From bb8ac8a78f6e16b682c042d2a66b3553557a5f48 Mon Sep 17 00:00:00 2001 From: erik Date: Wed, 19 Oct 2022 09:25:37 +0200 Subject: [PATCH] Add ingress definitions to c4k-common Also update gitignore. --- .gitignore | 3 + src/main/cljc/dda/c4k_common/ingress.cljc | 79 +++++++++++++ src/main/resources/ingress/certificate.yaml | 16 +++ src/main/resources/ingress/host-rule.yaml | 10 ++ src/main/resources/ingress/http-ingress.yaml | 20 ++++ src/main/resources/ingress/https-ingress.yaml | 24 ++++ .../cljc/dda/c4k_common/ingress_test.cljc | 110 ++++++++++++++++++ 7 files changed, 262 insertions(+) create mode 100644 src/main/cljc/dda/c4k_common/ingress.cljc create mode 100644 src/main/resources/ingress/certificate.yaml create mode 100644 src/main/resources/ingress/host-rule.yaml create mode 100644 src/main/resources/ingress/http-ingress.yaml create mode 100644 src/main/resources/ingress/https-ingress.yaml create mode 100644 src/test/cljc/dda/c4k_common/ingress_test.cljc diff --git a/.gitignore b/.gitignore index ca00915..7616f34 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,6 @@ public/js/ valid-auth.edn valid-config.edn my-auth.edn + +.clj-kondo/ +.lsp/ diff --git a/src/main/cljc/dda/c4k_common/ingress.cljc b/src/main/cljc/dda/c4k_common/ingress.cljc new file mode 100644 index 0000000..94824a9 --- /dev/null +++ b/src/main/cljc/dda/c4k_common/ingress.cljc @@ -0,0 +1,79 @@ +(ns dda.c4k-common.ingress + (:require + [clojure.spec.alpha :as s] + #?(:cljs [shadow.resource :as rc]) + #?(:clj [orchestra.core :refer [defn-spec]] + :cljs [orchestra.core :refer-macros [defn-spec]]) + #?(:clj [clojure.edn :as edn] + :cljs [cljs.reader :as edn]) + [dda.c4k-common.yaml :as yaml] + [dda.c4k-common.common :as cm] + [dda.c4k-common.predicate :as pred])) + +(s/def ::issuer pred/letsencrypt-issuer?) +(s/def ::service-name string?) +(s/def ::ingress-name string?) +(s/def ::cert-name string?) +(s/def ::service-port pos-int?) +(s/def ::fqdns (s/coll-of pred/fqdn-string?)) + +(def ingress? (s/keys :req-un [::fqdns ::ingress-name ::service-name ::service-port] + :opt-un [::issuer ::cert-name])) + +(def certificate? (s/keys :req-un [::fqdns ::cert-name] + :opt-un [::issuer])) + +#?(:cljs + (defmethod yaml/load-resource :ingress [resource-name] + (case resource-name + "ingress/host-rule.yaml" (rc/inline "ingress/host-rule.yaml") + "ingress/certificate.yaml" (rc/inline "ingress/certificate.yaml") + "ingress/http-ingress.yaml" (rc/inline "ingress/http-ingress.yaml") + "ingress/https-ingress.yaml" (rc/inline "ingress/https-ingress.yaml") + (throw (js/Error. "Undefined Resource!"))))) + +#?(:cljs + (defmethod yaml/load-as-edn :ingress [resource-name] + (yaml/from-string (yaml/load-resource resource-name)))) + +(defn-spec generate-host-rule pred/map-or-seq? + [service-name ::service-name + service-port ::service-port + fqdn pred/fqdn-string?] + (-> + (yaml/load-as-edn "ingress/host-rule.yaml") + (cm/replace-all-matching-values-by-new-value "FQDN" fqdn) + (cm/replace-all-matching-values-by-new-value "SERVICE_PORT" service-port) + (cm/replace-all-matching-values-by-new-value "SERVICE_NAME" service-name))) + +(defn-spec generate-http-ingress pred/map-or-seq? + [config ingress?] + (let [{:keys [ingress-name service-name service-port fqdns]} config] + (-> + (yaml/load-as-edn "ingress/http-ingress.yaml") + (assoc-in [:metadata :name] ingress-name) + (assoc-in [:spec :rules] (mapv (partial generate-host-rule service-name service-port) fqdns))))) + +(defn-spec generate-https-ingress