APIGOV-26782 - update proxy settings

README.md

@@ -66,24 +66,27 @@ On startup the Kong traceability agent first validates that it is able to connec
 
 All Kong specific environment variables available are listed below
 
-| Name                                   | Description                                                                                   |
-| -------------------------------------- | --------------------------------------------------------------------------------------------- |
-| Discovery Agent Variables              |                                                                                               |
-| **KONG_ADMIN_URL**                     | The Kong admin API URL that the agent will query against                                      |
-| **KONG_ADMIN_AUTH_APIKEY_HEADER**      | The API Key header name the agent will use when authenticating                                |
-| **KONG_ADMIN_AUTH_APIKEY_VALUE**       | The API Key value the agent will use when authenticating                                      |
-| **KONG_ADMIN_AUTH_BASICAUTH_USERNAME** | The HTTP Basic username that the agent will use when authenticating                           |
-| **KONG_ADMIN_AUTH_BASICAUTH_PASSWORD** | The HTTP Basic password that the agent will use when authenticating                           |
-| **KONG_PROXY_HOST**                    | The proxy endpoint that the agent will use in API Services for discovered Kong routes         |
-| **KONG_PROXY_PORTS_HTTP**              | The HTTP port number that the agent will set for discovered APIS                              |
-| **KONG_PROXY_PORTS_HTTPS**             | The HTTPs port number that the agent will set for discovered APIS                             |
-| **KONG_SPEC_LOCALPATH**                | The local path that the agent will look in for API definitions                                |
-| **KONG_SPEC_URLPATHS**                 | The URL paths that the agent will query on the gateway service for API definitions            |
-| **KONG_SPEC_DEVPORTALENABLED**         | Set to true if hte agent should look for spec files in the Kong Dev Portal (default: `false`) |
-|                                        |                                                                                               |
-| Traceability Agent Variables           |                                                                                               |
-| **KONG_LOGS_HTTP_PATH**                | The path endpoint that the Traceability agent will listen on (default: `/requestlogs`)        |
-| **KONG_LOGS_HTTP_PORT**                | The port that the Traceability agent HTTP server will listen on (default: `9000`)             |
+| Name                                   | Description                                                                                               |
+| -------------------------------------- | --------------------------------------------------------------------------------------------------------- |
+| Discovery Agent Variables              |                                                                                                           |
+| **KONG_ADMIN_URL**                     | The Kong admin API URL that the agent will query against                                                  |
+| **KONG_ADMIN_AUTH_APIKEY_HEADER**      | The API Key header name the agent will use when authenticating                                            |
+| **KONG_ADMIN_AUTH_APIKEY_VALUE**       | The API Key value the agent will use when authenticating                                                  |
+| **KONG_ADMIN_AUTH_BASICAUTH_USERNAME** | The HTTP Basic username that the agent will use when authenticating                                       |
+| **KONG_ADMIN_AUTH_BASICAUTH_PASSWORD** | The HTTP Basic password that the agent will use when authenticating                                       |
+| **KONG_PROXY_HOST**                    | The proxy host that the agent will use in API Services when the Kong route does not specify hosts         |
+| **KONG_PROXY_PORTS_HTTP**              | The HTTP port number that the agent will set for discovered APIS                                          |
+| **KONG_PROXY_PORTS_HTTPS**             | The HTTPs port number that the agent will set for discovered APIS                                         |
+| **KONG_PROXY_PORTS_HTTP_DISABLE**      | Set to true if the agent should ignore routes that server over HTTP                                       |
+| **KONG_PROXY_PORTS_HTTPS_DISABLE**     | Set to true if the agent should ignore routes that server over HTTPs                                      |
+| **KONG_PROXY_BASEPATH**                | The proxy base path that will be added between the proxy host and Kong route path when building endpoints |
+| **KONG_SPEC_LOCALPATH**                | The local path that the agent will look in for API definitions                                            |
+| **KONG_SPEC_URLPATHS**                 | The URL paths that the agent will query on the gateway service for API definitions                        |
+| **KONG_SPEC_DEVPORTALENABLED**         | Set to true if hte agent should look for spec files in the Kong Dev Portal (default: `false`)             |
+|                                        |                                                                                                           |
+| Traceability Agent Variables           |                                                                                                           |
+| **KONG_LOGS_HTTP_PATH**                | The path endpoint that the Traceability agent will listen on (default: `/requestlogs`)                    |
+| **KONG_LOGS_HTTP_PORT**                | The port that the Traceability agent HTTP server will listen on (default: `9000`)                         |
 
