meissa/c4k-common
6
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge branch 'yaml-ns-refactoring' into 'master'

Browse source 
Refactor the yaml namespace

See merge request domaindrivenarchitecture/c4k-common!2
This commit is contained in:
Pat Dyn 2022-11-08 13:30:31 +00:00
commit d4c559a5e1
9 changed files with 285 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

78
src/main/cljc/dda/c4k_common/ingress_cert.cljc Normal file
View file

@ -0,0 +1,78 @@
(ns dda.c4k-common.ingress-cert
(:require
[clojure.spec.alpha :as s]
#?(:cljs [shadow.resource :as rc])
#?(:clj [orchestra.core :refer [defn-spec]]
:cljs [orchestra.core :refer-macros [defn-spec]])
#?(:clj [clojure.edn :as edn]
:cljs [cljs.reader :as edn])
[dda.c4k-common.yaml :as yaml]
[dda.c4k-common.common :as cm]
[dda.c4k-common.predicate :as pred]))
(s/def ::issuer pred/letsencrypt-issuer?)
(s/def ::service-name string?)
(s/def ::app-name string?)
(s/def ::ingress-name string?)
(s/def ::cert-name string?)
(s/def ::service-port pos-int?)
(s/def ::fqdns (s/coll-of pred/fqdn-string?))
(def ingress? (s/keys :req-un [::fqdns ::app-name ::ingress-name ::service-name ::service-port]
:opt-un [::issuer ::cert-name]))
(def certificate? (s/keys :req-un [::fqdns ::app-name ::cert-name]
:opt-un [::issuer]))
#?(:cljs
(defmethod yaml/load-resource :ingress [resource-name]
(case resource-name
"ingress/host-rule.yaml" (rc/inline "ingress/host-rule.yaml")
"ingress/certificate.yaml" (rc/inline "ingress/certificate.yaml")
"ingress/http-ingress.yaml" (rc/inline "ingress/http-ingress.yaml")
"ingress/https-ingress.yaml" (rc/inline "ingress/https-ingress.yaml")
(throw (js/Error. "Undefined Resource!")))))
(defn-spec generate-host-rule pred/map-or-seq?
[service-name ::service-name
service-port ::service-port
fqdn pred/fqdn-string?]
(->
(yaml/load-as-edn "ingress/host-rule.yaml")
(cm/replace-all-matching-values-by-new-value "FQDN" fqdn)
(cm/replace-all-matching-values-by-new-value "SERVICE_PORT" service-port)
(cm/replace-all-matching-values-by-new-value "SERVICE_NAME" service-name)))
(defn-spec generate-http-ingress pred/map-or-seq?
[config ingress?]
(let [{:keys [ingress-name service-name service-port fqdns app-name]} config]
(->
(yaml/load-as-edn "ingress/http-ingress.yaml")
(assoc-in [:metadata :name] ingress-name)
(assoc-in [:metadata :labels :app.kubernetes.part-of] app-name)
(assoc-in [:spec :rules] (mapv (partial generate-host-rule service-name service-port) fqdns)))))
(defn-spec generate-https-ingress pred/map-or-seq?
[config ingress?]
(let [{:keys [ingress-name cert-name service-name service-port fqdns app-name]} config]
(->
(yaml/load-as-edn "ingress/https-ingress.yaml")
(assoc-in [:metadata :name] ingress-name)
(assoc-in [:metadata :labels :app.kubernetes.part-of] app-name)
(assoc-in [:spec :tls 0 :secretName] cert-name)
(assoc-in [:spec :tls 0 :hosts] fqdns)
(assoc-in [:spec :rules] (mapv (partial generate-host-rule service-name service-port) fqdns)))))
(defn-spec generate-certificate pred/map-or-seq?
[config certificate?]
(let [{:keys [cert-name issuer fqdns app-name]
:or {issuer "staging"}} config
letsencrypt-issuer (name issuer)]
(->
(yaml/load-as-edn "ingress/certificate.yaml")
(assoc-in [:metadata :name] cert-name)
(assoc-in [:metadata :labels :app.kubernetes.part-of] app-name)
(assoc-in [:spec :secretName] cert-name)
(assoc-in [:spec :commonName] (first fqdns))
(assoc-in [:spec :dnsNames] fqdns)
(assoc-in [:spec :issuerRef :name] letsencrypt-issuer))))

9
src/main/cljs/dda/c4k_common/yaml.cljs
View file

@ -3,8 +3,12 @@
["js-yaml" :as yaml]
[clojure.string :as st]
[orchestra.core :refer-macros [defn-spec]]
[shadow.resource :as rc]
[dda.c4k-common.predicate :as cp]))
(defn string-or-keyword? [input]
(or (string? input) (keyword? input)))
(defn-spec from-string cp/map-or-seq?
[input string?]
(js->clj (yaml/load input)
@ -15,9 +19,12 @@
(yaml/dump (clj->js edn)))
(defn-spec dispatch-by-resource-name keyword?
[resource string?]
[resource string-or-keyword?]
(keyword (first (st/split resource #"/"))))
(defmulti load-resource dispatch-by-resource-name)
(defmulti load-as-edn dispatch-by-resource-name)
(defmethod load-as-edn :default [resource-name]
(from-string (load-resource resource-name)))

18
src/main/resources/ingress/certificate.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: c4k-common-cert
labels:
app.kubernetes.part-of: c4k-common-app
namespace: default
spec:
secretName: c4k-common-cert
commonName: FQDN
duration: 2160h # 90d
renewBefore: 360h # 15d
dnsNames:
- FQDN
issuerRef:
name: staging
kind: ClusterIssuer

10
src/main/resources/ingress/host-rule.yaml Normal file
View file

@ -0,0 +1,10 @@
host: FQDN
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: SERVICE_NAME
port:
number: SERVICE_PORT

