Skip to content

Commit b515032

Browse files
bjee19bjee19
committed
WIP just need a couple more tests
1 parent 8e779fc commit b515032

File tree

15 files changed

+452
-51
lines changed

15 files changed

+452
-51
lines changed

‎charts/nginx-gateway-fabric/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
264264
| `certGenerator.ttlSecondsAfterFinished` | How long to wait after the cert generator job has finished before it is removed by the job controller. | int | `30` |
265265
| `clusterDomain` | The DNS cluster domain of your Kubernetes cluster. | string | `"cluster.local"` |
266266
| `gateways` | A list of Gateway objects. View https://gateway-api.sigs.k8s.io/reference/spec/#gateway for full Gateway reference. | list | `[]` |
267-
| `nginx` | The nginx section contains the configuration for all NGINX data plane deployments installed by the NGINX Gateway Fabric control plane. | object | `{"config":{},"container":{"hostPorts":[],"lifecycle":{},"readinessProbe":{},"resources":{},"volumeMounts":[]},"debug":false,"image":{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric/nginx","tag":"edge"},"imagePullSecret":"","imagePullSecrets":[],"kind":"deployment","plus":false,"pod":{},"replicas":1,"service":{"externalTrafficPolicy":"Local","loadBalancerClass":"","loadBalancerIP":"","loadBalancerSourceRanges":[],"nodePorts":[],"type":"LoadBalancer"},"usage":{"caSecretName":"","clientSSLSecretName":"","endpoint":"","resolver":"","secretName":"nplus-license","skipVerify":false}}` |
267+
| `nginx` | The nginx section contains the configuration for all NGINX data plane deployments installed by the NGINX Gateway Fabric control plane. | object | `{"config":{},"container":{"hostPorts":[],"lifecycle":{},"readinessProbe":{},"resources":{},"volumeMounts":[]},"debug":false,"image":{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric/nginx","tag":"edge"},"imagePullSecret":"","imagePullSecrets":[],"kind":"deployment","nginxOneConsole":{"dataplaneKeySecretName":"","endpointHost":"product.connect.nginx.com","endpointPort":443,"tlsSkipVerify":false},"plus":false,"pod":{},"replicas":1,"service":{"externalTrafficPolicy":"Local","loadBalancerClass":"","loadBalancerIP":"","loadBalancerSourceRanges":[],"nodePorts":[],"type":"LoadBalancer"},"usage":{"caSecretName":"","clientSSLSecretName":"","endpoint":"","resolver":"","secretName":"nplus-license","skipVerify":false}}` |
268268
| `nginx.config` | The configuration for the data plane that is contained in the NginxProxy resource. This is applied globally to all Gateways managed by this instance of NGINX Gateway Fabric. | object | `{}` |
269269
| `nginx.container` | The container configuration for the NGINX container. This is applied globally to all Gateways managed by this instance of NGINX Gateway Fabric. | object | `{"hostPorts":[],"lifecycle":{},"readinessProbe":{},"resources":{},"volumeMounts":[]}` |
270270
| `nginx.container.hostPorts` | A list of HostPorts to expose on the host. This configuration allows containers to bind to a specific port on the host node, enabling external network traffic to reach the container directly through the host's IP address and port. Use this option when you need to expose container ports on the host for direct access, such as for debugging, legacy integrations, or when NodePort/LoadBalancer services are not suitable. Note: Using hostPort may have security and scheduling implications, as it ties pods to specific nodes and ports. | list | `[]` |

