Skip to content

Commit 8227112

Browse files
eguzkieguzki
authored
Merge pull request #1415 from 3scale/dev-environments
Dev environments
2 parents cff87c9 + 064c47d commit 8227112

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+1309
-318
lines changed

‎Makefile

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,6 @@ DEVEL_DOCKER_COMPOSE_VOLMOUNT_MAC_FILE ?= docker-compose-devel-volmount-mac.yml
2323
DEVEL_DOCKER_COMPOSE_VOLMOUNT_DEFAULT_FILE ?= docker-compose-devel-volmount-default.yml
2424

2525
PROVE_DOCKER_COMPOSE_FILE ?= docker-compose.prove.yml
26-
FORWARD_PROXY_DOCKER_COMPOSE_FILE ?= docker-compose.forward-proxy.yml
27-
UPSTREAM_TLS_DOCKER_COMPOSE_FILE ?= docker-compose.upstream-tls.yml
2826

2927
DOCKER_VOLUME_NAME ?= apicast-local-volume
3028

@@ -167,20 +165,9 @@ gateway-logs: export IMAGE_NAME = does-not-matter
167165
gateway-logs:
168166
$(DOCKER) compose logs gateway
169167

170-
opentelemetry-gateway: ## run gateway instrumented with opentelemetry
171-
$(DOCKER) compose run opentelemetry-instrumented-gateway
172-
173168
opentracing-gateway: ## run gateway instrumented with opentracing
174169
$(DOCKER) compose run opentracing-instrumented-gateway
175170

176-
# Environment described in ./examples/forward-proxy
177-
forward-proxy-gateway: ## run gateway configured to run along with a forward proxy
178-
$(DOCKER) compose -f $(FORWARD_PROXY_DOCKER_COMPOSE_FILE) run gateway
179-
180-
# Environment described in ./examples/tlsv1.3-upstream
181-
upstream-tls-gateway: ## run gateway configured to access upstream powered with TLS
182-
$(DOCKER) compose -f $(UPSTREAM_TLS_DOCKER_COMPOSE_FILE) run gateway
183-
184171
test-runtime-image: export IMAGE_NAME ?= $(RUNTIME_IMAGE)
185172
test-runtime-image: clean-containers ## Smoke test the runtime image. Pass any docker image in IMAGE_NAME parameter.
186173
$(DOCKER) compose --version
@@ -247,8 +234,6 @@ clean-containers:
247234
$(DOCKER) compose down --volumes --remove-orphans
248235
$(DOCKER) compose -f $(PROVE_DOCKER_COMPOSE_FILE) down --volumes --remove-orphans
249236
$(DOCKER) compose -f $(DEVEL_DOCKER_COMPOSE_FILE) -f $(DEVEL_DOCKER_COMPOSE_VOLMOUNT_FILE) down --volumes --remove-orphans
250-
$(DOCKER) compose -f $(FORWARD_PROXY_DOCKER_COMPOSE_FILE) down --volumes --remove-orphans
251-
$(DOCKER) compose -f $(UPSTREAM_TLS_DOCKER_COMPOSE_FILE) down --volumes --remove-orphans
252237

253238
clean-deps: ## Remove all local dependency folders
254239
- rm -rf $(PROJECT_PATH)/lua_modules $(PROJECT_PATH)/local $(PROJECT_PATH)/.cpanm $(PROJECT_PATH)/vendor/cache $(PROJECT_PATH)/.cache :

‎dev-environments/http-proxy-plain-http-upstream/Makefile

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
SHELL = /usr/bin/env bash -o pipefail
2+
.SHELLFLAGS = -ec
3+
.DEFAULT_GOAL := gateway
4+
MKFILE_PATH := $(abspath $(lastword $(MAKEFILE_LIST)))
5+
WORKDIR := $(patsubst %/,%,$(dir $(MKFILE_PATH)))
6+
DOCKER ?= $(shell which docker 2> /dev/null || echo "docker")
7+
8+
gateway: ## run gateway configured to access upstream powered with TLS
9+
$(DOCKER) compose -f docker-compose.yml run --service-ports gateway
10+
11+
clean:
12+
$(DOCKER) compose down --volumes --remove-orphans
13+
$(DOCKER) compose -f docker-compose.yml down --volumes --remove-orphans

