Skip to content

Commit 92c1cd9

Browse files
iromlimoabu
iromli
and
moabu
authored
feat(cloud-native): add support for gRPC bridge (#2679)
* feat(cloud-native): add support for gRPC bridge Signed-off-by: iromli <isman.firmansyah@gmail.com> * chore: update FLEX_SOURCE_VERSION Signed-off-by: iromli <isman.firmansyah@gmail.com> * fix: strip /jans-auth when calling authzen-configuration Signed-off-by: iromli <isman.firmansyah@gmail.com> * fix: add missing routes for protected endpoints Signed-off-by: iromli <isman.firmansyah@gmail.com> * refactor: create subchart for gateway-api Signed-off-by: iromli <isman.firmansyah@gmail.com> * chore: explicit appProtocol for grpc service Signed-off-by: iromli <isman.firmansyah@gmail.com> * chore: fix grpc comments Signed-off-by: iromli <isman.firmansyah@gmail.com> * refactor: move gatewayApi configuration to gateway-api Signed-off-by: iromli <isman.firmansyah@gmail.com> * fix: resolve gateway-api chart name Signed-off-by: iromli <isman.firmansyah@gmail.com> * chore: mention about required auth-server.lockEnabled flag Signed-off-by: iromli <isman.firmansyah@gmail.com> * chore: adjust labels and NOTES Signed-off-by: iromli <isman.firmansyah@gmail.com> * refactor(openbanking): change gatewayApi to gateway-api Signed-off-by: iromli <isman.firmansyah@gmail.com> * chore: use scoped airlock-gw-params name Signed-off-by: iromli <isman.firmansyah@gmail.com> * fix: resolve jans-lock endpoints Signed-off-by: iromli <isman.firmansyah@gmail.com> * refactor: reorganize GA implementation Signed-off-by: iromli <isman.firmansyah@gmail.com> * chore: sync openbanking-values.yaml Signed-off-by: iromli <isman.firmansyah@gmail.com> * chore: add Gateway API default labels Signed-off-by: iromli <isman.firmansyah@gmail.com> * chore: set defaultMode for CA cert volume Signed-off-by: iromli <isman.firmansyah@gmail.com> * refactor: reorganize GA implementation Signed-off-by: iromli <isman.firmansyah@gmail.com> * chore: revert FLEX_SOURCE_VERSION Signed-off-by: iromli <isman.firmansyah@gmail.com> * docs: update comment for Loadbalancer IP in YAML Signed-off-by: Mohammad Abudayyeh <47318409+moabu@users.noreply.github.com> --------- Signed-off-by: iromli <isman.firmansyah@gmail.com> Signed-off-by: Isman Firmansyah <iromli@users.noreply.github.com> Signed-off-by: Mohammad Abudayyeh <47318409+moabu@users.noreply.github.com> Co-authored-by: Mohammad Abudayyeh <47318409+moabu@users.noreply.github.com>
1 parent 3732729 commit 92c1cd9

31 files changed

+1326
-332
lines changed

‎charts/gluu-all-in-one/README.md‎

Lines changed: 37 additions & 16 deletions
Large diffs are not rendered by default.

‎charts/gluu-all-in-one/templates/NOTES.txt‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,4 +12,38 @@ RECOMMENDATION:
1212
2. This can be left public in demo or internal development environments only.
1313

1414
********************************************************************************
15-
{{- end }}
15+
{{- end }}
16+
17+
{{- with .Values.gatewayApi }}
18+
{{ if .enabled }}
19+
********************************************************************************
20+
*** WARNING: GATEWAY API CONFIGURATION ***
21+
********************************************************************************
22+
23+
The legacy flag `gatewayApi.enabled` is set to TRUE. Any configuration
24+
previously managed by `gatewayApi` will be ignored. See the following sections
25+
for migration.
26+
27+
RECOMMENDATION:
28+
29+
1. Use `gateway-api.enabled` flag.
30+
2. Use `gateway-api` instead of `gatewayApi` to configure the Gateway API.
31+
32+
ATTRIBUTE CHANGES:
33+
34+
| Legacy | New |
35+
| --------------------------------- | ------------------------------------- |
36+
| `gatewayApi.enabled` | `gateway-api.enabled` |
37+
| `gatewayApi.gatewayClassName` | `gateway-api.gateway.className` |
38+
| `gatewayApi.name` | `gateway-api.gateway.name` |
39+
| `gatewayApi.httpPort` | `gateway-api.gateway.httpPort` |
40+
| `gatewayApi.httpsPort` | `gateway-api.gateway.httpsPort` |
41+
| `gatewayApi.tlsSecretName` | `gateway-api.gateway.tlsSecretName` |
42+
| `gatewayApi.gatewayLabels` | `gateway-api.gateway.labels` |
43+
| `gatewayApi.gatewayAnnotations` | `gateway-api.gateway.annotations` |
44+
| `gatewayApi.routeLabels` | `gateway-api.routes.labels` |
45+
| `gatewayApi.routeAnnotations` | `gateway-api.routes.annotations` |
46+
47+
********************************************************************************
48+
{{- end }}
49+
{{- end }}

