diff --git a/src/main/cljc/dda/c4k_common/ingress_cert.cljc b/src/main/cljc/dda/c4k_common/ingress_cert.cljc index 98c43dc..cef31be 100644 --- a/src/main/cljc/dda/c4k_common/ingress_cert.cljc +++ b/src/main/cljc/dda/c4k_common/ingress_cert.cljc @@ -12,15 +12,16 @@ (s/def ::issuer pred/letsencrypt-issuer?) (s/def ::service-name string?) +(s/def ::app-name string?) (s/def ::ingress-name string?) (s/def ::cert-name string?) (s/def ::service-port pos-int?) (s/def ::fqdns (s/coll-of pred/fqdn-string?)) -(def ingress? (s/keys :req-un [::fqdns ::ingress-name ::service-name ::service-port] +(def ingress? (s/keys :req-un [::fqdns ::app-name ::ingress-name ::service-name ::service-port] :opt-un [::issuer ::cert-name])) -(def certificate? (s/keys :req-un [::fqdns ::cert-name] +(def certificate? (s/keys :req-un [::fqdns ::app-name ::cert-name] :opt-un [::issuer])) #?(:cljs @@ -32,48 +33,51 @@ "ingress/https-ingress.yaml" (rc/inline "ingress/https-ingress.yaml") (throw (js/Error. "Undefined Resource!"))))) +; TODO: Review jem 2022/10/26: generalize! #?(:cljs (defmethod yaml/load-as-edn :ingress [resource-name] (yaml/from-string (yaml/load-resource resource-name)))) (defn-spec generate-host-rule pred/map-or-seq? [service-name ::service-name - service-port ::service-port + service-port ::service-port fqdn pred/fqdn-string?] - (-> - (yaml/load-as-edn "ingress/host-rule.yaml") - (cm/replace-all-matching-values-by-new-value "FQDN" fqdn) - (cm/replace-all-matching-values-by-new-value "SERVICE_PORT" service-port) - (cm/replace-all-matching-values-by-new-value "SERVICE_NAME" service-name))) + (-> + (yaml/load-as-edn "ingress/host-rule.yaml") + (cm/replace-all-matching-values-by-new-value "FQDN" fqdn) + (cm/replace-all-matching-values-by-new-value "SERVICE_PORT" service-port) + (cm/replace-all-matching-values-by-new-value "SERVICE_NAME" service-name))) (defn-spec generate-http-ingress pred/map-or-seq? [config ingress?] - (let [{:keys [ingress-name service-name service-port fqdns]} config] + (let [{:keys [ingress-name service-name service-port fqdns app-name]} config] (-> (yaml/load-as-edn "ingress/http-ingress.yaml") - (assoc-in [:metadata :name] ingress-name) + (assoc-in [:metadata :name] ingress-name) + (assoc-in [:metadata :labels :app.kubernetes.part-of] app-name) (assoc-in [:spec :rules] (mapv (partial generate-host-rule service-name service-port) fqdns))))) (defn-spec generate-https-ingress pred/map-or-seq? [config ingress?] - (let [{:keys [ingress-name cert-name service-name service-port fqdns]} config] + (let [{:keys [ingress-name cert-name service-name service-port fqdns app-name]} config] (-> (yaml/load-as-edn "ingress/https-ingress.yaml") (assoc-in [:metadata :name] ingress-name) + (assoc-in [:metadata :labels :app.kubernetes.part-of] app-name) (assoc-in [:spec :tls 0 :secretName] cert-name) (assoc-in [:spec :tls 0 :hosts] fqdns) (assoc-in [:spec :rules] (mapv (partial generate-host-rule service-name service-port) fqdns))))) (defn-spec generate-certificate pred/map-or-seq? [config certificate?] - (let [{:keys [cert-name issuer fqdns] + (let [{:keys [cert-name issuer fqdns app-name] :or {issuer "staging"}} config letsencrypt-issuer (name issuer)] (-> - (yaml/load-as-edn "ingress/certificate.yaml") + (yaml/load-as-edn "ingress/certificate.yaml") (assoc-in [:metadata :name] cert-name) + (assoc-in [:metadata :labels :app.kubernetes.part-of] app-name) (assoc-in [:spec :secretName] cert-name) (assoc-in [:spec :commonName] (first fqdns)) (assoc-in [:spec :dnsNames] fqdns) (assoc-in [:spec :issuerRef :name] letsencrypt-issuer)))) - \ No newline at end of file diff --git a/src/main/resources/ingress/certificate.yaml b/src/main/resources/ingress/certificate.yaml index 72bf6cd..5020461 100644 --- a/src/main/resources/ingress/certificate.yaml +++ b/src/main/resources/ingress/certificate.yaml @@ -2,6 +2,8 @@ apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: c4k-common-cert + labels: + app.kubernetes.part-of: c4k-common-app namespace: default spec: secretName: c4k-common-cert diff --git a/src/main/resources/ingress/http-ingress.yaml