22
src/main/resources/ingress/http-ingress.yaml Normal file
View file

@ -0,0 +1,22 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: c4k-common-http-ingress
namespace: default
labels:
app.kubernetes.part-of: c4k-common-app
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: web
traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd
spec:
rules:
- host: FQDN
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: SERVICE_NAME
port:
number: 80

26
src/main/resources/ingress/https-ingress.yaml Normal file
View file

@ -0,0 +1,26 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: c4k-common-https-ingress
namespace: default
labels:
app.kubernetes.part-of: c4k-common-app
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls: "true"
spec:
tls:
- hosts:
- FQDN
secretName: c4k-common-cert
rules:
- host: FQDN
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: SERVICE_NAME
port:
number: 80

119
src/test/cljc/dda/c4k_common/ingress_cert_test.cljc Normal file
View file

@ -0,0 +1,119 @@
(ns dda.c4k-common.ingress-cert-test
(:require
#?(:clj [clojure.test :refer [deftest is are testing run-tests]]
:cljs [cljs.test :refer-macros [deftest is are testing run-tests]])
[clojure.spec.test.alpha :as st]
[dda.c4k-common.ingress-cert :as cut]))
(st/instrument `cut/generate-host-rule)
(st/instrument `cut/generate-http-ingress)
(st/instrument `cut/generate-https-ingress)
(st/instrument `cut/generate-certificate)
(deftest should-generate-rule
(is (= {:host "test.com",
:http
{:paths
[{:pathType "Prefix",
:path "/",
:backend
{:service {:name "myservice", :port {:number 3000}}}}]}}
(cut/generate-host-rule "myservice" 3000 "test.com"))))
(deftest should-generate-http-ingress
(is (= {:apiVersion "networking.k8s.io/v1",
:kind "Ingress",
:metadata
{:name "test-io-http-ingress",
:namespace "default",
:labels {:app.kubernetes.part-of "c4k-common-app"},
:annotations
#:traefik.ingress.kubernetes.io{:router.entrypoints "web",
:router.middlewares "default-redirect-https@kubernetescrd"}}}
(dissoc (cut/generate-http-ingress
{:issuer "prod"
:app-name "c4k-common-app"
:service-name "myservice"
:service-port 3000
:ingress-name "test-io-http-ingress"
:fqdns ["test.de" "www.test.de" "test-it.de" "www.test-it.de"]}) :spec)))
(is (= {:rules
[{:host "test.de",
:http
{:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "myservice", :port {:number 3000}}}}]}}
{:host "www.test.de",
:http
{:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "myservice", :port {:number 3000}}}}]}}
{:host "test-it.de",
:http
{:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "myservice", :port {:number 3000}}}}]}}
{:host "www.test-it.de",
:http
{:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "myservice", :port {:number 3000}}}}]}}]}
(:spec (cut/generate-http-ingress
{:issuer "prod"
:service-name "myservice"
:app-name "c4k-common-app"
:service-port 3000
:ingress-name "test-io-http-ingress"
:fqdns ["test.de" "www.test.de" "test-it.de" "www.test-it.de"]})))))
(deftest should-generate-https-ingress
(is (= {:apiVersion "networking.k8s.io/v1",
:kind "Ingress",
:metadata
{:name "test-io-https-ingress",
:namespace "default",
:labels {:app.kubernetes.part-of "c4k-common-app"},
:annotations #:traefik.ingress.kubernetes.io{:router.entrypoints "websecure", :router.tls "true"}}}
(dissoc (cut/generate-https-ingress
{:issuer "prod"
:service-name "test-io-service"
:app-name "c4k-common-app"
:service-port 80
:ingress-name "test-io-https-ingress"
:fqdns ["test.de" "www.test.de" "test-it.de" "www.test-it.de"]}) :spec)))
(is (= {:tls
[{:hosts
["test.de" "www.test.de" "test-it.de" "www.test-it.de"],
:secretName "test-io-cert"}]
:rules
[{:host "test.de",
:http
{:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "test-io-service", :port {:number 80}}}}]}}
{:host "www.test.de",
:http
{:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "test-io-service", :port {:number 80}}}}]}}
{:host "test-it.de",
:http
{:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "test-io-service", :port {:number 80}}}}]}}
{:host "www.test-it.de",
:http
{:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "test-io-service", :port {:number 80}}}}]}}]}
(:spec (cut/generate-https-ingress {:issuer "prod"
:app-name "c4k-common-app"
:service-name "test-io-service"
:service-port 80
:ingress-name "test-io-https-ingress"
:cert-name "test-io-cert"
:fqdns ["test.de" "www.test.de" "test-it.de" "www.test-it.de"]})))))
(deftest should-generate-certificate
(is (= {:apiVersion "cert-manager.io/v1",
:kind "Certificate",
:metadata {:name "test-io-cert",
:namespace "default",
:labels {:app.kubernetes.part-of "c4k-common-app"}},
:spec
{:secretName "test-io-cert",
:commonName "test.de",
:duration "2160h",
:renewBefore "360h",
:dnsNames ["test.de" "test.org" "www.test.de" "www.test.org"],
:issuerRef {:name "prod", :kind "ClusterIssuer"}}}
(cut/generate-certificate {:fqdns ["test.de" "test.org" "www.test.de" "www.test.org"]
:app-name "c4k-common-app"
:cert-name "test-io-cert"
:issuer "prod"}))))

2
src/test/cljs/dda/c4k_common/yaml_test.cljs
View file

@ -56,4 +56,4 @@
[{:backend
{:serviceName "another_keycloak"
:servicePort 8081}}]}}]}}
(cut/from-string (cut/load-resource "test/ingress_test.yaml")))))
(cut/load-as-edn "test/ingress_test.yaml"))))