‎charts/gluu-all-in-one/templates/configmap.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,8 @@ data:
9494
| replace "scriptLogLevel" "script_log_level"
9595
| replace "auditStatsLogTarget" "audit_log_target"
9696
| replace "auditStatsLogLevel" "audit_log_level"
97+
| replace "lockLogTarget" "lock_log_target"
98+
| replace "lockLogLevel" "lock_log_level"
9799
| replace "enableStdoutLogPrefix" "enable_stdout_log_prefix"
98100
| squote
99101
}}

‎charts/gluu-all-in-one/templates/deployment.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,8 +77,8 @@ spec:
7777
value: {{ include "saml.customJavaOptions" . | trim }}
7878
- name: CN_SCIM_JAVA_OPTIONS
7979
value: {{ include "scim.customJavaOptions" . | trim }}
80-
{{- include "flex-all-in-one.usr-envs" . | indent 12 }}
81-
{{- include "flex-all-in-one.usr-secret-envs" . | indent 12 }}
80+
{{- include "flex-all-in-one.usr-envs" . | indent 10 }}
81+
{{- include "flex-all-in-one.usr-secret-envs" . | indent 10 }}
8282
securityContext:
8383
runAsUser: 1000
8484
runAsNonRoot: true

‎charts/gluu-all-in-one/templates/gw-api-gateway.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{{- if index .Values "gateway-api" "enabled" -}}
2+
3+
{{- $fullName := include "flex-all-in-one.fullname" . -}}
4+
{{- $namespace := .Release.Namespace -}}
5+
6+
apiVersion: gateway.networking.k8s.io/v1
7+
kind: Gateway
8+
metadata:
9+
name: {{ index .Values "gateway-api" "gateway" "name" }}
10+
namespace: {{ $namespace }}
11+
labels:
12+
app: {{ $fullName }}-gateway
13+
{{- if index .Values "gateway-api" "gateway" "labels" }}
14+
{{- toYaml (index .Values "gateway-api" "gateway" "labels") | nindent 4 }}
15+
{{- end }}
16+
{{- if index .Values "gateway-api" "gateway" "annotations" }}
17+
annotations:
18+
{{- toYaml (index .Values "gateway-api" "gateway" "annotations") | nindent 4 }}
19+
{{- end }}
20+
spec:
21+
gatewayClassName: {{ index .Values "gateway-api" "gateway" "className" }}
22+
infrastructure:
23+
labels:
24+
app: {{ $fullName }}-gateway-infrastructure
25+
{{- if index .Values "gateway-api" "gateway" "infrastructure" "labels" }}
26+
{{- toYaml (index .Values "gateway-api" "gateway" "infrastructure" "labels") | nindent 6 }}
27+
{{- end }}
28+
{{- if index .Values "gateway-api" "gateway" "infrastructure" "annotations" }}
29+
annotations:
30+
{{- toYaml (index .Values "gateway-api" "gateway" "infrastructure" "annotations") | nindent 6 }}
31+
{{- end }}
32+
{{- if index .Values "gateway-api" "gateway" "infrastructure" "parametersRef" }}
33+
parametersRef:
34+
{{- toYaml (index .Values "gateway-api" "gateway" "infrastructure" "parametersRef") | nindent 6 }}
35+
{{- else if and (eq (index .Values "gateway-api" "gateway" "className") "airlock-microgateway") (index .Values "gateway-api" "additionalConfig" "airlock" "createLbService") }}
36+
parametersRef:
37+
group: microgateway.airlock.com
38+
kind: GatewayParameters
39+
name: {{ .Release.Name }}-airlock-gw-params
40+
{{- else if and (eq (index .Values "gateway-api" "gateway" "className") "nginx") (index .Values "gateway-api" "gateway" "caCert") }}
41+
parametersRef:
42+
group: gateway.nginx.org
43+
kind: NginxProxy
44+
name: {{ .Release.Name }}-nginx-proxy-config
45+
{{- end }}
46+
{{- if and (index .Values "gateway-api" "gateway" "attachLbIp") (.Values.lbIp) }}
47+
addresses:
48+
- type: IPAddress
49+
value: {{ .Values.lbIp }}
50+
{{- end }}
51+
listeners:
52+
- name: http
53+
port: {{ index .Values "gateway-api" "gateway" "httpPort" }}
54+
protocol: HTTP
55+
- name: https
56+
port: {{ index .Values "gateway-api" "gateway" "httpsPort" }}
57+
protocol: HTTPS
58+
tls:
59+
mode: Terminate
60+
certificateRefs:
61+
- name: {{ index .Values "gateway-api" "gateway" "tlsSecretName" }}
62+
63+
{{- end }}