‎charts/nginx-gateway-fabric/templates/deployment.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,18 @@ spec:
103103
{{- if .Capabilities.APIVersions.Has "security.openshift.io/v1/SecurityContextConstraints" }}
104104
- --nginx-scc={{ include "nginx-gateway.scc-name" . }}-nginx
105105
{{- end}}
106+
{{- if .Values.nginx.nginxOneConsole.dataplaneKeySecretName }}
107+
- --nginx-one-console-dataplane-key-secret={{ .Values.nginx.nginxOneConsole.dataplaneKeySecretName }}
108+
{{- if .Values.nginx.nginxOneConsole.endpointHost }}
109+
- --nginx-one-console-telemetry-endpoint-host={{ .Values.nginx.nginxOneConsole.endpointHost }}
110+
{{- end }}
111+
{{- if .Values.nginx.nginxOneConsole.endpointPort }}
112+
- --nginx-one-console-telemetry-endpoint-port={{ .Values.nginx.nginxOneConsole.endpointPort }}
113+
{{- end }}
114+
{{- if .Values.nginx.nginxOneConsole.tlsSkipVerify }}
115+
- --nginx-one-console-tls-skip-verify
116+
{{- end }}
117+
{{- end }}
106118
env:
107119
- name: POD_NAMESPACE
108120
valueFrom:

‎charts/nginx-gateway-fabric/values.schema.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -445,6 +445,42 @@
445445
"required": [],
446446
"title": "kind"
447447
},
448+
"nginxOneConsole": {
449+
"description": "Configuration for NGINX One Console.",
450+
"properties": {
451+
"dataplaneKeySecretName": {
452+
"default": "",
453+
"description": "Name of the secret which holds the dataplane key that is required to authenticate with the NGINX One Console.",
454+
"required": [],
455+
"title": "dataplaneKeySecretName",
456+
"type": "string"
457+
},
458+
"endpointHost": {
459+
"default": "product.connect.nginx.com",
460+
"description": "The Endpoint host that the NGINX One Console telemetry metrics will be sent to. ",
461+
"required": [],
462+
"title": "endpointHost",
463+
"type": "string"
464+
},
465+
"endpointPort": {
466+
"default": 443,
467+
"description": "The endpoint port that the NGINX One Console telemetry metrics will be sent to.",
468+
"required": [],
469+
"title": "endpointPort",
470+
"type": "integer"
471+
},
472+
"tlsSkipVerify": {
473+
"default": false,
474+
"description": "NGINX One Console configuration specifying tls skip verify.",
475+
"required": [],
476+
"title": "tlsSkipVerify",
477+
"type": "boolean"
478+
}
479+
},
480+
"required": [],
481+
"title": "nginxOneConsole",
482+
"type": "object"
483+
},
448484
"plus": {
449485
"default": false,
450486
"description": "Is NGINX Plus image being used.",

‎charts/nginx-gateway-fabric/values.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,20 @@ nginx:
212212
# -- Is NGINX Plus image being used.
213213
plus: false
214214

215+
# Configuration for NGINX One Console.
216+
nginxOneConsole:
217+
# Name of the secret which holds the dataplane key that is required to authenticate with the NGINX One Console.
218+
dataplaneKeySecretName: ""
219+
220+
# The Endpoint host that the NGINX One Console telemetry metrics will be sent to.
221+
endpointHost: "product.connect.nginx.com"
222+
223+
# The endpoint port that the NGINX One Console telemetry metrics will be sent to.
224+
endpointPort: 443
225+
226+
# NGINX One Console configuration specifying tls skip verify.
227+
tlsSkipVerify: false
228+
215229
# -- The name of the secret containing docker registry credentials.
216230
# Secret must exist in the same namespace as the helm release. The control
217231
# plane will copy this secret into any namespace where NGINX is deployed.

‎cmd/gateway/commands.go

Lines changed: 71 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import (
66
"os"
77
"runtime/debug"
88
"strconv"
9-
"strings"
109
"time"
1110