b/src/main/resources/ingress/http-ingress.yaml index 35f697f..4edc6cf 100644 --- a/src/main/resources/ingress/http-ingress.yaml +++ b/src/main/resources/ingress/http-ingress.yaml @@ -3,6 +3,8 @@ kind: Ingress metadata: name: c4k-common-http-ingress namespace: default + labels: + app.kubernetes.part-of: c4k-common-app annotations: traefik.ingress.kubernetes.io/router.entrypoints: web traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd @@ -13,7 +15,7 @@ spec: paths: - pathType: Prefix path: "/" - backend: + backend: # TODO: Review jem 2022/10/26: wo backend as we should only do a redirect here ... ? service: name: SERVICE_NAME port: diff --git a/src/main/resources/ingress/https-ingress.yaml b/src/main/resources/ingress/https-ingress.yaml index 8798b43..e253be0 100644 --- a/src/main/resources/ingress/https-ingress.yaml +++ b/src/main/resources/ingress/https-ingress.yaml @@ -3,6 +3,8 @@ kind: Ingress metadata: name: c4k-common-https-ingress namespace: default + labels: + app.kubernetes.part-of: c4k-common-app annotations: traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.tls: "true" diff --git a/src/test/cljc/dda/c4k_common/ingress_test.cljc b/src/test/cljc/dda/c4k_common/ingress_cert_test.cljc similarity index 85% rename from src/test/cljc/dda/c4k_common/ingress_test.cljc rename to src/test/cljc/dda/c4k_common/ingress_cert_test.cljc index dc4dc2a..5da7964 100644 --- a/src/test/cljc/dda/c4k_common/ingress_test.cljc +++ b/src/test/cljc/dda/c4k_common/ingress_cert_test.cljc @@ -1,4 +1,4 @@ -(ns dda.c4k-common.ingress-test +(ns dda.c4k-common.ingress-cert-test (:require #?(:clj [clojure.test :refer [deftest is are testing run-tests]] :cljs [cljs.test :refer-macros [deftest is are testing run-tests]]) @@ -28,11 +28,13 @@ :metadata {:name "test-io-http-ingress", :namespace "default", + :labels {:app.kubernetes.part-of "c4k-common-app"}, :annotations #:traefik.ingress.kubernetes.io{:router.entrypoints "web", :router.middlewares "default-redirect-https@kubernetescrd"}}} (dissoc (cut/generate-http-ingress {:issuer "prod" + :app-name "c4k-common-app" :service-name "myservice" :service-port 3000 :ingress-name "test-io-http-ingress" @@ -53,6 +55,7 @@ (:spec (cut/generate-http-ingress {:issuer "prod" :service-name "myservice" + :app-name "c4k-common-app" :service-port 3000 :ingress-name "test-io-http-ingress" :fqdns ["test.de" "www.test.de" "test-it.de" "www.test-it.de"]}))))) @@ -63,10 +66,12 @@ :metadata {:name "test-io-https-ingress", :namespace "default", + :labels {:app.kubernetes.part-of "c4k-common-app"}, :annotations #:traefik.ingress.kubernetes.io{:router.entrypoints "websecure", :router.tls "true"}}} (dissoc (cut/generate-https-ingress {:issuer "prod" :service-name "test-io-service" + :app-name "c4k-common-app" :service-port 80 :ingress-name "test-io-https-ingress" :fqdns ["test.de" "www.test.de" "test-it.de" "www.test-it.de"]}) :spec))) @@ -88,6 +93,7 @@ :http {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "test-io-service", :port {:number 80}}}}]}}]} (:spec (cut/generate-https-ingress {:issuer "prod" + :app-name "c4k-common-app" :service-name "test-io-service" :service-port 80 :ingress-name "test-io-https-ingress" @@ -97,7 +103,9 @@ (deftest should-generate-certificate (is (= {:apiVersion "cert-manager.io/v1", :kind "Certificate", - :metadata {:name "test-io-cert", :namespace "default"}, + :metadata {:name "test-io-cert", + :namespace "default", + :labels {:app.kubernetes.part-of "c4k-common-app"}}, :spec {:secretName "test-io-cert", :commonName "test.de", @@ -105,6 +113,7 @@ :renewBefore "360h", :dnsNames ["test.de" "test.org" "www.test.de" "www.test.org"], :issuerRef {:name "prod", :kind "ClusterIssuer"}}} - (cut/generate-certificate {:fqdns ["test.de" "test.org" "www.test.de" "www.test.org"] - :cert-name "test-io-cert" - :issuer "prod"})))) \ No newline at end of file + (cut/generate-certificate {:fqdns ["test.de" "test.org" "www.test.de" "www.test.org"] + :app-name "c4k-common-app" + :cert-name "test-io-cert" + :issuer "prod"})))) \ No newline at end of file