mirror of
https://github.com/openappsec/openappsec.git
synced 2025-11-16 17:31:52 +03:00
Compare commits
28 Commits
Feb_13_202
...
1.1.8
| Author | SHA1 | Date | |
|---|---|---|---|
|
98639d9cb6 | ||
|
b3de81d9d9 | ||
|
|
a77fd9a6d0 | ||
|
|
8454b2dd9b | ||
|
|
3913e1e8b3 | ||
|
262b2e59ff | ||
|
|
a01c65994a | ||
|
|
1d13973ae2 | ||
|
|
c20fa9f966 | ||
|
|
0d22790ebe | ||
|
|
9f86c4607e | ||
|
|
0e47ed8595 | ||
|
|
42b0bf2981 | ||
|
|
75b40933ec | ||
|
|
b795661328 | ||
|
|
eb509dfa85 | ||
|
|
ec834aeafb | ||
|
2c9ec1e48c | ||
|
|
55b5973c15 | ||
|
|
63b5a63ded | ||
|
|
b08047cc33 | ||
|
|
328808c15f | ||
|
|
c255621cd6 | ||
|
|
3afc4acfc5 | ||
|
|
4e6ed5734a | ||
|
|
102a0308c2 | ||
|
aa8cfd1b2a | ||
|
|
5452d68f9b |
@@ -96,7 +96,7 @@ open-appsec GitHub includes four main repositories:
|
||||
|
||||
## Installing external dependencies
|
||||
|
||||
Before compiling the services, you'll need to ensure the latest development versions of the following libraries:
|
||||
Before compiling the services, you'll need to ensure the latest development versions of the following libraries and tools:
|
||||
* Boost
|
||||
* OpenSSL
|
||||
* PCRE2
|
||||
@@ -107,12 +107,13 @@ Before compiling the services, you'll need to ensure the latest development vers
|
||||
* Redis
|
||||
* Hiredis
|
||||
* MaxmindDB
|
||||
* yq
|
||||
|
||||
An example of installing the packages on Alpine:
|
||||
|
||||
```bash
|
||||
$ apk update
|
||||
$ apk add boost-dev openssl-dev pcre2-dev libxml2-dev gtest-dev curl-dev hiredis-dev redis libmaxminddb-dev
|
||||
$ apk add boost-dev openssl-dev pcre2-dev libxml2-dev gtest-dev curl-dev hiredis-dev redis libmaxminddb-dev yq
|
||||
```
|
||||
|
||||
## Compiling and packaging the agent code
|
||||
|
||||
11
build_system/apisix/apisix-standalone.yaml
Normal file
11
build_system/apisix/apisix-standalone.yaml
Normal file
@@ -0,0 +1,11 @@
|
||||
# example local declarative configuration file for apisix in standalone mode
|
||||
|
||||
routes:
|
||||
-
|
||||
uri: /anything
|
||||
upstream:
|
||||
nodes:
|
||||
"httpbin.org:80": 1
|
||||
type: roundrobin
|
||||
|
||||
#END
|
||||
46
build_system/apisix/docker-compose.yaml
Normal file
46
build_system/apisix/docker-compose.yaml
Normal file
@@ -0,0 +1,46 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
version: "3"
|
||||
|
||||
services:
|
||||
apisix:
|
||||
container_name: apisix
|
||||
image: "ghcr.io/openappsec/apisix-attachment:latest"
|
||||
ipc: host
|
||||
restart: always
|
||||
volumes:
|
||||
- ./apisix-localconfig/apisix-standalone.yaml:/usr/local/apisix/conf/apisix.yaml:ro
|
||||
environment:
|
||||
- APISIX_STAND_ALONE=true
|
||||
ports:
|
||||
- "9180:9180/tcp"
|
||||
- "9080:9080/tcp"
|
||||
- "9091:9091/tcp"
|
||||
- "9443:9443/tcp"
|
||||
|
||||
appsec-agent:
|
||||
container_name: appsec-agent
|
||||
image: 'ghcr.io/openappsec/agent:latest'
|
||||
ipc: host
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
# adjust with your own email below
|
||||
- user_email=user@email.com
|
||||
- registered_server="APISIX Server"
|
||||
volumes:
|
||||
- ./appsec-config:/etc/cp/conf
|
||||
- ./appsec-data:/etc/cp/data
|
||||
- ./appsec-logs:/var/log/nano_agent
|
||||
- ./appsec-localconfig:/ext/appsec
|
||||
command: /cp-nano-agent --standalone
|
||||
@@ -3,4 +3,4 @@ dependencies:
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 12.2.8
|
||||
digest: sha256:0d13b8b0c66b8e18781eac510ce58b069518ff14a6a15ad90375e7f0ffad71fe
|
||||
generated: "2024-02-11T17:18:56.196746248Z"
|
||||
generated: "2024-03-26T14:53:49.928153508Z"
|
||||
|
||||
@@ -1,7 +1,5 @@
|
||||
annotations:
|
||||
artifacthub.io/changes: |-
|
||||
- "update web hook cert gen to latest release v20231226-1a7112e06"
|
||||
- "Update Ingress-Nginx version controller-v1.9.6"
|
||||
artifacthub.io/changes: '- "Update Ingress-Nginx version controller-v1.10.0"'
|
||||
artifacthub.io/prerelease: "false"
|
||||
apiVersion: v2
|
||||
appVersion: latest
|
||||
@@ -17,4 +15,4 @@ kubeVersion: '>=1.20.0-0'
|
||||
name: open-appsec-k8s-nginx-ingress
|
||||
sources:
|
||||
- https://github.com/kubernetes/ingress-nginx
|
||||
version: 4.9.1
|
||||
version: 4.10.0
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
[ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer
|
||||
|
||||
 
|
||||
 
|
||||
|
||||
To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources.
|
||||
|
||||
@@ -253,11 +253,11 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.admissionWebhooks.namespaceSelector | object | `{}` | |
|
||||
| controller.admissionWebhooks.objectSelector | object | `{}` | |
|
||||
| controller.admissionWebhooks.patch.enabled | bool | `true` | |
|
||||
| controller.admissionWebhooks.patch.image.digest | string | `"sha256:25d6a5f11211cc5c3f9f2bf552b585374af287b4debf693cacbe2da47daa5084"` | |
|
||||
| controller.admissionWebhooks.patch.image.digest | string | `"sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334"` | |
|
||||
| controller.admissionWebhooks.patch.image.image | string | `"ingress-nginx/kube-webhook-certgen"` | |
|
||||
| controller.admissionWebhooks.patch.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| controller.admissionWebhooks.patch.image.registry | string | `"registry.k8s.io"` | |
|
||||
| controller.admissionWebhooks.patch.image.tag | string | `"v20231226-1a7112e06"` | |
|
||||
| controller.admissionWebhooks.patch.image.tag | string | `"v1.4.0"` | |
|
||||
| controller.admissionWebhooks.patch.labels | object | `{}` | Labels to be added to patch job resources |
|
||||
| controller.admissionWebhooks.patch.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not |
|
||||
| controller.admissionWebhooks.patch.nodeSelector."kubernetes.io/os" | string | `"linux"` | |
|
||||
@@ -317,7 +317,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.hostname | object | `{}` | Optionally customize the pod hostname. |
|
||||
| controller.image.allowPrivilegeEscalation | bool | `false` | |
|
||||
| controller.image.chroot | bool | `false` | |
|
||||
| controller.image.digest | string | `"sha256:1405cc613bd95b2c6edd8b2a152510ae91c7e62aea4698500d23b2145960ab9c"` | |
|
||||
| controller.image.digest | string | `"sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c"` | |
|
||||
| controller.image.digestChroot | string | `"sha256:7eb46ff733429e0e46892903c7394aff149ac6d284d92b3946f3baf7ff26a096"` | |
|
||||
| controller.image.image | string | `"ingress-nginx/controller"` | |
|
||||
| controller.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
@@ -326,7 +326,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.image.runAsNonRoot | bool | `true` | |
|
||||
| controller.image.runAsUser | int | `101` | |
|
||||
| controller.image.seccompProfile.type | string | `"RuntimeDefault"` | |
|
||||
| controller.image.tag | string | `"v1.9.6"` | |
|
||||
| controller.image.tag | string | `"v1.10.0"` | |
|
||||
| controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation |
|
||||
| controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). |
|
||||
| controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass |
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
# Changelog
|
||||
|
||||
This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
|
||||
|
||||
### 4.10.0
|
||||
|
||||
* - "Update Ingress-Nginx version controller-v1.10.0"
|
||||
|
||||
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.9.1...helm-chart-4.10.0
|
||||
@@ -29,7 +29,7 @@
|
||||
- --watch-namespace={{ default "$(POD_NAMESPACE)" .Values.controller.scope.namespace }}
|
||||
{{- end }}
|
||||
{{- if and (not .Values.controller.scope.enabled) .Values.controller.scope.namespaceSelector }}
|
||||
- --watch-namespace-selector={{ default "" .Values.controller.scope.namespaceSelector }}
|
||||
- --watch-namespace-selector={{ .Values.controller.scope.namespaceSelector }}
|
||||
{{- end }}
|
||||
{{- if and .Values.controller.reportNodeInternalIp .Values.controller.hostNetwork }}
|
||||
- --report-node-internal-ip-address={{ .Values.controller.reportNodeInternalIp }}
|
||||
@@ -54,6 +54,9 @@
|
||||
{{- if .Values.controller.watchIngressWithoutClass }}
|
||||
- --watch-ingress-without-class=true
|
||||
{{- end }}
|
||||
{{- if not .Values.controller.metrics.enabled }}
|
||||
- --enable-metrics={{ .Values.controller.metrics.enabled }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.enableTopologyAwareRouting }}
|
||||
- --enable-topology-aware-routing=true
|
||||
{{- end }}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if and ( .Values.controller.metrics.enabled ) ( .Values.controller.metrics.prometheusRule.enabled ) ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) -}}
|
||||
{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.prometheusRule.enabled -}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
|
||||
@@ -34,7 +34,7 @@ spec:
|
||||
http-headers: false
|
||||
request-body: false
|
||||
log-destination:
|
||||
cloud: false
|
||||
cloud: true
|
||||
stdout:
|
||||
format: json-formatted
|
||||
---
|
||||
|
||||
@@ -21,7 +21,7 @@ tests:
|
||||
of: ConfigMap
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-ingress-nginx-custom-add-headers
|
||||
value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-custom-add-headers
|
||||
- equal:
|
||||
path: data.X-Another-Custom-Header
|
||||
value: Value
|
||||
|
||||
@@ -21,7 +21,7 @@ tests:
|
||||
of: ConfigMap
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-ingress-nginx-custom-proxy-headers
|
||||
value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-custom-proxy-headers
|
||||
- equal:
|
||||
path: data.X-Custom-Header
|
||||
value: Value
|
||||
|
||||
@@ -11,4 +11,4 @@ tests:
|
||||
of: ConfigMap
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-ingress-nginx-controller
|
||||
value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-controller
|
||||
|
||||
@@ -6,6 +6,7 @@ tests:
|
||||
- it: should create a DaemonSet if `controller.kind` is "DaemonSet"
|
||||
set:
|
||||
controller.kind: DaemonSet
|
||||
kind: Vanilla
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
@@ -13,4 +14,38 @@ tests:
|
||||
of: DaemonSet
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-ingress-nginx-controller
|
||||
value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-controller
|
||||
|
||||
- it: should create a DaemonSet with argument `--enable-metrics=false` if `controller.metrics.enabled` is false
|
||||
set:
|
||||
controller.kind: DaemonSet
|
||||
kind: Vanilla
|
||||
controller.metrics.enabled: false
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].args
|
||||
content: --enable-metrics=false
|
||||
|
||||
- it: should create a DaemonSet without argument `--enable-metrics=false` if `controller.metrics.enabled` is true
|
||||
set:
|
||||
controller.kind: DaemonSet
|
||||
kind: Vanilla
|
||||
controller.metrics.enabled: true
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.containers[0].args
|
||||
content: --enable-metrics=false
|
||||
|
||||
- it: should create a DaemonSet with resource limits if `controller.resources.limits` is set
|
||||
set:
|
||||
controller.kind: DaemonSet
|
||||
kind: Vanilla
|
||||
controller.resources.limits.cpu: 500m
|
||||
controller.resources.limits.memory: 512Mi
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].resources.limits.cpu
|
||||
value: 500m
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].resources.limits.memory
|
||||
value: 512Mi
|
||||
|
||||
@@ -11,20 +11,38 @@ tests:
|
||||
of: Deployment
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-ingress-nginx-controller
|
||||
value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-controller
|
||||
|
||||
- it: should create a Deployment with 3 replicas if `controller.replicaCount` is 3
|
||||
set:
|
||||
controller.replicaCount: 3
|
||||
kind: Vanilla
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.replicas
|
||||
value: 3
|
||||
|
||||
- it: should create a Deployment with argument `--enable-metrics=false` if `controller.metrics.enabled` is false
|
||||
set:
|
||||
controller.metrics.enabled: false
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].args
|
||||
content: --enable-metrics=false
|
||||
|
||||
- it: should create a Deployment without argument `--enable-metrics=false` if `controller.metrics.enabled` is true
|
||||
set:
|
||||
controller.metrics.enabled: true
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.containers[0].args
|
||||
content: --enable-metrics=false
|
||||
|
||||
- it: should create a Deployment with resource limits if `controller.resources.limits` is set
|
||||
set:
|
||||
controller.resources.limits.cpu: 500m
|
||||
controller.resources.limits.memory: 512Mi
|
||||
kind: Vanilla
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].resources.limits.cpu
|
||||
|
||||
@@ -14,4 +14,4 @@ tests:
|
||||
of: HorizontalPodAutoscaler
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-ingress-nginx-controller
|
||||
value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-controller
|
||||
|
||||
@@ -14,4 +14,4 @@ tests:
|
||||
of: ScaledObject
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-ingress-nginx-controller
|
||||
value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-controller
|
||||
|
||||
@@ -20,4 +20,4 @@ tests:
|
||||
of: NetworkPolicy
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-ingress-nginx-controller
|
||||
value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-controller
|
||||
|
||||
@@ -22,4 +22,4 @@ tests:
|
||||
of: Service
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-ingress-nginx-controller-internal
|
||||
value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-controller-internal
|
||||
|
||||
@@ -20,4 +20,4 @@ tests:
|
||||
of: Service
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-ingress-nginx-controller-metrics
|
||||
value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-controller-metrics
|
||||
|
||||
@@ -20,7 +20,7 @@ tests:
|
||||
of: Service
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-ingress-nginx-controller
|
||||
value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-controller
|
||||
|
||||
- it: should create a Service of type "NodePort" if `controller.service.external.enabled` is true and `controller.service.type` is "NodePort"
|
||||
set:
|
||||
|
||||
@@ -20,7 +20,7 @@ tests:
|
||||
of: Service
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-ingress-nginx-defaultbackend
|
||||
value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-defaultbackend
|
||||
|
||||
- it: should create a Service with port 80 if `defaultBackend.service.port` is 80
|
||||
set:
|
||||
|
||||
@@ -26,8 +26,8 @@ controller:
|
||||
## for backwards compatibility consider setting the full image url via the repository value below
|
||||
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
|
||||
## repository:
|
||||
tag: "v1.9.6"
|
||||
digest: sha256:1405cc613bd95b2c6edd8b2a152510ae91c7e62aea4698500d23b2145960ab9c
|
||||
tag: "v1.10.0"
|
||||
digest: sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c
|
||||
digestChroot: sha256:7eb46ff733429e0e46892903c7394aff149ac6d284d92b3946f3baf7ff26a096
|
||||
pullPolicy: IfNotPresent
|
||||
runAsNonRoot: true
|
||||
@@ -781,8 +781,8 @@ controller:
|
||||
## for backwards compatibility consider setting the full image url via the repository value below
|
||||
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
|
||||
## repository:
|
||||
tag: v20231226-1a7112e06
|
||||
digest: sha256:25d6a5f11211cc5c3f9f2bf552b585374af287b4debf693cacbe2da47daa5084
|
||||
tag: v1.4.0
|
||||
digest: sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334
|
||||
pullPolicy: IfNotPresent
|
||||
# -- Provide a priority class name to the webhook patching job
|
||||
##
|
||||
@@ -1198,7 +1198,7 @@ appsec:
|
||||
image:
|
||||
registry: ghcr.io/openappsec
|
||||
image: smartsync-tuning
|
||||
tag: 1.1.3
|
||||
tag: latest
|
||||
enabled: false
|
||||
replicaCount: 1
|
||||
securityContext:
|
||||
|
||||
@@ -1,8 +1,33 @@
|
||||
# Changelog
|
||||
|
||||
## Unreleased
|
||||
## 2.38.0
|
||||
|
||||
Nothing yet.
|
||||
### Changes
|
||||
|
||||
* Added support for setting `SVC.tls.appProtocol` and `SVC.http.appProtocol` values to configure the appProtocol fields
|
||||
for Kubernetes Service HTTP and TLS ports. It might be useful for integration with external load balancers like GCP.
|
||||
[#1018](https://github.com/Kong/charts/pull/1018)
|
||||
|
||||
## 2.37.1
|
||||
|
||||
* Rename the controller status port. This fixes a collision with the proxy status port in the Prometheus ServiceMonitor.
|
||||
[#1008](https://github.com/Kong/charts/pull/1008)
|
||||
|
||||
## 2.37.0
|
||||
|
||||
### Changes
|
||||
|
||||
* Bumped default `kong/kubernetes-ingress-controller` image tag and updated CRDs to 3.1.