‎dev-environments/http-proxy-plain-http-upstream/README.md

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# PROXY with upstream using plain HTTP 1.1
2+
3+
APIcast --> tiny proxy (connect to 443 but no cert installed) --> upstream (plain HTTP 1.1)
4+
5+
APIcast configured with plain HTTP 1.1 upstream through a proxy.
6+
7+
## Run the gateway
8+
9+
Running local `apicast-test` docker image
10+
11+
```sh
12+
make gateway
13+
```
14+
15+
Running custom apicast image
16+
17+
```sh
18+
make gateway IMAGE_NAME=quay.io/3scale/apicast:latest
19+
```
20+
21+
Traffic between the proxy and upstream can be inspected looking at logs from `example.com` service
22+
23+
```
24+
docker compose -p http-proxy-plain-http-upstream logs -f example.com
25+
```
26+
27+
Proxy can be inspected looking at logs from `proxy` service
28+
29+
```
30+
docker compose -p http-proxy-plain-http-upstream logs -f proxy
31+
```
32+
33+
## Testing
34+
35+
`GET` request
36+
37+
```sh
38+
curl --resolve get.example.com:8080:127.0.0.1 -v "http://get.example.com:8080/?user_key=123"
39+
```
40+
41+
`POST` request
42+
43+
```sh
44+
curl --resolve post.example.com:8080:127.0.0.1 -v -X POST "http://post.example.com:8080/?user_key=123"
45+
```
46+
47+
## Clean env
48+
49+
```sh
50+
make clean
51+
```

‎dev-environments/http-proxy-plain-http-upstream/apicast-config.json

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"services": [
3+
{
4+
"id": "1",
5+
"backend_version": "1",
6+
"proxy": {
7+
"hosts": ["get.example.com"],
8+
"api_backend": "http://example.com/get",
9+
"backend": {
10+
"endpoint": "http://127.0.0.1:8081",
11+
"host": "backend"
12+
},
13+
"policy_chain": [
14+
{
15+
"name": "apicast.policy.http_proxy",
16+
"configuration": {
17+
"http_proxy": "http://proxy:443/"
18+
}
19+
},
20+
{
21+
"name": "apicast.policy.apicast"
22+
}
23+
],
24+
"proxy_rules": [
25+
{
26+
"http_method": "GET",
27+
"pattern": "/",
28+
"metric_system_name": "hits",
29+
"delta": 1,
30+
"parameters": [],
31+
"querystring_parameters": {}
32+
}
33+
]
34+
}
35+
},
36+
{
37+
"id": "2",
38+
"backend_version": "1",
39+
"proxy": {
40+
"hosts": ["post.example.com"],
41+
"api_backend": "http://example.com/post",
42+
"backend": {
43+
"endpoint": "http://127.0.0.1:8081",
44+
"host": "backend"
45+
},
46+
"policy_chain": [
47+
{
48+
"name": "apicast.policy.http_proxy",
49+
"configuration": {
50+
"http_proxy": "http://proxy:443/"
51+
}
52+
},
53+
{
54+
"name": "apicast.policy.apicast"
55+
}
56+
],
57+
"proxy_rules": [
58+
{
59+
"http_method": "POST",
60+
"pattern": "/",
61+
"metric_system_name": "hits",
62+
"delta": 1,
63+
"parameters": [],
64+
"querystring_parameters": {}
65+
}
66+
]
67+
}
68+
}
69+
]
70+
}

‎docker-compose.forward-proxy.yml renamed to ‎dev-environments/http-proxy-plain-http-upstream/docker-compose.yml

