Skip to content

Commit 28f716c

Browse files
edwardrfedw-defang
andauthored
Show ALB DNS name as cert gen target for aws byoc (#915)
* Show ALB DNS name as cert gen target for aws byoc * update nix sha * Do not load LB dns name from client side * Keep old ServiceID in protobuf as some old state files still has it * update nix hash * Update spacing * Remove unused alb functions * Update nix sha --------- Co-authored-by: Edward J <[email protected]>
1 parent f19b850 commit 28f716c

File tree

7 files changed

+813
-654
lines changed

7 files changed

+813
-654
lines changed

pkgs/defang/cli.nix

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ buildGoModule {
77
pname = "defang-cli";
88
version = "git";
99
src = ../../src;
10-
vendorHash = "sha256-AWdzmP3mLe1GtDCjnk+misSWgYnp1kduh/GaiaJhK6A=";
10+
vendorHash = "sha256-of8K2h3gYoOdxHmBDXKiRfm35YeVE5R4WOy0pcSim4c=";
1111

1212
subPackages = [ "cmd/cli" ];
1313

src/go.mod

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ require (
1111
cloud.google.com/go/secretmanager v1.14.2
1212
cloud.google.com/go/storage v1.46.0
1313
github.com/AlecAivazis/survey/v2 v2.3.7
14-
github.com/aws/aws-sdk-go-v2 v1.32.4
14+
github.com/aws/aws-sdk-go-v2 v1.32.6
1515
github.com/aws/aws-sdk-go-v2/config v1.26.6
1616
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.42.6
1717
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.35.4
@@ -22,7 +22,7 @@ require (
2222
github.com/aws/aws-sdk-go-v2/service/servicequotas v1.25.5
2323
github.com/aws/aws-sdk-go-v2/service/ssm v1.44.7
2424
github.com/aws/aws-sdk-go-v2/service/sts v1.26.7
25-
github.com/aws/smithy-go v1.22.0
25+
github.com/aws/smithy-go v1.22.1
2626
github.com/awslabs/goformation/v7 v7.13.1
2727
github.com/bufbuild/connect-go v1.10.0
2828
github.com/compose-spec/compose-go/v2 v2.4.3
@@ -103,8 +103,8 @@ require (
103103
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 // indirect
104104
github.com/aws/aws-sdk-go-v2/credentials v1.16.16
105105
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 // indirect
106-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23 // indirect
107-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23 // indirect
106+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.25 // indirect
107+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.25 // indirect
108108
github.com/aws/aws-sdk-go-v2/internal/ini v1.7.3 // indirect
109109
github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.10 // indirect
110110
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect

src/go.sum

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,8 @@ github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migc
4646
github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
4747
github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
4848
github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
49-
github.com/aws/aws-sdk-go-v2 v1.32.4 h1:S13INUiTxgrPueTmrm5DZ+MiAo99zYzHEFh1UNkOxNE=
50-
github.com/aws/aws-sdk-go-v2 v1.32.4/go.mod h1:2SK5n0a2karNTv5tbP1SjsX0uhttou00v/HpXKM1ZUo=
49+
github.com/aws/aws-sdk-go-v2 v1.32.6 h1:7BokKRgRPuGmKkFMhEg/jSul+tB9VvXhcViILtfG8b4=
50+
github.com/aws/aws-sdk-go-v2 v1.32.6/go.mod h1:P5WJBrYqqbWVaOxgH0X/FYYD47/nooaPOZPlQdmiN2U=
5151
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 h1:x6xsQXGSmW6frevwDA+vi/wqhp1ct18mVXYN08/93to=
5252
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2/go.mod h1:lPprDr1e6cJdyYeGXnRaJoP4Md+cDBvi2eOj00BlGmg=
5353
github.com/aws/aws-sdk-go-v2/config v1.26.6 h1:Z/7w9bUqlRI0FFQpetVuFYEsjzE3h7fpU6HuGmfPL/o=
@@ -56,10 +56,10 @@ github.com/aws/aws-sdk-go-v2/credentials v1.16.16 h1:8q6Rliyv0aUFAVtzaldUEcS+T5g
5656
github.com/aws/aws-sdk-go-v2/credentials v1.16.16/go.mod h1:UHVZrdUsv63hPXFo1H7c5fEneoVo9UXiz36QG1GEPi0=
5757
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 h1:c5I5iH+DZcH3xOIMlz3/tCKJDaHFwYEmxvlh2fAcFo8=
5858
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11/go.mod h1:cRrYDYAMUohBJUtUnOhydaMHtiK/1NZ0Otc9lIb6O0Y=
59-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23 h1:A2w6m6Tmr+BNXjDsr7M90zkWjsu4JXHwrzPg235STs4=
60-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23/go.mod h1:35EVp9wyeANdujZruvHiQUAo9E3vbhnIO1mTCAxMlY0=
61-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23 h1:pgYW9FCabt2M25MoHYCfMrVY2ghiiBKYWUVXfwZs+sU=
62-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23/go.mod h1:c48kLgzO19wAu3CPkDWC28JbaJ+hfQlsdl7I2+oqIbk=
59+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.25 h1:s/fF4+yDQDoElYhfIVvSNyeCydfbuTKzhxSXDXCPasU=
60+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.25/go.mod h1:IgPfDv5jqFIzQSNbUEMoitNooSMXjRSDkhXv8jiROvU=
61+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.25 h1:ZntTCl5EsYnhN/IygQEUugpdwbhdkom9uHcbCftiGgA=
62+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.25/go.mod h1:DBdPrgeocww+CSl1C8cEV8PN1mHMBhuCDLpXezyvWkE=
6363
github.com/aws/aws-sdk-go-v2/internal/ini v1.7.3 h1:n3GDfwqF2tzEkXlv5cuy4iy7LpKDtqDMcNLfZDu9rls=
6464
github.com/aws/aws-sdk-go-v2/internal/ini v1.7.3/go.mod h1:6fQQgfuGmw8Al/3M2IgIllycxV7ZW7WCdVSqfBeUiCY=
6565
github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.10 h1:5oE2WzJE56/mVveuDZPJESKlg/00AaS2pY2QZcnxg4M=
@@ -94,8 +94,8 @@ github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7 h1:QPMJf+Jw8E1l7zqhZmMlFw6w
9494
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7/go.mod h1:ykf3COxYI0UJmxcfcxcVuz7b6uADi1FkiUz6Eb7AgM8=
9595
github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 h1:NzO4Vrau795RkUdSHKEwiR01FaGzGOH1EETJ+5QHnm0=
9696
github.com/aws/aws-sdk-go-v2/service/sts v1.26.7/go.mod h1:6h2YuIoxaMSCFf5fi1EgZAwdfkGMgDY+DVfa61uLe4U=
97-
github.com/aws/smithy-go v1.22.0 h1:uunKnWlcoL3zO7q+gG2Pk53joueEOsnNB28QdMsmiMM=
98-
github.com/aws/smithy-go v1.22.0/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
97+
github.com/aws/smithy-go v1.22.1 h1:/HPHZQ0g7f4eUeK6HKglFz8uwVfZKgoI25rb/J+dnro=
98+
github.com/aws/smithy-go v1.22.1/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
9999
github.com/awslabs/goformation/v7 v7.13.1 h1:QlPn8qwNCqYhrb4GW8kLjT4j1J49n5Qh/anpurCHxUA=
100100
github.com/awslabs/goformation/v7 v7.13.1/go.mod h1:FTCFMNesubEX0LAd6kIR+YkDD1U+5UaMbXtgPUgsck0=
101101
github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=

src/pkg/cli/cert.go

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -89,12 +89,7 @@ func GenerateLetsEncryptCert(ctx context.Context, project *compose.Project, clie
8989
for _, serviceInfo := range services.Services {
9090
if service, ok := project.Services[serviceInfo.Service.Name]; ok && service.DomainName != "" && serviceInfo.ZoneId == "" {
9191
cnt++
92-
targets := []string{serviceInfo.PublicFqdn}
93-
for i, endpoint := range serviceInfo.Endpoints {
94-
if service.Ports[i].Mode == compose.Mode_INGRESS {
95-
targets = append(targets, endpoint)
96-
}
97-
}
92+
targets := getDomainTargets(serviceInfo, service)
9893
term.Debugf("Found service %v with domain %v and targets %v", service.Name, service.DomainName, targets)
9994
generateCert(ctx, service.DomainName, targets, client)
10095
}
@@ -106,6 +101,20 @@ func GenerateLetsEncryptCert(ctx context.Context, project *compose.Project, clie
106101
return nil
107102
}
108103

