meissa/c4k-common
6
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

add ratelimit to ingress #1

Merged
jem merged 2 commits from feature/ingress-ratelimit into master 2024-02-20 10:51:50 +00:00
Conversation 0 Commits 2 Files changed 6 +163 -58
6 changed files with 163 additions and 58 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

78
src/main/cljc/dda/c4k_common/ingress.cljc
View file

@ -1,11 +1,9 @@
(ns dda.c4k-common.ingress (ns dda.c4k-common.ingress
(:require (:require
[clojure.spec.alpha :as s] [clojure.spec.alpha :as s]
#?(:cljs [shadow.resource :as rc])
#?(:clj [orchestra.core :refer [defn-spec]] #?(:clj [orchestra.core :refer [defn-spec]]
:cljs [orchestra.core :refer-macros [defn-spec]]) :cljs [orchestra.core :refer-macros [defn-spec]])
#?(:clj [clojure.edn :as edn] #?(:cljs [dda.c4k-common.macros :refer-macros [inline-resources]])
:cljs [cljs.reader :as edn])
[dda.c4k-common.yaml :as yaml] [dda.c4k-common.yaml :as yaml]
[dda.c4k-common.common :as cm] [dda.c4k-common.common :as cm]
[dda.c4k-common.predicate :as pred])) [dda.c4k-common.predicate :as pred]))
@ -17,26 +15,28 @@
(s/def ::cert-name string?) (s/def ::cert-name string?)
(s/def ::service-port pos-int?) (s/def ::service-port pos-int?)
(s/def ::fqdns (s/coll-of pred/fqdn-string?)) (s/def ::fqdns (s/coll-of pred/fqdn-string?))
(s/def ::average-rate pos-int?)
(s/def ::burst-rate pos-int?)
(def simple-ingress? (s/keys :req-un [::fqdns ::service-name ::service-port] (def simple-ingress? (s/keys :req-un [::fqdns ::service-name ::service-port]
:opt-un [::issuer])) :opt-un [::issuer ::average-rate]))
(def ingress? (s/keys :req-un [::fqdns ::app-name ::ingress-name ::service-name ::service-port] (def ingress? (s/keys :req-un [::fqdns ::app-name ::ingress-name ::service-name ::service-port]
:opt-un [::issuer ::cert-name])) :opt-un [::issuer ::cert-name ::rate-limit-name]))
(def certificate? (s/keys :req-un [::fqdns ::app-name ::cert-name] (def certificate? (s/keys :req-un [::fqdns ::app-name ::cert-name]
:opt-un [::issuer])) :opt-un [::issuer]))
; TODO: use this default consistently (def rate-limit-config? (s/keys :req-un [::rate-limit-name
(def ingress-defaults {:issuer "staging"}) ::average-rate
::burst-rate]))
(def simple-ingress-defaults {:issuer "staging"
:average-rate 10})
#?(:cljs #?(:cljs
(defmethod yaml/load-resource :ingress [resource-name] (defmethod yaml/load-resource :ingress [resource-name]
(case resource-name (get (inline-resources "ingress") resource-name)))
"ingress/host-rule.yaml" (rc/inline "ingress/host-rule.yaml")
"ingress/certificate.yaml" (rc/inline "ingress/certificate.yaml")
"ingress/ingress.yaml" (rc/inline "ingress/ingress.yaml")
(throw (js/Error. "Undefined Resource!")))))
(defn-spec generate-host-rule pred/map-or-seq? (defn-spec generate-host-rule pred/map-or-seq?
[service-name ::service-name [service-name ::service-name
@ -48,16 +48,14 @@
(cm/replace-all-matching-values-by-new-value "SERVICE_PORT" service-port) (cm/replace-all-matching-values-by-new-value "SERVICE_PORT" service-port)
(cm/replace-all-matching-values-by-new-value "SERVICE_NAME" service-name))) (cm/replace-all-matching-values-by-new-value "SERVICE_NAME" service-name)))