|
||||
[#1011](https://github.com/Kong/charts/pull/1011)
|
||||
* Bumped default `kong` image tag to 3.6.
|
||||
[#1011](https://github.com/Kong/charts/pull/1011)
|
||||
|
||||
## 2.36.0
|
||||
|
||||
### Fixed
|
||||
|
||||
* Add `KongLicense` RBAC rules.
|
||||
[#1006](https://github.com/Kong/charts/pull/1006)
|
||||
|
||||
## 2.35.1
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
apiVersion: v2
|
||||
appVersion: 1.1.5
|
||||
appVersion: 1.1.8
|
||||
dependencies:
|
||||
- condition: postgresql.enabled
|
||||
name: postgresql
|
||||
@@ -14,4 +14,4 @@ maintainers:
|
||||
name: open-appsec-kong
|
||||
sources:
|
||||
- https://github.com/Kong/charts/tree/main/charts/kong
|
||||
version: 2.35.1
|
||||
version: 2.38.0
|
||||
|
||||
@@ -667,7 +667,7 @@ mixed TCP/UDP LoadBalancer Services). It _does not_ support the `http`, `tls`,
|
||||
or `ingress` sections, as it is used only for stream listens.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|------------------------------------|---------------------------------------------------------------------------------------|--------------------------|
|
||||
|-----------------------------------|-------------------------------------------------------------------------------------------|--------------------------|
|
||||
| SVC.enabled | Create Service resource for SVC (admin, proxy, manager, etc.) | |
|
||||
| SVC.http.enabled | Enables http on the service | |
|
||||
| SVC.http.servicePort | Service port to use for http | |
|
||||
@@ -675,6 +675,7 @@ or `ingress` sections, as it is used only for stream listens.
|
||||
| SVC.http.nodePort | Node port to use for http | |
|
||||
| SVC.http.hostPort | Host port to use for http | |
|
||||
| SVC.http.parameters | Array of additional listen parameters | `[]` |
|
||||
| SVC.http.appProtocol | `appProtocol` to be set in a Service's port. If left empty, no `appProtocol` will be set. | |
|
||||
| SVC.tls.enabled | Enables TLS on the service | |
|
||||
| SVC.tls.containerPort | Container port to use for TLS | |
|
||||
| SVC.tls.servicePort | Service port to use for TLS | |
|
||||
@@ -682,6 +683,7 @@ or `ingress` sections, as it is used only for stream listens.
|
||||
| SVC.tls.hostPort | Host port to use for TLS | |
|
||||
| SVC.tls.overrideServiceTargetPort | Override service port to use for TLS without touching Kong containerPort | |
|
||||
| SVC.tls.parameters | Array of additional listen parameters | `["http2"]` |
|
||||
| SVC.tls.appProtocol | `appProtocol` to be set in a Service's port. If left empty, no `appProtocol` will be set. | |
|
||||
| SVC.type | k8s service type. Options: NodePort, ClusterIP, LoadBalancer | |
|
||||
| SVC.clusterIP | k8s service clusterIP | |
|
||||
| SVC.loadBalancerClass | loadBalancerClass to use for LoadBalancer provisionning | |
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -33,9 +33,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -90,7 +90,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -205,7 +205,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -274,8 +274,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-custom-dbless-config
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -286,8 +286,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-admin
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -309,8 +309,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -336,9 +336,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -364,8 +364,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -84,8 +84,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -108,9 +108,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -138,7 +138,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -159,7 +159,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -240,7 +240,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -350,7 +350,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -408,8 +408,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -617,6 +617,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -657,8 +689,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -677,8 +709,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -742,8 +774,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -766,8 +798,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -783,8 +815,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -797,8 +829,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -825,9 +857,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -854,8 +886,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -870,8 +902,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -881,8 +913,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -137,7 +137,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -158,7 +158,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -241,7 +241,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -353,7 +353,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -410,8 +410,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -619,6 +619,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -658,8 +690,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -677,8 +709,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -741,8 +773,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -764,8 +796,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -780,8 +812,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -793,8 +825,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -820,9 +852,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -848,8 +880,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -863,8 +895,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -873,8 +905,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -430,8 +430,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -639,6 +639,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -678,8 +710,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -697,8 +729,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -761,8 +793,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -784,8 +816,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -800,8 +832,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -822,8 +854,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -849,9 +881,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -877,8 +909,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -892,8 +924,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -902,8 +934,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -432,8 +432,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -641,6 +641,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -680,8 +712,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -699,8 +731,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -763,8 +795,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -786,8 +818,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -802,8 +834,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -824,8 +856,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -851,9 +883,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -879,8 +911,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -894,8 +926,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -904,8 +936,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -428,8 +428,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -637,6 +637,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -676,8 +708,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -695,8 +727,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -759,8 +791,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -782,8 +814,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -798,8 +830,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -811,8 +843,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -838,9 +870,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -866,8 +898,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -881,8 +913,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -891,8 +923,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -463,8 +463,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -672,6 +672,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -711,8 +743,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -730,8 +762,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -794,8 +826,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -817,8 +849,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -833,8 +865,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -864,8 +896,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -891,9 +923,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -919,8 +951,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -934,8 +966,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -944,8 +976,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -0,0 +1,912 @@
|
||||
['kong-ingress-5-3.1-rbac-values']
|
||||
SnapShot = """
|
||||
- object:
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1beta1
|
||||
clientConfig:
|
||||
caBundle: '###DYNAMIC_FIELD###'
|
||||
service:
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
failurePolicy: Ignore
|
||||
name: validations.kong.konghq.com
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: owner
|
||||
operator: NotIn
|
||||
values:
|
||||
- helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
apiVersions:
|
||||
- '*'
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- kongconsumers
|
||||
- kongplugins
|
||||
- kongclusterplugins
|
||||
- kongingresses
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- secrets
|
||||
- services
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- ingresses
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
apiVersions:
|
||||
- v1alpha2
|
||||
- v1beta1
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- gateways
|
||||
- httproutes
|
||||
sideEffects: None
|
||||
- object:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/name: kong
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kuma.io/gateway: enabled
|
||||
kuma.io/service-account-token-volume: chartsnap-kong-token
|
||||
traffic.sidecar.istio.io/includeInboundPorts: \"\"
|
||||
labels:
|
||||
app: chartsnap-kong
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args: null
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: CONTROLLER_ADMISSION_WEBHOOK_LISTEN
|
||||
value: 0.0.0.0:8080
|
||||
- name: CONTROLLER_ANONYMOUS_REPORTS
|
||||
value: \"false\"
|
||||
- name: CONTROLLER_ELECTION_ID
|
||||
value: kong-ingress-controller-leader-kong
|
||||
- name: CONTROLLER_INGRESS_CLASS
|
||||
value: kong
|
||||
- name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY
|
||||
value: \"true\"
|
||||
- name: CONTROLLER_KONG_ADMIN_URL
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.1.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
name: ingress-controller
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: webhook
|
||||
protocol: TCP
|
||||
- containerPort: 10255
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /admission-webhook
|
||||
name: webhook-cert
|
||||
readOnly: true
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: chartsnap-kong-token
|
||||
readOnly: true
|
||||
- env:
|
||||
- name: KONG_ADMIN_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_GUI_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_GUI_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_LISTEN
|
||||
value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
|
||||
- name: KONG_ANONYMOUS_REPORTS
|
||||
value: \"off\"
|
||||
- name: KONG_CLUSTER_LISTEN
|
||||
value: \"off\"
|
||||
- name: KONG_DATABASE
|
||||
value: \"off\"
|
||||
- name: KONG_KIC
|
||||
value: \"on\"
|
||||
- name: KONG_LUA_PACKAGE_PATH
|
||||
value: /opt/?.lua;/opt/?/init.lua;;
|
||||
- name: KONG_NGINX_WORKER_PROCESSES
|
||||
value: \"2\"
|
||||
- name: KONG_PORTAL_API_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PORTAL_API_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PORT_MAPS
|
||||
value: 80:8000, 443:8443
|
||||
- name: KONG_PREFIX
|
||||
value: /kong_prefix/
|
||||
- name: KONG_PROXY_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PROXY_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PROXY_LISTEN
|
||||
value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl
|
||||
- name: KONG_PROXY_STREAM_ACCESS_LOG
|
||||
value: /dev/stdout basic
|
||||
- name: KONG_PROXY_STREAM_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ROUTER_FLAVOR
|
||||
value: traditional
|
||||
- name: KONG_STATUS_ACCESS_LOG
|
||||
value: \"off\"
|
||||
- name: KONG_STATUS_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_STATUS_LISTEN
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- kong
|
||||
- quit
|
||||
- --wait=15
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /status
|
||||
port: status
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
name: proxy
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
name: proxy
|
||||
protocol: TCP
|
||||
- containerPort: 8443
|
||||
name: proxy-tls
|
||||
protocol: TCP
|
||||
- containerPort: 8100
|
||||
name: status
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /status/ready
|
||||
port: status
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /kong_prefix/
|
||||
name: chartsnap-kong-prefix-dir
|
||||
- mountPath: /tmp
|
||||
name: chartsnap-kong-tmp
|
||||
initContainers:
|
||||
- command:
|
||||
- rm
|
||||
- -vrf
|
||||
- $KONG_PREFIX/pids
|
||||
env:
|
||||
- name: KONG_ADMIN_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_GUI_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_GUI_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_LISTEN
|
||||
value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
|
||||
- name: KONG_ANONYMOUS_REPORTS
|
||||
value: \"off\"
|
||||
- name: KONG_CLUSTER_LISTEN
|
||||
value: \"off\"
|
||||
- name: KONG_DATABASE
|
||||
value: \"off\"
|
||||
- name: KONG_KIC
|
||||
value: \"on\"
|
||||
- name: KONG_LUA_PACKAGE_PATH
|
||||
value: /opt/?.lua;/opt/?/init.lua;;
|
||||
- name: KONG_NGINX_WORKER_PROCESSES
|
||||
value: \"2\"
|
||||
- name: KONG_PORTAL_API_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PORTAL_API_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PORT_MAPS
|
||||
value: 80:8000, 443:8443
|
||||
- name: KONG_PREFIX
|
||||
value: /kong_prefix/
|
||||
- name: KONG_PROXY_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PROXY_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PROXY_LISTEN
|
||||
value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl
|
||||
- name: KONG_PROXY_STREAM_ACCESS_LOG
|
||||
value: /dev/stdout basic
|
||||
- name: KONG_PROXY_STREAM_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ROUTER_FLAVOR
|
||||
value: traditional
|
||||
- name: KONG_STATUS_ACCESS_LOG
|
||||
value: \"off\"
|
||||
- name: KONG_STATUS_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_STATUS_LISTEN
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /kong_prefix/
|
||||
name: chartsnap-kong-prefix-dir
|
||||
- mountPath: /tmp
|
||||
name: chartsnap-kong-tmp
|
||||
securityContext: {}
|
||||
serviceAccountName: chartsnap-kong
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- emptyDir:
|
||||
sizeLimit: 256Mi
|
||||
name: chartsnap-kong-prefix-dir
|
||||
- emptyDir:
|
||||
sizeLimit: 1Gi
|
||||
name: chartsnap-kong-tmp
|
||||
- name: chartsnap-kong-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
- name: webhook-cert
|
||||
secret:
|
||||
secretName: chartsnap-kong-validation-webhook-keypair
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongupstreampolicies
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongupstreampolicies/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumergroups
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumergroups/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- services/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- ingressclassparameterses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumers/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongplugins
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongplugins/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- tcpingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- tcpingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- udpingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- udpingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongclusterplugins
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongclusterplugins/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: chartsnap-kong
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- configmaps
|
||||
- pods
|
||||
- secrets
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resourceNames:
|
||||
- kong-ingress-controller-leader-kong-kong
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- configmaps
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: chartsnap-kong
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
- object:
|
||||
apiVersion: v1
|
||||
data:
|
||||
tls.crt: '###DYNAMIC_FIELD###'
|
||||
tls.key: '###DYNAMIC_FIELD###'
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
- object:
|
||||
apiVersion: v1
|
||||
data:
|
||||
tls.crt: '###DYNAMIC_FIELD###'
|
||||
tls.key: '###DYNAMIC_FIELD###'
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
ports:
|
||||
- name: kong-manager
|
||||
port: 8002
|
||||
protocol: TCP
|
||||
targetPort: 8002
|
||||
- name: kong-manager-tls
|
||||
port: 8445
|
||||
protocol: TCP
|
||||
targetPort: 8445
|
||||
selector:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/name: kong
|
||||
type: NodePort
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
ports:
|
||||
- name: kong-proxy
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 8000
|
||||
- name: kong-proxy-tls
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 8443
|
||||
selector:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/name: kong
|
||||
type: LoadBalancer
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
ports:
|
||||
- name: webhook
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: webhook
|
||||
selector:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
@@ -0,0 +1,908 @@
|
||||
[proxy-appprotocol-values]
|
||||
SnapShot = """
|
||||
- object:
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1beta1
|
||||
clientConfig:
|
||||
caBundle: '###DYNAMIC_FIELD###'
|
||||
service:
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
failurePolicy: Ignore
|
||||
name: validations.kong.konghq.com
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: owner
|
||||
operator: NotIn
|
||||
values:
|
||||
- helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
apiVersions:
|
||||
- '*'
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- kongconsumers
|
||||
- kongplugins
|
||||
- kongclusterplugins
|
||||
- kongingresses
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- secrets
|
||||
- services
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- ingresses
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
apiVersions:
|
||||
- v1alpha2
|
||||
- v1beta1
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- gateways
|
||||
- httproutes
|
||||
sideEffects: None
|
||||
- object:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/name: kong
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kuma.io/gateway: enabled
|
||||
kuma.io/service-account-token-volume: chartsnap-kong-token
|
||||
traffic.sidecar.istio.io/includeInboundPorts: \"\"
|
||||
labels:
|
||||
app: chartsnap-kong
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args: null
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: CONTROLLER_ADMISSION_WEBHOOK_LISTEN
|
||||
value: 0.0.0.0:8080
|
||||
- name: CONTROLLER_ELECTION_ID
|
||||
value: kong-ingress-controller-leader-kong
|
||||
- name: CONTROLLER_INGRESS_CLASS
|
||||
value: kong
|
||||
- name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY
|
||||
value: \"true\"
|
||||
- name: CONTROLLER_KONG_ADMIN_URL
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
name: ingress-controller
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: webhook
|
||||
protocol: TCP
|
||||
- containerPort: 10255
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /admission-webhook
|
||||
name: webhook-cert
|
||||
readOnly: true
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: chartsnap-kong-token
|
||||
readOnly: true
|
||||
- env:
|
||||
- name: KONG_ADMIN_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_GUI_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_GUI_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_LISTEN
|
||||
value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
|
||||
- name: KONG_CLUSTER_LISTEN
|
||||
value: \"off\"
|
||||
- name: KONG_DATABASE
|
||||
value: \"off\"
|
||||
- name: KONG_KIC
|
||||
value: \"on\"
|
||||
- name: KONG_LUA_PACKAGE_PATH
|
||||
value: /opt/?.lua;/opt/?/init.lua;;
|
||||
- name: KONG_NGINX_WORKER_PROCESSES
|
||||
value: \"2\"
|
||||
- name: KONG_PORTAL_API_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PORTAL_API_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PORT_MAPS
|
||||
value: 80:8000, 443:8443
|
||||
- name: KONG_PREFIX
|
||||
value: /kong_prefix/
|
||||
- name: KONG_PROXY_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PROXY_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PROXY_LISTEN
|
||||
value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl
|
||||
- name: KONG_PROXY_STREAM_ACCESS_LOG
|
||||
value: /dev/stdout basic
|
||||
- name: KONG_PROXY_STREAM_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ROUTER_FLAVOR
|
||||
value: traditional
|
||||
- name: KONG_STATUS_ACCESS_LOG
|
||||
value: \"off\"
|
||||
- name: KONG_STATUS_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_STATUS_LISTEN
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- kong
|
||||
- quit
|
||||
- --wait=15
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /status
|
||||
port: status
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
name: proxy
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
name: proxy
|
||||
protocol: TCP
|
||||
- containerPort: 8443
|
||||
name: proxy-tls
|
||||
protocol: TCP
|
||||
- containerPort: 8100
|
||||
name: status
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /status/ready
|
||||
port: status
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /kong_prefix/
|
||||
name: chartsnap-kong-prefix-dir
|
||||
- mountPath: /tmp
|
||||
name: chartsnap-kong-tmp
|
||||
initContainers:
|
||||
- command:
|
||||
- rm
|
||||
- -vrf
|
||||
- $KONG_PREFIX/pids
|
||||
env:
|
||||
- name: KONG_ADMIN_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_GUI_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_GUI_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_LISTEN
|
||||
value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
|
||||
- name: KONG_CLUSTER_LISTEN
|
||||
value: \"off\"
|
||||
- name: KONG_DATABASE
|
||||
value: \"off\"
|
||||
- name: KONG_KIC
|
||||
value: \"on\"
|
||||
- name: KONG_LUA_PACKAGE_PATH
|
||||
value: /opt/?.lua;/opt/?/init.lua;;
|
||||
- name: KONG_NGINX_WORKER_PROCESSES
|
||||
value: \"2\"
|
||||
- name: KONG_PORTAL_API_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PORTAL_API_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PORT_MAPS
|
||||
value: 80:8000, 443:8443
|
||||
- name: KONG_PREFIX
|
||||
value: /kong_prefix/
|
||||
- name: KONG_PROXY_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PROXY_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PROXY_LISTEN
|
||||
value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl
|
||||
- name: KONG_PROXY_STREAM_ACCESS_LOG
|
||||
value: /dev/stdout basic
|
||||
- name: KONG_PROXY_STREAM_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ROUTER_FLAVOR
|
||||
value: traditional
|
||||
- name: KONG_STATUS_ACCESS_LOG
|
||||
value: \"off\"
|
||||
- name: KONG_STATUS_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_STATUS_LISTEN
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /kong_prefix/
|
||||
name: chartsnap-kong-prefix-dir
|
||||
- mountPath: /tmp
|
||||
name: chartsnap-kong-tmp
|
||||
securityContext: {}
|
||||
serviceAccountName: chartsnap-kong
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- emptyDir:
|
||||
sizeLimit: 256Mi
|
||||
name: chartsnap-kong-prefix-dir
|
||||
- emptyDir:
|
||||
sizeLimit: 1Gi
|
||||
name: chartsnap-kong-tmp
|
||||
- name: chartsnap-kong-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
- name: webhook-cert
|
||||
secret:
|
||||
secretName: chartsnap-kong-validation-webhook-keypair
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongupstreampolicies
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongupstreampolicies/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumergroups
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumergroups/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- services/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- ingressclassparameterses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumers/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongplugins
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongplugins/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- tcpingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- tcpingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- udpingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- udpingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongclusterplugins
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongclusterplugins/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: chartsnap-kong
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- configmaps
|
||||
- pods
|
||||
- secrets
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resourceNames:
|
||||
- kong-ingress-controller-leader-kong-kong
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- configmaps
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: chartsnap-kong
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
- object:
|
||||
apiVersion: v1
|
||||
data:
|
||||
tls.crt: '###DYNAMIC_FIELD###'
|
||||
tls.key: '###DYNAMIC_FIELD###'
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
- object:
|
||||
apiVersion: v1
|
||||
data:
|
||||
tls.crt: '###DYNAMIC_FIELD###'
|
||||
tls.key: '###DYNAMIC_FIELD###'
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
ports:
|
||||
- name: kong-manager
|
||||
port: 8002
|
||||
protocol: TCP
|
||||
targetPort: 8002
|
||||
- name: kong-manager-tls
|
||||
port: 8445
|
||||
protocol: TCP
|
||||
targetPort: 8445
|
||||
selector:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/name: kong
|
||||
type: NodePort
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
ports:
|
||||
- appProtocol: http
|
||||
name: kong-proxy
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 8000
|
||||
- appProtocol: https
|
||||
name: kong-proxy-tls
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 8443
|
||||
selector:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/name: kong
|
||||
type: LoadBalancer
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
ports:
|
||||
- name: webhook
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: webhook
|
||||
selector:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -613,6 +613,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -652,8 +684,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -671,8 +703,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -735,8 +767,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -758,8 +790,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -774,8 +806,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -787,8 +819,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -814,9 +846,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -842,8 +874,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -857,8 +889,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -867,8 +899,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: my-kong-sa
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -158,7 +158,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -410,8 +410,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -619,6 +619,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -658,8 +690,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -677,8 +709,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -741,8 +773,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -764,8 +796,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -780,8 +812,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -793,8 +825,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -820,9 +852,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -848,8 +880,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -863,8 +895,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -873,8 +905,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -32,9 +32,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -249,8 +249,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -276,9 +276,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -304,8 +304,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -104,10 +104,10 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
environment: test
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -139,7 +139,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -160,7 +160,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -252,7 +252,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -370,7 +370,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -447,8 +447,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -473,8 +473,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -497,8 +497,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -706,6 +706,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -745,8 +777,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -764,8 +796,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -828,8 +860,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -851,8 +883,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -867,8 +899,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -880,8 +912,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -907,9 +939,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -935,8 +967,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -950,8 +982,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -960,8 +992,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -83,8 +83,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -111,9 +111,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -150,7 +150,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -171,7 +171,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -270,7 +270,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -404,7 +404,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -507,7 +507,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-db
|
||||
resources: {}
|
||||
@@ -724,8 +724,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-init-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -740,8 +740,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-init-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -819,7 +819,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-migrations
|
||||
resources: {}
|
||||
@@ -924,7 +924,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -977,8 +977,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-post-upgrade-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -993,8 +993,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-post-upgrade-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -1072,7 +1072,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-post-upgrade-migrations
|
||||
resources: {}
|
||||
@@ -1177,7 +1177,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -1232,8 +1232,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-pre-upgrade-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1248,8 +1248,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-pre-upgrade-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -1327,7 +1327,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-upgrade-migrations
|
||||
resources: {}
|
||||
@@ -1432,7 +1432,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -1481,8 +1481,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1505,10 +1505,26 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -1548,8 +1564,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -1567,8 +1583,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -1631,8 +1647,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-default
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -1841,6 +1857,22 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
@@ -1849,8 +1881,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -1869,8 +1901,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-default
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -1895,8 +1927,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-bash-wait-for-postgres
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -1917,8 +1949,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -1933,8 +1965,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -1961,8 +1993,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1988,9 +2020,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -2024,8 +2056,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -2039,8 +2071,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -2099,8 +2131,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -33,9 +33,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -92,7 +92,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -208,7 +208,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -295,8 +295,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-custom-dbless-config
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -307,8 +307,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -334,9 +334,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -362,8 +362,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -33,9 +33,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -92,7 +92,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:9000, [::]:9000, 0.0.0.0:9001 ssl, [::]:9001 ssl
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -212,7 +212,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: 0.0.0.0:9000, [::]:9000, 0.0.0.0:9001 ssl, [::]:9001 ssl
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -271,8 +271,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -304,8 +304,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-custom-dbless-config
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -316,8 +316,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -343,9 +343,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -379,8 +379,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -110,9 +110,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -142,7 +142,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -163,7 +163,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -261,7 +261,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -388,7 +388,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -477,7 +477,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-db
|
||||
resources: {}
|
||||
@@ -694,8 +694,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-init-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -710,8 +710,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-init-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -788,7 +788,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-migrations
|
||||
resources: {}
|
||||
@@ -879,7 +879,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -932,8 +932,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-post-upgrade-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -948,8 +948,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-post-upgrade-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -1026,7 +1026,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-post-upgrade-migrations
|
||||
resources: {}
|
||||
@@ -1117,7 +1117,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -1172,8 +1172,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-pre-upgrade-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1188,8 +1188,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-pre-upgrade-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -1266,7 +1266,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-upgrade-migrations
|
||||
resources: {}
|
||||
@@ -1357,7 +1357,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -1406,8 +1406,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1430,8 +1430,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -1639,6 +1639,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -1678,8 +1710,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -1697,8 +1729,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -1761,8 +1793,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -1787,8 +1819,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-bash-wait-for-postgres
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -1802,8 +1834,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -1818,8 +1850,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -1846,8 +1878,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1873,9 +1905,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1901,8 +1933,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1916,8 +1948,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -1976,8 +2008,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.35.1
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
env:
|
||||
anonymous_reports: "off"
|
||||
ingressController:
|
||||
env:
|
||||
anonymous_reports: "false"
|
||||
image:
|
||||
tag: "3.1.0"
|
||||
@@ -0,0 +1,7 @@
|
||||
# This values test that the `proxy.*.appProtocol` can be set to a custom value.
|
||||
|
||||
proxy:
|
||||
http:
|
||||
appProtocol: "http"
|
||||
tls:
|
||||
appProtocol: "https"
|
||||
File diff suppressed because it is too large
Load Diff
@@ -213,6 +213,9 @@ spec:
|
||||
- name: kong-{{ .serviceName }}
|
||||
port: {{ .http.servicePort }}
|
||||
targetPort: {{ .http.containerPort }}
|
||||
{{- if .http.appProtocol }}
|
||||
appProtocol: {{ .http.appProtocol }}
|
||||
{{- end }}
|
||||
{{- if (and (or (eq .type "LoadBalancer") (eq .type "NodePort")) (not (empty .http.nodePort))) }}
|
||||
nodePort: {{ .http.nodePort }}
|
||||
{{- end }}
|
||||
@@ -223,6 +226,9 @@ spec:
|
||||
- name: kong-{{ .serviceName }}-tls
|
||||
port: {{ .tls.servicePort }}
|
||||
targetPort: {{ .tls.overrideServiceTargetPort | default .tls.containerPort }}
|
||||
{{- if .tls.appProtocol }}
|
||||
appProtocol: {{ .tls.appProtocol }}
|
||||
{{- end }}
|
||||
{{- if (and (or (eq .type "LoadBalancer") (eq .type "NodePort")) (not (empty .tls.nodePort))) }}
|
||||
nodePort: {{ .tls.nodePort }}
|
||||
{{- end }}
|
||||
@@ -890,7 +896,7 @@ The name of the Service which will be used by the controller to update the Ingre
|
||||
containerPort: 10255
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
- name: status
|
||||
- name: cstatus
|
||||
containerPort: 10254
|
||||
protocol: TCP
|
||||
env:
|
||||
@@ -1647,6 +1653,24 @@ resource roles into their separate templates.
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- if (semverCompare ">= 3.1.0" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
|
||||
@@ -34,7 +34,7 @@ spec:
|
||||
http-headers: false
|
||||
request-body: false
|
||||
log-destination:
|
||||
cloud: false
|
||||
cloud: true
|
||||
stdout:
|
||||
format: json-formatted
|
||||
---
|
||||
|
||||
@@ -130,7 +130,7 @@ extraLabels: {}
|
||||
# Specify Kong's Docker image and repository details here
|
||||
image:
|
||||
repository: kong
|
||||
tag: "3.5"
|
||||
tag: "3.6"
|
||||
# Kong Enterprise
|
||||
# repository: kong/kong-gateway
|
||||
# tag: "3.5"
|
||||
@@ -317,6 +317,10 @@ proxy:
|
||||
parameters:
|
||||
- http2
|
||||
|
||||
# Specify the Service's TLS port's appProtocol. This can be useful when integrating with
|
||||
# external load balancers that require the `appProtocol` field to be set (e.g. GCP).
|
||||
appProtocol: ""
|
||||
|
||||
# Define stream (TCP) listen
|
||||
# To enable, remove "[]", uncomment the section below, and select your desired
|
||||
# ports and parameters. Listens are dynamically named after their containerPort,
|
||||
@@ -525,7 +529,7 @@ ingressController:
|
||||
enabled: true
|
||||
image:
|
||||
repository: kong/kubernetes-ingress-controller
|
||||
tag: "3.0"
|
||||
tag: "3.1"
|
||||
# Optionally set a semantic version for version-gated features. This can normally
|
||||
# be left unset. You only need to set this if your tag is not a semver string,
|
||||
# such as when you are using a "next" tag. Set this to the effective semantic
|
||||
@@ -1255,7 +1259,7 @@ appsec:
|
||||
#registry:
|
||||
repository: ghcr.io/openappsec
|
||||
image: "agent"
|
||||
tag: "1.1.5"
|
||||
tag: "1.1.8"
|
||||
pullPolicy: Always
|
||||
|
||||
securityContext:
|
||||
@@ -1269,7 +1273,7 @@ appsec:
|
||||
kong:
|
||||
image:
|
||||
repository: "ghcr.io/openappsec/kong-attachment"
|
||||
tag: "1.1.5"
|
||||
tag: "1.1.8"
|
||||
configMapName: appsec-settings-configmap
|
||||
configMapContent:
|
||||
crowdsec:
|
||||
|
||||
@@ -18,6 +18,10 @@ if [ ! -f /nano-service-installers/$ORCHESTRATION_INSTALLATION_SCRIPT ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z $1 ]; then
|
||||
var_mode="--hybrid_mode"
|
||||
fi
|
||||
|
||||
while true; do
|
||||
if [ -z "$1" ]; then
|
||||
break
|
||||
@@ -27,24 +31,24 @@ while true; do
|
||||
elif [ "$1" == "--proxy" ]; then
|
||||
shift
|
||||
var_proxy="$1"
|
||||
elif [ "$1" == "--hybrid-mode" ]; then
|
||||
elif [ "$1" == "--hybrid-mode" ] || [ "$1" == "--standalone" ]; then
|
||||
var_mode="--hybrid_mode"
|
||||
elif [ "$1" == "--token" ]; then
|
||||
shift
|
||||
var_token="$1"
|
||||
elif [ "$1" == "--standalone" ]; then
|
||||
var_mode="--hybrid_mode"
|
||||
var_token="cp-3fb5c718-5e39-47e6-8d5e-99b4bc5660b74b4b7fc8-5312-451d-a763-aaf7872703c0"
|
||||
fi
|
||||
shift
|
||||
done
|
||||
|
||||
if [ -z $var_token ]; then
|
||||
if [ -z $var_token ] && [ $var_mode != "--hybrid_mode" ]; then
|
||||
echo "Error: Token was not provided as input argument."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
orchestration_service_installation_flags="--token $var_token --container_mode --skip_registration"
|
||||
orchestration_service_installation_flags="--container_mode --skip_registration"
|
||||
if [ ! -z $var_token ]; then
|
||||
orchestration_service_installation_flags="$orchestration_service_installation_flags --token $var_token"
|
||||
fi
|
||||
if [ ! -z $var_fog_address ]; then
|
||||
orchestration_service_installation_flags="$orchestration_service_installation_flags --fog $var_fog_address"
|
||||
fi
|
||||
@@ -67,7 +71,7 @@ fi
|
||||
/nano-service-installers/$CACHE_INSTALLATION_SCRIPT --install
|
||||
/nano-service-installers/$HTTP_TRANSACTION_HANDLER_SERVICE --install
|
||||
|
||||
if [ ! -z $CROWDSEC_ENABLED ]; then
|
||||
if [ "$CROWDSEC_ENABLED" == "true" ]; then
|
||||
/nano-service-installers/$INTELLIGENCE_INSTALLATION_SCRIPT --install
|
||||
/nano-service-installers/$CROWDSEC_INSTALLATION_SCRIPT --install
|
||||
fi
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
add_subdirectory(report_messaging)
|
||||
add_subdirectory(http_manager)
|
||||
add_subdirectory(generic_rulebase)
|
||||
add_subdirectory(signal_handler)
|
||||
add_subdirectory(gradual_deployment)
|
||||
add_subdirectory(packet)
|
||||
|
||||
@@ -1136,8 +1136,7 @@ private:
|
||||
NginxAttachmentOpaque &opaque = i_transaction_table->getState<NginxAttachmentOpaque>();
|
||||
uuid = opaque.getSessionUUID();
|
||||
}
|
||||
web_response_data.uuid_size =
|
||||
string("Incident Id: ").length() + uuid.size();
|
||||
web_response_data.uuid_size = uuid.size();
|
||||
|
||||
if (web_trigger_conf.getDetailsLevel() == "Redirect") {
|
||||
web_response_data.response_data.redirect_data.redirect_location_size =
|
||||
|
||||
@@ -17,6 +17,7 @@
|
||||
#include <vector>
|
||||
|
||||
#include "generic_rulebase/parameters_config.h"
|
||||
#include "generic_rulebase/triggers_config.h"
|
||||
#include "generic_rulebase/zone.h"
|
||||
#include "config.h"
|
||||
|
||||
@@ -26,6 +27,9 @@ public:
|
||||
virtual Maybe<Zone, Config::Errors> getLocalZone() const = 0;
|
||||
virtual Maybe<Zone, Config::Errors> getOtherZone() const = 0;
|
||||
|
||||
virtual LogTriggerConf getLogTriggerConf(const std::string &trigger_Id) const = 0;
|
||||
virtual ParameterException getParameterException(const std::string ¶meter_Id) const = 0;
|
||||
|
||||
using ParameterKeyValues = std::unordered_map<std::string, std::set<std::string>>;
|
||||
virtual std::set<ParameterBehavior> getBehavior(const ParameterKeyValues &key_value_pairs) const = 0;
|
||||
|
||||
|
||||
@@ -25,6 +25,7 @@ struct DecisionTelemetryData
|
||||
std::string source;
|
||||
TrafficMethod method;
|
||||
int responseCode;
|
||||
uint64_t elapsedTime;
|
||||
std::set<std::string> attackTypes;
|
||||
|
||||
DecisionTelemetryData() :
|
||||
@@ -36,6 +37,7 @@ struct DecisionTelemetryData
|
||||
source(),
|
||||
method(POST),
|
||||
responseCode(0),
|
||||
elapsedTime(0),
|
||||
attackTypes()
|
||||
{
|
||||
}
|
||||
|
||||
@@ -141,9 +141,12 @@ public:
|
||||
|
||||
ReportMessaging & operator<<(const LogField &field);
|
||||
|
||||
void setForceBuffering(bool _force_buffering);
|
||||
|
||||
private:
|
||||
Report report;
|
||||
bool is_async_message;
|
||||
bool force_buffering = false;
|
||||
MessageCategory message_type_tag;
|
||||
};
|
||||
|
||||
|
||||
@@ -91,6 +91,7 @@ private:
|
||||
MetricCalculations::Counter response_2xx{this, "reservedNgenG"};
|
||||
MetricCalculations::Counter response_4xx{this, "reservedNgenH"};
|
||||
MetricCalculations::Counter response_5xx{this, "reservedNgenI"};
|
||||
MetricCalculations::Average<uint64_t> average_latency{this, "reservedNgenJ"};
|
||||
};
|
||||
|
||||
class WaapAttackTypesMetrics : public WaapTelemetryBase
|
||||
|
||||
@@ -33,7 +33,9 @@ ReportMessaging::~ReportMessaging()
|
||||
HTTPMethod::POST,
|
||||
url,
|
||||
log_rest,
|
||||
message_type_tag
|
||||
message_type_tag,
|
||||
MessageMetadata(),
|
||||
force_buffering
|
||||
);
|
||||
} catch (...) {}
|
||||
}
|
||||
@@ -44,3 +46,9 @@ ReportMessaging::operator<<(const LogField &field)
|
||||
report << field;
|
||||
return *this;
|
||||
}
|
||||
|
||||
void
|
||||
ReportMessaging::setForceBuffering(bool _force_buffering)
|
||||
{
|
||||
force_buffering = _force_buffering;
|
||||
}
|
||||
|
||||
@@ -99,12 +99,55 @@ TEST_F(ReportMessagingTest, title_only)
|
||||
" }\n"
|
||||
"}",
|
||||
_,
|
||||
_,
|
||||
_
|
||||
)
|
||||
).Times(1);
|
||||
ReportMessaging("test", ReportIS::AudienceTeam::AGENT_CORE, 1, true, ReportIS::Tags::ACCESS_CONTROL);
|
||||
}
|
||||
|
||||
TEST_F(ReportMessagingTest, with_buffering)
|
||||
{
|
||||
EXPECT_CALL(
|
||||
mock_messaging,
|
||||
sendAsyncMessage(
|
||||
_,
|
||||
_,
|
||||
"{\n"
|
||||
" \"log\": {\n"
|
||||
" \"eventTime\": \"Best Time ever\",\n"
|
||||
" \"eventName\": \"test\",\n"
|
||||
" \"eventSeverity\": \"Info\",\n"
|
||||
" \"eventPriority\": \"Low\",\n"
|
||||
" \"eventType\": \"Event Driven\",\n"
|
||||
" \"eventLevel\": \"Log\",\n"
|
||||
" \"eventLogLevel\": \"info\",\n"
|
||||
" \"eventAudience\": \"Internal\",\n"
|
||||
" \"eventAudienceTeam\": \"Agent Core\",\n"
|
||||
" \"eventFrequency\": 0,\n"
|
||||
" \"eventTags\": [\n"
|
||||
" \"Access Control\"\n"
|
||||
" ],\n"
|
||||
" \"eventSource\": {\n"
|
||||
" \"eventTraceId\": \"\",\n"
|
||||
" \"eventSpanId\": \"\",\n"
|
||||
" \"issuingEngineVersion\": \"\",\n"
|
||||
" \"serviceName\": \"Unnamed Nano Service\"\n"
|
||||
" },\n"
|
||||
" \"eventData\": {\n"
|
||||
" \"eventObject\": 1\n"
|
||||
" }\n"
|
||||
" }\n"
|
||||
"}",
|
||||
_,
|
||||
_,
|
||||
true
|
||||
)
|
||||
).Times(1);
|
||||
ReportMessaging report("test", ReportIS::AudienceTeam::AGENT_CORE, 1, true, ReportIS::Tags::ACCESS_CONTROL);
|
||||
report.setForceBuffering(true);
|
||||
}
|
||||
|
||||
TEST_F(ReportMessagingTest, with_dynamic_fields)
|
||||
{
|
||||
EXPECT_CALL(
|
||||
@@ -140,6 +183,7 @@ TEST_F(ReportMessagingTest, with_dynamic_fields)
|
||||
" }\n"
|
||||
"}",
|
||||
_,
|
||||
_,
|
||||
_
|
||||
)
|
||||
).Times(1);
|
||||
@@ -189,6 +233,7 @@ TEST_F(ReportMessagingTest, custom_event_object)
|
||||
" }\n"
|
||||
"}",
|
||||
_,
|
||||
_,
|
||||
_
|
||||
)
|
||||
).Times(1);
|
||||
@@ -243,6 +288,7 @@ TEST_F(ReportMessagingTest, custom_priority)
|
||||
" }\n"
|
||||
"}",
|
||||
_,
|
||||
_,
|
||||
_
|
||||
)
|
||||
).Times(1);
|
||||
@@ -309,6 +355,7 @@ TEST_F(ReportMessagingTest, with_env_details)
|
||||
" }\n"
|
||||
"}",
|
||||
_,
|
||||
_,
|
||||
_
|
||||
)
|
||||
).Times(1);
|
||||
|
||||
@@ -37,6 +37,7 @@ public:
|
||||
if (!ipv4_addresses.empty()) ipv4_address = ipv4_addresses.front();
|
||||
} catch (const cereal::Exception &e) {
|
||||
dbgWarning(D_L7_ACCESS_CONTROL) << "Failed to load IP reputation data JSON. Error: " << e.what();
|
||||
ar.setNextName(nullptr);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -12,20 +12,34 @@
|
||||
// limitations under the License.