1211
"github.com/spf13/cobra"
@@ -58,27 +57,31 @@ func createRootCommand() *cobra.Command {
5857
func createControllerCommand() *cobra.Command {
5958
// flag names
6059
const (
61-
configFlag = "config"
62-
serviceFlag = "service"
63-
agentTLSSecretFlag = "agent-tls-secret"
64-
metricsDisableFlag = "metrics-disable"
65-
metricsSecureFlag = "metrics-secure-serving"
66-
metricsPortFlag = "metrics-port"
67-
healthDisableFlag = "health-disable"
68-
healthPortFlag = "health-port"
69-
leaderElectionDisableFlag = "leader-election-disable"
70-
leaderElectionLockNameFlag = "leader-election-lock-name"
71-
productTelemetryDisableFlag = "product-telemetry-disable"
72-
gwAPIExperimentalFlag = "gateway-api-experimental-features"
73-
nginxDockerSecretFlag = "nginx-docker-secret" //nolint:gosec // not credentials
74-
usageReportSecretFlag = "usage-report-secret"
75-
usageReportEndpointFlag = "usage-report-endpoint"
76-
usageReportResolverFlag = "usage-report-resolver"
77-
usageReportSkipVerifyFlag = "usage-report-skip-verify"
78-
usageReportClientSSLSecretFlag = "usage-report-client-ssl-secret" //nolint:gosec // not credentials
79-
usageReportCASecretFlag = "usage-report-ca-secret" //nolint:gosec // not credentials
80-
snippetsFiltersFlag = "snippets-filters"
81-
nginxSCCFlag = "nginx-scc"
60+
configFlag = "config"
61+
serviceFlag = "service"
62+
agentTLSSecretFlag = "agent-tls-secret"
63+
nginxOneConsoleDataplaneKeySecretFlag = "nginx-one-console-dataplane-key-secret"
64+
nginxOneConsoleTelemetryEndpointHostFlag = "nginx-one-console-telemetry-endpoint-host"
65+
nginxOneConsoleTelemetryEndpointPortFlag = "nginx-one-console-telemetry-endpoint-port"
66+
nginxOneConsoleTLSSkipVerifyFlag = "nginx-one-console-tls-skip-verify"
67+
metricsDisableFlag = "metrics-disable"
68+
metricsSecureFlag = "metrics-secure-serving"
69+
metricsPortFlag = "metrics-port"
70+
healthDisableFlag = "health-disable"
71+
healthPortFlag = "health-port"
72+
leaderElectionDisableFlag = "leader-election-disable"
73+
leaderElectionLockNameFlag = "leader-election-lock-name"
74+
productTelemetryDisableFlag = "product-telemetry-disable"
75+
gwAPIExperimentalFlag = "gateway-api-experimental-features"
76+
nginxDockerSecretFlag = "nginx-docker-secret" //nolint:gosec // not credentials
77+
usageReportSecretFlag = "usage-report-secret"
78+
usageReportEndpointFlag = "usage-report-endpoint"
79+
usageReportResolverFlag = "usage-report-resolver"
80+
usageReportSkipVerifyFlag = "usage-report-skip-verify"
81+
usageReportClientSSLSecretFlag = "usage-report-client-ssl-secret" //nolint:gosec // not credentials
82+
usageReportCASecretFlag = "usage-report-ca-secret" //nolint:gosec // not credentials
83+
snippetsFiltersFlag = "snippets-filters"
84+
nginxSCCFlag = "nginx-scc"
8285
)
8386

8487
// flag values
@@ -101,7 +104,19 @@ func createControllerCommand() *cobra.Command {
101104
validator: validateResourceName,
102105
value: agentTLSSecret,
103106
}
104-
nginxSCCName = stringValidatingValue{
107+
nginxOneConsoleDataplaneKeySecretName = stringValidatingValue{
108+
validator: validateResourceName,
109+
}
110+
nginxOneConsoleTelemetryEndpointHost = stringValidatingValue{
111+
validator: validateResourceName,
112+
value: "product.connect.nginx.com",
113+
}
114+
nginxOneConsoleTelemetryEndpointPort = intValidatingValue{
115+
validator: validateProtocolPort,
116+
value: 443,
117+
}
118+
nginxOneConsoleTLSSkipVerify bool
119+
nginxSCCName = stringValidatingValue{
105120
validator: validateResourceName,
106121
}
107122
disableMetrics bool
@@ -257,6 +272,12 @@ func createControllerCommand() *cobra.Command {
257272
NginxDockerSecretNames: nginxDockerSecrets.values,
258273
AgentTLSSecretName: agentTLSSecretName.value,
259274
NGINXSCCName: nginxSCCName.value,
275+
NginxOneConsoleTelemetryConfig: config.NginxOneConsoleTelemetryConfig{
276+
DataplaneKeySecretName: nginxOneConsoleDataplaneKeySecretName.value,
277+
EndpointHost: nginxOneConsoleTelemetryEndpointHost.value,
278+
EndpointPort: nginxOneConsoleTelemetryEndpointPort.value,
279+
EndpointTLSSkipVerify: nginxOneConsoleTLSSkipVerify,
280+
},
260281
}
261282

