Skip to content

Commit 356421f

Browse files
nickumia-reisysnickumia-reisys
authored
new: initial egress proxy deployment framework (#172)
Mostly a copy from data.gov egress deployment. A few edits to account for data.gov-specific names and deployment oddities. I'm not confident that this will work out of the box because of uniqueness of the management spaces. More commits will likely follow haha
1 parent 85dcd4d commit 356421f

File tree

9 files changed

+279
-0
lines changed

9 files changed

+279
-0
lines changed

‎.github/workflows/disable-egress.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
name: disable egress proxy
3+
4+
on: # yamllint disable-line rule:truthy
5+
workflow_dispatch:
6+
inputs:
7+
appName:
8+
description: 'App Name'
9+
required: true
10+
type: choice
11+
options:
12+
- "ssb-eks"
13+
- "ssb-smtp"
14+
- "ssb-solrcloud"
15+
appSpace:
16+
description: 'Cloud Foundry Space'
17+
required: true
18+
type: choice
19+
options:
20+
- "development-ssb"
21+
- "management-staging"
22+
- "management"
23+
24+
jobs:
25+
disable-egress:
26+
concurrency: ${{ github.event.inputs.appSpace }}
27+
name: ${{ github.event.inputs.appName }} -- ${{ github.event.inputs.appSpace }}
28+
environment: ${{ github.event.inputs.appSpace }}
29+
runs-on: ubuntu-latest
30+
steps:
31+
- name: checkout
32+
uses: actions/checkout@v3
33+
- name: disable egress
34+
uses: cloud-gov/cg-cli-tools@main
35+
with:
36+
command: egress/disable-egress ${{ github.event.inputs.appName }}
37+
cf_org: gsa-datagov
38+
cf_space: ${{ github.event.inputs.appSpace }}
39+
cf_username: ${{secrets.CF_SERVICE_USER}}
40+
cf_password: ${{secrets.CF_SERVICE_AUTH}}

‎.github/workflows/enable-egress.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
name: enable egress proxy
3+
4+
on: # yamllint disable-line rule:truthy
5+
workflow_dispatch:
6+
inputs:
7+
appName:
8+
description: 'App Name'
9+
required: true
10+
type: choice
11+
options:
12+
- "ssb-eks"
13+
- "ssb-smtp"
14+
- "ssb-solrcloud"
15+
appSpace:
16+
description: 'Cloud Foundry Space'
17+
required: true
18+
type: choice
19+
options:
20+
- "development-ssb"
21+
- "management-staging"
22+
- "management"
23+
24+
env:
25+
SSB_DIR: ssb
26+
CG_DIR: cg-egress-proxy
27+
28+
jobs:
29+
enable-egress:
30+
concurrency: ${{ github.event.inputs.appSpace }}
31+
name: ${{ github.event.inputs.appName }} -- ${{ github.event.inputs.appSpace }}
32+
environment: ${{ github.event.inputs.appSpace }}
33+
runs-on: ubuntu-latest
34+
steps:
35+
- name: checkout ssb
36+
uses: actions/checkout@v3
37+
with:
38+
path: ${{ env.SSB_DIR }}
39+
- name: checkout cg-egress-proxy
40+
uses: actions/checkout@v3
41+
with:
42+
repository: 'GSA/cg-egress-proxy'
43+
path: ${{ env.CG_DIR }}
44+
45+
# trying to emulate:
46+
# https://github.com/GSA/cg-egress-proxy/blob/main/Dockerfile
47+
- name: build caddy - setup go
48+
uses: actions/setup-go@v3
49+
with:
50+
go-version: '1.18.4' # latest
51+
- name: build caddy - get xcaddy
52+
run: go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
53+
- name: build caddy - xcaddy build
54+
run: >
55+
xcaddy build
56+
--with github.com/hairyhenderson/caddy-teapot-module@v0.0.3-0
57+
--with github.com/caddyserver/forwardproxy@caddy2
58+
--output ${{ env.CG_DIR }}/proxy/caddy
59+
60+
- name: enable egress
61+
uses: cloud-gov/cg-cli-tools@main
62+
with:
63+
# tmate command for testing and debugging
64+
# command: apt-get -y install tmate; tmate -F
65+
command: >
66+
ssb/egress/enable-egress
67+
${{ github.event.inputs.appName }}
68+
${{ github.event.inputs.appSpace }}
69+
cf_org: gsa-datagov
70+
cf_space: ${{ github.event.inputs.appSpace }}
71+
cf_username: ${{secrets.CF_SERVICE_USER}}
72+
cf_password: ${{secrets.CF_SERVICE_AUTH}}

‎.github/workflows/restart-egress.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
name: restart egress proxy
3+
4+
on: # yamllint disable-line rule:truthy
5+
workflow_dispatch:
6+
schedule:
7+
- cron: '0 3 * * *' # every day at 3am UTC
8+
9+
jobs:
10+
11+
restart-egress:
12+
strategy:
13+
matrix:
14+
environ: [development-ssb, management-staging, management]
15+
name: restart egress (${{matrix.environ}})
16+
concurrency: ${{matrix.environ}}
17+
environment: ${{matrix.environ}}
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: checkout
21+
uses: actions/checkout@v3
22+
- name: cf restart
23+
uses: cloud-gov/cg-cli-tools@main
24+
with:
25+
command: egress/restart-egress
26+
cf_org: gsa-datagov
27+
cf_space: ${{matrix.environ}}-egress
28+
cf_username: ${{secrets.CF_SERVICE_EGRESS_USER}}
29+
cf_password: ${{secrets.CF_SERVICE_EGRESS_AUTH}}

