badblocks/docker-easy-haproxy
1
0
Fork 0
Code Activity

Fix SSL on Kubernetes

Browse source
This commit is contained in:
Joao Gilberto Magalhaes 2022-08-26 11:38:02 -05:00
parent 0d16c117cb
commit 68eea939a3
8 changed files with 194 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/easymapping/__init__.py
View file

@ -110,6 +110,9 @@ class HaproxyConfigGenerator:
self.label.create([definition, "letsencrypt"]),
False
) and self.mapping["letsencrypt"]["email"] != ""
clone_to_ssl = self.label.get_bool(
self.label.create([definition, "clone_to_ssl"])
)
if port not in easymapping:
easymapping[port] = {
@ -147,7 +150,7 @@ class HaproxyConfigGenerator:
self.label.create([definition, "redirect"])
)
if letsencrypt:
if letsencrypt or clone_to_ssl:
if "443" not in easymapping:
easymapping["443"] = {
"mode": "http",
@ -160,17 +163,17 @@ class HaproxyConfigGenerator:
easymapping["443"]["hosts"][hostname]["letsencrypt"] = False
easymapping["443"]["hosts"][hostname]["redirect_ssl"] = False
easymapping["443"]["ssl"] = True
self.letsencrypt_hosts.append(hostname) if hostname not in self.letsencrypt_hosts else self.letsencrypt_hosts
self.letsencrypt_hosts.append(hostname) if letsencrypt and hostname not in self.letsencrypt_hosts else self.letsencrypt_hosts
# handle SSL
ssl_label = self.label.create([definition, "sslcert"])
if self.label.has_label(ssl_label):
filename = "{}.pem".format(d[host_label])
easymapping[port]["ssl"] = True
easymapping[port]["ssl"] = True if not clone_to_ssl else False
self.certs[filename] = base64.b64decode(d[ssl_label]).decode('ascii')
if self.label.get_bool(self.label.create([definition, "ssl"])):
easymapping[port]["ssl"] = True
easymapping[port]["ssl"] = True if not clone_to_ssl else False
return easymapping.values()

4
src/functions/__init__.py
View file

@ -31,8 +31,8 @@ class Functions:
Functions.ERROR: 4,
Functions.FATAL: 5
}
level_required = 0 if level not in level_importance else level_importance[level]
level_asked = 0 if log_level_str.upper() not in level_importance else level_importance[log_level_str.upper()]
level_required = 1 if level not in level_importance else level_importance[level]
level_asked = 1 if log_level_str.upper() not in level_importance else level_importance[log_level_str.upper()]
return level_asked < level_required
@staticmethod

13
src/processor/__init__.py
View file

@ -14,7 +14,7 @@ class ContainerEnv:
def read():
env_vars = {
"customerrors": True if os.getenv("HAPROXY_CUSTOMERRORS") == "true" else False,
"ssl_mode": os.getenv("EASYHAPROXY_SSL_MODE") if os.getenv("EASYHAPROXY_SSL_MODE") else 'default'
"ssl_mode": os.getenv("EASYHAPROXY_SSL_MODE").lower() if os.getenv("EASYHAPROXY_SSL_MODE") else 'default'
}
if os.getenv("HAPROXY_PASSWORD"):
@ -157,6 +157,7 @@ class Kubernetes(ProcessorInterface):
letsencrypt = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.letsencrypt")
redirect_ssl = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.redirect_ssl")
redirect = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.redirect")
mode = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.mode")
data = {}
data["creation_timestamp"] = ingress.metadata.creation_timestamp.strftime("%x %X")
@ -193,15 +194,17 @@ class Kubernetes(ProcessorInterface):
rule_data["%s.port" % (definition)] = "80"
rule_data["%s.localport" % (definition)] = port_number
if rule.host in ssl_hosts:
rule_data["%s.ssl" % (definition)] = 'true'
rule_data["%s.clone_to_ssl" % (definition)] = 'true'
if redirect_ssl is not None:
rule_data["%s.redirect_ssl" % (definition)] = 'true'
rule_data["%s.redirect_ssl" % (definition)] = redirect_ssl
if letsencrypt is not None:
rule_data["%s.letsencrypt" % (definition)] = 'true'
rule_data["%s.letsencrypt" % (definition)] = letsencrypt
if redirect is not None:
rule_data["%s.redirect" % (definition)] = redirect
if mode is not None:
rule_data["%s.mode" % (definition)] = mode
service_name = rule.http.paths[0].backend.service.ingress_name
service_name = rule.http.paths[0].backend.service.name
try:
api_response = self.api_instance.read_namespaced_service(service_name, ingress.metadata.namespace)
cluster_ip = api_response.spec.cluster_ip