|
||||
|
||||
#include "access_control_practice.h"
|
||||
#include "new_practice.h"
|
||||
|
||||
using namespace std;
|
||||
|
||||
USE_DEBUG_FLAG(D_LOCAL_POLICY);
|
||||
// LCOV_EXCL_START Reason: no test exist
|
||||
|
||||
static const map<string, string> valid_modes_to_key = {
|
||||
static const set<string> valid_modes = {
|
||||
"prevent",
|
||||
"detect",
|
||||
"inactive",
|
||||
"prevent-learn",
|
||||
"detect-learn",
|
||||
"as-top-level",
|
||||
"inherited"
|
||||
};
|
||||
|
||||
static const unordered_map<string, string> valid_modes_to_key = {
|
||||
{"prevent", "Active"},
|
||||
{"prevent-learn", "Active"},
|
||||
{"detect", "Detect"},
|
||||
{"detect-learn", "Detect"},
|
||||
{"inactive", "Inactive"}
|
||||
};
|
||||
|
||||
static const set<string> valid_units = {"minute", "second"};
|
||||
|
||||
static const std::unordered_map<std::string, std::string> key_to_units_val = {
|
||||
static const unordered_map<std::string, std::string> key_to_units_val = {
|
||||
{ "second", "Second"},
|
||||
{ "minute", "Minute"}
|
||||
};
|
||||
@@ -177,13 +191,10 @@ void
|
||||
AccessControlRateLimit::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading Access control rate limit";
|
||||
string in_mode;
|
||||
parseAppsecJSONKey<string>("overrideMode", in_mode, archive_in, "detect");
|
||||
if (valid_modes_to_key.find(in_mode) == valid_modes_to_key.end()) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec access control rate limit override mode invalid: " << in_mode;
|
||||
throw PolicyGenException("AppSec access control rate limit override mode invalid: " + in_mode);
|
||||
} else {
|
||||
mode = valid_modes_to_key.at(in_mode);
|
||||
parseMandatoryAppsecJSONKey<string>("overrideMode", mode, archive_in, "inactive");
|
||||
if (valid_modes.find(mode) == valid_modes.end()) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec access control rate limit override mode invalid: " << mode;
|
||||
throw PolicyGenException("AppSec access control rate limit override mode invalid: " + mode);
|
||||
}
|
||||
parseAppsecJSONKey<std::vector<AccessControlRateLimiteRules>>("rules", rules, archive_in);
|
||||
}
|
||||
@@ -205,9 +216,10 @@ AccessControlRateLimit::getRules() const
|
||||
}
|
||||
|
||||
const string &
|
||||
AccessControlRateLimit::getMode() const
|
||||
AccessControlRateLimit::getMode(const std::string &default_mode) const
|
||||
{
|
||||
return mode;
|
||||
const string &res = getModeWithDefault(mode, default_mode, valid_modes_to_key);
|
||||
return res;
|
||||
}
|
||||
|
||||
void
|
||||
@@ -227,7 +239,7 @@ AccessControlPracticeSpec::setName(const string &_name)
|
||||
}
|
||||
|
||||
const AccessControlRateLimit &
|
||||
AccessControlPracticeSpec::geRateLimit() const
|
||||
AccessControlPracticeSpec::getRateLimit() const
|
||||
{
|
||||
return rate_limit;
|
||||
}
|
||||
|
||||
@@ -133,7 +133,7 @@ AppSecPracticeWebAttacks::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec practice spec";
|
||||
parseAppsecJSONKey<AppSecWebAttackProtections>("protections", protections, archive_in);
|
||||
parseAppsecJSONKey<string>("override-mode", mode, archive_in, "Unset");
|
||||
parseAppsecJSONKey<string>("override-mode", mode, archive_in, "as-top-level");
|
||||
if (valid_modes.count(mode) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec practice override mode invalid: " << mode;
|
||||
}
|
||||
@@ -187,7 +187,7 @@ AppSecPracticeWebAttacks::getMinimumConfidence() const
|
||||
const string &
|
||||
AppSecPracticeWebAttacks::getMode(const string &default_mode) const
|
||||
{
|
||||
if (mode == "Unset" || (key_to_practices_val2.find(mode) == key_to_practices_val2.end())) {
|
||||
if (isModeInherited(mode) || (key_to_practices_val2.find(mode) == key_to_practices_val2.end())) {
|
||||
dbgError(D_LOCAL_POLICY) << "Couldn't find a value for key: " << mode << ". Returning " << default_mode;
|
||||
return default_mode;
|
||||
}
|
||||
@@ -429,6 +429,9 @@ WebAppSection::WebAppSection(
|
||||
context(_context),
|
||||
web_attack_mitigation_severity(parsed_appsec_spec.getWebAttacks().getMinimumConfidence()),
|
||||
web_attack_mitigation_mode(parsed_appsec_spec.getWebAttacks().getMode(default_mode)),
|
||||
csrf_protection_mode("Disabled"),
|
||||
open_redirect_mode("Disabled"),
|
||||
error_disclosure_mode("Disabled"),
|
||||
practice_advanced_config(parsed_appsec_spec),
|
||||
anti_bots(parsed_appsec_spec.getAntiBot()),
|
||||
trusted_sources({ parsed_trusted_sources })
|
||||
@@ -451,6 +454,7 @@ WebAppSection::WebAppSection(
|
||||
}
|
||||
}
|
||||
|
||||
// Used for V1Beta2
|
||||
WebAppSection::WebAppSection(
|
||||
const string &_application_urls,
|
||||
const string &_asset_id,
|
||||
@@ -465,7 +469,8 @@ WebAppSection::WebAppSection(
|
||||
const PracticeAdvancedConfig &_practice_advanced_config,
|
||||
const AppsecPracticeAntiBotSection &_anti_bots,
|
||||
const LogTriggerSection &parsed_log_trigger,
|
||||
const AppSecTrustedSources &parsed_trusted_sources)
|
||||
const AppSecTrustedSources &parsed_trusted_sources,
|
||||
const NewAppSecWebAttackProtections &protections)
|
||||
:
|
||||
application_urls(_application_urls),
|
||||
asset_id(_asset_id),
|
||||
@@ -489,6 +494,10 @@ WebAppSection::WebAppSection(
|
||||
web_attack_mitigation_severity == "medium" ? "high" :
|
||||
"Error";
|
||||
|
||||
csrf_protection_mode = protections.getCsrfProtectionMode(_web_attack_mitigation_mode);
|
||||
open_redirect_mode = protections.getOpenRedirectMode(_web_attack_mitigation_mode);
|
||||
error_disclosure_mode = protections.getErrorDisclosureMode(_web_attack_mitigation_mode);
|
||||
|
||||
triggers.push_back(TriggersInWaapSection(parsed_log_trigger));
|
||||
for (const SourcesIdentifiers &source_ident : parsed_trusted_sources.getSourcesIdentifiers()) {
|
||||
overrides.push_back(AppSecOverride(source_ident));
|
||||
@@ -510,9 +519,9 @@ WebAppSection::save(cereal::JSONOutputArchive &out_ar) const
|
||||
cereal::make_nvp("webAttackMitigationAction", web_attack_mitigation_action),
|
||||
cereal::make_nvp("webAttackMitigationMode", web_attack_mitigation_mode),
|
||||
cereal::make_nvp("practiceAdvancedConfig", practice_advanced_config),
|
||||
cereal::make_nvp("csrfProtection", disabled_str),
|
||||
cereal::make_nvp("openRedirect", disabled_str),
|
||||
cereal::make_nvp("errorDisclosure", disabled_str),
|
||||
cereal::make_nvp("csrfProtection", csrf_protection_mode),
|
||||
cereal::make_nvp("openRedirect", open_redirect_mode),
|
||||
cereal::make_nvp("errorDisclosure", error_disclosure_mode),
|
||||
cereal::make_nvp("practiceId", practice_id),
|
||||
cereal::make_nvp("practiceName", practice_name),
|
||||
cereal::make_nvp("assetId", asset_id),
|
||||
|
||||
@@ -165,7 +165,7 @@ public:
|
||||
void load(cereal::JSONInputArchive &archive_in);
|
||||
|
||||
const std::vector<AccessControlRateLimiteRules> & getRules() const;
|
||||
const std::string & getMode() const;
|
||||
const std::string & getMode(const std::string &default_mode = "inactive") const;
|
||||
std::vector<RateLimitRulesSection> createRateLimitRulesSection(const RateLimitRulesTriggerSection &trigger) const;
|
||||
|
||||
private:
|
||||
@@ -178,7 +178,7 @@ class AccessControlPracticeSpec
|
||||
public:
|
||||
void load(cereal::JSONInputArchive &archive_in);
|
||||
|
||||
const AccessControlRateLimit & geRateLimit() const;
|
||||
const AccessControlRateLimit &getRateLimit() const;
|
||||
const std::string & getAppSecClassName() const;
|
||||
const std::string & getName() const;
|
||||
void setName(const std::string &_name);
|
||||
|
||||
@@ -278,6 +278,7 @@ public:
|
||||
const std::vector<InnerException> &parsed_exceptions
|
||||
);
|
||||
|
||||
// used for V1beta2
|
||||
WebAppSection(
|
||||
const std::string &_application_urls,
|
||||
const std::string &_asset_id,
|
||||
@@ -292,7 +293,8 @@ public:
|
||||
const PracticeAdvancedConfig &_practice_advanced_config,
|
||||
const AppsecPracticeAntiBotSection &_anti_bots,
|
||||
const LogTriggerSection &parsed_log_trigger,
|
||||
const AppSecTrustedSources &parsed_trusted_sources);
|
||||
const AppSecTrustedSources &parsed_trusted_sources,
|
||||
const NewAppSecWebAttackProtections &protections);
|
||||
|
||||
void save(cereal::JSONOutputArchive &out_ar) const;
|
||||
|
||||
@@ -310,6 +312,9 @@ private:
|
||||
std::string web_attack_mitigation_action;
|
||||
std::string web_attack_mitigation_severity;
|
||||
std::string web_attack_mitigation_mode;
|
||||
std::string csrf_protection_mode;
|
||||
std::string open_redirect_mode;
|
||||
std::string error_disclosure_mode;
|
||||
bool web_attack_mitigation;
|
||||
std::vector<TriggersInWaapSection> triggers;
|
||||
PracticeAdvancedConfig practice_advanced_config;
|
||||
|
||||
@@ -97,8 +97,7 @@ parseAppsecJSONKey(
|
||||
value = default_value;
|
||||
if (!mandatory) {
|
||||
dbgDebug(D_LOCAL_POLICY)
|
||||
<< "Could not parse the required key. Key: \""<< key_name
|
||||
<< "\", Error: " << e.what();
|
||||
<< "Could not parse a non-mandatory key: \""<< key_name << "\", Error: " << e.what();
|
||||
} else {
|
||||
throw PolicyGenException(
|
||||
"Could not parse a mandatory key: \"" + key_name + "\", Error: " + std::string(e.what())
|
||||
|
||||
@@ -24,6 +24,14 @@
|
||||
#include "debug.h"
|
||||
#include "local_policy_common.h"
|
||||
|
||||
bool isModeInherited(const std::string &mode);
|
||||
|
||||
const std::string &getModeWithDefault(
|
||||
const std::string &mode,
|
||||
const std::string &default_mode,
|
||||
const std::unordered_map<std::string, std::string> &key_to_val
|
||||
);
|
||||
|
||||
class IpsProtectionsRulesSection
|
||||
{
|
||||
public:
|
||||
@@ -126,8 +134,8 @@ class NewIntrusionPrevention
|
||||
public:
|
||||
void load(cereal::JSONInputArchive &archive_in);
|
||||
|
||||
std::vector<IpsProtectionsRulesSection> createIpsRules() const;
|
||||
const std::string & getMode() const;
|
||||
std::vector<IpsProtectionsRulesSection> createIpsRules(const std::string &default_mode) const;
|
||||
const std::string & getMode(const std::string &default_mode = "inactive") const;
|
||||
|
||||
private:
|
||||
std::string override_mode;
|
||||
@@ -273,7 +281,8 @@ public:
|
||||
const std::string &asset_name,
|
||||
const std::string &asset_id,
|
||||
const std::string &practice_name,
|
||||
const std::string &practice_id
|
||||
const std::string &practice_id,
|
||||
const std::string &default_mode
|
||||
) const;
|
||||
|
||||
private:
|
||||
@@ -486,7 +495,7 @@ public:
|
||||
void load(cereal::JSONInputArchive &archive_in);
|
||||
|
||||
void addFile(const std::string &file_name);
|
||||
const std::string & getOverrideMode() const;
|
||||
const std::string & getOverrideMode(const std::string &default_mode = "inactive") const;
|
||||
const std::vector<std::string> & getConfigMap() const;
|
||||
const std::vector<std::string> & getFiles() const;
|
||||
bool isTemporary() const;
|
||||
@@ -530,10 +539,10 @@ class NewAppSecWebAttackProtections
|
||||
public:
|
||||
void load(cereal::JSONInputArchive &archive_in);
|
||||
|
||||
const std::string getCsrfProtectionMode() const;
|
||||
const std::string & getErrorDisclosureMode() const;
|
||||
const std::string & getCsrfProtectionMode(const std::string &default_mode = "inactive") const;
|
||||
const std::string & getErrorDisclosureMode(const std::string &default_mode = "inactive") const;
|
||||
const std::string & getOpenRedirectMode(const std::string &default_mode = "inactive") const;
|
||||
bool getNonValidHttpMethods() const;
|
||||
const std::string getOpenRedirectMode() const;
|
||||
|
||||
private:
|
||||
std::string csrf_protection;
|
||||
@@ -551,9 +560,9 @@ public:
|
||||
int getMaxHeaderSizeBytes() const;
|
||||
int getMaxObjectDepth() const;
|
||||
int getMaxUrlSizeBytes() const;
|
||||
const std::string & getMinimumConfidence() const;
|
||||
const NewAppSecWebAttackProtections & getprotections() const;
|
||||
const std::string & getMode(const std::string &default_mode = "Inactive") const;
|
||||
const std::string & getMinimumConfidence(const std::string &default_mode = "inactive") const;
|
||||
const NewAppSecWebAttackProtections & getProtections() const;
|
||||
const std::string & getMode(const std::string &default_mode = "inactive") const;
|
||||
|
||||
private:
|
||||
int max_body_size_kb;
|
||||
|
||||
@@ -158,7 +158,8 @@ private:
|
||||
const std::string &source_identifier,
|
||||
const std::string & context,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
std::map<AnnotationTypes, std::string> &rule_annotations
|
||||
std::map<AnnotationTypes, std::string> &rule_annotations,
|
||||
const std::string &default_mode
|
||||
);
|
||||
|
||||
void createSnortProtecionsSection(const std::string &file_name, bool is_temporary);
|
||||
@@ -172,7 +173,8 @@ private:
|
||||
const std::string &practice_id,
|
||||
const std::string &source_identifier,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
std::map<AnnotationTypes, std::string> &rule_annotations
|
||||
std::map<AnnotationTypes, std::string> &rule_annotations,
|
||||
const std::string &default_mode
|
||||
);
|
||||
|
||||
void
|
||||
@@ -183,7 +185,8 @@ private:
|
||||
const std::string &practice_name,
|
||||
const std::string & context,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
std::map<AnnotationTypes, std::string> &rule_annotations
|
||||
std::map<AnnotationTypes, std::string> &rule_annotations,
|
||||
const std::string &default_mode
|
||||
);
|
||||
|
||||
void
|
||||
@@ -192,6 +195,7 @@ private:
|
||||
const std::string &url,
|
||||
const std::string &uri,
|
||||
const std::string &trigger_id,
|
||||
const std::string &default_mode,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
std::map<AnnotationTypes, std::string> &rule_annotations
|
||||
);
|
||||
|
||||
@@ -414,7 +414,7 @@ K8sPolicyUtils::createAppsecPolicyK8sFromV1beta2Crds(
|
||||
|
||||
vector<AccessControlPracticeSpec> access_control_practices =
|
||||
extractV1Beta2ElementsFromCluster<AccessControlPracticeSpec>(