262283
if err := controller.StartManager(conf); err != nil {
@@ -304,6 +325,32 @@ func createControllerCommand() *cobra.Command {
304325
`NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway).`,
305326
)
306327

328+
cmd.Flags().Var(
329+
&nginxOneConsoleDataplaneKeySecretName,
330+
nginxOneConsoleDataplaneKeySecretFlag,
331+
`The name of the Secret containing the NGINX One Console's dataplane key. Must exist in the same namespace that `+
332+
`the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway).`,
333+
)
334+
335+
cmd.Flags().Var(
336+
&nginxOneConsoleTelemetryEndpointHost,
337+
nginxOneConsoleTelemetryEndpointHostFlag,
338+
`The host of the NGINX One Console's telemetry endpoint.`,
339+
)
340+
341+
cmd.Flags().Var(
342+
&nginxOneConsoleTelemetryEndpointPort,
343+
nginxOneConsoleTelemetryEndpointPortFlag,
344+
`The port of the NGINX One Console's telemetry endpoint.`,
345+
)
346+
347+
cmd.Flags().BoolVar(
348+
&nginxOneConsoleTLSSkipVerify,
349+
nginxOneConsoleTLSSkipVerifyFlag,
350+
false,
351+
"Disable client verification of the NGINX One Console's telemetry endpoint server certificate.",
352+
)
353+
307354
cmd.Flags().BoolVar(
308355
&disableMetrics,
309356
metricsDisableFlag,
@@ -741,19 +788,13 @@ func createGatewayPodConfig(version, svcName string) (config.GatewayPodConfig, e
741788
return config.GatewayPodConfig{}, err
742789
}
743790

744-
// use image tag version if set, otherwise fall back to binary version
745-
ngfVersion := version
746-
if imageParts := strings.Split(image, ":"); len(imageParts) == 2 {
747-
ngfVersion = imageParts[1]
748-
}
749-
750791
c := config.GatewayPodConfig{
751792
ServiceName: svcName,
752793
Namespace: ns,
753794
Name: name,
754795
UID: podUID,
755796
InstanceName: instance,
756-
Version: ngfVersion,
797+
Version: version,
757798
Image: image,
758799
}
759800

‎cmd/gateway/commands_test.go

Lines changed: 64 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,10 @@ func TestControllerCmdFlagValidation(t *testing.T) {
156156
"--usage-report-client-ssl-secret=client-secret",
157157
"--snippets-filters",
158158
"--nginx-scc=nginx-sscc-name",
159+
"--nginx-one-console-dataplane-key-secret=dataplane-key-secret",
160+
"--nginx-one-console-telemetry-endpoint-host=telemetry-endpoint-host",
161+
"--nginx-one-console-telemetry-endpoint-port=443",
162+
"--nginx-one-console-tls-skip-verify",
159163
},
160164
wantErr: false,
161165
},
@@ -426,6 +430,65 @@ func TestControllerCmdFlagValidation(t *testing.T) {
426430
wantErr: true,
427431
expectedErrPrefix: `invalid argument "!@#$" for "--nginx-scc" flag: invalid format: `,
428432
},
433+
{
434+
name: "nginx-one-console-dataplane-key-secret is set to empty string",
435+
args: []string{
436+
"--nginx-one-console-dataplane-key-secret=",
437+
},
438+
wantErr: true,
439+
expectedErrPrefix: `invalid argument "" for "--nginx-one-console-dataplane-key-secret" flag: must be set`,
440+
},
441+
{
442+
name: "nginx-one-console-dataplane-key-secret is invalid",
443+
args: []string{
444+
"--nginx-one-console-dataplane-key-secret=!@#$",
445+
},
446+
wantErr: true,
447+
expectedErrPrefix: `invalid argument "!@#$" for "--nginx-one-console-dataplane-key-secret" flag: invalid format: `,
448+
},
449+
{
450+
name: "nginx-one-console-telemetry-endpoint-host is set to empty string",
451+
args: []string{
452+
"--nginx-one-console-telemetry-endpoint-host=",
453+
},
454+
wantErr: true,
455+
expectedErrPrefix: `invalid argument "" for "--nginx-one-console-telemetry-endpoint-host" flag: must be set`,
456+
},
457+
{
458+
name: "nginx-one-console-telemetry-endpoint-host is invalid",
459+
args: []string{
460+
"--nginx-one-console-telemetry-endpoint-host=!@#$",
461+
},
462+
wantErr: true,
463+
expectedErrPrefix: `invalid argument "!@#$" for "--nginx-one-console-telemetry-endpoint-host" flag: invalid format: `,
464+
},
465+
{
466+
name: "nginx-one-console-telemetry-endpoint-port is invalid type",
467+
args: []string{
468+
"--nginx-one-console-telemetry-endpoint-port=invalid", // not an int
469+
},
470+
wantErr: true,
471+
expectedErrPrefix: `invalid argument "invalid" for "--nginx-one-console-telemetry-endpoint-port" flag: failed to parse int value:` +
472+
` strconv.ParseInt: parsing "invalid": invalid syntax`,
473+
},
474+
{
475+
name: "nginx-one-console-telemetry-endpoint-port is outside of range",
476+
args: []string{
477+
"--nginx-one-console-telemetry-endpoint-port=65536", // outside of range
478+
},
479+
wantErr: true,
480+
expectedErrPrefix: `invalid argument "65536" for "--nginx-one-console-telemetry-endpoint-port" flag:` +
481+
` port outside of valid port range [1 - 65535]: 65536`,
482+
},
483+
{
484+
name: "nginx-one-console-tls-skip-verify is not a bool",
485+
expectedErrPrefix: `invalid argument "not-a-bool" for "--nginx-one-console-tls-skip-verify" flag: strconv.ParseBool:` +
486+
` parsing "not-a-bool": invalid syntax`,
487+
args: []string{
488+
"--nginx-one-console-tls-skip-verify=not-a-bool",
489+
},
490+
wantErr: true,
491+
},
429492
}
430493

431494
// common flags validation is tested separately
@@ -753,21 +816,13 @@ func TestCreateGatewayPodConfig(t *testing.T) {
753816
Name: "my-pod",
754817
UID: "1234",
755818
InstanceName: "my-pod-xyz",
756-
Version: "tag",
819+
Version: "0.0.0",
757820
Image: "my-pod-image:tag",
758821
}
759822
cfg, err := createGatewayPodConfig(version, "svc")
760823
g.Expect(err).To(Not(HaveOccurred()))
761824
g.Expect(cfg).To(Equal(expCfg))
762825

763-
// unset image tag and use provided version
764-
g.Expect(os.Setenv("IMAGE_NAME", "my-pod-image")).To(Succeed())
765-
expCfg.Version = version
766-
expCfg.Image = "my-pod-image"
767-
cfg, err = createGatewayPodConfig(version, "svc")
768-
g.Expect(err).To(Not(HaveOccurred()))
769-
g.Expect(cfg).To(Equal(expCfg))
770-
771826
// unset image name
772827
g.Expect(os.Unsetenv("IMAGE_NAME")).To(Succeed())
773828
cfg, err = createGatewayPodConfig(version, "svc")

‎cmd/gateway/validation.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,14 @@ func validatePort(port int) error {
157157
return nil
158158
}
159159

160+
// validateProtocolPort makes sure a given port is inside the valid port range for its usage. This also includes well known ports.
161+
func validateProtocolPort(port int) error {
162+
if port < 1 || port > 65535 {
163+
return fmt.Errorf("port outside of valid port range [1 - 65535]: %v", port)
164+
}
165+
return nil
166+
}
167+
160168
// ensureNoPortCollisions checks if the same port has been defined multiple times.
161169
func ensureNoPortCollisions(ports ...int) error {
162170
seen := make(map[int]struct{})

0 commit comments

Comments
 (0)