Add initial proxy support for push command

Author: emilioalvap

package-lock.json

@@ -74,7 +74,7 @@
     "sonic-boom": "^3.3.0",
     "source-map-support": "^0.5.21",
     "stack-utils": "^2.0.6",
-    "undici": "^5.29.0",
+    "undici": "^7.11.0",
     "unzip-stream": "^0.3.4",
     "yaml": "^2.2.2"
   },

package.json

@@ -54,6 +54,7 @@ import { createLightweightMonitors } from './push/monitor';
 import { getVersion } from './push/kibana_api';
 import { installTransform } from './core/transform';
 import { totp, TOTPCmdOptions } from './core/mfa';
+import { setGlobalProxy } from './push/utils';
 
 /* eslint-disable-next-line @typescript-eslint/no-var-requires */
 const { name, version } = require('../package.json');
@@ -68,6 +69,11 @@ const {
   tags,
   match,
   fields,
+  proxyToken,
+  proxyUri,
+  proxyNoVerify,
+  proxyCa,
+  proxyCert,
 } = getCommonCommandOpts();
 
 program
@@ -193,9 +199,12 @@ program
     '--space <space>',
     'the target Kibana spaces for the pushed monitors — spaces help you organise pushed monitors.'
   )
-  .option('--proxy_uri <uri>', 'proxy uri to use when pushing to kibana')
-  .option('--proxy_token <token>', 'auth token to use the proxy')
   .option('-y, --yes', 'skip all questions and run non-interactively')
+  .addOption(proxyUri)
+  .addOption(proxyToken)
+  .addOption(proxyNoVerify)
+  .addOption(proxyCa)
+  .addOption(proxyCert)
   .addOption(pattern)
   .addOption(tags)
   .addOption(fields)
@@ -218,6 +227,16 @@ program
         },
         'push'
       )) as PushOptions;
+
+      //Set up global proxy agent if any of the related options are set
+      setGlobalProxy(
+        options.proxyUri,
+        options.proxyToken,
+        options.proxyNoVerify ? false : true,
+        options.proxyCa,
+        options.proxyCert
+      );
+
       await validatePush(options, settings);
       const monitors = runner._buildMonitors(options);
       if ((options as CliArgs).throttling == null) {

src/cli.ts

@@ -263,8 +263,11 @@ export type PushOptions = Partial<ProjectSettings> &
     retestOnFailure?: MonitorConfig['retestOnFailure'];
     enabled?: boolean;
     grepOpts?: GrepOptions;
-    proxy_uri?: string;
-    proxy_token?: string;
+    proxyUri?: string;
+    proxyToken?: string;
+    proxyCa?: string;
+    proxyCert?: string;
+    proxyNoVerify?: string;
   };
 
 export type ProjectSettings = {

src/common_types.ts

@@ -49,7 +49,6 @@ export async function getLocations(options: LocationCmdOptions) {
     url: generateURL(options, 'location'),
     method: 'GET',
     auth: options.auth,
-    proxyAgent: null, // for now we don't support proxy with this.
   });
   return resp.locations;
 }

src/locations/index.ts

@@ -28,6 +28,8 @@ import { createOption } from 'commander';
 import { readConfig } from './config';
 import type { CliArgs, RunOptions } from './common_types';
 import { THROTTLING_WARNING_MSG, warn } from './helpers';
+import path from 'path';
+import { existsSync, readFileSync } from 'fs';
 
 type Mode = 'run' | 'push';
 
@@ -255,6 +257,27 @@ export function getCommonCommandOpts() {
     }, {});
   });
 
+  const proxyUri = createOption(
+    '--proxy-uri <uri>',
+    'proxy uri to use when pushing to kibana'
+  );
+  const proxyToken = createOption(
+    '--proxy-token <token>',
+    'auth token to use the proxy'
+  );
+  const proxyCa = createOption(
+    '--proxy-ca <path>',
+    'provide a CA override for proxy endpoint, as a path to be loaded or as string '
+  ).argParser(parseFileOption);
+  const proxyCert = createOption(
+    '--proxy-cert <path>',
+    'provide a cert override for proxy endpoint, as a path to be loaded or as string '
+  ).argParser(parseFileOption);
+  const proxyNoVerify = createOption(
+    '--proxy-no-verify',
+    'disable TLS verification for the proxy connection'
+  );
+
   return {
     auth,
     authMandatory,
@@ -265,6 +288,11 @@ export function getCommonCommandOpts() {
     tags,
     match,
     fields,
+    proxyUri,
+    proxyToken,
+    proxyCa,
+    proxyCert,
+    proxyNoVerify,
   };
 }
 