|
||||
"accesscontrolpractice",
|
||||
"accesscontrolpractices",
|
||||
policy_elements_names[AnnotationTypes::ACCESS_CONTROL_PRACTICE]
|
||||
);
|
||||
|
||||
@@ -489,6 +489,8 @@ K8sPolicyUtils::createAppsecPolicyK8s(const string &policy_name, const string &i
|
||||
!doesVersionExist(maybe_appsec_policy_spec.unpack().getMetaData().getAnnotations(), "v1beta1")
|
||||
) {
|
||||
try {
|
||||
std::string v1beta1_error =
|
||||
maybe_appsec_policy_spec.ok() ? "There is no v1beta1 policy" : maybe_appsec_policy_spec.getErr();
|
||||
dbgWarning(D_LOCAL_POLICY
|
||||
) << "Failed to retrieve Appsec policy with crds version: v1beta1, Trying version: v1beta2";
|
||||
auto maybe_v1beta2_appsec_policy_spec = getObjectFromCluster<AppsecSpecParser<NewAppsecPolicySpec>>(
|
||||
@@ -498,7 +500,7 @@ K8sPolicyUtils::createAppsecPolicyK8s(const string &policy_name, const string &i
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "Failed to retrieve AppSec policy. Error: " << maybe_v1beta2_appsec_policy_spec.getErr();
|
||||
return std::make_tuple(
|
||||
genError("Failed to retrieve AppSec v1beta1 policy. Error: " + maybe_appsec_policy_spec.getErr()),
|
||||
genError("Failed to retrieve AppSec v1beta1 policy. Error: " + v1beta1_error),
|
||||
genError(
|
||||
"Failed to retrieve AppSec v1beta2 policy. Error: " + maybe_v1beta2_appsec_policy_spec.getErr()
|
||||
)
|
||||
@@ -584,7 +586,9 @@ K8sPolicyUtils::createAppsecPoliciesFromIngresses()
|
||||
);
|
||||
if (!std::get<0>(maybe_appsec_policy).ok() && !std::get<1>(maybe_appsec_policy).ok()) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "Failed to create appsec policy. Error: "
|
||||
<< "Failed to create appsec policy. v1beta1 Error: "
|
||||
<< std::get<0>(maybe_appsec_policy).getErr()
|
||||
<< ". v1beta2 Error: "
|
||||
<< std::get<1>(maybe_appsec_policy).getErr();
|
||||
continue;
|
||||
}
|
||||
|
||||
@@ -99,7 +99,7 @@ V1beta2AppsecLinuxPolicy::serialize(cereal::JSONInputArchive &archive_in)
|
||||
archive_in
|
||||
);
|
||||
parseAppsecJSONKey<vector<NewAppsecLogTrigger>>("logTriggers", log_triggers, archive_in);
|
||||
parseAppsecJSONKey<vector<NewAppSecCustomResponse>>("customResponse", custom_responses, archive_in);
|
||||
parseAppsecJSONKey<vector<NewAppSecCustomResponse>>("customResponses", custom_responses, archive_in);
|
||||
parseAppsecJSONKey<vector<NewAppsecException>>("exceptions", exceptions, archive_in);
|
||||
parseAppsecJSONKey<vector<NewTrustedSourcesSpec>>("trustedSources", trusted_sources, archive_in);
|
||||
parseAppsecJSONKey<vector<NewSourcesIdentifiers>>("sourcesIdentifiers", sources_identifiers, archive_in);
|
||||
|
||||
@@ -44,7 +44,7 @@ void
|
||||
NewAppsecException::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading New AppSec exception";
|
||||
parseAppsecJSONKey<string>("name", name, archive_in, "exception");
|
||||
parseAppsecJSONKey<string>("name", name, archive_in);
|
||||
parseMandatoryAppsecJSONKey<string>("action", action, archive_in, "accept");
|
||||
parseAppsecJSONKey<string>("appsecClassName", appsec_class_name, archive_in);
|
||||
if (valid_actions.count(action) == 0) {
|
||||
|
||||
@@ -21,8 +21,16 @@ USE_DEBUG_FLAG(D_LOCAL_POLICY);
|
||||
static const set<string> performance_impacts = {"low", "medium", "high"};
|
||||
static const set<string> severity_levels = {"low", "medium", "high", "critical"};
|
||||
static const set<string> size_unit = {"bytes", "KB", "MB", "GB"};
|
||||
static const set<string> confidences_actions = {"prevent", "detect", "inactive"};
|
||||
static const set<string> valid_modes = {"prevent", "detect", "inactive", "prevent-learn", "detect-learn"};
|
||||
static const set<string> confidences_actions = {"prevent", "detect", "inactive", "as-top-level", "inherited"};
|
||||
static const set<string> valid_modes = {
|
||||
"prevent",
|
||||
"detect",
|
||||
"inactive",
|
||||
"prevent-learn",
|
||||
"detect-learn",
|
||||
"as-top-level",
|
||||
"inherited"
|
||||
};
|
||||
static const set<string> valid_confidences = {"medium", "high", "critical"};
|
||||
static const std::unordered_map<std::string, std::string> key_to_performance_impact_val = {
|
||||
{ "low", "Low or lower"},
|
||||
@@ -48,6 +56,30 @@ static const std::unordered_map<std::string, uint64_t> unit_to_int = {
|
||||
{ "MB", 1048576},
|
||||
{ "GB", 1073741824}
|
||||
};
|
||||
static const std::string TRANSPARENT_MODE = "Transparent";
|
||||
|
||||
bool
|
||||
isModeInherited(const string &mode)
|
||||
{
|
||||
return mode == "as-top-level" || mode == "inherited";
|
||||
}
|
||||
|
||||
const std::string &
|
||||
getModeWithDefault(
|
||||
const std::string &mode,
|
||||
const std::string &default_mode,
|
||||
const std::unordered_map<std::string, std::string> &key_to_val)
|
||||
{
|
||||
if (isModeInherited(mode) && (key_to_val.find(default_mode) != key_to_val.end())) {
|
||||
dbgError(D_LOCAL_POLICY) << "Setting to top-level mode: " << default_mode;
|
||||
return key_to_val.at(default_mode);
|
||||
}
|
||||
else if (key_to_val.find(mode) == key_to_val.end()) {
|
||||
dbgError(D_LOCAL_POLICY) << "Given mode: " << mode << " or top-level: " << default_mode << " is invalid.";
|
||||
return key_to_val.at("inactive");
|
||||
}
|
||||
return key_to_val.at(mode);
|
||||
}
|
||||
|
||||
void
|
||||
NewAppSecWebBotsURI::load(cereal::JSONInputArchive &archive_in)
|
||||
@@ -84,7 +116,7 @@ NewAppSecPracticeAntiBot::load(cereal::JSONInputArchive &archive_in)
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec Web Bots";
|
||||
parseAppsecJSONKey<vector<NewAppSecWebBotsURI>>("injectedUris", injected_uris, archive_in);
|
||||
parseAppsecJSONKey<vector<NewAppSecWebBotsURI>>("validatedUris", validated_uris, archive_in);
|
||||
parseAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "Inactive");
|
||||
parseMandatoryAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "inactive");
|
||||
if (valid_modes.count(override_mode) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec Web Bots override mode invalid: " << override_mode;
|
||||
}
|
||||
@@ -110,26 +142,33 @@ NewAppSecWebAttackProtections::load(cereal::JSONInputArchive &archive_in)
|
||||
parseAppsecJSONKey<string>("csrfProtection", csrf_protection, archive_in, "inactive");
|
||||
parseAppsecJSONKey<string>("errorDisclosure", error_disclosure, archive_in, "inactive");
|
||||
parseAppsecJSONKey<string>("openRedirect", open_redirect, archive_in, "inactive");
|
||||
if (valid_modes.count(csrf_protection) == 0 ||
|
||||
valid_modes.count(error_disclosure) == 0 ||
|
||||
valid_modes.count(open_redirect) == 0) {
|
||||
string error_msg = "AppSec Attack Protections mode invalid. csrf_protection: " + csrf_protection +
|
||||
" error_disclosure: " + error_disclosure + " open_redirect: " + open_redirect;
|
||||
dbgWarning(D_LOCAL_POLICY) << error_msg;
|
||||
throw PolicyGenException(error_msg);
|
||||
}
|
||||
parseAppsecJSONKey<bool>("nonValidHttpMethods", non_valid_http_methods, archive_in, false);
|
||||
}
|
||||
|
||||
const string
|
||||
NewAppSecWebAttackProtections::getCsrfProtectionMode() const
|
||||
const string &
|
||||
NewAppSecWebAttackProtections::getCsrfProtectionMode(const string &default_mode) const
|
||||
{
|
||||
if (key_to_practices_val.find(csrf_protection) == key_to_practices_val.end()) {
|
||||
dbgError(D_LOCAL_POLICY)
|
||||
<< "Failed to find a value for "
|
||||
<< csrf_protection
|
||||
<< ". Setting CSRF protection to Inactive";
|
||||
return "Inactive";
|
||||
}
|
||||
return key_to_practices_val.at(csrf_protection);
|
||||
return getModeWithDefault(csrf_protection, default_mode, key_to_practices_val2);
|
||||
}
|
||||
|
||||
const string &
|
||||
NewAppSecWebAttackProtections::getErrorDisclosureMode() const
|
||||
NewAppSecWebAttackProtections::getErrorDisclosureMode(const string &default_mode) const
|
||||
{
|
||||
return error_disclosure;
|
||||
return getModeWithDefault(error_disclosure, default_mode, key_to_practices_val2);
|
||||
}
|
||||
|
||||
const string &
|
||||
NewAppSecWebAttackProtections::getOpenRedirectMode(const string &default_mode) const
|
||||
{
|
||||
return getModeWithDefault(open_redirect, default_mode, key_to_practices_val2);
|
||||
}
|
||||
|
||||
bool
|
||||
@@ -138,40 +177,24 @@ NewAppSecWebAttackProtections::getNonValidHttpMethods() const
|
||||
return non_valid_http_methods;
|
||||
}
|
||||
|
||||
const string
|
||||
NewAppSecWebAttackProtections::getOpenRedirectMode() const
|
||||
{
|
||||
if (key_to_practices_val.find(open_redirect) == key_to_practices_val.end()) {
|
||||
dbgError(D_LOCAL_POLICY)
|
||||
<< "Failed to find a value for "
|
||||
<< open_redirect
|
||||
<< ". Setting Open Redirect mode to Inactive";
|
||||
return "Inactive";
|
||||
}
|
||||
return key_to_practices_val.at(open_redirect);
|
||||
}
|
||||
|
||||
void
|
||||
NewAppSecPracticeWebAttacks::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec practice web attacks spec";
|
||||
parseAppsecJSONKey<NewAppSecWebAttackProtections>("protections", protections, archive_in);
|
||||
parseAppsecJSONKey<string>("overrideMode", mode, archive_in, "Unset");
|
||||
parseMandatoryAppsecJSONKey<string>("overrideMode", mode, archive_in, "inactive");
|
||||
if (valid_modes.count(mode) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec practice override mode invalid: " << mode;
|
||||
}
|
||||
|
||||
if (getMode() == "Prevent") {
|
||||
parseMandatoryAppsecJSONKey<string>("minimumConfidence", minimum_confidence, archive_in, "critical");
|
||||
parseAppsecJSONKey<string>("minimumConfidence", minimum_confidence, archive_in, "critical");
|
||||
if (valid_confidences.count(minimum_confidence) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec practice override minimum confidence invalid: "
|
||||
<< minimum_confidence;
|
||||
throw PolicyGenException("AppSec practice override minimum confidence invalid: " + minimum_confidence);
|
||||
}
|
||||
} else {
|
||||
minimum_confidence = "Transparent";
|
||||
}
|
||||
|
||||
parseAppsecJSONKey<int>("maxBodySizeKb", max_body_size_kb, archive_in, 1000000);
|
||||
parseAppsecJSONKey<int>("maxHeaderSizeBytes", max_header_size_bytes, archive_in, 102400);
|
||||
parseAppsecJSONKey<int>("maxObjectDepth", max_object_depth, archive_in, 40);
|
||||
@@ -203,19 +226,25 @@ NewAppSecPracticeWebAttacks::getMaxUrlSizeBytes() const
|
||||
}
|
||||
|
||||
const string &
|
||||
NewAppSecPracticeWebAttacks::getMinimumConfidence() const
|
||||
NewAppSecPracticeWebAttacks::getMinimumConfidence(const string &default_mode) const
|
||||
{
|
||||
if (getMode(default_mode) != "Prevent") {
|
||||
return TRANSPARENT_MODE;
|
||||
}
|
||||
return minimum_confidence;
|
||||
}
|
||||
|
||||
const string &
|
||||
NewAppSecPracticeWebAttacks::getMode(const string &default_mode) const
|
||||
{
|
||||
if (mode == "Unset" || (key_to_practices_val2.find(mode) == key_to_practices_val2.end())) {
|
||||
dbgError(D_LOCAL_POLICY) << "Couldn't find a value for key: " << mode << ". Returning " << default_mode;
|
||||
return default_mode;
|
||||
}
|
||||
return key_to_practices_val2.at(mode);
|
||||
const string &res = getModeWithDefault(mode, default_mode, key_to_practices_val);
|
||||
return res;
|
||||
}
|
||||
|
||||
const NewAppSecWebAttackProtections &
|
||||
NewAppSecPracticeWebAttacks::getProtections() const
|
||||
{
|
||||
return protections;
|
||||
}
|
||||
|
||||
SnortProtectionsSection::SnortProtectionsSection(
|
||||
@@ -244,7 +273,7 @@ SnortProtectionsSection::save(cereal::JSONOutputArchive &out_ar) const
|
||||
{
|
||||
out_ar(
|
||||
cereal::make_nvp("context", context),
|
||||
cereal::make_nvp("mode", key_to_mode_val.at(mode)),
|
||||
cereal::make_nvp("mode", mode),
|
||||
cereal::make_nvp("files", files),
|
||||
cereal::make_nvp("assetName", asset_name),
|
||||
cereal::make_nvp("assetId", asset_id),
|
||||
@@ -440,8 +469,8 @@ void
|
||||
NewSnortSignaturesAndOpenSchemaAPI::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec Snort Signatures practice";
|
||||
parseAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "inactive");
|
||||
parseMandatoryAppsecJSONKey<vector<string>>("configmap", config_map, archive_in);
|
||||
parseMandatoryAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "inactive");
|
||||
parseAppsecJSONKey<vector<string>>("configmap", config_map, archive_in);
|
||||
parseAppsecJSONKey<vector<string>>("files", files, archive_in);
|
||||
is_temporary = false;
|
||||
if (valid_modes.count(override_mode) == 0) {
|
||||
@@ -457,9 +486,10 @@ NewSnortSignaturesAndOpenSchemaAPI::addFile(const string &file_name)
|
||||
}
|
||||
|
||||
const string &
|
||||
NewSnortSignaturesAndOpenSchemaAPI::getOverrideMode() const
|
||||
NewSnortSignaturesAndOpenSchemaAPI::getOverrideMode(const string &default_mode) const
|
||||
{
|
||||
return override_mode;
|
||||
const string &res = getModeWithDefault(override_mode, default_mode, key_to_practices_val);
|
||||
return res;
|
||||
}
|
||||
|
||||
const vector<string> &
|
||||
@@ -491,7 +521,7 @@ IpsProtectionsRulesSection::save(cereal::JSONOutputArchive &out_ar) const
|
||||
{
|
||||
vector<string> protections;
|
||||
out_ar(
|
||||
cereal::make_nvp("action", key_to_mode_val.at(action)),
|
||||
cereal::make_nvp("action", action),
|
||||
cereal::make_nvp("confidenceLevel", confidence_level),
|
||||
cereal::make_nvp("clientProtections", true),
|
||||
cereal::make_nvp("serverProtections", true),
|
||||
@@ -541,7 +571,7 @@ IpsProtectionsSection::save(cereal::JSONOutputArchive &out_ar) const
|
||||
cereal::make_nvp("practiceName", practice_name),
|
||||
cereal::make_nvp("practiceId", practice_id),
|
||||
cereal::make_nvp("sourceIdentifier", source_identifier),
|
||||
cereal::make_nvp("defaultAction", key_to_mode_val.at(mode)),
|
||||
cereal::make_nvp("defaultAction", mode),
|
||||
cereal::make_nvp("rules", rules)
|
||||
);
|
||||
}
|
||||
@@ -566,7 +596,7 @@ void
|
||||
NewIntrusionPrevention::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec Intrusion Prevention practice";