2
src/tests/fixtures/services-clone-to-ssl vendored Normal file
View file

@ -0,0 +1,2 @@
{"10.152.183.62": {"creation_timestamp": "08/24/22 02:59:44", "resource_version": "72517156", "namespace": "parking", "easyhaproxy.valida-me_8080.host": "valida.me", "easyhaproxy.valida-me_8080.port": "80", "easyhaproxy.valida-me_8080.localport": 8080, "easyhaproxy.valida-me_8080.redirect": "{\"www.valida.me\": \"https://valida.me\"}", "easyhaproxy.www-valida-me_8080.host": "www.valida.me", "easyhaproxy.www-valida-me_8080.port": "80", "easyhaproxy.www-valida-me_8080.localport": 8080, "easyhaproxy.www-valida-me_8080.redirect": "{\"www.valida.me\": \"https://valida.me\"}"},
"10.152.183.215": {"creation_timestamp": "08/26/22 03:06:01", "resource_version": "72522999", "namespace": "default", "easyhaproxy.host2-local_8080.host": "host2.local", "easyhaproxy.host2-local_8080.port": "80", "easyhaproxy.host2-local_8080.localport": 8080, "easyhaproxy.host2-local_8080.clone_to_ssl": "true"}}

2
src/tests/test_containerenv.py
View file

@ -23,7 +23,7 @@ def test_container_env_customerrors():
os.environ['HAPROXY_CUSTOMERRORS'] = ''
def test_container_env_sslmode():
os.environ['EASYHAPROXY_SSL_MODE'] = 'strict'
os.environ['EASYHAPROXY_SSL_MODE'] = 'STRICT'
try:
assert {
"customerrors": False,

77
src/tests/test_parser.py
View file

@ -423,6 +423,83 @@ def test_parser_ssl_letsencrypt():
assert expected_file.read() == haproxy_config
assert ["test.example.org"] == cfg.letsencrypt_hosts
def test_parser_finds_services_clone_to_ssl_raw():
line_list = load_fixture("services-clone-to-ssl")
result = {
"customerrors": False,
"letsencrypt": {
"email": LETSENCRYPT_EMAIL
},
"stats": {
"port": 0
}
}
if os.path.exists(CERT_FILE):
os.remove(CERT_FILE)
cfg = easymapping.HaproxyConfigGenerator(result)
parsed_object = [
{
"health-check":"",
"hosts":{
"host2.local":{
"containers":[
"10.152.183.215:8080"
],
"letsencrypt": False,
"redirect_ssl": False
},
"valida.me":{
"containers":[
"10.152.183.62:8080"
],
"letsencrypt": False,
"redirect_ssl": False
},
"www.valida.me":{
"containers":[
"10.152.183.62:8080"
],
"letsencrypt": False,
"redirect_ssl": False
}
},
"mode":"http",
"port":"80",
"redirect":{
}
},
{
"health-check":"ssl",
"hosts":{
"host2.local":{
"containers":[
"10.152.183.215:8080"
],
"letsencrypt": False,
"redirect_ssl": False
}
},
"mode":"http",
"port":"443",
"redirect":{
},
"ssl": True
}
]
processed = list(cfg.parse(line_list))
assert parsed_object == processed
assert [] == cfg.letsencrypt_hosts
#test_parser_finds_services_raw()
#test_parser_tcp()
#test_parser_multiple_hosts()