diff --git a/docs/install/kuberntes-advanced.md b/docs/install/kuberntes-advanced.md index a580309..e15d9f5 100644 --- a/docs/install/kuberntes-advanced.md +++ b/docs/install/kuberntes-advanced.md @@ -61,12 +61,12 @@ spec: gatewayVersion: latest # 0.2.2 ## Server config server: -# # Kubernetes tls secret name -# tlsSecretName: tls-secret -# #Redis configs for distributed rate limiting across multiple instances -# redis: -# addr: redis:6379 -# password: password + # Kubernetes tls secret name + tlsSecretName: '' #Optional, tls-secret + #Redis configs for distributed rate limiting across multiple instances + redis: + addr: '' #Optional, redis:6379 + password: '' #Optional, password writeTimeout: 10 readTimeout: 15 idleTimeout: 30 @@ -131,35 +131,33 @@ metadata: name: route-sample spec: gateway: gateway-sample - routes: - - path: / - name: Example - hosts: [] - rewrite: / - methods: - - GET - - POST - - PUT - destination: https://example.com - backends: [] - insecureSkipVerify: false - healthCheck: - path: / - interval: 10s - timeout: 10s - healthyStatuses: - - 200 - - 404 - cors: - origins: [] - headers: {} - rateLimit: 15 - disableHostFording: true - interceptErrors: [] - blockCommonExploits: false - ## Middleware names - middlewares: - - basic-middleware-sample + path: / + hosts: [] + rewrite: / + methods: + - GET + - POST + - PUT + destination: https://example.com + backends: [] + insecureSkipVerify: false + healthCheck: + path: / + interval: 10s + timeout: 10s + healthyStatuses: + - 200 + - 404 + cors: + origins: [] + headers: {} + rateLimit: 15 + disableHostFording: true + interceptErrors: [] + blockCommonExploits: false + ## Middleware names + middlewares: + - basic-middleware-sample ``` ## Uninstall diff --git a/docs/middleware/access.md b/docs/middleware/access.md index 9b548c3..e9cb211 100644 --- a/docs/middleware/access.md +++ b/docs/middleware/access.md @@ -37,4 +37,21 @@ Example of access middleware cors: {} middlewares: - api-forbidden-paths +``` +## Advanced Kubernetes deployment + +```yaml +apiVersion: gomaproj.github.io/v1beta1 +kind: Middleware +metadata: + name: access-middleware-sample +spec: + type: access + ## prevents access paths + paths: + - /swagger-ui/* + - /v2/swagger-ui/* + - /api-docs/* + - /internal/* + - /actuator/* ``` \ No newline at end of file diff --git a/docs/middleware/basic.md b/docs/middleware/basic.md index 0bf1bb2..41c758c 100644 --- a/docs/middleware/basic.md +++ b/docs/middleware/basic.md @@ -37,4 +37,20 @@ middlewares: cors: {} middlewares: - basic-auth +``` + +## Advanced Kubernetes deployment + +```yaml +apiVersion: gomaproj.github.io/v1beta1 +kind: Middleware +metadata: + name: basic-middleware-sample +spec: + type: basic + paths: + - /admin/* + rule: + username: admin + password: admin ``` \ No newline at end of file diff --git a/docs/middleware/oauth.md b/docs/middleware/oauth.md index 42cd400..cbcfa40 100644 --- a/docs/middleware/oauth.md +++ b/docs/middleware/oauth.md @@ -5,9 +5,9 @@ parent: Middleware nav_order: 5 --- -### OAuth middleware +# OAuth middleware -Example of Google provider +### Example of Google provider ```yaml - name: google-oauth @@ -30,7 +30,7 @@ Example of Google provider ``` -Example of Authentik provider +### Example of Authentik provider ```yaml - name: oauth-authentik @@ -59,32 +59,6 @@ Example of Authentik provider jwtSecret: your-strong-jwt-secret | It's optional ``` -### Access middleware - -Access middleware prevents access to a route or specific route path. - -Example of access middleware -```yaml - # The server will return 403 - - name: api-forbidden-paths - type: access - ## prevents access paths - paths: - - /swagger-ui/* - - /v2/swagger-ui/* - - /api-docs/* - - /internal/* - - /actuator/* -``` -### RateLimit middleware - -The RateLimit middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is. - -Example of rateLimit middleware -```yaml - -``` - ### Apply middleware on the route ```yaml @@ -99,4 +73,37 @@ Example of rateLimit middleware cors: {} middlewares: - oauth-authentik +``` + +## Advanced Kubernetes deployment + +```yaml +apiVersion: gomaproj.github.io/v1beta1 +kind: Middleware +metadata: + name: oauth-middleware-sample +spec: + type: basic + paths: + - /protected + - /example-of-oauth + rule: + clientId: xxx + clientSecret: xxx + # oauth provider google, gitlab, github, amazon, facebook, custom + provider: custom + endpoint: + authUrl: https://authentik.example.com/application/o/authorize/ + tokenUrl: https://authentik.example.com/application/o/token/ + userInfoUrl: https://authentik.example.com/application/o/userinfo/ + redirectUrl: https://example.com/callback + #RedirectPath is the PATH to redirect users after authentication, e.g: /my-protected-path/dashboard + redirectPath: '' + #CookiePath e.g.: /my-protected-path or / || by default is applied on a route path + cookiePath: "/" + scopes: + - email + - openid + state: randomStateString + jwtSecret: your-strong-jwt-secret | It's optional ``` \ No newline at end of file diff --git a/docs/middleware/rate-limit.md b/docs/middleware/rate-limit.md index 9e334fe..5f8b492 100644 --- a/docs/middleware/rate-limit.md +++ b/docs/middleware/rate-limit.md @@ -20,7 +20,7 @@ middlewares: - /* rule: unit: minute # or hour - requestsPerUnit: 10 + requestsPerUnit: 60 ``` Example of route rate limiting middleware @@ -41,4 +41,20 @@ gateway: rateLimit: 60 # per minute routes: - name: Example +``` + +## Advanced Kubernetes deployment + +```yaml +apiVersion: gomaproj.github.io/v1beta1 +kind: Middleware +metadata: + name: ratelimit-middleware-sample +spec: + type: basic + paths: + - /* + rule: + unit: minute # or hour + requestsPerUnit: 60 ``` \ No newline at end of file diff --git a/docs/quickstart/gateway.md b/docs/quickstart/gateway.md index 97c2e28..5bfb22b 100644 --- a/docs/quickstart/gateway.md +++ b/docs/quickstart/gateway.md @@ -90,4 +90,48 @@ gateway: directory: /etc/goma/extra watch: true routes: [] +``` + +## Advanced Kubernetes deployment + +```yaml +apiVersion: gomaproj.github.io/v1beta1 +kind: Gateway +metadata: + labels: {} + name: gateway-sample +spec: + # The version of Goma Gateway + # See: https://github.com/jkaninda/goma-gateway/releases + gatewayVersion: latest # 0.2.2 + server: + # Kubernetes tls secret name + tlsSecretName: '' #Optional, tls-secret + #Redis configs for distributed rate limiting across multiple instances + redis: + addr: '' #Optional, redis:6379 + password: '' #Optional, password + writeTimeout: 10 + readTimeout: 15 + idleTimeout: 35 + logLevel: info + disableHealthCheckStatus: true + disableKeepAlive: false + enableMetrics: true + # Replicas count + replicaCount: 1 + resources: + limits: + cpu: 250m + memory: 512Mi + requests: + cpu: 100m + memory: 128Mi + autoScaling: + enabled: true + minReplicas: 2 + maxReplicas: 5 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + affinity: {} ``` \ No newline at end of file diff --git a/docs/quickstart/route.md b/docs/quickstart/route.md index 832c020..0336a4b 100644 --- a/docs/quickstart/route.md +++ b/docs/quickstart/route.md @@ -189,4 +189,37 @@ gateway: middlewares: - api-forbidden-paths - jwt-auth +``` +## Advanced Kubernetes deployment + +```yaml +apiVersion: gomaproj.github.io/v1beta1 +kind: Route +metadata: + labels: {} + name: route-sample +spec: + gateway: gateway-sample + path: / + hosts: [] + rewrite: /g + methods: [GET] + destination: https://example.com + backends: [] + insecureSkipVerify: true + healthCheck: + path: / + interval: 10s + timeout: 10s + healthyStatuses: + - 200 + - 404 + cors: + origins: [] + headers: {} + disableHostFording: true + blockCommonExploits: true + middlewares: + - basic-middleware-sample + - ratelimit ``` \ No newline at end of file diff --git a/docs/quickstart/ssl.md b/docs/quickstart/tls.md similarity index 52% rename from docs/quickstart/ssl.md rename to docs/quickstart/tls.md index 671de14..c1c3150 100644 --- a/docs/quickstart/ssl.md +++ b/docs/quickstart/tls.md @@ -1,19 +1,19 @@ --- -title: SSL Certificate +title: TLS Certificate layout: default parent: Quickstart nav_order: 5 --- -# SSL Certificate +# TLS Certificate ```yaml version: 1.0 gateway: - sslCertFile: cert.pem - sslKeyFile: key.pem + tlsCertFile: cert.pem + tlsKeyFile: key.pem ``` diff --git a/internal/gateway_type.go b/internal/gateway_type.go index 25eddba..5ad3e1f 100644 --- a/internal/gateway_type.go +++ b/internal/gateway_type.go @@ -20,9 +20,13 @@ package pkg // Gateway contains Goma Proxy Gateway's configs type Gateway struct { // SSLCertFile SSL Certificate file - SSLCertFile string `yaml:"sslCertFile" env:"GOMA_SSL_CERT_FILE, overwrite"` + SSLCertFile string `yaml:"sslCertFile,omitempty" env:"GOMA_SSL_CERT_FILE, overwrite"` // Deprecated, use TlsCertFile instead // SSLKeyFile SSL Private key file - SSLKeyFile string `yaml:"sslKeyFile" env:"GOMA_SSL_KEY_FILE, overwrite"` + SSLKeyFile string `yaml:"sslKeyFile,omitempty" env:"GOMA_SSL_KEY_FILE, overwrite"` // Deprecated, use TlsKeyFile instead + // TlsCertFile TLS Certificate file + TlsCertFile string `yaml:"tlsCertFile" env:"GOMA_TLS_CERT_FILE, overwrite"` + // SSLKeyFile TLS Private key file + TlsKeyFile string `yaml:"tlsKeyFile" env:"GOMA_TLS_KEY_FILE, overwrite"` // Redis contains redis database details Redis Redis `yaml:"redis"` // WriteTimeout defines proxy write timeout diff --git a/internal/server.go b/internal/server.go index a9be5ea..404a43c 100644 --- a/internal/server.go +++ b/internal/server.go @@ -37,9 +37,8 @@ func (gatewayServer GatewayServer) Start() error { tlsConfig, listenWithTLS, err := gatewayServer.initTLS() if err != nil { - return err + logger.Error("Failed to initialize TLS") } - if !gatewayServer.gateway.DisableDisplayRouteOnStart { printRoute(dynamicRoutes) } diff --git a/internal/tls.go b/internal/tls.go index fda25f1..8f363b9 100644 --- a/internal/tls.go +++ b/internal/tls.go @@ -24,16 +24,35 @@ import ( ) func (gatewayServer GatewayServer) initTLS() (*tls.Config, bool, error) { - cert, key := gatewayServer.gateway.SSLCertFile, gatewayServer.gateway.SSLKeyFile - if cert == "" || key == "" { + loadAndWarn := func(cert, key string, warnMsg string) (*tls.Config, bool, error) { + if len(cert) != 0 || len(key) != 0 { + if warnMsg != "" { + logger.Warn("sslCertFile and sslKeyFile are deprecated, please use tlsCertFile and tlsKeyFile instead") + } + tlsConfig, err := loadTLS(cert, key) + if err != nil { + return nil, false, fmt.Errorf("failed to load TLS config: %w", err) + } + return tlsConfig, true, nil + } return nil, false, nil } - - tlsConfig, err := loadTLS(cert, key) - if err != nil { - return nil, false, fmt.Errorf("failed to load TLS config: %w", err) + // Check deprecated fields + tlsConfig, loaded, err := loadAndWarn( + gatewayServer.gateway.SSLCertFile, + gatewayServer.gateway.SSLKeyFile, + "Warn", + ) + if loaded || err != nil { + return tlsConfig, loaded, err } - return tlsConfig, true, nil + + // Check new fields + return loadAndWarn( + gatewayServer.gateway.TlsCertFile, + gatewayServer.gateway.TlsKeyFile, + "", + ) } // loadTLS loads TLS Certificate