@@ -299,3 +327,17 @@ function parseAsBuffer(value: any): Buffer {
     return value;
   }
 }
+
+function parseFileOption(value: string) {
+  const filePath = path.resolve(value);
+
+  if (!existsSync(filePath)) {
+    return value;
+  }
+
+  try {
+    return readFileSync(filePath);
+  } catch (e) {
+    throw new Error(`could not be read provided path ${filePath}: ${e}`);
+  }
+}

src/options.ts

@@ -34,7 +34,7 @@ import {
   sendRequest,
   APIMonitorError,
 } from './request';
-import { build_proxy_settings, generateURL } from './utils';
+import { generateURL } from './utils';
 
 // Default batch size for bulk put / delete
 export const BATCH_SIZE = parseInt(process.env.CHUNK_SIZE) || 250;
@@ -57,7 +57,6 @@ export async function bulkPutMonitors(
     method: 'PUT',
     auth: options.auth,
     body: JSON.stringify({ monitors: schemas }),
-    proxyAgent: build_proxy_settings(options.proxy_uri, options.proxy_token),
   });
 
   const { failedMonitors } = resp;
@@ -104,7 +103,6 @@ const fetchMonitors = async (options: PushOptions, afterKey?: string) => {
     url,
     method: 'GET',
     auth: options.auth,
-    proxyAgent: build_proxy_settings(options.proxy_uri, options.proxy_token),
   });
   return {
     afterKey: resp.after_key,
@@ -126,7 +124,6 @@ export async function bulkDeleteMonitors(
     method: 'DELETE',
     auth: options.auth,
     body: JSON.stringify({ monitors: monitorIDs }),
-    proxyAgent: build_proxy_settings(options.proxy_uri, options.proxy_token),
   });
 }
 
@@ -141,7 +138,6 @@ export async function getVersion(options: PushOptions) {
     url: generateURL(options, 'status'),
     method: 'GET',
     auth: options.auth,
-    proxyAgent: build_proxy_settings(options?.proxy_uri, options?.proxy_token),
   });
 
   return data.kibana.version;
@@ -173,7 +169,6 @@ export async function createMonitorsLegacy({
     method: 'PUT',
     auth: options.auth,
     body: JSON.stringify(schema),
-    proxyAgent: build_proxy_settings(options.proxy_uri, options.proxy_token),
   });
 
   const resBody = await handleError(statusCode, url, body);

src/push/kibana_api.ts

@@ -32,7 +32,6 @@ import { indent, symbols } from '../helpers';
 const { version } = require('../../package.json');
 
 export type APIRequestOptions = {
-  proxyAgent: Dispatcher;
   url: string;
   method: Dispatcher.HttpMethod;
   auth: string;
@@ -53,7 +52,6 @@ export async function sendRequest(options: APIRequestOptions) {
     // align with the default timeout of the kibana route
     headersTimeout: 2 * 60 * 1000,
   };
-  if (options.proxyAgent) request_options['dispatcher'] = options.proxyAgent;
   return await request(options.url, request_options);
 }
 

src/push/request.ts

@@ -28,7 +28,8 @@ import { progress, removeTrailingSlash } from '../helpers';
 import { green, red, grey, yellow, Colorize, bold } from 'kleur/colors';
 import { PushOptions } from '../common_types';
 import { Monitor } from '../dsl/monitor';
-import { ProxyAgent } from 'undici';
+import { ProxyAgent, setGlobalDispatcher } from 'undici';
+import { EnvHttpProxyAgent } from 'undici';
 
 export function logDiff<T extends Set<string>>(
   newIDs: T,
@@ -201,13 +202,21 @@ export function normalizeMonitorName(p: string, replacement = '_') {
   return p;
 }
 
-export function build_proxy_settings(proxy_uri: string, proxy_auth: string) {
-  let proxyAgent = null;
-  if (proxy_uri) {
-    proxyAgent = new ProxyAgent({
-      uri: proxy_uri,
-      token: proxy_auth,
-    });
-  }
-  return proxyAgent;
+export function setGlobalProxy(
+  uri: string,
+  token: string,
+  rejectUnauthorized: boolean,
+  ca: string,
+  cert: string
+) {
+  // Create proxy agent if options exist, if not attempt to load env proxy
+  const proxyAgent = uri
+    ? new ProxyAgent({
+        uri,
+        token,
+        proxyTls: { ca: ca ?? null, cert: cert ?? null, rejectUnauthorized },
+      })
+    : new EnvHttpProxyAgent();
+
+  setGlobalDispatcher(proxyAgent);
 }