|
||||
parseAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "inactive");
|
||||
parseMandatoryAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "inactive");
|
||||
if (valid_modes.count(override_mode) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec Intrusion Prevention override mode invalid: " << override_mode;
|
||||
throw PolicyGenException("AppSec Intrusion Prevention override mode invalid: " + override_mode);
|
||||
@@ -580,13 +610,13 @@ NewIntrusionPrevention::load(cereal::JSONInputArchive &archive_in)
|
||||
"AppSec Intrusion Prevention max performance impact invalid: " + max_performance_impact
|
||||
);
|
||||
}
|
||||
parseAppsecJSONKey<string>("minSeverityLevel", min_severity_level, archive_in, "low");
|
||||
parseAppsecJSONKey<string>("minSeverityLevel", min_severity_level, archive_in, "medium");
|
||||
if (severity_levels.count(min_severity_level) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec Intrusion Prevention min severity level invalid: "
|
||||
<< min_severity_level;
|
||||
}
|
||||
parseAppsecJSONKey<string>("highConfidenceEventAction", high_confidence_event_action, archive_in, "prevent");
|
||||
parseAppsecJSONKey<string>("highConfidenceEventAction", high_confidence_event_action, archive_in, "inherited");
|
||||
if (confidences_actions.count(high_confidence_event_action) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec Intrusion Prevention high confidence event invalid: "
|
||||
@@ -595,7 +625,9 @@ NewIntrusionPrevention::load(cereal::JSONInputArchive &archive_in)
|
||||
"AppSec Intrusion Prevention high confidence event invalid: " + high_confidence_event_action
|
||||
);
|
||||
}
|
||||
parseAppsecJSONKey<string>("mediumConfidenceEventAction", medium_confidence_event_action, archive_in, "prevent");
|
||||
parseAppsecJSONKey<string>(
|
||||
"mediumConfidenceEventAction", medium_confidence_event_action, archive_in, "inherited"
|
||||
);
|
||||
if (confidences_actions.count(medium_confidence_event_action) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec Intrusion Prevention medium confidence event invalid: "
|
||||
@@ -613,16 +645,16 @@ NewIntrusionPrevention::load(cereal::JSONInputArchive &archive_in)
|
||||
"AppSec Intrusion Prevention low confidence event action invalid: " + low_confidence_event_action
|
||||
);
|
||||
}
|
||||
parseAppsecJSONKey<int>("minCveYear", min_cve_Year, archive_in);
|
||||
parseAppsecJSONKey<int>("minCveYear", min_cve_Year, archive_in, 2016);
|
||||
}
|
||||
|
||||
vector<IpsProtectionsRulesSection>
|
||||
NewIntrusionPrevention::createIpsRules() const
|
||||
NewIntrusionPrevention::createIpsRules(const string &default_mode) const
|
||||
{
|
||||
vector<IpsProtectionsRulesSection> ips_rules;
|
||||
IpsProtectionsRulesSection high_rule(
|
||||
min_cve_Year,
|
||||
high_confidence_event_action,
|
||||
getModeWithDefault(high_confidence_event_action, default_mode, key_to_practices_val),
|
||||
string("High"),
|
||||
max_performance_impact,
|
||||
string(""),
|
||||
@@ -632,7 +664,7 @@ NewIntrusionPrevention::createIpsRules() const
|
||||
|
||||
IpsProtectionsRulesSection med_rule(
|
||||
min_cve_Year,
|
||||
medium_confidence_event_action,
|
||||
getModeWithDefault(medium_confidence_event_action, default_mode, key_to_practices_val),
|
||||
string("Medium"),
|
||||
max_performance_impact,
|
||||
string(""),
|
||||
@@ -642,7 +674,7 @@ NewIntrusionPrevention::createIpsRules() const
|
||||
|
||||
IpsProtectionsRulesSection low_rule(
|
||||
min_cve_Year,
|
||||
low_confidence_event_action,
|
||||
getModeWithDefault(low_confidence_event_action, default_mode, key_to_practices_val),
|
||||
string("Low"),
|
||||
max_performance_impact,
|
||||
string(""),
|
||||
@@ -654,9 +686,10 @@ NewIntrusionPrevention::createIpsRules() const
|
||||
}
|
||||
|
||||
const std::string &
|
||||
NewIntrusionPrevention::getMode() const
|
||||
NewIntrusionPrevention::getMode(const std::string &default_mode) const
|
||||
{
|
||||
return override_mode;
|
||||
const string &res = getModeWithDefault(override_mode, default_mode, key_to_practices_val);
|
||||
return res;
|
||||
}
|
||||
|
||||
FileSecurityProtectionsSection::FileSecurityProtectionsSection(
|
||||
@@ -711,20 +744,20 @@ FileSecurityProtectionsSection::save(cereal::JSONOutputArchive &out_ar) const
|
||||
cereal::make_nvp("assetId", asset_id),
|
||||
cereal::make_nvp("practiceName", practice_name),
|
||||
cereal::make_nvp("practiceId", practice_id),
|
||||
cereal::make_nvp("action", key_to_mode_val.at(action)),
|
||||
cereal::make_nvp("filesWithoutNameAction", key_to_mode_val.at(files_without_name_action)),
|
||||
cereal::make_nvp("action", action),
|
||||
cereal::make_nvp("filesWithoutNameAction", files_without_name_action),
|
||||
cereal::make_nvp("allowFilesWithoutName", allow_files_without_name),
|
||||
cereal::make_nvp("highConfidence", key_to_mode_val.at(high_confidence_action)),
|
||||
cereal::make_nvp("mediumConfidence", key_to_mode_val.at(medium_confidence_action)),
|
||||
cereal::make_nvp("lowConfidence", key_to_mode_val.at(low_confidence_action)),
|
||||
cereal::make_nvp("highConfidence", high_confidence_action),
|
||||
cereal::make_nvp("mediumConfidence", medium_confidence_action),
|
||||
cereal::make_nvp("lowConfidence", low_confidence_action),
|
||||
cereal::make_nvp("severityLevel", key_to_severity_level_val.at(severity_level)),
|
||||
cereal::make_nvp("fileSizeLimitAction", key_to_mode_val.at(file_size_limit_action)),
|
||||
cereal::make_nvp("fileSizeLimitAction", file_size_limit_action),
|
||||
cereal::make_nvp("fileSizeLimit", file_size_limit),
|
||||
cereal::make_nvp("requiredFileSizeLimit", required_file_size_limit),
|
||||
cereal::make_nvp("requiredArchiveExtraction", required_archive_extraction),
|
||||
cereal::make_nvp("archiveFileSizeLimit", archive_file_size_limit),
|
||||
cereal::make_nvp("MultiLevelArchiveAction", key_to_mode_val.at(multi_level_archive_action)),
|
||||
cereal::make_nvp("UnopenedArchiveAction", key_to_mode_val.at(unopened_archive_action))
|
||||
cereal::make_nvp("MultiLevelArchiveAction", multi_level_archive_action),
|
||||
cereal::make_nvp("UnopenedArchiveAction", unopened_archive_action)
|
||||
);
|
||||
}
|
||||
|
||||
@@ -748,7 +781,7 @@ void
|
||||
NewFileSecurityArchiveInspection::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec File Security Archive Inspection practice";
|
||||
parseAppsecJSONKey<bool>("extractArchiveFiles", extract_archive_files, archive_in, true);
|
||||
parseAppsecJSONKey<bool>("extractArchiveFiles", extract_archive_files, archive_in, false);
|
||||
parseAppsecJSONKey<uint64_t>("scanMaxFileSize", scan_max_file_size, archive_in, 10);
|
||||
parseAppsecJSONKey<string>("scanMaxFileSizeUnit", scan_max_file_size_unit, archive_in, "MB");
|
||||
if (size_unit.count(scan_max_file_size_unit) == 0) {
|
||||
@@ -763,7 +796,7 @@ NewFileSecurityArchiveInspection::load(cereal::JSONInputArchive &archive_in)
|
||||
"archivedFilesWithinArchivedFiles",
|
||||
archived_files_within_archived_files,
|
||||
archive_in,
|
||||
"prevent");
|
||||
"inherited");
|
||||
if (confidences_actions.count(archived_files_within_archived_files) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec File Security Archive Inspection archived files within archived files invalid: "
|
||||
@@ -777,7 +810,7 @@ NewFileSecurityArchiveInspection::load(cereal::JSONInputArchive &archive_in)
|
||||
"archivedFilesWhereContentExtractionFailed",
|
||||
archived_files_where_content_extraction_failed,
|
||||
archive_in,
|
||||
"prevent");
|
||||
"inherited");
|
||||
if (confidences_actions.count(archived_files_where_content_extraction_failed) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec File Security Archive Inspection archived files within archived file invalid: "
|
||||
@@ -834,7 +867,7 @@ NewFileSecurityLargeFileInspection::load(cereal::JSONInputArchive &archive_in)
|
||||
"filesExceedingSizeLimitAction",
|
||||
files_exceeding_size_limit_action,
|
||||
archive_in,
|
||||
"prevent");
|
||||
"inherited");
|
||||
if (confidences_actions.count(files_exceeding_size_limit_action) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec File Security Archive Inspection archived files within archived files invalid: "
|
||||
@@ -869,18 +902,18 @@ void
|
||||
NewFileSecurity::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec File Security practice";
|
||||
parseAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "inactive");
|
||||
parseMandatoryAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "inactive");
|
||||
if (valid_modes.count(override_mode) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec File Security override mode invalid: " << override_mode;
|
||||
throw PolicyGenException("AppSec File Security override mode invalid: " + override_mode);
|
||||
}
|
||||
parseMandatoryAppsecJSONKey<string>("minSeverityLevel", min_severity_level, archive_in, "low");
|
||||
parseAppsecJSONKey<string>("minSeverityLevel", min_severity_level, archive_in, "medium");
|
||||
if (severity_levels.count(min_severity_level) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec File Security min severity level invalid: " << min_severity_level;
|
||||
min_severity_level = "low";
|
||||
}
|
||||
parseMandatoryAppsecJSONKey<string>(
|
||||
"highConfidenceEventAction", high_confidence_event_action, archive_in, "inactive"
|
||||
parseAppsecJSONKey<string>(
|
||||
"highConfidenceEventAction", high_confidence_event_action, archive_in, "inherited"
|
||||
);
|
||||
if (confidences_actions.count(high_confidence_event_action) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
@@ -888,8 +921,8 @@ NewFileSecurity::load(cereal::JSONInputArchive &archive_in)
|
||||
<< high_confidence_event_action;
|
||||
high_confidence_event_action = "inactive";
|
||||
}
|
||||
parseMandatoryAppsecJSONKey<string>(
|
||||
"mediumConfidenceEventAction", medium_confidence_event_action, archive_in, "inactive"
|
||||
parseAppsecJSONKey<string>(
|
||||
"mediumConfidenceEventAction", medium_confidence_event_action, archive_in, "inherited"
|
||||
);
|
||||
if (confidences_actions.count(medium_confidence_event_action) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
@@ -897,8 +930,8 @@ NewFileSecurity::load(cereal::JSONInputArchive &archive_in)
|
||||
<< medium_confidence_event_action;
|
||||
medium_confidence_event_action = "inactive";
|
||||
}
|
||||
parseMandatoryAppsecJSONKey<string>(
|
||||
"lowConfidenceEventAction", low_confidence_event_action, archive_in, "inactive"
|
||||
parseAppsecJSONKey<string>(
|
||||
"lowConfidenceEventAction", low_confidence_event_action, archive_in, "detect"
|
||||
);
|
||||
if (confidences_actions.count(low_confidence_event_action) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
@@ -906,7 +939,7 @@ NewFileSecurity::load(cereal::JSONInputArchive &archive_in)
|
||||
<< low_confidence_event_action;
|
||||
low_confidence_event_action = "inactive";
|
||||
}
|
||||
parseMandatoryAppsecJSONKey<string>("unnamedFilesAction", unnamed_files_action, archive_in, "inactive");
|
||||
parseAppsecJSONKey<string>("unnamedFilesAction", unnamed_files_action, archive_in, "inherited");
|
||||
if (confidences_actions.count(unnamed_files_action) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec File Security low unnamed files action invalid: "
|
||||
@@ -914,10 +947,8 @@ NewFileSecurity::load(cereal::JSONInputArchive &archive_in)
|
||||
unnamed_files_action = "inactive";
|
||||
}
|
||||
parseAppsecJSONKey<bool>("threatEmulationEnabled", threat_emulation_enabled, archive_in);
|
||||
parseMandatoryAppsecJSONKey<NewFileSecurityArchiveInspection>("archiveInspection", archive_inspection, archive_in);
|
||||
parseMandatoryAppsecJSONKey<NewFileSecurityLargeFileInspection>(
|
||||
"largeFileInspection", large_file_inspection, archive_in
|
||||
);
|
||||
parseAppsecJSONKey<NewFileSecurityArchiveInspection>("archiveInspection", archive_inspection, archive_in);
|
||||
parseAppsecJSONKey<NewFileSecurityLargeFileInspection>("largeFileInspection", large_file_inspection, archive_in);
|
||||
}
|
||||
|
||||
const string &
|
||||
@@ -944,28 +975,37 @@ NewFileSecurity::createFileSecurityProtectionsSection(
|
||||
const string &asset_name,
|
||||
const string &asset_id,
|
||||
const string &practice_name,
|
||||
const string &practice_id) const
|
||||
const string &practice_id,
|
||||
const string &default_mode) const
|
||||
{
|
||||
string practice_action = (isModeInherited(override_mode) ? default_mode : override_mode);
|
||||
const string &unnamed_files_action_val =
|
||||
getModeWithDefault(unnamed_files_action, practice_action, key_to_mode_val);
|
||||
const string &large_file_action_val = getModeWithDefault(
|
||||
getLargeFileInspection().getFileSizeLimitAction(),
|
||||
practice_action,
|
||||
key_to_mode_val
|
||||
);
|
||||
return FileSecurityProtectionsSection(
|
||||
getLargeFileInspection().getFileSizeLimit(),
|
||||
getArchiveInspection().getArchiveFileSizeLimit(),
|
||||
unnamed_files_action == "prevent" ? true : false,
|
||||
getLargeFileInspection().getFileSizeLimitAction() == "prevent" ? true : false,
|
||||
unnamed_files_action_val == "Prevent" ? true : false,
|
||||
large_file_action_val == "Prevent" ? true : false,
|
||||
getArchiveInspection().getrequiredArchiveExtraction(),
|
||||
context,
|
||||
asset_name,
|
||||
asset_id,
|
||||
practice_name,
|
||||
practice_id,
|
||||
override_mode,
|
||||
unnamed_files_action,
|
||||
high_confidence_event_action,
|
||||
medium_confidence_event_action,
|
||||
low_confidence_event_action,
|
||||
getModeWithDefault(override_mode, practice_action, key_to_mode_val),
|
||||
unnamed_files_action_val,
|
||||
getModeWithDefault(high_confidence_event_action, practice_action, key_to_mode_val),
|
||||
getModeWithDefault(medium_confidence_event_action, practice_action, key_to_mode_val),
|
||||
getModeWithDefault(low_confidence_event_action, practice_action, key_to_mode_val),