 ## Setup
 

helm/kong-agents/templates/discovery-deployment.yaml

@@ -68,10 +68,16 @@ spec:
           env:
             - name: KONG_PROXY_HOST
               value: "{{ .Values.kong.proxy.host }}"
+            - name: KONG_PROXY_BASEPATH
+              value: "{{ .Values.kong.proxy.basePath }}"
             - name: KONG_PROXY_PORTS_HTTP
-              value: "{{ .Values.kong.proxy.ports.http }}"
+              value: "{{ .Values.kong.proxy.ports.http.number }}"
             - name: KONG_PROXY_PORTS_HTTPS
-              value: "{{ .Values.kong.proxy.ports.https }}"
+              value: "{{ .Values.kong.proxy.ports.https.number }}"
+            - name: KONG_PROXY_PORTS_HTTP_DISABLE
+              value: "{{ .Values.kong.proxy.ports.http.disable }}"
+            - name: KONG_PROXY_PORTS_HTTPS_DISABLE
+              value: "{{ .Values.kong.proxy.ports.https.disable }}"
             - name: KONG_ADMIN_URL
               value: "{{ .Values.kong.admin.url }}"
             {{- if (include "kong-agents.specDownloadPathsString" .) }}
@@ -116,10 +122,15 @@ spec:
                      (not (eq (toString $key) ""))
                      (not (has (toString $key) (list "KONG_ADMIN_URL" 
                                                      "KONG_ADMIN_AUTH_APIKEY_HEADER" 
-                                                     "KONG_ADMIN_AUTH_APIKEY_VALUE" 
+                                                     "KONG_ADMIN_AUTH_APIKEY_VALUE"
+                                                     "KONG_ADMIN_AUTH_BASICAUTH_USERNAME"
+                                                     "KONG_ADMIN_AUTH_BASICAUTH_PASSWORD"
                                                      "KONG_PROXY_HOST" 
+                                                     "KONG_PROXY_BASEPATH" 
                                                      "KONG_PROXY_PORTS_HTTP" 
                                                      "KONG_PROXY_PORTS_HTTPS" 
+                                                     "KONG_PROXY_PORTS_HTTP_DISABLE" 
+                                                     "KONG_PROXY_PORTS_HTTPS_DISABLE" 
                                                      "KONG_SPEC_LOCALPATH"
                                                      "KONG_SPEC_URLPATHS"
                                                      "KONG_LOGS_HTTP_SERVER_PATH"

helm/kong-agents/templates/traceability-statefulset.yaml

@@ -80,10 +80,15 @@ spec:
                      (not (eq (toString $key) ""))
                      (not (has (toString $key) (list "KONG_ADMIN_URL" 
                                                      "KONG_ADMIN_AUTH_APIKEY_HEADER" 
-                                                     "KONG_ADMIN_AUTH_APIKEY_VALUE" 
+                                                     "KONG_ADMIN_AUTH_APIKEY_VALUE"
+                                                     "KONG_ADMIN_AUTH_BASICAUTH_USERNAME"
+                                                     "KONG_ADMIN_AUTH_BASICAUTH_PASSWORD"
                                                      "KONG_PROXY_HOST" 
+                                                     "KONG_PROXY_BASEPATH" 
                                                      "KONG_PROXY_PORTS_HTTP" 
                                                      "KONG_PROXY_PORTS_HTTPS" 
+                                                     "KONG_PROXY_PORTS_HTTP_DISABLE" 
+                                                     "KONG_PROXY_PORTS_HTTPS_DISABLE" 
                                                      "KONG_SPEC_LOCALPATH"
                                                      "KONG_SPEC_URLPATHS"
                                                      "KONG_LOGS_HTTP_SERVER_PATH"

helm/kong-agents/values.yaml

@@ -33,18 +33,23 @@ kong:
         username:
         password:
   proxy:
-    host: 
+    host:
+    basePath:
     ports:
-      http: 8000
-      https: 8443
+      http:
+        disable:
+        number: 
+      https:
+        disable: 
+        number: 
   spec:
     filter:
     urlPaths: []
     localPath:
   logs:
     http:
-      path: /requestlogs
-      port: 9000
+      path:
+      port:
 