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ services:
55
image: ${IMAGE_NAME:-apicast-test}
66
depends_on:
77
- proxy
8-
- upstream
8+
- example.com
9+
- two.upstream
910
environment:
1011
THREESCALE_CONFIG_FILE: /tmp/config.json
1112
THREESCALE_DEPLOYMENT_ENV: staging
@@ -20,20 +21,23 @@ services:
2021
- "8080:8080"
2122
- "8090:8090"
2223
volumes:
23-
- ./examples/forward-proxy/apicast-config.json:/tmp/config.json
24-
upstream:
25-
image: nginx:1.23.4
26-
expose:
27-
- "443"
28-
volumes:
29-
- ./examples/forward-proxy/proxy-nginx.conf:/etc/nginx/nginx.conf
30-
- ./examples/forward-proxy/upstream-cert/upstream.key:/etc/pki/tls.key
31-
- ./examples/forward-proxy/upstream-cert/upstream.crt:/etc/pki/tls.crt
24+
- ./apicast-config.json:/tmp/config.json
3225
proxy:
3326
build:
34-
dockerfile: ./examples/forward-proxy/tinyproxy.Dockerfile
27+
dockerfile: ./tinyproxy.Dockerfile
3528
expose:
3629
- "3128:3128"
3730
- "443:443"
3831
volumes:
39-
- ./examples/forward-proxy/tinyproxy.conf:/etc/tinyproxy/tinyproxy.conf
32+
- ./tinyproxy.conf:/etc/tinyproxy/tinyproxy.conf
33+
example.com:
34+
image: alpine/socat:1.7.4.4
35+
container_name: example.com
36+
command: "-d -v -d TCP-LISTEN:80,reuseaddr,fork TCP:two.upstream:80"
37+
expose:
38+
- "443"
39+
restart: unless-stopped
40+
two.upstream:
41+
image: kennethreitz/httpbin
42+
expose:
43+
- "80"

‎examples/forward-proxy/tinyproxy.Dockerfile renamed to ‎dev-environments/http-proxy-plain-http-upstream/tinyproxy.Dockerfile

File renamed without changes.

‎examples/forward-proxy/tinyproxy.conf renamed to ‎dev-environments/http-proxy-plain-http-upstream/tinyproxy.conf

File renamed without changes.

‎dev-environments/https-proxy-upstream-tlsv1.3/Makefile

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
SHELL = /usr/bin/env bash -o pipefail
2+
.SHELLFLAGS = -ec
3+
.DEFAULT_GOAL := gateway
4+
MKFILE_PATH := $(abspath $(lastword $(MAKEFILE_LIST)))
5+
WORKDIR := $(patsubst %/,%,$(dir $(MKFILE_PATH)))
6+
DOCKER ?= $(shell which docker 2> /dev/null || echo "docker")
7+
8+
gateway: ## run gateway configured to access upstream powered with TLS
9+
$(DOCKER) compose -f docker-compose.yml run --service-ports gateway
10+
11+
clean:
12+
$(DOCKER) compose down --volumes --remove-orphans
13+
$(DOCKER) compose -f docker-compose.yml down --volumes --remove-orphans
14+
15+
certs:
16+
$(MAKE) clean -C $(WORKDIR)/cert -f $(WORKDIR)/cert/Makefile
17+
$(MAKE) ca -C $(WORKDIR)/cert -f $(WORKDIR)/cert/Makefile
18+
$(MAKE) clientcerts -C $(WORKDIR)/cert -f $(WORKDIR)/cert/Makefile DOMAIN=example.com

