Skip to content

Commit c32d1b8

Browse files
maruiz93maruiz93
committed
Refactor nginx config in prod
Follow up of 7033 PR Signed-off-by: Marta Anon <[email protected]>
1 parent c6ebe43 commit c32d1b8

File tree

19 files changed

+67
-88
lines changed

19 files changed

+67
-88
lines changed

‎components/konflux-ui/production/base/proxy/auth.conf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Auth configuration with impersonation enabled
2+
auth_request_set $user $upstream_http_x_auth_request_email;
3+
proxy_set_header Impersonate-User $user;
4+
proxy_set_header Impersonate-Group system:authenticated;
5+
proxy_set_header Authorization "Bearer __BEARER_TOKEN__";

‎components/konflux-ui/production/base/proxy/kubearchive.conf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
location /api/k8s/plugins/kubearchive/ {
2+
auth_request /oauth2/auth;
3+
rewrite /api/k8s/plugins/kubearchive/(.+) /$1 break;
4+
proxy_read_timeout 30m;
5+
proxy_pass https://kubearchive-api-server.product-kubearchive.svc.cluster.local:8081;
6+
include /mnt/nginx-generated-config/auth.conf;
7+
}

‎components/konflux-ui/production/base/proxy/kustomization.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,11 @@ configMapGenerator:
77
- name: proxy
88
files:
99
- nginx.conf
10+
- name: proxy-nginx-templates
11+
files:
12+
- auth.conf
13+
- name: proxy-nginx-static
14+
files:
15+
- tekton-results.conf
16+
- tekton-results-workspaces.conf
17+
- kubearchive.conf

‎components/konflux-ui/production/base/proxy/nginx.conf

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -139,24 +139,7 @@ http {
139139
include /mnt/nginx-generated-config/auth.conf;
140140
}
141141

142-
# Deprecated
143-
location /api/k8s/plugins/tekton-results/workspaces/ {
144-
auth_request /oauth2/auth;
145-
146-
rewrite /api/k8s/plugins/tekton-results/workspaces/.+?/(.+) /$1 break;
147-
proxy_read_timeout 30m;
148-
include /mnt/nginx-generated-config/tekton-results.conf;
149-
include /mnt/nginx-generated-config/auth.conf;
150-
}
151142

152-
location /api/k8s/plugins/tekton-results/ {
153-
auth_request /oauth2/auth;
154-
155-
rewrite /api/k8s/plugins/tekton-results/(.+) /$1 break;
156-
proxy_read_timeout 30m;
157-
include /mnt/nginx-generated-config/tekton-results.conf;
158-
include /mnt/nginx-generated-config/auth.conf;
159-
}
160143

161144
# GET requests to /api/k8s/api/v1/namespaces and /api/k8s/api/v1/namespaces/
162145
# are handled from the namespace-lister.
@@ -200,6 +183,5 @@ http {
200183
}
201184

202185
include /mnt/nginx-additional-location-configs/*.conf;
203-
include /mnt/nginx-generated-config/kubearchive.conf;
204186
}
205187
}

‎components/konflux-ui/production/base/proxy/proxy.yaml

Lines changed: 16 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -54,48 +54,23 @@ spec:
5454
memory: 64Mi
5555
- name: generate-nginx-configs
5656
image: registry.access.redhat.com/ubi9/ubi@sha256:66233eebd72bb5baa25190d4f55e1dc3fff3a9b77186c1f91a0abdb274452072
57-
envFrom:
58-
- configMapRef:
59-
name: proxy-init-config
6057
command:
6158
- sh
6259
- -c
6360
- |
6461
set -e
6562
66-
auth_conf=/mnt/nginx-generated-config/auth.conf
67-
68-
if [[ "$IMPERSONATE" == "true" ]]; then
69-
token=$(cat /mnt/api-token/token)
70-
echo 'auth_request_set $user $upstream_http_x_auth_request_email;' > "$auth_conf"
71-
echo 'proxy_set_header Impersonate-User $user;' >> "$auth_conf"
72-
echo 'proxy_set_header Impersonate-Group system:authenticated;' >> "$auth_conf"
73-
echo "proxy_set_header Authorization \"Bearer $token\";" >> "$auth_conf"
74-
else
75-
echo "# impersonation was disabled by config" > "$auth_conf"
76-
fi
63+
# Generate auth.conf with bearer token replacement
64+
token=$(cat /mnt/api-token/token)
65+
sed "s/__BEARER_TOKEN__/$token/g" /mnt/nginx-templates/auth.conf > /mnt/nginx-generated-config/auth.conf
7766
78-
chmod 640 "$auth_conf"
79-
80-
echo \
81-
"proxy_pass ${TEKTON_RESULTS_URL:?tekton results url must be provided};" \
82-
> /mnt/nginx-generated-config/tekton-results.conf
83-
84-
if [[ "$KUBEARCHIVE_URL" != "" ]]; then
85-
echo "location /api/k8s/plugins/kubearchive/ {" > /mnt/nginx-generated-config/kubearchive.conf
86-
echo "auth_request /oauth2/auth;" >> /mnt/nginx-generated-config/kubearchive.conf
87-
echo "rewrite /api/k8s/plugins/kubearchive/(.+) /\$1 break;" >> /mnt/nginx-generated-config/kubearchive.conf
88-
echo "proxy_read_timeout 30m;" >> /mnt/nginx-generated-config/kubearchive.conf
89-
echo "proxy_pass ${KUBEARCHIVE_URL};" >> /mnt/nginx-generated-config/kubearchive.conf
90-
echo "include /mnt/nginx-generated-config/auth.conf;" >> /mnt/nginx-generated-config/kubearchive.conf
91-
echo "}" >> /mnt/nginx-generated-config/kubearchive.conf
92-
else
93-
echo "# KubeArchive disabled by config" > /mnt/nginx-generated-config/kubearchive.conf
94-
fi
67+
chmod 640 /mnt/nginx-generated-config/auth.conf
9568
9669
volumeMounts:
9770
- name: nginx-generated-config
9871
mountPath: /mnt/nginx-generated-config
72+
- name: nginx-templates
73+
mountPath: /mnt/nginx-templates
9974
- name: api-token
10075
mountPath: /mnt/api-token
10176
securityContext:
@@ -167,6 +142,8 @@ spec:
167142
mountPath: /mnt
168143
- name: nginx-generated-config
169144
mountPath: /mnt/nginx-generated-config
145+
- name: nginx-static
146+
mountPath: /mnt/nginx-additional-location-configs
170147
- name: static-content
171148
mountPath: /opt/app-root/src/static-content
172149
securityContext:
@@ -228,6 +205,14 @@ spec:
228205
- key: nginx.conf
229206
path: nginx.conf
230207
name: proxy
208+
- configMap:
209+
defaultMode: 420
210+
name: proxy-nginx-templates
211+
name: nginx-templates
212+
- configMap:
213+
defaultMode: 420
214+
name: proxy-nginx-static
215+
name: nginx-static
231216
- name: logs
232217
emptyDir: {}
233218
- name: nginx-tmp

‎components/konflux-ui/production/base/proxy/tekton-results-workspaces.conf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Deprecated
2+
location /api/k8s/plugins/tekton-results/workspaces/ {
3+
auth_request /oauth2/auth;
4+
5+
rewrite /api/k8s/plugins/tekton-results/workspaces/.+?/(.+) /$1 break;
6+
proxy_read_timeout 30m;
7+
include /mnt/nginx-generated-config/tekton-results.conf;
8+
include /mnt/nginx-generated-config/auth.conf;
9+
}

‎components/konflux-ui/production/base/proxy/tekton-results.conf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
location /api/k8s/plugins/tekton-results/ {
2+
auth_request /oauth2/auth;
3+
4+
rewrite /api/k8s/plugins/tekton-results/(.+) /$1 break;
5+
proxy_read_timeout 30m;
6+
proxy_pass https://tekton-results-api-service.tekton-results.svc.cluster.local:8080;
7+
include /mnt/nginx-generated-config/auth.conf;
8+
}

‎components/konflux-ui/production/kflux-ocp-p01/kustomization.yaml

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,6 @@ configMapGenerator:
99
- name: dex
1010
files:
1111
- dex-config.yaml
12-
- name: proxy-init-config
13-
literals:
14-
- IMPERSONATE=true
15-
- TEKTON_RESULTS_URL=https://tekton-results-api-service.tekton-results.svc.cluster.local:8080
16-
- KUBEARCHIVE_URL=https://kubearchive-api-server.product-kubearchive.svc.cluster.local:8081
1712

1813
patches:
1914
- path: add-service-certs-patch.yaml

‎components/konflux-ui/staging/stone-stage-p01/kubearchive.conf renamed to ‎components/konflux-ui/production/kflux-osp-p01/kubearchive.conf

File renamed without changes.

‎components/konflux-ui/production/kflux-osp-p01/kustomization.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@ configMapGenerator:
88
- name: dex
99
files:
1010
- dex-config.yaml
11-
- name: proxy-init-config
12-
literals:
13-
- IMPERSONATE=true
14-
- TEKTON_RESULTS_URL=https://tekton-results-api-service.tekton-results.svc.cluster.local:8080
11+
- name: proxy-nginx-static
12+
files:
13+
- kubearchive.conf
14+
behavior: merge
1515

1616
patches:
1717
- path: add-service-certs-patch.yaml

0 commit comments

Comments
 (0)