|
||||
min_severity_level,
|
||||
getLargeFileInspection().getFileSizeLimitAction(),
|
||||
getArchiveInspection().getMultiLevelArchiveAction(),
|
||||
getArchiveInspection().getUnopenedArchiveAction()
|
||||
large_file_action_val,
|
||||
getModeWithDefault(getArchiveInspection().getMultiLevelArchiveAction(), practice_action, key_to_mode_val),
|
||||
getModeWithDefault(getArchiveInspection().getUnopenedArchiveAction(), practice_action, key_to_mode_val)
|
||||
);
|
||||
}
|
||||
|
||||
@@ -974,14 +1014,14 @@ NewAppSecPracticeSpec::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec practice spec";
|
||||
parseAppsecJSONKey<NewSnortSignaturesAndOpenSchemaAPI>(
|
||||
"openapi-schema-validation",
|
||||
"schemaValidation",
|
||||
openapi_schema_validation,
|
||||
archive_in
|
||||
);
|
||||
parseAppsecJSONKey<string>("appsecClassName", appsec_class_name, archive_in);
|
||||
parseAppsecJSONKey<NewFileSecurity>("fileSecurity", file_security, archive_in);
|
||||
parseAppsecJSONKey<NewIntrusionPrevention>("intrusionPrevention", intrusion_prevention, archive_in);
|
||||
parseAppsecJSONKey<NewSnortSignaturesAndOpenSchemaAPI>("snortSignatures", snort_signatures, archive_in);
|
||||
parseMandatoryAppsecJSONKey<NewFileSecurity>("fileSecurity", file_security, archive_in);
|
||||
parseMandatoryAppsecJSONKey<NewIntrusionPrevention>("intrusionPrevention", intrusion_prevention, archive_in);
|
||||
parseMandatoryAppsecJSONKey<NewSnortSignaturesAndOpenSchemaAPI>("snortSignatures", snort_signatures, archive_in);
|
||||
parseMandatoryAppsecJSONKey<NewAppSecPracticeWebAttacks>("webAttacks", web_attacks, archive_in);
|
||||
parseAppsecJSONKey<NewAppSecPracticeAntiBot>("antiBot", anti_bot, archive_in);
|
||||
parseAppsecJSONKey<string>("name", practice_name, archive_in);
|
||||
|
||||
@@ -58,7 +58,7 @@ Maybe<T>
|
||||
PolicyMakerUtils::openFileAsJson(const string &path)
|
||||
{
|
||||
auto maybe_file_as_json = Singleton::Consume<I_ShellCmd>::by<LocalPolicyMgmtGenerator>()->getExecOutput(
|
||||
getFilesystemPathConfig() + "/bin/yq " + path + " -o json"
|
||||
getFilesystemPathConfig() + "/bin/yq eval " + path + " -o json"
|
||||
);
|
||||
|
||||
if (!maybe_file_as_json.ok()) {
|
||||
@@ -996,13 +996,15 @@ PolicyMakerUtils::createIpsSections(
|
||||
const string &source_identifier,
|
||||
const string & context,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
map<AnnotationTypes, string> &rule_annotations)
|
||||
map<AnnotationTypes, string> &rule_annotations,
|
||||
const string &default_mode)
|
||||
{
|
||||
auto apssec_practice = getAppsecPracticeSpec<V1beta2AppsecLinuxPolicy, NewAppSecPracticeSpec>(
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
policy);
|
||||
|
||||
if (apssec_practice.getIntrusionPrevention().getMode().empty()) return;
|
||||
const string &override_mode = apssec_practice.getIntrusionPrevention().getMode(default_mode);
|
||||
if (override_mode == "Inactive" || override_mode == "Disabled") return;
|
||||
|
||||
IpsProtectionsSection ips_section = IpsProtectionsSection(
|
||||
context,
|
||||
@@ -1011,8 +1013,8 @@ PolicyMakerUtils::createIpsSections(
|
||||
practice_name,
|
||||
practice_id,
|
||||
source_identifier,
|
||||
apssec_practice.getIntrusionPrevention().getMode(),
|
||||
apssec_practice.getIntrusionPrevention().createIpsRules()
|
||||
override_mode,
|
||||
apssec_practice.getIntrusionPrevention().createIpsRules(override_mode)
|
||||
);
|
||||
|
||||
ips[asset_name] = ips_section;
|
||||
@@ -1068,13 +1070,16 @@ PolicyMakerUtils::createSnortSections(
|
||||
const string &practice_id,
|
||||
const string &source_identifier,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
map<AnnotationTypes, string> &rule_annotations)
|
||||
map<AnnotationTypes, string> &rule_annotations,
|
||||
const string &default_mode)
|
||||
{
|
||||
auto apssec_practice = getAppsecPracticeSpec<V1beta2AppsecLinuxPolicy, NewAppSecPracticeSpec>(
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
policy);
|
||||
|
||||
if (apssec_practice.getSnortSignatures().getOverrideMode() == "inactive" ||
|
||||
const string &override_mode = apssec_practice.getSnortSignatures().getOverrideMode(default_mode);
|
||||
if (override_mode == "Inactive" ||
|
||||
override_mode == "Disabled" ||
|
||||
apssec_practice.getSnortSignatures().getFiles().size() == 0) {
|
||||
return;
|
||||
}
|
||||
@@ -1094,7 +1099,7 @@ PolicyMakerUtils::createSnortSections(
|
||||
practice_name,
|
||||
practice_id,
|
||||
source_identifier,
|
||||
apssec_practice.getSnortSignatures().getOverrideMode(),
|
||||
override_mode,
|
||||
apssec_practice.getSnortSignatures().getFiles()
|
||||
);
|
||||
|
||||
@@ -1109,7 +1114,8 @@ PolicyMakerUtils::createFileSecuritySections(
|
||||
const string &practice_name,
|
||||
const string &context,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
map<AnnotationTypes, string> &rule_annotations)
|
||||
map<AnnotationTypes, string> &rule_annotations,
|
||||
const string &default_mode)
|
||||
{
|
||||
auto apssec_practice = getAppsecPracticeSpec<V1beta2AppsecLinuxPolicy, NewAppSecPracticeSpec>(
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
@@ -1122,7 +1128,8 @@ PolicyMakerUtils::createFileSecuritySections(
|
||||
asset_name,
|
||||
asset_id,
|
||||
practice_name,
|
||||
practice_id
|
||||
practice_id,
|
||||
default_mode
|
||||
);
|
||||
|
||||
file_security[asset_name] = file_security_section;
|
||||
@@ -1134,6 +1141,7 @@ PolicyMakerUtils::createRateLimitSection(
|
||||
const string &url,
|
||||
const string &uri,
|
||||
const string &trigger_id,
|
||||
const std::string &default_mode,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
map<AnnotationTypes, string> &rule_annotations)
|
||||
{
|
||||
@@ -1157,13 +1165,13 @@ PolicyMakerUtils::createRateLimitSection(
|
||||
trigger = RateLimitRulesTriggerSection(trigger_id, trigger_name, "Trigger");
|
||||
}
|
||||
|
||||
auto rules = access_control_practice.geRateLimit().createRateLimitRulesSection(trigger);
|
||||
auto rules = access_control_practice.getRateLimit().createRateLimitRulesSection(trigger);
|
||||
|
||||
rate_limit[rule_annotations[AnnotationTypes::ACCESS_CONTROL_PRACTICE]] = RateLimitSection(
|
||||
asset_name,
|
||||
url,
|
||||
uri,
|
||||
access_control_practice.geRateLimit().getMode(),
|
||||
access_control_practice.getRateLimit().getMode(default_mode),
|
||||
practice_id,
|
||||
rule_annotations[AnnotationTypes::ACCESS_CONTROL_PRACTICE],
|
||||
rules
|
||||
@@ -1198,12 +1206,13 @@ PolicyMakerUtils::createWebAppSection(
|
||||
practice_id,
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
rule_config.getContext(),
|
||||
apssec_practice.getWebAttacks().getMinimumConfidence(),
|
||||
apssec_practice.getWebAttacks().getMinimumConfidence(default_mode),
|
||||
apssec_practice.getWebAttacks().getMode(default_mode),
|
||||
practice_advance_config,
|
||||
apssec_practice.getAntiBot(),
|
||||
log_triggers[rule_annotations[AnnotationTypes::TRIGGER]],
|
||||
trusted_sources[rule_annotations[AnnotationTypes::TRUSTED_SOURCES]]
|
||||
trusted_sources[rule_annotations[AnnotationTypes::TRUSTED_SOURCES]],
|
||||
apssec_practice.getWebAttacks().getProtections()
|
||||
);
|
||||
web_apps[rule_config.getAssetName()] = web_app;
|
||||
}
|
||||
@@ -1271,7 +1280,8 @@ PolicyMakerUtils::createThreatPreventionPracticeSections(
|
||||
current_identifier,
|
||||
rule_config.getContext(),
|
||||
policy,
|
||||
rule_annotations
|
||||
rule_annotations,
|
||||
default_mode
|
||||
);
|
||||
|
||||
createSnortSections(
|
||||
@@ -1282,7 +1292,8 @@ PolicyMakerUtils::createThreatPreventionPracticeSections(
|
||||
practice_id,
|
||||
current_identifier,
|
||||
policy,
|
||||
rule_annotations
|
||||
rule_annotations,
|
||||
default_mode
|
||||
);
|
||||
|
||||
createFileSecuritySections(
|
||||
@@ -1292,11 +1303,18 @@ PolicyMakerUtils::createThreatPreventionPracticeSections(
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
"assetId(" + rule_config.getAssetId() + ")",
|
||||
policy,
|
||||
rule_annotations
|
||||
rule_annotations,
|
||||
default_mode
|
||||
);
|
||||
|
||||
if (!web_apps.count(rule_config.getAssetName())) {
|
||||
createWebAppSection(policy, rule_config, practice_id, asset_name, default_mode, rule_annotations);
|
||||
createWebAppSection(
|
||||
policy,
|
||||
rule_config,
|
||||
practice_id,
|
||||
asset_name,
|
||||
default_mode,
|
||||
rule_annotations);
|
||||
}
|
||||
|
||||
}
|
||||
@@ -1568,6 +1586,7 @@ PolicyMakerUtils::createPolicyElementsByRule<V1beta2AppsecLinuxPolicy, NewParsed
|
||||
std::get<0>(splited_host_name),
|
||||
std::get<2>(splited_host_name),
|
||||
log_triggers[rule_annotations[AnnotationTypes::TRIGGER]].getTriggerId(),
|
||||
rule.getMode(),
|
||||
policy,
|
||||
rule_annotations
|
||||
);
|
||||
|
||||
@@ -216,6 +216,18 @@ getFecApplicable(const string &command_output)
|
||||
return genError("Could not determine if fec applicable");
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
getSMCBasedMgmtId(const string &command_output)
|
||||
{
|
||||
return getAttr(command_output, "Mgmt object UUID was not found");
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
getSMCBasedMgmtName(const string &command_output)
|
||||
{
|
||||
return getAttr(command_output, "Mgmt object Name was not found");
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
getSmbObjectName(const string &command_output)
|
||||
{
|
||||
|
||||
@@ -33,7 +33,10 @@
|
||||
SHELL_PRE_CMD("read sdwan data",
|
||||
"(cpsdwan get_data > /tmp/cpsdwan_getdata_orch.json~) "
|
||||
"&& (mv /tmp/cpsdwan_getdata_orch.json~ /tmp/cpsdwan_getdata_orch.json)")
|
||||
#endif
|
||||
#endif //gaia || smb
|
||||
#if defined(smb)
|
||||
SHELL_PRE_CMD("gunzip local.cfg", "gunzip -c $FWDIR/state/local/FW1/local.cfg.gz > /tmp/local.cfg")
|
||||
#endif //smb
|
||||
#endif
|
||||
|
||||
#ifdef SHELL_CMD_HANDLER
|
||||
@@ -115,6 +118,22 @@ SHELL_CMD_HANDLER(
|
||||
"cat $FWDIR/database/myself_objects.C | awk -F '[:()]' '/:VPN_1/ {print $3}' | head -n 1",
|
||||
getGWIPSecVPNBlade
|
||||
)
|
||||
SHELL_CMD_HANDLER(
|
||||
"SMCBasedMgmtId",
|
||||
"domain_uuid=$(jq -r .domain_uuid /tmp/cpsdwan_getdata_orch.json);"
|
||||
"[ \"$domain_uuid\" != \"null\" ] && echo \"$domain_uuid\" ||"
|
||||
"cat $FWDIR/database/myself_objects.C "
|
||||
"| awk -F'[{}]' '/:masters/ { found=1; next } found && /:Uid/ { uid=tolower($2); print uid; exit }'",
|
||||
getSMCBasedMgmtId
|
||||
)
|
||||
SHELL_CMD_HANDLER(
|
||||
"SMCBasedMgmtName",
|
||||
"domain_name=$(jq -r .domain_name /tmp/cpsdwan_getdata_orch.json);"
|
||||
"[ \"$domain_name\" != \"null\" ] && echo \"$domain_name\" ||"
|
||||
"cat $FWDIR/database/myself_objects.C "
|
||||
"| awk -F '[:()]' '/:masters/ {found=1; next} found && /:Name/ {print $3; exit}'",
|
||||
getSMCBasedMgmtName
|
||||
)
|
||||
#endif //gaia
|
||||
|
||||
#if defined(smb)
|
||||
@@ -148,6 +167,23 @@ SHELL_CMD_HANDLER(
|
||||
"cat $FWDIR/conf/active_blades.txt | grep -o 'IPS [01]' | cut -d ' ' -f2",
|
||||
getSmbGWIPSecVPNBlade
|
||||
)
|
||||
SHELL_CMD_HANDLER(
|
||||
"SMCBasedMgmtId",
|
||||
"domain_uuid=$(jq -r .domain_uuid /tmp/cpsdwan_getdata_orch.json);"
|
||||
"[ \"$domain_uuid\" != \"null\" ] && echo \"$domain_uuid\" ||"
|
||||
"cat /tmp/local.cfg "
|
||||
"| awk -F'[{}]' '/:masters/ { found=1; next } found && /:Uid/ { uid=tolower($2); print uid; exit }'",
|
||||
getSMCBasedMgmtId
|
||||
)
|
||||
|
||||
SHELL_CMD_HANDLER(
|
||||
"SMCBasedMgmtName",
|
||||
"domain_name=$(jq -r .domain_name /tmp/cpsdwan_getdata_orch.json);"
|
||||
"[ \"$domain_name\" != \"null\" ] && echo \"$domain_name\" ||"
|
||||
"cat /tmp/local.cfg "
|
||||
"| awk -F '[:()]' '/:masters/ {found=1; next} found && /:Name/ {print $3; exit}'",
|
||||
getSMCBasedMgmtName
|
||||
)
|
||||
#endif//smb
|
||||
|
||||
SHELL_CMD_OUTPUT("kernel_version", "uname -r")
|
||||
@@ -190,3 +226,9 @@ FILE_CONTENT_HANDLER("os_release", "/etc/os-release", getOsRelease)
|
||||
FILE_CONTENT_HANDLER("AppSecModelVersion", "/etc/cp/conf/waap/waap.data", getWaapModelVersion)
|
||||
|
||||
#endif // FILE_CONTENT_HANDLER
|
||||
|
||||
#ifdef SHELL_POST_CMD
|
||||
#if defined(smb)
|
||||
SHELL_POST_CMD("remove local.cfg", "rm -rf /tmp/local.cfg")
|
||||
#endif //smb
|
||||
#endif
|
||||
|
||||
@@ -64,6 +64,12 @@ private:
|
||||
#undef FILE_CONTENT_HANDLER
|
||||
};
|
||||
|
||||
#define SHELL_POST_CMD(NAME, COMMAND) {NAME, COMMAND},
|
||||
map<string, string> shell_post_commands = {
|
||||
#include "details_resolver_impl.h"
|
||||
};
|
||||
#undef SHELL_POST_CMD
|
||||
|
||||
map<string, string>
|
||||
DetailsResolvingHanlder::Impl::getResolvedDetails() const
|
||||
{
|
||||
@@ -114,6 +120,18 @@ DetailsResolvingHanlder::Impl::getResolvedDetails() const
|
||||
in_file->close();
|
||||
}
|
||||
|
||||
for (auto &shell_post_command : shell_post_commands) {
|
||||
const string &name = shell_post_command.first;
|
||||
const string &command = shell_post_command.second;
|
||||
Maybe<int> command_ret = shell->getExecReturnCode(command, timeout);
|
||||
|
||||
if (!command_ret.ok()) {
|
||||
dbgWarning(D_AGENT_DETAILS) << "Failed to run post-command " << name;
|
||||
} else if (*command_ret) {
|
||||
dbgWarning(D_AGENT_DETAILS) << "Post-command " << name << " failed (rc: " << *command_ret << ")";
|
||||
}
|
||||
}
|
||||
|
||||
I_AgentDetailsReporter *reporter = Singleton::Consume<I_AgentDetailsReporter>::by<DetailsResolvingHanlder>();
|
||||
reporter->addAttr(resolved_details, true);
|
||||
|
||||
|
||||
@@ -1012,10 +1012,11 @@ private:
|
||||
HybridModeMetricEvent().notify();
|
||||
|
||||
if (!response.ok()) {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Failed to get the update. Error: " << response.getErr();
|
||||
orch_status->setFieldStatus(
|
||||
OrchestrationStatusFieldType::LAST_UPDATE,
|
||||
OrchestrationStatusResult::FAILED,
|
||||
response.getErr()
|
||||
"Warning: Agent/Gateway failed during the update process. Contact Check Point support."
