charts/nginz: Support galeb and allow upstream services to be in another namespace

charts/nginz/templates/conf/_nginx.conf.tpl

@@ -145,6 +145,11 @@ http {
   limit_req_zone $rate_limited_by_zuser zone=reqs_per_user:12m rate=10r/s;
   limit_req_zone $rate_limited_by_addr zone=reqs_per_addr:12m rate=5r/m;
 
+# TODO: Port to cannon nginx.conf
+{{- range $limit := .Values.nginx_conf.user_rate_limit_request_zones }}
+  {{ $limit }}
+{{- end }}
+
   limit_conn_zone $rate_limited_by_zuser zone=conns_per_user:10m;
   limit_conn_zone $rate_limited_by_addr zone=conns_per_addr:10m;
 
@@ -277,6 +282,12 @@ http {
         limit_req zone=reqs_per_addr burst=5 nodelay;
         limit_conn conns_per_addr 20;
               {{- end -}}
+            {{- else }}
+
+              # TODO: Port to cannon nginx.conf
+              {{- if hasKey $location "specific_user_rate_limit" }}
+        limit_req zone={{ $location.specific_user_rate_limit }} nodelay;
+              {{- end }}
             {{- end }}
 
         if ($request_method = 'OPTIONS') {
@@ -287,7 +298,7 @@ http {
             return 204;
         }
 
-        proxy_pass         http://{{ $name }};
+        proxy_pass         http://{{ $name }}{{ if hasKey $.Values.nginx_conf.upstream_namespace $name }}.{{ get $.Values.nginx_conf.upstream_namespace $name }}{{end}};
         proxy_http_version 1.1;
 
             {{- if ($location.disable_request_buffering) }}

charts/nginz/templates/conf/_upstreams.txt.tpl

@@ -1,3 +1,3 @@
 {{ define "nginz_upstreams.txt" }}
-{{ range $key, $value := .Values.nginx_conf.upstreams }}{{ if not (has $key $.Values.nginx_conf.ignored_upstreams) }} {{ $key }} {{ end }}{{ end -}}
-{{ end }}
+{{ range $key, $value := .Values.nginx_conf.upstreams }}{{ if not (has $key $.Values.nginx_conf.ignored_upstreams) }} {{ $key }}{{ if hasKey $.Values.nginx_conf.upstream_namespace $key }}.{{ get $.Values.nginx_conf.upstream_namespace $key }}{{end}} {{ end }}{{ end -}}
+{{ end }}

charts/nginz/values.yaml

@@ -51,6 +51,10 @@ nginx_conf:
   - /conversations/([^/]*)/call/state
   - /search/top
   - /search/common
+
+  user_rate_limit_request_zones:
+    - limit_req_zone $rate_limited_by_zuser zone=reqs_per_user_signatures:12m rate=10r/m;
+
   # The origins from which we allow CORS requests. These are combined with
   # 'external_env_domain' to form a full url
   allowlisted_origins:
@@ -67,6 +71,10 @@ nginx_conf:
   # See also "Separate incoming websocket network traffic from the rest of the
   # https traffic" section in the docs.
   ignored_upstreams: []
+  # TODO: Copy into cannon
+  upstream_namespace: {
+    # galeb: integrations
+  }
   upstreams:
     cargohold:
     - path: /conversations/([^/]*)/assets
@@ -484,6 +492,27 @@ nginx_conf:
       - all
       versioned: false
       strip_version: true
+    galeb:
+    - path: /consent
+      envs:
+      - all
+      disable_zauth: true
+      versioned: false
+      strip_version: true
+    - path: /self/consent
+      versioned: false
+      strip_version: true
+    - path: /signature
+      versioned: false
+      specific_user_rate_limit: reqs_per_user_signatures
+      strip_version: true
+    - path: /i/marketo/emails/([^/]*)$
+      disable_zauth: true
+      versioned: false
+      basic_auth: true
+      envs:
+      - staging
+
     calling-test:
     - path: /calling-test
       envs: