-
Notifications
You must be signed in to change notification settings - Fork 170
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1415 from 3scale/dev-environments
Dev environments
- Loading branch information
Showing
45 changed files
with
1,309 additions
and
318 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| SHELL = /usr/bin/env bash -o pipefail | ||
| .SHELLFLAGS = -ec | ||
| .DEFAULT_GOAL := gateway | ||
| MKFILE_PATH := $(abspath $(lastword $(MAKEFILE_LIST))) | ||
| WORKDIR := $(patsubst %/,%,$(dir $(MKFILE_PATH))) | ||
| DOCKER ?= $(shell which docker 2> /dev/null || echo "docker") | ||
|
|
||
| gateway: ## run gateway configured to access upstream powered with TLS | ||
| $(DOCKER) compose -f docker-compose.yml run --service-ports gateway | ||
|
|
||
| clean: | ||
| $(DOCKER) compose down --volumes --remove-orphans | ||
| $(DOCKER) compose -f docker-compose.yml down --volumes --remove-orphans |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| # PROXY with upstream using plain HTTP 1.1 | ||
|
|
||
| APIcast --> tiny proxy (connect to 443 but no cert installed) --> upstream (plain HTTP 1.1) | ||
|
|
||
| APIcast configured with plain HTTP 1.1 upstream through a proxy. | ||
|
|
||
| ## Run the gateway | ||
|
|
||
| Running local `apicast-test` docker image | ||
|
|
||
| ```sh | ||
| make gateway | ||
| ``` | ||
|
|
||
| Running custom apicast image | ||
|
|
||
| ```sh | ||
| make gateway IMAGE_NAME=quay.io/3scale/apicast:latest | ||
| ``` | ||
|
|
||
| Traffic between the proxy and upstream can be inspected looking at logs from `example.com` service | ||
|
|
||
| ``` | ||
| docker compose -p http-proxy-plain-http-upstream logs -f example.com | ||
| ``` | ||
|
|
||
| Proxy can be inspected looking at logs from `proxy` service | ||
|
|
||
| ``` | ||
| docker compose -p http-proxy-plain-http-upstream logs -f proxy | ||
| ``` | ||
|
|
||
| ## Testing | ||
|
|
||
| `GET` request | ||
|
|
||
| ```sh | ||
| curl --resolve get.example.com:8080:127.0.0.1 -v "http://get.example.com:8080/?user_key=123" | ||
| ``` | ||
|
|
||
| `POST` request | ||
|
|
||
| ```sh | ||
| curl --resolve post.example.com:8080:127.0.0.1 -v -X POST "http://post.example.com:8080/?user_key=123" | ||
| ``` | ||
|
|
||
| ## Clean env | ||
|
|
||
| ```sh | ||
| make clean | ||
| ``` |
70 changes: 70 additions & 0 deletions
70
dev-environments/http-proxy-plain-http-upstream/apicast-config.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| { | ||
| "services": [ | ||
| { | ||
| "id": "1", | ||
| "backend_version": "1", | ||
| "proxy": { | ||
| "hosts": ["get.example.com"], | ||
| "api_backend": "http://example.com/get", | ||
| "backend": { | ||
| "endpoint": "http://127.0.0.1:8081", | ||
| "host": "backend" | ||
| }, | ||
| "policy_chain": [ | ||
| { | ||
| "name": "apicast.policy.http_proxy", | ||
| "configuration": { | ||
| "http_proxy": "http://proxy:443/" | ||
| } | ||
| }, | ||
| { | ||
| "name": "apicast.policy.apicast" | ||
| } | ||
| ], | ||
| "proxy_rules": [ | ||
| { | ||
| "http_method": "GET", | ||
| "pattern": "/", | ||
| "metric_system_name": "hits", | ||
| "delta": 1, | ||
| "parameters": [], | ||
| "querystring_parameters": {} | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| { | ||
| "id": "2", | ||
| "backend_version": "1", | ||
| "proxy": { | ||
| "hosts": ["post.example.com"], | ||
| "api_backend": "http://example.com/post", | ||
| "backend": { | ||
| "endpoint": "http://127.0.0.1:8081", | ||
| "host": "backend" | ||
| }, | ||
| "policy_chain": [ | ||
| { | ||
| "name": "apicast.policy.http_proxy", | ||
| "configuration": { | ||
| "http_proxy": "http://proxy:443/" | ||
| } | ||
| }, | ||
| { | ||
| "name": "apicast.policy.apicast" | ||
| } | ||
| ], | ||
| "proxy_rules": [ | ||
| { | ||
| "http_method": "POST", | ||
| "pattern": "/", | ||
| "metric_system_name": "hits", | ||
| "delta": 1, | ||
| "parameters": [], | ||
| "querystring_parameters": {} | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| SHELL = /usr/bin/env bash -o pipefail | ||
| .SHELLFLAGS = -ec | ||
| .DEFAULT_GOAL := gateway | ||
| MKFILE_PATH := $(abspath $(lastword $(MAKEFILE_LIST))) | ||
| WORKDIR := $(patsubst %/,%,$(dir $(MKFILE_PATH))) | ||
| DOCKER ?= $(shell which docker 2> /dev/null || echo "docker") | ||
|
|
||
| gateway: ## run gateway configured to access upstream powered with TLS | ||
| $(DOCKER) compose -f docker-compose.yml run --service-ports gateway | ||
|
|
||
| clean: | ||
| $(DOCKER) compose down --volumes --remove-orphans | ||
| $(DOCKER) compose -f docker-compose.yml down --volumes --remove-orphans | ||
|
|
||
| certs: | ||
| $(MAKE) clean -C $(WORKDIR)/cert -f $(WORKDIR)/cert/Makefile | ||
| $(MAKE) ca -C $(WORKDIR)/cert -f $(WORKDIR)/cert/Makefile | ||
| $(MAKE) clientcerts -C $(WORKDIR)/cert -f $(WORKDIR)/cert/Makefile DOMAIN=example.com |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| # PROXY with upstream using TLSv1.3 | ||
|
|
||
| APIcast --> tiny proxy (connect to 443 but no cert installed) --> upstream (TLSv1.3) | ||
|
|
||
| APIcast configured with TLSv1.3 powered upstream through a proxy. TLS termination endpoint is `socat`. | ||
|
|
||
| APicast starts SSL tunnel (via HTTP CONNECT method) against proxy to access upstream configured with TLSv1.3 | ||
|
|
||
| ## Create the SSL Certificates | ||
|
|
||
| ```sh | ||
| make certs | ||
| ``` | ||
|
|
||
| ## Run the gateway | ||
|
|
||
| Running local `apicast-test` docker image | ||
|
|
||
| ```sh | ||
| make gateway | ||
| ``` | ||
|
|
||
| Running custom apicast image | ||
|
|
||
| ```sh | ||
| make gateway IMAGE_NAME=quay.io/3scale/apicast:latest | ||
| ``` | ||
|
|
||
| Traffic between the proxy and upstream can be inspected looking at logs from `example.com` service | ||
|
|
||
| ``` | ||
| docker compose -p https-proxy-upstream-tlsv13 logs -f example.com | ||
| ``` | ||
|
|
||
| Proxy can be inspected looking at logs from `proxy` service | ||
|
|
||
| ``` | ||
| docker compose -p https-proxy-upstream-tlsv13 logs -f proxy | ||
| ``` | ||
|
|
||
| ## Testing | ||
|
|
||
| `GET` request | ||
|
|
||
| ```sh | ||
| curl --resolve get.example.com:8080:127.0.0.1 -v "http://get.example.com:8080/?user_key=123" | ||
| ``` | ||
|
|
||
| `POST` request | ||
|
|
||
| ```sh | ||
| curl --resolve post.example.com:8080:127.0.0.1 -v -X POST "http://post.example.com:8080/?user_key=123" | ||
| ``` | ||
|
|
||
| ## Clean env | ||
|
|
||
| ```sh | ||
| make clean | ||
| ``` |
70 changes: 70 additions & 0 deletions
70
dev-environments/https-proxy-upstream-tlsv1.3/apicast-config.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| { | ||
| "services": [ | ||
| { | ||
| "id": "1", | ||
| "backend_version": "1", | ||
| "proxy": { | ||
| "hosts": ["get.example.com"], | ||
| "api_backend": "https://example.com/get", | ||
| "backend": { | ||
| "endpoint": "http://127.0.0.1:8081", | ||
| "host": "backend" | ||
| }, | ||
| "policy_chain": [ | ||
| { | ||
| "name": "apicast.policy.http_proxy", | ||
| "configuration": { | ||
| "https_proxy": "http://proxy:443/" | ||
| } | ||
| }, | ||
| { | ||
| "name": "apicast.policy.apicast" | ||
| } | ||
| ], | ||
| "proxy_rules": [ | ||
| { | ||
| "http_method": "GET", | ||
| "pattern": "/", | ||
| "metric_system_name": "hits", | ||
| "delta": 1, | ||
| "parameters": [], | ||
| "querystring_parameters": {} | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| { | ||
| "id": "2", | ||
| "backend_version": "1", | ||
| "proxy": { | ||
| "hosts": ["post.example.com"], | ||
| "api_backend": "https://example.com/post", | ||
| "backend": { | ||
| "endpoint": "http://127.0.0.1:8081", | ||
| "host": "backend" | ||
| }, | ||
| "policy_chain": [ | ||
| { | ||
| "name": "apicast.policy.http_proxy", | ||
| "configuration": { | ||
| "https_proxy": "http://proxy:443/" | ||
| } | ||
| }, | ||
| { | ||
| "name": "apicast.policy.apicast" | ||
| } | ||
| ], | ||
| "proxy_rules": [ | ||
| { | ||
| "http_method": "POST", | ||
| "pattern": "/", | ||
| "metric_system_name": "hits", | ||
| "delta": 1, | ||
| "parameters": [], | ||
| "querystring_parameters": {} | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ] | ||
| } |
16 changes: 16 additions & 0 deletions
16
dev-environments/https-proxy-upstream-tlsv1.3/cert/Makefile
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| clean: | ||
| - rm *.crt *.key *.pem *.csr | ||
|
|
||
| ca: | ||
| openssl genrsa -out rootCA.key 2048 | ||
| openssl req -batch -new -x509 -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem | ||
|
|
||
| clientcerts: | ||
| openssl req -subj '/CN=$(DOMAIN)' -newkey rsa:4096 -nodes \ | ||
| -sha256 \ | ||
| -days 3650 \ | ||
| -keyout $(DOMAIN).key \ | ||
| -out $(DOMAIN).csr | ||
| chmod +r $(DOMAIN).key | ||
| openssl x509 -req -in $(DOMAIN).csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out $(DOMAIN).crt -days 500 -sha256 | ||
| cat $(DOMAIN).key $(DOMAIN).crt >$(DOMAIN).pem |
Oops, something went wrong.