‎dev-environments/https-proxy-upstream-tlsv1.3/README.md

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# PROXY with upstream using TLSv1.3
2+
3+
APIcast --> tiny proxy (connect to 443 but no cert installed) --> upstream (TLSv1.3)
4+
5+
APIcast configured with TLSv1.3 powered upstream through a proxy. TLS termination endpoint is `socat`.
6+
7+
APicast starts SSL tunnel (via HTTP CONNECT method) against proxy to access upstream configured with TLSv1.3
8+
9+
## Create the SSL Certificates
10+
11+
```sh
12+
make certs
13+
```
14+
15+
## Run the gateway
16+
17+
Running local `apicast-test` docker image
18+
19+
```sh
20+
make gateway
21+
```
22+
23+
Running custom apicast image
24+
25+
```sh
26+
make gateway IMAGE_NAME=quay.io/3scale/apicast:latest
27+
```
28+
29+
Traffic between the proxy and upstream can be inspected looking at logs from `example.com` service
30+
31+
```
32+
docker compose -p https-proxy-upstream-tlsv13 logs -f example.com
33+
```
34+
35+
Proxy can be inspected looking at logs from `proxy` service
36+
37+
```
38+
docker compose -p https-proxy-upstream-tlsv13 logs -f proxy
39+
```
40+
41+
## Testing
42+
43+
`GET` request
44+
45+
```sh
46+
curl --resolve get.example.com:8080:127.0.0.1 -v "http://get.example.com:8080/?user_key=123"
47+
```
48+
49+
`POST` request
50+
51+
```sh
52+
curl --resolve post.example.com:8080:127.0.0.1 -v -X POST "http://post.example.com:8080/?user_key=123"
53+
```
54+
55+
## Clean env
56+
57+
```sh
58+
make clean
59+
```

‎dev-environments/https-proxy-upstream-tlsv1.3/apicast-config.json

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"services": [
3+
{
4+
"id": "1",
5+
"backend_version": "1",
6+
"proxy": {
7+
"hosts": ["get.example.com"],
8+
"api_backend": "https://example.com/get",
9+
"backend": {
10+
"endpoint": "http://127.0.0.1:8081",
11+
"host": "backend"
12+
},
13+
"policy_chain": [
14+
{
15+
"name": "apicast.policy.http_proxy",
16+
"configuration": {
17+
"https_proxy": "http://proxy:443/"
18+
}
19+
},
20+
{
21+
"name": "apicast.policy.apicast"
22+
}
23+
],
24+
"proxy_rules": [
25+
{
26+
"http_method": "GET",
27+
"pattern": "/",
28+
"metric_system_name": "hits",
29+
"delta": 1,
30+
"parameters": [],
31+
"querystring_parameters": {}
32+
}
33+
]
34+
}
35+
},
36+
{
37+
"id": "2",
38+
"backend_version": "1",
39+
"proxy": {
40+
"hosts": ["post.example.com"],
41+
"api_backend": "https://example.com/post",
42+
"backend": {
43+
"endpoint": "http://127.0.0.1:8081",
44+
"host": "backend"
45+
},
46+
"policy_chain": [
47+
{
48+
"name": "apicast.policy.http_proxy",
49+
"configuration": {
50+
"https_proxy": "http://proxy:443/"
51+
}
52+
},
53+
{
54+
"name": "apicast.policy.apicast"
55+
}
56+
],
57+
"proxy_rules": [
58+
{
59+
"http_method": "POST",
60+
"pattern": "/",
61+
"metric_system_name": "hits",
62+
"delta": 1,
63+
"parameters": [],
64+
"querystring_parameters": {}
65+
}
66+
]
67+
}
68+
}
69+
]
70+
}

‎dev-environments/https-proxy-upstream-tlsv1.3/cert/Makefile

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
clean:
2+
- rm *.crt *.key *.pem *.csr
3+
4+
ca:
5+
openssl genrsa -out rootCA.key 2048
6+
openssl req -batch -new -x509 -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem
7+
8+
clientcerts:
9+
openssl req -subj '/CN=$(DOMAIN)' -newkey rsa:4096 -nodes \
10+
-sha256 \
11+
-days 3650 \
12+
-keyout $(DOMAIN).key \
13+
-out $(DOMAIN).csr
14+
chmod +r $(DOMAIN).key
15+
openssl x509 -req -in $(DOMAIN).csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out $(DOMAIN).crt -days 500 -sha256
16+
cat $(DOMAIN).key $(DOMAIN).crt >$(DOMAIN).pem

0 commit comments

Comments
 (0)