104+
func getDomainTargets(serviceInfo *defangv1.ServiceInfo, service compose.ServiceConfig) []string {
105+
// Only use the ALB for aws cert gen to avoid defang domain in the middle
106+
if serviceInfo.LbDnsName != "" {
107+
return []string{serviceInfo.LbDnsName}
108+
} else {
109+
targets := []string{serviceInfo.PublicFqdn}
110+
for i, endpoint := range serviceInfo.Endpoints {
111+
if service.Ports[i].Mode == compose.Mode_INGRESS {
112+
targets = append(targets, endpoint)
113+
}
114+
}
115+
return targets
116+
}
117+
}
109118
func generateCert(ctx context.Context, domain string, targets []string, client client.FabricClient) {
110119
term.Infof("Checking DNS setup for %v", domain)
111120
if err := waitForCNAME(ctx, domain, targets, client); err != nil {

src/pkg/cli/cert_test.go

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,15 @@ import (
1010
"net/http"
1111
"net/http/httptest"
1212
"net/url"
13+
"slices"
14+
"sort"
1315
"strings"
1416
"testing"
1517
"time"
18+
19+
"github.com/DefangLabs/defang/src/pkg/cli/compose"
20+
defangv1 "github.com/DefangLabs/defang/src/protos/io/defang/v1"
21+
composetypes "github.com/compose-spec/compose-go/v2/types"
1622
)
1723

1824
type tryResult struct {
@@ -236,3 +242,72 @@ func TestHttpClient(t *testing.T) {
236242
t.Fatalf("expected 2nd dns lookup after cache expiry, but got %v", mr.calls)
237243
}
238244
}
245+
246+
func TestGetDomainTargets(t *testing.T) {
247+
tests := []struct {
248+
name string
249+
serviceInfo *defangv1.ServiceInfo
250+
service compose.ServiceConfig
251+
expected []string
252+
}{
253+
{
254+
name: "use only lb dns name when present",
255+
serviceInfo: &defangv1.ServiceInfo{
256+
LbDnsName: "aws.alb.com",
257+
PublicFqdn: "app.defang.app",
258+
Endpoints: []string{"8080--app.defang.app", "8081--app.defang.app"},
259+
},
260+
service: compose.ServiceConfig{
261+
Ports: []composetypes.ServicePortConfig{
262+
{Mode: compose.Mode_INGRESS},
263+
{Mode: compose.Mode_INGRESS},
264+
},
265+
},
266+
expected: []string{"aws.alb.com"},
267+
},
268+
{
269+
name: "use only public fqdn and end points when lb dns name is empty",
270+
serviceInfo: &defangv1.ServiceInfo{
271+
LbDnsName: "",
272+
PublicFqdn: "app.defang.app",
273+
Endpoints: []string{"8080--app.defang.app", "8081--app.defang.app"},
274+
},
275+
service: compose.ServiceConfig{
276+
Ports: []composetypes.ServicePortConfig{
277+
{Mode: compose.Mode_INGRESS},
278+
{Mode: compose.Mode_INGRESS},
279+
},
280+
},
281+
expected: []string{"app.defang.app", "8080--app.defang.app", "8081--app.defang.app"},
282+
},
283+
{
284+
name: "only use endpoint of ingress ports",
285+
serviceInfo: &defangv1.ServiceInfo{
286+
LbDnsName: "",
287+
PublicFqdn: "app.defang.app",
288+
Endpoints: []string{"8080--app.defang.app", "8081--app.defang.app"},
289+
},
290+
service: compose.ServiceConfig{
291+
Ports: []composetypes.ServicePortConfig{
292+
{Mode: compose.Mode_INGRESS},
293+
{Mode: compose.Mode_HOST},
294+
},
295+
},
296+
expected: []string{"app.defang.app", "8080--app.defang.app"},
297+
},
298+
}
299+
300+
for _, tt := range tests {
301+
t.Run(tt.name, func(t *testing.T) {
302+
targets := getDomainTargets(tt.serviceInfo, tt.service)
303+
if len(targets) != len(tt.expected) {
304+
t.Errorf("expected %v targets, got %v", len(tt.expected), len(targets))
305+
}
306+
sort.Strings(targets)
307+
sort.Strings(tt.expected)
308+
if !slices.Equal(targets, tt.expected) {
309+
t.Errorf("expected %v, got %v", tt.expected, targets)
310+
}
311+
})
312+
}
313+
}

0 commit comments

Comments
 (0)