‎charts/gluu-all-in-one/templates/gw-api-impl-airlock.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if and (index .Values "gateway-api" "enabled") (eq (index .Values "gateway-api" "gateway" "className") "airlock-microgateway") -}}
2+
{{- if index .Values "gateway-api" "additionalConfig" "airlock" "createLbService" }}
3+
apiVersion: microgateway.airlock.com/v1alpha1
4+
kind: GatewayParameters
5+
metadata:
6+
name: {{ .Release.Name }}-airlock-gw-params
7+
namespace: {{ .Release.Namespace }}
8+
spec:
9+
kubernetes:
10+
service:
11+
type: LoadBalancer
12+
{{- end }}
13+
{{- end }}

‎charts/gluu-all-in-one/templates/gw-api-impl-cilium.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{- if and (index .Values "gateway-api" "enabled") (eq (index .Values "gateway-api" "gateway" "className") "cilium") -}}
2+
{{- $fullName := include "flex-all-in-one.fullname" . -}}
3+
{{- if index .Values "gateway-api" "additionalConfig" "cilium" "ipPoolBlocks" }}
4+
apiVersion: "cilium.io/v2"
5+
kind: CiliumLoadBalancerIPPool
6+
metadata:
7+
name: {{ $fullName }}-cilium-ip-pool
8+
spec:
9+
blocks:
10+
{{- toYaml (index .Values "gateway-api" "additionalConfig" "cilium" "ipPoolBlocks") | nindent 4 }}
11+
{{- end }}
12+
{{- end }}

‎charts/gluu-all-in-one/templates/gw-api-impl-envoy.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{{- if and (index .Values "gateway-api" "enabled") (eq (index .Values "gateway-api" "gateway" "className") "envoy") -}}
2+
{{- if index .Values "gateway-api" "additionalConfig" "envoy" "createGatewayClass" }}
3+
apiVersion: gateway.networking.k8s.io/v1
4+
kind: GatewayClass
5+
metadata:
6+
name: envoy
7+
spec:
8+
controllerName: gateway.envoyproxy.io/gatewayclass-controller
9+
{{- end }}
10+
{{- end }}

‎charts/gluu-all-in-one/templates/gw-api-impl-nginx.yaml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{{- if and (index .Values "gateway-api" "enabled") (eq (index .Values "gateway-api" "gateway" "className") "nginx") -}}
2+
3+
{{- if index .Values "gateway-api" "gateway" "caCert" }}
4+
apiVersion: gateway.nginx.org/v1alpha2
5+
kind: NginxProxy
6+
metadata:
7+
name: {{ .Release.Name }}-nginx-proxy-config
8+
namespace: {{ .Release.Namespace }}
9+
spec:
10+
kubernetes:
11+
deployment:
12+
container:
13+
volumeMounts:
14+
- mountPath: /etc/nginx/extra-secrets/ca.crt
15+
name: gateway-ca-cert
16+
subPath: ca.crt
17+
- mountPath: /etc/nginx/extra-secrets
18+
name: extra-secrets
19+
pod:
20+
volumes:
21+
- name: extra-secrets
22+
emptyDir: {}
23+
- name: gateway-ca-cert
24+
secret:
25+
defaultMode: 0664
26+
secretName: {{ .Release.Name }}-gateway-ca-cert
27+
{{- end }}
28+
29+
{{- /* Start of Snippets definition */}}
30+
{{- if and (index .Values "gateway-api" "gateway" "verifyClientCertProtection") (index .Values "gateway-api" "additionalConfig" "nginx" "enableClientCertSnippets") }}
31+
---
32+
33+
apiVersion: gateway.nginx.org/v1alpha1
34+
kind: SnippetsFilter
35+
metadata:
36+
name: {{ .Release.Name }}-nginx-verify-client
37+
namespace: {{ .Release.Namespace }}
38+
spec:
39+
snippets:
40+
- context: http.server.location
41+
value: |
42+
if ($ssl_client_verify != SUCCESS) {
43+
return 403;
44+
}
45+
proxy_set_header X-ClientCert $ssl_client_escaped_cert;
46+
47+
{{- if index .Values "gateway-api" "gateway" "caCert" }}
48+
---
49+
50+
apiVersion: gateway.nginx.org/v1alpha1
51+
kind: SnippetsPolicy
52+
metadata:
53+
name: {{ .Release.Name }}-nginx-verify-client
54+
namespace: {{ .Release.Namespace }}
55+
spec:
56+
targetRefs:
57+
- group: gateway.networking.k8s.io
58+
kind: Gateway
59+
name: {{ index .Values "gateway-api" "gateway" "name" }}
60+
snippets:
61+
- context: http.server
62+
value: |
63+
ssl_client_certificate /etc/nginx/extra-secrets/ca.crt;
64+
ssl_verify_client optional;
65+
{{- end }}
66+
67+
{{- end }}
68+
{{- /* End of Snippets definition */}}
69+
70+
{{- end }}

0 commit comments

Comments
 (0)