‎egress/acl/allow.acl‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
*.gov
2+
*.mil
3+
s3-us-gov-west-1.amazonaws.com

‎egress/acl/deny.acl‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
*.bing.com
2+
somewebsitesothisisntempty.com

‎egress/disable-egress‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
#!/bin/bash
2+
set -e
3+
set -o pipefail
4+
# for debugging
5+
# set -x
6+
7+
help()
8+
{
9+
echo
10+
echo "$0: disables egress proxy for a given app."
11+
echo "Syntax: disable-egress <APP>"
12+
echo " <APP> must be a valid cf app in the current space with egress enabled."
13+
#echo "Options:"
14+
#echo " --space <SPACE>: #TODO"
15+
echo
16+
echo "To re-enable egress for an app, use enable-egress."
17+
exit 1
18+
}
19+
20+
app="$1"
21+
22+
if [ -z "$app" ]; then
23+
echo "No app provided."
24+
help
25+
else
26+
echo "Checking for app $app in space.."
27+
if cf apps | tr -s ' ' | cut -d ' ' -f 1 | grep -q -E "(^|\s)$app($|\s)"; then
28+
echo "$app found."
29+
echo "Unsetting environment variable proxy_url.."
30+
cf unset-env "$app" proxy_url
31+
echo "Checking network policy.."
32+
read -r source dest protocol port space <<< "$( cf network-policies --source "$app" | tail -n +4 | tr -s ' ' | cut -d ' ' -f 1-5 )"
33+
if [ -z "$dest" ] && [ -z "$protocol" ] && [ -z "$port" ] && [ -z "$space" ]; then
34+
# network policy already empty, pass
35+
echo "Network policy not found, continuing.."
36+
else
37+
cf remove-network-policy "$source" "$dest" -s "$space" --protocol "$protocol" --port "$port"
38+
fi
39+
echo "Restarting $app.."
40+
cf restart "$app"
41+
else
42+
echo "App not found in space."
43+
help
44+
fi
45+
fi

‎egress/egress-smoke.sh‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/bin/bash
2+
3+
# Smoke test for testing egress
4+
5+
set -o errexit
6+
set -o pipefail
7+
set -o nounset
8+
set -x
9+
10+
SPACE=$2
11+
ALLOW_DOMAIN="data.gov"
12+
DENY_DOMAIN="bing.com"
13+
14+
function test_egress {
15+
DOMAIN=$1
16+
CODE=$2
17+
[ "$CODE" == "$(curl -I --silent https://"$DOMAIN" | head -n 1 | cut -d$' ' -f2)" ]
18+
}
19+
20+
# Application may not be fully available immediately, wait 15 seconds
21+
sleep 15
22+
23+
if [ "$SPACE" == "egress" ]; then
24+
# in the egress space, the egress app itself should be able to reach anything
25+
DENY_CODE=200
26+
elif [ "$SPACE" == "app" ]; then
27+
# in the app space, the app's egress should be restricted
28+
DENY_CODE=403
29+
else
30+
false || echo 'Error: SPACE not found'
31+
fi
32+
33+
test_egress "$ALLOW_DOMAIN" 200
34+
echo "Allow domain ok"
35+
36+
test_egress "$DENY_DOMAIN" "$DENY_CODE"
37+
echo "Deny domain ok"
38+
39+
echo ok

‎egress/enable-egress‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/bin/bash
2+
set -e
3+
set -o pipefail
4+
5+
help()
6+
{
7+
echo
8+
echo "$0: enables egress proxy for a given app."
9+
echo "Note that this will not set up egress, but rather re-enable egress that has been disabled with disable-egress."
10+
echo "Syntax: $0 <APP>"
11+
echo " <APP> must be a valid cf app in the current space with egress disabled."
12+
#echo "Options:"
13+
#echo " --space <SPACE>: #TODO"
14+
echo
15+
echo "To disable egress for an app, use disable-egress."
16+
echo "This depends on SSB_DIR and CG_DIR environment variables being set."
17+
exit 1
18+
}
19+
20+
app="$1"
21+
space="$2"
22+
23+
if [ -z "$app" ]; then
24+
echo "No app provided."
25+
help
26+
elif [ -z "$space" ]; then
27+
echo "No space provided."
28+
help
29+
else
30+
# cg-egress-proxy needs jq 🤷
31+
if ! command -v jq &> /dev/null; then
32+
apt-get install jq -y
33+
fi
34+
35+
cp "$SSB_DIR/egress/acl/allow.acl" "$CG_DIR/${app}.allow.acl"
36+
cp "$SSB_DIR/egress/acl/deny.acl" "$CG_DIR/${app}.deny.acl"
37+
38+
# need to be in CG_DIR for cg-egress-proxy scripts to run correctly
39+
cd "$CG_DIR"
40+
bin/cf-deployproxy -a "$app" -s "$space-egress" -e "proxy_url"
41+
fi

‎egress/restart-egress‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
set -e
3+
set -o pipefail
4+
5+
for app in $(cf apps | tail -n +4 | tr -s ' ' | cut -d ' ' -f 1)
6+
do
7+
cf restart "$app" --strategy rolling
8+
done

0 commit comments

Comments
 (0)