 # Add any environment variable overrides here
 env: {}

pkg/discovery/config/config.go

@@ -11,17 +11,20 @@ import (
 )
 
 const (
-	cfgKongProxyHost         = "kong.proxy.host"
-	cfgKongAdminUrl          = "kong.admin.url"
-	cfgKongAdminAPIKey       = "kong.admin.auth.apiKey.value"
-	cfgKongAdminAPIKeyHeader = "kong.admin.auth.apiKey.header"
-	cfgKongAdminUsername     = "kong.admin.auth.basicauth.username"
-	cfgKongAdminPassword     = "kong.admin.auth.basicauth.password"
-	cfgKongProxyPortHttp     = "kong.proxy.ports.http"
-	cfgKongProxyPortHttps    = "kong.proxy.ports.https"
-	cfgKongSpecURLPaths      = "kong.spec.urlPaths"
-	cfgKongSpecLocalPath     = "kong.spec.localPath"
-	cfgKongSpecFilter        = "kong.spec.filter"
+	cfgKongAdminUrl               = "kong.admin.url"
+	cfgKongAdminAPIKey            = "kong.admin.auth.apiKey.value"
+	cfgKongAdminAPIKeyHeader      = "kong.admin.auth.apiKey.header"
+	cfgKongAdminUsername          = "kong.admin.auth.basicauth.username"
+	cfgKongAdminPassword          = "kong.admin.auth.basicauth.password"
+	cfgKongProxyHost              = "kong.proxy.host"
+	cfgKongProxyPortHttp          = "kong.proxy.ports.http"
+	cfgKongProxyPortHttpDisabled  = "kong.proxy.ports.http.disabled"
+	cfgKongProxyPortHttps         = "kong.proxy.ports.https"
+	cfgKongProxyPortHttpsDisabled = "kong.proxy.ports.https.disabled"
+	cfgKongProxyBasePath          = "kong.proxy.basePath"
+	cfgKongSpecURLPaths           = "kong.spec.urlPaths"
+	cfgKongSpecLocalPath          = "kong.spec.localPath"
+	cfgKongSpecFilter             = "kong.spec.filter"
 )
 
 func AddKongProperties(rootProps properties.Properties) {
@@ -32,7 +35,10 @@ func AddKongProperties(rootProps properties.Properties) {
 	rootProps.AddStringProperty(cfgKongAdminPassword, "", "Password for basic auth to authenticate with Kong Admin API")
 	rootProps.AddStringProperty(cfgKongProxyHost, "", "The Kong proxy endpoint")
 	rootProps.AddIntProperty(cfgKongProxyPortHttp, 80, "The Kong proxy http port")
+	rootProps.AddBoolProperty(cfgKongProxyPortHttpDisabled, false, "Set to true to disable adding an http endpoint to discovered routes")
 	rootProps.AddIntProperty(cfgKongProxyPortHttps, 443, "The Kong proxy https port")
+	rootProps.AddStringProperty(cfgKongProxyBasePath, "", "The base path for the Kong proxy endpoint")
+	rootProps.AddBoolProperty(cfgKongProxyPortHttpsDisabled, false, "Set to true to disable adding an https endpoint to discovered routes")
 	rootProps.AddStringSliceProperty(cfgKongSpecURLPaths, []string{}, "URL paths that the agent will look in for spec files")
 	rootProps.AddStringProperty(cfgKongSpecLocalPath, "", "Local paths where the agent will look for spec files")
 	rootProps.AddStringProperty(cfgKongSpecFilter, "", "SDK Filter format. Empty means filters are ignored.")
@@ -65,13 +71,19 @@ type KongAdminAuthAPIKeyConfig struct {
 }
 
 type KongProxyConfig struct {
-	Host  string         `config:"host"`
-	Ports KongPortConfig `config:"ports"`
+	Host     string         `config:"host"`
+	Ports    KongPortConfig `config:"ports"`
+	BasePath string         `config:"basePath"`
 }
 
 type KongPortConfig struct {
-	HTTP  int `config:"http"`
-	HTTPS int `config:"https"`
+	HTTP  KongPortSettingsConfig `config:"http"`
+	HTTPS KongPortSettingsConfig `config:"https"`
+}
+
+type KongPortSettingsConfig struct {
+	Number  int  `config:"number"`
+	Disable bool `config:"disable"`
 }
 
 type KongSpecConfig struct {
@@ -90,22 +102,38 @@ type KongGatewayConfig struct {
 }
 
 const (
-	hostErr       = "kong host must be provided."
-	proxyPortErr  = "both proxy port values of http https are required"
-	invalidUrlErr = "invalid Admin API url provided. Must contain protocol + hostname + port." +
+	hostErr           = "kong host must be provided"
+	httpPortErr       = "a non-zero value is required for the http port number when it is enabled"
+	httpsPortErr      = "a non-zero value is required for the https port number when it is enabled"
+	basePathPrefixErr = "the base path must start with a '/' character"
+	basePathSuffixErr = "the base path must not end with a '/' character"
+	portErr           = "at least one port endpoint needs to be enabled"
+	invalidUrlErr     = "invalid Admin API url provided. Must contain protocol + hostname + port." +
 		"Examples: <http://kong.com:8001>, <https://kong.com:8444>"
 	credentialConfigErr = "invalid authorization configuration provided. " +
 		"If provided, (Username and Password) or (ClientID and ClientSecret) must be non-empty"
 )
 