pred/map-or-seq? + [config ingress?] + (let [{:keys [ingress-name cert-name service-name service-port fqdns]} config] + (-> + (yaml/load-as-edn "ingress/https-ingress.yaml") + (assoc-in [:metadata :name] ingress-name) + (assoc-in [:spec :tls 0 :secretName] cert-name) + (assoc-in [:spec :tls 0 :hosts] fqdns) + (assoc-in [:spec :rules] (mapv (partial generate-host-rule service-name service-port) fqdns))))) + +(defn-spec generate-certificate pred/map-or-seq? + [config certificate?] + (let [{:keys [cert-name issuer fqdns] + :or {issuer "staging"}} config + letsencrypt-issuer (name issuer)] + (-> + (yaml/load-as-edn "ingress/certificate.yaml") + (assoc-in [:metadata :name] cert-name) + (assoc-in [:spec :secretName] cert-name) + (assoc-in [:spec :commonName] (first fqdns)) + (assoc-in [:spec :dnsNames] fqdns) + (assoc-in [:spec :issuerRef :name] letsencrypt-issuer)))) + \ No newline at end of file diff --git a/src/main/resources/ingress/certificate.yaml b/src/main/resources/ingress/certificate.yaml new file mode 100644 index 0000000..72bf6cd --- /dev/null +++ b/src/main/resources/ingress/certificate.yaml @@ -0,0 +1,16 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: c4k-common-cert + namespace: default +spec: + secretName: c4k-common-cert + commonName: FQDN + duration: 2160h # 90d + renewBefore: 360h # 15d + dnsNames: + - FQDN + issuerRef: + name: staging + kind: ClusterIssuer + \ No newline at end of file diff --git a/src/main/resources/ingress/host-rule.yaml b/src/main/resources/ingress/host-rule.yaml new file mode 100644 index 0000000..73d0e9f --- /dev/null +++ b/src/main/resources/ingress/host-rule.yaml @@ -0,0 +1,10 @@ +host: FQDN +http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: SERVICE_NAME + port: + number: SERVICE_PORT diff --git a/src/main/resources/ingress/http-ingress.yaml b/src/main/resources/ingress/http-ingress.yaml new file mode 100644 index 0000000..3ca4151 --- /dev/null +++ b/src/main/resources/ingress/http-ingress.yaml @@ -0,0 +1,20 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: c4k-common-http-ingress + namespace: default + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: web + traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd +spec: + rules: + - host: FQDN + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: SERVIC_ENAME + port: + number: 80 diff --git a/src/main/resources/ingress/https-ingress.yaml b/src/main/resources/ingress/https-ingress.yaml new file mode 100644 index 0000000..8798b43 --- /dev/null +++ b/src/main/resources/ingress/https-ingress.yaml @@ -0,0 +1,24 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: c4k-common-https-ingress + namespace: default + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" +spec: + tls: + - hosts: + - FQDN + secretName: c4k-common-cert + rules: + - host: FQDN + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: SERVICE_NAME + port: + number: 80 diff --git a/src/test/cljc/dda/c4k_common/ingress_test.cljc b/src/test/cljc/dda/c4k_common/ingress_test.cljc new file mode 100644 index 0000000..56ff0d2 --- /dev/null +++ b/src/test/cljc/dda/c4k_common/ingress_test.cljc @@ -0,0 +1,110 @@ +(ns dda.c4k-common.ingress-test + (:require + #?