IP Allow-List Sample Part 2

.github/workflows/test-sample-apps.yml

@@ -4,6 +4,7 @@ on:
   pull_request_target:
     branches: [ main ]
     types: [ opened, synchronize, reopened ]
+  workflow_dispatch:
 
 permissions:
   pull-requests: write
@@ -57,7 +58,7 @@ jobs:
         run: cf8 login -a "${{ secrets.CF_API }}" -u "${{ secrets.CF_USERNAME }}" -p "${{ secrets.CF_PASSWORD }}" -o "${{ secrets.CF_ORG }}" -s "${{ secrets.CF_SPACE }}" --origin uaa
       - name: Deploy CloudFoundry sample apps
         run: cf8 push -f "${GITHUB_WORKSPACE}/http2/apps-manifest.yml" --var domain=${{ secrets.CF_DOMAIN }} --var hostname_prefix="$HOSTNAME_PREFIX" --vars-file "${GITHUB_WORKSPACE}/http2/gradle.properties"
-      - name: Test Sample apps
+      - name: Test HTTP/2 Sample apps
         run: |
           get_route() {
             echo "${HOSTNAME_PREFIX}${1}.${{ secrets.CF_DOMAIN }}"
@@ -72,13 +73,28 @@ jobs:
           grpcurl -proto http2/node-grpc/example.proto $(get_route node-grpc-test):443 Example.Run
           grpcurl -proto http2/python-grpc/example.proto $(get_route python-grpc-test):443 Example.Run
           grpcurl -proto http2/ruby-grpc/example.proto $(get_route ruby-grpc-test):443 Example.Run
+      - name: Deploy IP Allow-List Sample App
+        run: |
+          cf8 push --var "domain=${{ secrets.CF_DOMAIN }}" --var "suffix=${HOSTNAME_PREFIX}" --manifest "${GITHUB_WORKSPACE}/ip-allow-listing-route-service/manifest.yml"
+          cf8 create-user-provided-service "allow-list-${HOSTNAME_PREFIX}" -r "https://ip-allow-list-rs-${HOSTNAME_PREFIX}.${{ secrets.CF_DOMAIN }}"
+          cf8 bind-route-service "${{ secrets.CF_DOMAIN }}" --hostname "ok-${HOSTNAME_PREFIX}" "allow-list-${HOSTNAME_PREFIX}"
+      - name: Test IP Allow-List Sample App
+        run: |
+          echo "Test IPv4 is accesible"
+          test "$(curl --silent --output /dev/null --write-out "%{http_code}" -4 "https://ok-${HOSTNAME_PREFIX}.cfapps.eu12.hana.ondemand.com")" -eq 200
       - name: Clean-up
         if: success() || failure()
         run: |
+          echo "Deleting service instance"
+          cf8 -f delete-service "allow-list-${HOSTNAME_PREFIX}" || true
           echo "Deleting apps and routes"
           yq e '.applications.[].name' "${GITHUB_WORKSPACE}/http2/apps-manifest.yml" | while read -r app_name; do
               echo "Deleting app: $app_name"
-              cf8 delete "$app_name" -r -f
+              cf8 delete "$app_name" -r -f || true
+          done
+          yq e '.applications.[].name' "${GITHUB_WORKSPACE}/ip-allow-listing-route-service/manifest.yml" | while read -r app_name; do
+              echo "Deleting app: $app_name"
+              cf8 delete "$app_name" -r -f || true
           done
   automerge:
     runs-on: ubuntu-latest

ip-allow-listing-route-service/Procfile

@@ -0,0 +1 @@
+web: ip-allow-listing-route-service

ip-allow-listing-route-service/allowlist.txt

@@ -0,0 +1 @@
+0.0.0.0/0

ip-allow-listing-route-service/main.go

@@ -2,6 +2,8 @@ package main
 
 import (
 	"bufio"
+	"bytes"
+	_ "embed"
 	"errors"
 	"fmt"
 	"log/slog"
@@ -21,6 +23,9 @@ var (
 	ErrInvalidTrueClientIP          = fmt.Errorf("%w: invalid x-cf-true-client-ip header", ErrBadRequest)
 )
 
+//go:embed allowlist.txt
+var allowListFile []byte
+
 func main() {
 	slog.SetDefault(slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug})))
 
@@ -32,12 +37,7 @@ func main() {
 }
 
 func Main() error {
-	allowListFile := os.Getenv("ALLOW_LIST_FILE")
-	if allowListFile == "" {
-		return fmt.Errorf("no file to read prefixes from provided")
-	}
-
-	allowedPrefixes, err := loadPrefixes(allowListFile)
+	allowedPrefixes, err := loadPrefixes()
 	if err != nil {
 		return err
 	}
@@ -59,13 +59,8 @@ func Main() error {
 	return s.ListenAndServe()
 }
 
-func loadPrefixes(path string) (prefixes []netip.Prefix, err error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, err
-	}
-
-	s := bufio.NewScanner(f)
+func loadPrefixes() (prefixes []netip.Prefix, err error) {
+	s := bufio.NewScanner(bytes.NewReader(allowListFile))
 	for s.Scan() {
 		l := strings.TrimSpace(s.Text())
 		if len(l) == 0 || l[0] == '#' {

ip-allow-listing-route-service/manifest.yml

@@ -1,10 +1,19 @@
 applications:
 - name: ip-allow-listing-route-service
+  path: .
+  lifecycle: cnb
   buildpacks:
-  - go_buildpack
+  - docker://docker.io/paketobuildpacks/go
   memory: 128M
   instances: 1
-  env:
-    ALLOW_LIST_FILE: allowlist.txt
   routes:
   - route: ip-allow-list-rs-((suffix)).((domain))
+- name: ok
+  path: ./ok
+  lifecycle: cnb
+  buildpacks:
+  - docker://docker.io/paketobuildpacks/go
+  memory: 64M
+  instances: 1
+  routes:
+  - route: ok-((suffix)).((domain))

ip-allow-listing-route-service/ok/Procfile

@@ -0,0 +1 @@
+web: ok

ip-allow-listing-route-service/ok/go.mod

@@ -0,0 +1,3 @@
+module github.com/sap-samples/cf-routing-samples/ip-allow-listing-route-service/ok
+
+go 1.24.0

ip-allow-listing-route-service/ok/main.go

@@ -0,0 +1,21 @@
+package main
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+)
+
+func main() {
+	err := http.ListenAndServe(":"+os.Getenv("PORT"), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/plain")
+		w.WriteHeader(http.StatusOK)
+		_, err := fmt.Fprint(w, "ok")
+		if err != nil {
+			fmt.Printf("error: handle request: %s\n", err.Error())
+		}
+	}))
+	if err != nil {
+		fmt.Printf("error: server exited: %s\n", err.Error())
+	}
+}