: aws.StringValue(tgPort),
+		},
 		HTTPRedirect:             httpRedirect,
 		NestedStack:              addonsOutputs,
 		AddonsExtraParams:        addonsParams,

diff --git a/internal/pkg/template/templates/workloads/partials/cf/alb.yml b/internal/pkg/template/templates/workloads/partials/cf/alb.yml
@@ -24,7 +24,11 @@ TargetGroup:
     HealthCheckTimeoutSeconds: {{.HTTPHealthCheck.Timeout}}
     {{- end}}
     Port: !Ref ContainerPort
+    {{- if eq .TargetContainer.Port "443" }}
+    Protocol: HTTPS
+    {{- else }}
     Protocol: HTTP
+    {{- end }}
     {{- if .HTTPVersion}}
     ProtocolVersion: {{.HTTPVersion}}
     {{- end}}

diff --git a/internal/pkg/template/workload.go b/internal/pkg/template/workload.go
@@ -482,6 +482,11 @@ type S3ObjectLocation struct {
 	Key    string // Key of the object.
 }
 
+type TargetContainer struct {
+	Name string
+	Port string
+}
+
 // WorkloadOpts holds optional data that can be provided to enable features in a workload stack template.
 type WorkloadOpts struct {
 	AppName            string
@@ -514,6 +519,7 @@ type WorkloadOpts struct {
 	DependsOn                map[string]string
 	Publish                  *PublishOpts
 	ServiceDiscoveryEndpoint string
+	TargetContainer          *TargetContainer
 	HTTPVersion              *string
 	ALBEnabled               bool
 	HostedZoneAliases        AliasesForHostedZone