 // ValidateCfg - Validates the gateway config
-func (c *KongGatewayConfig) ValidateCfg() (err error) {
+func (c *KongGatewayConfig) ValidateCfg() error {
 	logger := log.NewFieldLogger().WithPackage("config").WithComponent("ValidateConfig")
 	if c.Proxy.Host == "" {
 		return fmt.Errorf(hostErr)
 	}
-	if c.Proxy.Ports.HTTP == 0 || c.Proxy.Ports.HTTPS == 0 {
-		return fmt.Errorf(proxyPortErr)
+	if !c.Proxy.Ports.HTTP.Disable && c.Proxy.Ports.HTTP.Number == 0 {
+		return fmt.Errorf(httpPortErr)
+	}
+	if len(c.Proxy.BasePath) > 0 && !strings.HasPrefix(c.Proxy.BasePath, "/") {
+		return fmt.Errorf(basePathPrefixErr)
+	}
+	if len(c.Proxy.BasePath) > 0 && strings.HasSuffix(c.Proxy.BasePath, "/") {
+		return fmt.Errorf(basePathSuffixErr)
+	}
+	if !c.Proxy.Ports.HTTPS.Disable && c.Proxy.Ports.HTTPS.Number == 0 {
+		return fmt.Errorf(httpsPortErr)
+	}
+	if c.Proxy.Ports.HTTP.Disable && c.Proxy.Ports.HTTPS.Disable {
+		return fmt.Errorf(portErr)
 	}
 	if invalidAdminUrl(c.Admin.Url) {
 		return fmt.Errorf(invalidUrlErr)
@@ -116,7 +144,7 @@ func (c *KongGatewayConfig) ValidateCfg() (err error) {
 	if invalidCredentialConfig(c) {
 		return fmt.Errorf(credentialConfigErr)
 	}
-	return
+	return nil
 }
 
 func noCredentialsProvided(c *KongGatewayConfig) bool {
@@ -155,6 +183,22 @@ func invalidCredentialConfig(c *KongGatewayConfig) bool {
 
 func ParseProperties(rootProps properties.Properties) *KongGatewayConfig {
 	// Parse the config from bound properties and setup gateway config
+	httpPortConf := KongPortSettingsConfig{
+		Disable: rootProps.BoolPropertyValue(cfgKongProxyPortHttpDisabled),
+		Number:  rootProps.IntPropertyValue(cfgKongProxyPortHttp),
+	}
+	if httpPortConf.Disable {
+		httpPortConf.Number = 0
+	}
+
+	httpsPortConf := KongPortSettingsConfig{
+		Disable: rootProps.BoolPropertyValue(cfgKongProxyPortHttpsDisabled),
+		Number:  rootProps.IntPropertyValue(cfgKongProxyPortHttps),
+	}
+	if httpsPortConf.Disable {
+		httpsPortConf.Number = 0
+	}
+
 	return &KongGatewayConfig{
 		Admin: KongAdminConfig{
 			Url: rootProps.StringPropertyValue(cfgKongAdminUrl),
@@ -172,9 +216,10 @@ func ParseProperties(rootProps properties.Properties) *KongGatewayConfig {
 		Proxy: KongProxyConfig{
 			Host: rootProps.StringPropertyValue(cfgKongProxyHost),
 			Ports: KongPortConfig{
-				HTTP:  rootProps.IntPropertyValue(cfgKongProxyPortHttp),
-				HTTPS: rootProps.IntPropertyValue(cfgKongProxyPortHttps),
+				HTTP:  httpPortConf,
+				HTTPS: httpsPortConf,
 			},
+			BasePath: rootProps.StringPropertyValue(cfgKongProxyBasePath),
 		},
 		Spec: KongSpecConfig{
 			URLPaths:  rootProps.StringSlicePropertyValue(cfgKongSpecURLPaths),

pkg/discovery/config/config_test.go

@@ -6,21 +6,36 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestKongGateCfg(t *testing.T) {
+func TestKongGatewayCfg(t *testing.T) {
 	cfg := &KongGatewayConfig{}
 
 	err := cfg.ValidateCfg()
 	assert.Equal(t, hostErr, err.Error())
 
 	cfg.Proxy.Host = "localhost"
 	err = cfg.ValidateCfg()
-	assert.Equal(t, proxyPortErr, err.Error())
+	assert.Equal(t, httpPortErr, err.Error())
 