(:clj [clojure.test :refer [deftest is are testing run-tests]] + :cljs [cljs.test :refer-macros [deftest is are testing run-tests]]) + [clojure.spec.test.alpha :as st] + [dda.c4k-common.ingress :as cut])) + +(st/instrument `cut/generate-host-rule) +(st/instrument `cut/generate-http-ingress) +(st/instrument `cut/generate-https-ingress) +(st/instrument `cut/generate-certificate) + + +(deftest should-generate-rule + (is (= {:host "test.com", + :http + {:paths + [{:pathType "Prefix", + :path "/", + :backend + {:service {:name "myservice", :port {:number 3000}}}}]}} + (cut/generate-host-rule "myservice" 3000 "test.com")))) + + +(deftest should-generate-http-ingress + (is (= {:apiVersion "networking.k8s.io/v1", + :kind "Ingress", + :metadata + {:name "test-io-http-ingress", + :namespace "default", + :annotations + #:traefik.ingress.kubernetes.io{:router.entrypoints "web", + :router.middlewares "default-redirect-https@kubernetescrd"}}} + (dissoc (cut/generate-http-ingress + {:issuer "prod" + :service-name "myservice" + :service-port 3000 + :ingress-name "test-io-http-ingress" + :fqdns ["test.de" "www.test.de" "test-it.de" "www.test-it.de"]}) :spec))) + (is (= {:rules + [{:host "test.de", + :http + {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "myservice", :port {:number 3000}}}}]}} + {:host "www.test.de", + :http + {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "myservice", :port {:number 3000}}}}]}} + {:host "test-it.de", + :http + {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "myservice", :port {:number 3000}}}}]}} + {:host "www.test-it.de", + :http + {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "myservice", :port {:number 3000}}}}]}}]} + (:spec (cut/generate-http-ingress + {:issuer "prod" + :service-name "myservice" + :service-port 3000 + :ingress-name "test-io-http-ingress" + :fqdns ["test.de" "www.test.de" "test-it.de" "www.test-it.de"]}))))) + +(deftest should-generate-https-ingress + (is (= {:apiVersion "networking.k8s.io/v1", + :kind "Ingress", + :metadata + {:name "test-io-https-ingress", + :namespace "default", + :annotations #:traefik.ingress.kubernetes.io{:router.entrypoints "websecure", :router.tls "true"}}} + (dissoc (cut/generate-https-ingress + {:issuer "prod" + :service-name "test-io-service" + :service-port 80 + :ingress-name "test-io-https-ingress" + :fqdns ["test.de" "www.test.de" "test-it.de" "www.test-it.de"]}) :spec))) + (is (= {:tls + [{:hosts + ["test.de" "www.test.de" "test-it.de" "www.test-it.de"], + :secretName "test-io-cert"}] + :rules + [{:host "test.de", + :http + {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "test-io-service", :port {:number 80}}}}]}} + {:host "www.test.de", + :http + {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "test-io-service", :port {:number 80}}}}]}} + {:host "test-it.de", + :http + {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "test-io-service", :port {:number 80}}}}]}} + {:host "www.test-it.de", + :http + {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "test-io-service", :port {:number 80}}}}]}}]} + (:spec (cut/generate-https-ingress {:issuer "prod" + :service-name "test-io-service" + :service-port 80 + :ingress-name "test-io-https-ingress" + :cert-name "test-io-cert" + :fqdns ["test.de" "www.test.de" "test-it.de" "www.test-it.de"]}))))) + +(deftest should-generate-certificate + (is (= {:apiVersion "cert-manager.io/v1", + :kind "Certificate", + :metadata {:name "test-io-cert", :namespace "default"}, + :spec + {:secretName "test-io-cert", + :commonName "test.de", + :duration "2160h", + :renewBefore "360h", + :dnsNames ["test.de" "test.org" "www.test.de" "www.test.org"], + :issuerRef {:name "prod", :kind "ClusterIssuer"}}} + (cut/generate-certificate {:fqdns ["test.de" "test.org" "www.test.de" "www.test.org"] + :cert-name "test-io-cert" + :issuer "prod"})))) \ No newline at end of file