(defn-spec generate-ingress pred/map-or-seq? (defn-spec generate-rate-limit-middleware pred/map-or-seq?
[config ingress?] [config rate-limit-config?]
(let [{:keys [ingress-name cert-name service-name service-port fqdns app-name]} config] (let [{:keys [rate-limit-name average-rate burst-rate]} config]
(-> (->
(yaml/load-as-edn "ingress/ingress.yaml") (yaml/load-as-edn "ingress/middleware-ratelimit.yaml")
(assoc-in [:metadata :name] ingress-name) (assoc-in [:metadata :name] (str rate-limit-name "-ratelimit"))
(assoc-in [:metadata :labels :app.kubernetes.part-of] app-name) (assoc-in [:spec :rateLimit :average] average-rate)
(assoc-in [:spec :tls 0 :secretName] cert-name) (assoc-in [:spec :rateLimit :burst] burst-rate))))
(assoc-in [:spec :tls 0 :hosts] fqdns)
(assoc-in [:spec :rules] (mapv (partial generate-host-rule service-name service-port) fqdns)))))
(defn-spec generate-certificate pred/map-or-seq? (defn-spec generate-certificate pred/map-or-seq?
[config certificate?] [config certificate?]
@ -73,13 +71,49 @@
(assoc-in [:spec :dnsNames] fqdns) (assoc-in [:spec :dnsNames] fqdns)
(assoc-in [:spec :issuerRef :name] letsencrypt-issuer)))) (assoc-in [:spec :issuerRef :name] letsencrypt-issuer))))
(defn-spec generate-ingress pred/map-or-seq?
[config ingress?]
(let [{:keys [ingress-name cert-name service-name service-port fqdns app-name rate-limit-name]} config]
(->
(yaml/load-as-edn "ingress/ingress.yaml")
(assoc-in [:metadata :name] ingress-name)
(assoc-in [:metadata :labels :app.kubernetes.part-of] app-name)
(assoc-in [:metadata :annotations]
{:traefik.ingress.kubernetes.io/router.entrypoints
"web, websecure"
:traefik.ingress.kubernetes.io/router.middlewares
(if rate-limit-name
(str "default-redirect-https@kubernetescrd, " rate-limit-name "-ratelimit@kubernetescrd")
"default-redirect-https@kubernetescrd")
:metallb.universe.tf/address-pool "public"})
(assoc-in [:spec :tls 0 :secretName] cert-name)
(assoc-in [:spec :tls 0 :hosts] fqdns)
(assoc-in [:spec :rules]
(mapv (partial generate-host-rule service-name service-port) fqdns)))))
(defn-spec generate-ingress-and-cert any? (defn-spec generate-ingress-and-cert any?
[simple-ingress-config simple-ingress?] [simple-ingress-config simple-ingress?]
(let [{:keys [service-name]} simple-ingress-config (let [{:keys [service-name]} simple-ingress-config
config (merge {:app-name service-name config (merge {:app-name service-name
:ingress-name service-name :ingress-name service-name
:cert-name service-name} :cert-name service-name}
ingress-defaults simple-ingress-defaults
simple-ingress-config)] simple-ingress-config)]
[(generate-certificate config) [(generate-certificate config)
(generate-ingress config)]))
(defn-spec generate-simple-ingress any?
[simple-ingress-config simple-ingress?]
(let [{:keys [service-name]} simple-ingress-config
config (merge {:app-name service-name
:ingress-name service-name
:cert-name service-name
:rate-limit-name service-name}
simple-ingress-defaults
simple-ingress-config)
{:keys [average-rate]} config]
[(generate-certificate config)
(generate-rate-limit-middleware {:rate-limit-name service-name
:average-rate average-rate
:burst-rate average-rate})
(generate-ingress config)])) (generate-ingress config)]))