-	cfg.Proxy.Ports.HTTP = 8000
-	cfg.Proxy.Ports.HTTPS = 8443
+	cfg.Proxy.Ports.HTTP.Number = 8000
 	err = cfg.ValidateCfg()
-	assert.Equal(t, invalidUrlErr, err.Error())
+	assert.Equal(t, httpsPortErr, err.Error())
+
+	cfg.Proxy.Ports.HTTPS.Number = 8443
+	cfg.Proxy.Ports.HTTP.Disable = true
+	cfg.Proxy.Ports.HTTPS.Disable = true
+	err = cfg.ValidateCfg()
+	assert.Equal(t, portErr, err.Error())
+
+	cfg.Proxy.Ports.HTTP.Disable = false
+	cfg.Proxy.BasePath = "base"
+	err = cfg.ValidateCfg()
+	assert.Equal(t, basePathPrefixErr, err.Error())
+
+	cfg.Proxy.BasePath = "/base/"
+	err = cfg.ValidateCfg()
+	assert.Equal(t, basePathSuffixErr, err.Error())
 
+	cfg.Proxy.BasePath = "/base"
 	cfg.Admin.Url = "sdl.com:8000"
 	err = cfg.ValidateCfg()
 	assert.Equal(t, invalidUrlErr, err.Error())

pkg/discovery/gateway/client.go

@@ -158,17 +158,17 @@ func (gc *Client) specPreparation(ctx context.Context, route *klib.Route, servic
 	log := gc.logger.WithField(common.AttrRouteID, *route.ID).
 		WithField(common.AttrServiceID, *service.ID)
 
-	proxyHost := gc.kongGatewayCfg.Proxy.Host
-	httpPort := gc.kongGatewayCfg.Proxy.Ports.HTTP
-	httpsPort := gc.kongGatewayCfg.Proxy.Ports.HTTPS
-
 	apiPlugins, err := gc.plugins.GetEffectivePlugins(*route.ID, *service.ID)
 	if err != nil {
 		log.Warn("could not list plugins")
 		return
 	}
 
-	endpoints := gc.processKongRoute(proxyHost, route, httpPort, httpsPort)
+	endpoints := gc.processKongRoute(route)
+	if len(endpoints) == 0 {
+		log.Info("not processing route as no enabled endpoints detected")
+		return
+	}
 	serviceBody, err := gc.processKongAPI(ctx, route, service, spec, endpoints, apiPlugins)
 	if err != nil {
 		log.WithError(err).Error("failed to process kong API")
@@ -188,35 +188,20 @@ func (gc *Client) specPreparation(ctx context.Context, route *klib.Route, servic
 	log.Info("Successfully published to central")
 }
 
-func (gc *Client) processKongRoute(defaultHost string, route *klib.Route, httpPort, httpsPort int) []apic.EndpointDefinition {
-	var endpoints []apic.EndpointDefinition
+func (gc *Client) processKongRoute(route *klib.Route) []apic.EndpointDefinition {
 	if route == nil {
-		return endpoints
+		return []apic.EndpointDefinition{}
 	}
 
-	hosts := route.Hosts
-	hosts = append(hosts, &defaultHost)
-
-	for _, host := range hosts {
-		for _, path := range route.Paths {
-			for _, protocol := range route.Protocols {
-				port := httpPort
-				if *protocol == "https" {
-					port = httpsPort
-				}
-
-				endpoint := apic.EndpointDefinition{
-					Host:     *host,
-					Port:     int32(port),
-					Protocol: *protocol,
-					BasePath: *path,
-				}
-				endpoints = append(endpoints, endpoint)
-			}
-		}
+	kRoute := KongRoute{
+		Route:       route,
+		defaultHost: gc.kongGatewayCfg.Proxy.Host,
+		httpPort:    gc.kongGatewayCfg.Proxy.Ports.HTTP.Number,
+		httpsPort:   gc.kongGatewayCfg.Proxy.Ports.HTTPS.Number,
+		basePath:    gc.kongGatewayCfg.Proxy.BasePath,
 	}
 
-	return endpoints
+	return kRoute.GetEndpoints()
 }
 
 func (gc *Client) processKongAPI(