3
src/main/resources/ingress/ingress.yaml
View file

@ -1,10 +1,7 @@
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
metadata: metadata:
name: c4k-common-https-ingress
namespace: default namespace: default
labels:
app.kubernetes.part-of: c4k-common-app
annotations: annotations:
traefik.ingress.kubernetes.io/router.entrypoints: web, websecure traefik.ingress.kubernetes.io/router.entrypoints: web, websecure
traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd

8
src/main/resources/ingress/middleware-ratelimit.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: ratelimit
spec:
rateLimit:
average: AVG
burst: BRS

2
src/test/clj/dda/c4k_common/macros_test.clj
View file

@ -4,7 +4,7 @@
[dda.c4k-common.macros :refer [inline-resources]])) [dda.c4k-common.macros :refer [inline-resources]]))
(deftest should-count-inline-resources (deftest should-count-inline-resources
(is (= 3 (count (inline-resources "ingress"))))) (is (= 4 (count (inline-resources "ingress")))))
(deftest should-inline-resources (deftest should-inline-resources
(let [resource-path (fn [name] (str "dda/c4k_common/inline_resources_test/" name))] (let [resource-path (fn [name] (str "dda/c4k_common/inline_resources_test/" name))]

128
src/test/cljc/dda/c4k_common/ingress_test.cljc
View file

@ -20,26 +20,69 @@
{:service {:name "myservice", :port {:number 3000}}}}]}} {:service {:name "myservice", :port {:number 3000}}}}]}}
(cut/generate-host-rule "myservice" 3000 "test.com")))) (cut/generate-host-rule "myservice" 3000 "test.com"))))
(deftest should-generate-certificate
(is (= {:apiVersion "cert-manager.io/v1",
:kind "Certificate",
:metadata {:name "test-io-cert",
:namespace "default",
:labels {:app.kubernetes.part-of "c4k-common-app"}},
:spec
{:secretName "test-io-cert",
:commonName "test.de",
:duration "2160h",
:renewBefore "720h",
:dnsNames ["test.de" "test.org" "www.test.de" "www.test.org"],
:issuerRef {:name "prod", :kind "ClusterIssuer"}}}
(cut/generate-certificate {:fqdns ["test.de" "test.org" "www.test.de" "www.test.org"]
:app-name "c4k-common-app"
:cert-name "test-io-cert"
:issuer "prod"}))))
(deftest should-generate-middleware-ratelimit
(is (= {:apiVersion "traefik.containo.us/v1alpha1",
:kind "Middleware",
:metadata {:name "normal-ratelimit"},
:spec {:rateLimit {:average 10, :burst 5}}}
(cut/generate-rate-limit-middleware {:rate-limit-name "normal"
:average-rate 10, :burst-rate 5}))))
(deftest should-generate-ingress (deftest should-generate-ingress
(is (= {:apiVersion "networking.k8s.io/v1", (is (= {:apiVersion "networking.k8s.io/v1",
:kind "Ingress", :kind "Ingress",
:metadata :metadata
{:name "test-io-https-ingress", {
:namespace "default", :namespace "default",
:name "test-io-https-ingress",
:labels {:app.kubernetes.part-of "c4k-common-app"}, :labels {:app.kubernetes.part-of "c4k-common-app"},
:annotations {:traefik.ingress.kubernetes.io/router.entrypoints :annotations {:traefik.ingress.kubernetes.io/router.entrypoints
"web, websecure" "web, websecure"
:traefik.ingress.kubernetes.io/router.middlewares :traefik.ingress.kubernetes.io/router.middlewares
"default-redirect-https@kubernetescrd" "default-redirect-https@kubernetescrd"
:metallb.universe.tf/address-pool "public"}}} :metallb.universe.tf/address-pool "public"}}}
(dissoc (cut/generate-ingress (dissoc (cut/generate-ingress
{:issuer "prod" {:issuer "prod"
:service-name "test-io-service" :service-name "test-io-service"
:app-name "c4k-common-app" :app-name "c4k-common-app"
:service-port 80 :service-port 80
:ingress-name "test-io-https-ingress" :ingress-name "test-io-https-ingress"
:fqdns ["test.de" "www.test.de" "test-it.de" :fqdns ["test.de" "www.test.de" "test-it.de"
"www.test-it.de"]}) :spec))) "www.test-it.de"]}) :spec)))
(is (= {
:name "test-io-https-ingress",
:namespace "default",
:labels {:app.kubernetes.part-of "c4k-common-app"},
:annotations {:traefik.ingress.kubernetes.io/router.entrypoints
"web, websecure"
:traefik.ingress.kubernetes.io/router.middlewares
"default-redirect-https@kubernetescrd, normal-ratelimit@kubernetescrd",
:metallb.universe.tf/address-pool "public"}}
(:metadata (cut/generate-ingress
{:service-name "test-io-service"
:app-name "c4k-common-app"
:service-port 80
:ingress-name "test-io-https-ingress"
:rate-limit-name "normal"
:fqdns ["test.de"]}))))
(is (= {:tls (is (= {:tls
[{:hosts [{:hosts
["test.de" "www.test.de" "test-it.de" "www.test-it.de"], ["test.de" "www.test.de" "test-it.de" "www.test-it.de"],
@ -66,25 +109,6 @@
:fqdns ["test.de" "www.test.de" :fqdns ["test.de" "www.test.de"
"test-it.de" "test-it.de"
"www.test-it.de"]}))))) "www.test-it.de"]})))))
(deftest should-generate-certificate
(is (= {:apiVersion "cert-manager.io/v1",
:kind "Certificate",
:metadata {:name "test-io-cert",
:namespace "default",
:labels {:app.kubernetes.part-of "c4k-common-app"}},
:spec
{:secretName "test-io-cert",
:commonName "test.de",
:duration "2160h",
:renewBefore "720h",
:dnsNames ["test.de" "test.org" "www.test.de" "www.test.org"],
:issuerRef {:name "prod", :kind "ClusterIssuer"}}}
(cut/generate-certificate {:fqdns ["test.de" "test.org" "www.test.de" "www.test.org"]
:app-name "c4k-common-app"
:cert-name "test-io-cert"
:issuer "prod"}))))
(deftest should-generate-ingress-and-cert (deftest should-generate-ingress-and-cert
(is (= [{:apiVersion "cert-manager.io/v1", (is (= [{:apiVersion "cert-manager.io/v1",
:kind "Certificate", :kind "Certificate",
@ -121,4 +145,46 @@
:port {:number 80}}}}]}}]}}] :port {:number 80}}}}]}}]}}]
(cut/generate-ingress-and-cert {:fqdns ["test.jit.si"] (cut/generate-ingress-and-cert {:fqdns ["test.jit.si"]
:service-name "web" :service-name "web"
:service-port 80})))) :service-port 80}))))
(deftest should-generate-simple-ingress
(is (= [{:apiVersion "cert-manager.io/v1",
:kind "Certificate",
:metadata
{:name "web",
:labels {:app.kubernetes.part-of "web"},
:namespace "default"},
:spec
{:secretName "web",
:commonName "test.jit.si",
:duration "2160h",
:renewBefore "720h",
:dnsNames ["test.jit.si"],
:issuerRef {:name "staging", :kind "ClusterIssuer"}}}
{:apiVersion "traefik.containo.us/v1alpha1",
:kind "Middleware",
:metadata {:name "web-ratelimit"},
:spec {:rateLimit {:average 10, :burst 10}}}
{:apiVersion "networking.k8s.io/v1",
:kind "Ingress",
:metadata
{:name "web",
:namespace "default",
:labels {:app.kubernetes.part-of "web"},
:annotations
{:traefik.ingress.kubernetes.io/router.entrypoints "web, websecure",
:traefik.ingress.kubernetes.io/router.middlewares
"default-redirect-https@kubernetescrd, web-ratelimit@kubernetescrd",
:metallb.universe.tf/address-pool "public"}},
:spec
{:tls [{:hosts ["test.jit.si"], :secretName "web"}],
:rules
[{:host "test.jit.si",
:http {:paths [{:path "/",
:pathType "Prefix",
:backend
{:service {:name "web",
:port {:number 80}}}}]}}]}}]
(cut/generate-simple-ingress {:fqdns ["test.jit.si"]
:service-name "web"
:service-port 80}))))

2
src/test/cljs/dda/c4k_common/macros_test.cljs
View file

@ -4,7 +4,7 @@
[dda.c4k-common.macros :refer-macros [inline-resources]])) [dda.c4k-common.macros :refer-macros [inline-resources]]))
(deftest should-count-inline-resources (deftest should-count-inline-resources
(is (= 3 (count (inline-resources "ingress"))))) (is (= 4 (count (inline-resources "ingress")))))
(deftest should-inline-resources (deftest should-inline-resources
(let [resource-path (fn [name] (str "dda/c4k_common/inline_resources_test/" name))] (let [resource-path (fn [name] (str "dda/c4k_common/inline_resources_test/" name))]