|
||||
);
|
||||
|
||||
return genError(response.getErr());
|
||||
|
||||
@@ -90,6 +90,7 @@ public:
|
||||
"/api/v1/agents/events",
|
||||
_,
|
||||
MessageCategory::LOG,
|
||||
_,
|
||||
_
|
||||
)).WillRepeatedly(SaveArg<2>(&message_body));
|
||||
|
||||
|
||||
@@ -473,10 +473,11 @@ FogAuthenticator::authenticateAgent()
|
||||
auto orc_status = Singleton::Consume<I_OrchestrationStatus>::by<FogAuthenticator>();
|
||||
credentials = getCredentials();
|
||||
if (!credentials.ok()) {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Failed to authenticate the agent: " << credentials.getErr();
|
||||
orc_status->setFieldStatus(
|
||||
OrchestrationStatusFieldType::REGISTRATION,
|
||||
OrchestrationStatusResult::FAILED,
|
||||
credentials.getErr()
|
||||
"Warning: Agent/Gateway failed the authentication. Contact Check Point support."
|
||||
);
|
||||
return genError(credentials.getErr());
|
||||
}
|
||||
@@ -516,7 +517,7 @@ FogAuthenticator::authenticateAgent()
|
||||
orc_status->setFieldStatus(
|
||||
OrchestrationStatusFieldType::REGISTRATION,
|
||||
OrchestrationStatusResult::FAILED,
|
||||
access_token.getErr()
|
||||
"Warning: Agent/Gateway failed to receive access token. Contact Check Point support."
|
||||
);
|
||||
}
|
||||
int next_session_req = max(
|
||||
|
||||
@@ -154,6 +154,7 @@ protected:
|
||||
if (agentDetails->getOrchestrationMode() == OrchestrationMode::HYBRID) {
|
||||
MessageMetadata req_md(getSharedStorageHost(), 80);
|
||||
req_md.insertHeader("X-Tenant-Id", agentDetails->getTenantId());
|
||||
req_md.setConnectioFlag(MessageConnectionConfig::UNSECURE_CONN);
|
||||
auto req_status = messaging->sendSyncMessage(
|
||||
method,
|
||||
uri,
|
||||
@@ -161,6 +162,10 @@ protected:
|
||||
MessageCategory::GENERIC,
|
||||
req_md
|
||||
);
|
||||
if (!req_status.ok()) {
|
||||
dbgWarning(D_WAAP) << "failed to send request to uri: " << uri
|
||||
<< ", error: " << req_status.getErr().toString();
|
||||
}
|
||||
return req_status.ok();
|
||||
}
|
||||
auto req_status = messaging->sendSyncMessage(
|
||||
@@ -169,6 +174,10 @@ protected:
|
||||
obj,
|
||||
MessageCategory::GENERIC
|
||||
);
|
||||
if (!req_status.ok()) {
|
||||
dbgWarning(D_WAAP) << "failed to send request to uri: " << uri
|
||||
<< ", error: " << req_status.getErr().toString();
|
||||
}
|
||||
return req_status.ok();
|
||||
}
|
||||
|
||||
@@ -204,6 +213,7 @@ protected:
|
||||
if (agentDetails->getOrchestrationMode() == OrchestrationMode::HYBRID) {
|
||||
MessageMetadata req_md(getSharedStorageHost(), 80);
|
||||
req_md.insertHeader("X-Tenant-Id", agentDetails->getTenantId());
|
||||
req_md.setConnectioFlag(MessageConnectionConfig::UNSECURE_CONN);
|
||||
return messaging->sendSyncMessageWithoutResponse(
|
||||
method,
|
||||
uri,
|
||||
|
||||
@@ -20,6 +20,7 @@
|
||||
#include "../waap_clib/WaapOpenRedirect.h"
|
||||
#include "../waap_clib/FpMitigation.h"
|
||||
#include "../waap_clib/DeepParser.h"
|
||||
#include "../waap_clib/OASchemaUpdaterConfConstant.h"
|
||||
#include "http_inspection_events.h"
|
||||
|
||||
enum HeaderType {
|
||||
@@ -29,6 +30,7 @@ enum HeaderType {
|
||||
COOKIE_HEADER,
|
||||
REFERER_HEADER,
|
||||
CONTENT_TYPE_HEADER,
|
||||
AUTHORIZATION_HEADER,
|
||||
CLEAN_HEADER,
|
||||
OTHER_KNOWN_HEADERS
|
||||
};
|
||||
@@ -135,6 +137,7 @@ public:
|
||||
virtual void add_response_body_chunk(const char* data, int data_len) = 0;
|
||||
virtual void end_response_body() = 0;
|
||||
virtual void end_response() = 0;
|
||||
virtual const std::string& getResponseBody() = 0;
|
||||
|
||||
virtual void collectFoundPatterns() = 0;
|
||||
virtual ReportIS::Severity computeEventSeverityFromDecision() const = 0;
|
||||
|
||||
@@ -86,6 +86,7 @@ add_library(waap_clib
|
||||
ParserPercentEncode.cc
|
||||
ParserPairs.cc
|
||||
Waf2Util2.cc
|
||||
ParserPDF.cc
|
||||
)
|
||||
|
||||
add_definitions("-Wno-unused-function")
|
||||
|
||||
@@ -26,6 +26,7 @@
|
||||
#include "ParserPercentEncode.h"
|
||||
#include "ParserPairs.h"
|
||||
#include "ParserDelimiter.h"
|
||||
#include "ParserPDF.h"
|
||||
#include "WaapAssetState.h"
|
||||
#include "Waf2Regex.h"
|
||||
#include "Waf2Util.h"
|
||||
@@ -1146,11 +1147,17 @@ DeepParser::createInternalParser(
|
||||
));
|
||||
offset = 0;
|
||||
} else if (isTopData && (isBinaryType || m_pWaapAssetState->isBinarySampleType(cur_val))) {
|
||||
if (isPDFDetected(cur_val)) {
|
||||
dbgTrace(D_WAAP_DEEP_PARSER) << "Starting to parse a PDF file";
|
||||
m_parsersDeque.push_back(std::make_shared<BufferedParser<ParserPDF>>(*this, parser_depth + 1));
|
||||
offset = 0;
|
||||
} else {
|
||||
dbgTrace(D_WAAP_DEEP_PARSER) << "Starting to parse a binary file";
|
||||
m_parsersDeque.push_back(std::make_shared<BufferedParser<ParserBinary>>(*this, parser_depth + 1));
|
||||
offset = 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (offset < 0) {
|
||||
if (isPipesType) {
|
||||
dbgTrace(D_WAAP_DEEP_PARSER) << "Starting to parse pipes, positional: " << isKeyValDelimited;
|
||||
@@ -1473,3 +1480,12 @@ DeepParser::shouldEnforceDepthLimit(const std::shared_ptr<ParserBase> &parser) c
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
bool
|
||||
DeepParser::isPDFDetected(const std::string &cur_val) const
|
||||
{
|
||||
static const std::string PDF_header("%PDF-");
|
||||
if (cur_val.size() < 10)
|
||||
return false;
|
||||
return cur_val.substr(0, cur_val.size() > 64 ? 64 : cur_val.size()).find(PDF_header) != std::string::npos;
|
||||
}
|
||||
|
||||
@@ -173,6 +173,7 @@ private:
|
||||
bool shouldEnforceDepthLimit(const std::shared_ptr<ParserBase>& parser) const;
|
||||
void setLocalMaxObjectDepth(size_t depth) { m_localMaxObjectDepth = depth; }
|
||||
void setGlobalMaxObjectDepthReached() { m_globalMaxObjectDepthReached = true; }
|
||||
bool isPDFDetected(const std::string &cur_val) const;
|
||||
bool m_deepParserFlag;
|
||||
std::stack<std::tuple<size_t, size_t, std::string>> m_splitTypesStack; // depth, splitIndex, splitType
|
||||
std::deque<std::shared_ptr<ParserBase>> m_parsersDeque;
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
111
components/security_apps/waap/waap_clib/ParserPDF.cc
Normal file
111
components/security_apps/waap/waap_clib/ParserPDF.cc
Normal file
@@ -0,0 +1,111 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "ParserPDF.h"
|
||||
#include "Waf2Util.h"
|
||||
#include "debug.h"
|
||||
#include <string.h>
|
||||
|
||||
USE_DEBUG_FLAG(D_WAAP_PARSER_PDF);
|
||||
USE_DEBUG_FLAG(D_WAAP);
|
||||
|
||||
const std::string ParserPDF::m_parserName = "ParserPDF";
|
||||
const char* PDF_TAIL = "%%EOF";
|
||||
|
||||
ParserPDF::ParserPDF(
|
||||
IParserStreamReceiver &receiver,
|
||||
size_t parser_depth
|
||||
) :
|
||||
m_receiver(receiver),
|
||||
m_state(s_start),
|
||||
m_parser_depth(parser_depth)
|
||||
{}
|
||||
|
||||
ParserPDF::~ParserPDF()
|
||||
{}
|
||||
|
||||
size_t
|
||||
ParserPDF::push(const char *buf, size_t len)
|
||||
{
|
||||
dbgTrace(D_WAAP_PARSER_PDF)
|
||||
<< "buf="
|
||||
<< buf
|
||||
<< "len="
|
||||
<< len;
|
||||
|
||||
const char *c;
|
||||
|
||||
if (m_state == s_error) {
|
||||
return 0;
|
||||
}
|
||||
if (len == 0)
|
||||
{
|
||||
dbgTrace(D_WAAP_PARSER_PDF) << "ParserPDF::push(): end of stream. m_state=" << m_state;
|
||||
|
||||
if (m_state == s_end) {
|
||||
m_receiver.onKvDone();
|
||||
} else {
|
||||
m_state = s_error;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
switch (m_state) {
|
||||
case s_start:
|
||||
m_state = s_body;
|
||||
CP_FALL_THROUGH;
|
||||
case s_body:
|
||||
c = strstr(buf + len - MAX_TAIL_LOOKUP, PDF_TAIL);
|
||||
dbgTrace(D_WAAP_PARSER_PDF) << "ParserPDF::push(): c=" << c;
|
||||
if (c) {
|
||||
m_state = s_end;
|
||||
CP_FALL_THROUGH;
|
||||
} else {
|
||||
break;
|
||||
}
|
||||
case s_end:
|
||||
if (m_receiver.onKey("PDF", 3) != 0) {
|
||||
m_state = s_error;
|
||||
return 0;
|
||||
}
|
||||
if (m_receiver.onValue("", 0) != 0) {
|
||||
m_state = s_error;
|
||||
return 0;
|
||||
}
|
||||
break;
|
||||
case s_error:
|
||||
break;
|
||||
default:
|
||||
dbgTrace(D_WAAP_PARSER_PDF) << "ParserPDF::push(): unknown state: " << m_state;
|
||||
m_state = s_error;
|
||||
return 0;
|
||||
}
|
||||
|
||||
return len;
|
||||
}
|
||||
|
||||
|
||||
void ParserPDF::finish()
|
||||
{
|
||||
push(NULL, 0);
|
||||
}
|
||||
|
||||
const std::string& ParserPDF::name() const
|
||||
{
|
||||
return m_parserName;
|
||||
}
|
||||
|
||||
bool ParserPDF::error() const
|
||||
{
|
||||
return m_state == s_error;
|
||||
}
|
||||
47
components/security_apps/waap/waap_clib/ParserPDF.h
Normal file
47
components/security_apps/waap/waap_clib/ParserPDF.h
Normal file
@@ -0,0 +1,47 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#ifndef __PARSER_PDF_H__
|
||||
#define __PARSER_PDF_H__
|
||||
|
||||
#include "ParserBase.h"
|
||||
#include <string.h>
|
||||
|
||||
#define MAX_HEADER_LOOKUP 64
|
||||
#define MAX_TAIL_LOOKUP 5
|
||||
|
||||
class ParserPDF : public ParserBase {
|
||||
public:
|
||||
ParserPDF(IParserStreamReceiver &receiver, size_t parser_depth);
|
||||
virtual ~ParserPDF();
|
||||
virtual size_t push(const char *buf, size_t len);
|
||||
virtual void finish();
|
||||
virtual const std::string &name() const;
|
||||
virtual bool error() const;
|
||||
virtual size_t depth() { return 1; }
|
||||
|
||||
private:
|
||||
enum state {
|
||||
s_start,
|
||||
s_body,
|
||||
s_end,
|
||||
s_error
|
||||
};
|
||||
|
||||
IParserStreamReceiver &m_receiver;
|
||||
enum state m_state;
|
||||
static const std::string m_parserName;
|
||||
size_t m_parser_depth;
|
||||
};
|
||||
|
||||
#endif // __PARSER_PDF_H__
|
||||
@@ -706,6 +706,7 @@ void SerializeToLocalAndRemoteSyncBase::syncWorker()
|
||||
|
||||
MessageMetadata req_md(getLearningHost(), 80);
|
||||
req_md.insertHeader("X-Tenant-Id", agentDetails->getTenantId());
|
||||
req_md.setConnectioFlag(MessageConnectionConfig::UNSECURE_CONN);
|
||||
bool ok = messaging->sendSyncMessageWithoutResponse(
|
||||
HTTPMethod::POST,
|
||||
"/api/sync",
|
||||
|
||||
@@ -156,6 +156,7 @@ void
|
||||
WaapTrafficTelemetrics::updateMetrics(const string &asset_id, const DecisionTelemetryData &data)
|
||||
{
|
||||
initMetrics();
|
||||
average_latency.report(data.elapsedTime);
|
||||
switch (data.method)
|
||||
{
|
||||
case POST:
|
||||
|
||||
@@ -12,6 +12,7 @@
|
||||
// limitations under the License.
|
||||
|
||||
#include <string>
|
||||
#include <cctype>
|
||||
#include <boost/regex.hpp>
|
||||
#include "WaapOverrideFunctor.h"
|
||||
#include "Waf2Engine.h"
|
||||
@@ -47,14 +48,16 @@ bool WaapOverrideFunctor::operator()(const std::string& tag, const Waap::Util::C
|
||||
bool WaapOverrideFunctor::operator()(const std::string& tag, const boost::regex& rx)
|
||||
{
|
||||
boost::cmatch what;
|
||||
std::string tagLower = tag;
|
||||
std::transform(tagLower.begin(), tagLower.end(), tagLower.begin(), ::tolower);
|
||||
try {
|
||||
if (tag == "url") {
|
||||
return NGEN::Regex::regexMatch(__FILE__, __LINE__, waf2Transaction.getUri().c_str(), what, rx);
|
||||
if (tagLower == "url") {
|
||||
return NGEN::Regex::regexMatch(__FILE__, __LINE__, waf2Transaction.getUriStr().c_str(), what, rx);
|
||||
}
|
||||
else if (tag == "hostname") {
|
||||
else if (tagLower == "hostname") {
|
||||
return NGEN::Regex::regexMatch(__FILE__, __LINE__, waf2Transaction.getHost().c_str(), what, rx);
|
||||
}
|
||||
else if (tag == "sourceidentifier") {
|
||||
else if (tagLower == "sourceidentifier") {
|
||||
return NGEN::Regex::regexMatch(
|
||||
__FILE__,
|
||||
__LINE__,
|
||||
@@ -63,7 +66,7 @@ bool WaapOverrideFunctor::operator()(const std::string& tag, const boost::regex&
|
||||
rx
|
||||
);
|
||||
}
|
||||
else if (tag == "keyword") {
|
||||
else if (tagLower == "keyword") {
|
||||
for (const std::string& keywordStr : waf2Transaction.getKeywordMatches()) {
|
||||
if (NGEN::Regex::regexMatch(__FILE__, __LINE__, keywordStr.c_str(), what, rx)) {
|
||||
return true;
|
||||
@@ -71,7 +74,7 @@ bool WaapOverrideFunctor::operator()(const std::string& tag, const boost::regex&
|
||||
}
|
||||
return false;
|
||||
}
|
||||
else if (tag == "paramname" || tag == "paramName") {
|
||||
else if (tagLower == "paramname") {
|
||||
for (const DeepParser::KeywordInfo& keywordInfo : waf2Transaction.getKeywordInfo()) {
|
||||
if (NGEN::Regex::regexMatch(__FILE__, __LINE__, keywordInfo.getName().c_str(), what, rx)) {
|
||||
return true;
|
||||
@@ -85,7 +88,7 @@ bool WaapOverrideFunctor::operator()(const std::string& tag, const boost::regex&
|
||||
}
|
||||
return false;
|
||||
}
|
||||
else if (tag == "paramvalue" || tag == "paramValue") {
|
||||
else if (tagLower == "paramvalue") {
|
||||
for (const DeepParser::KeywordInfo& keywordInfo : waf2Transaction.getKeywordInfo()) {
|
||||
if (NGEN::Regex::regexMatch(__FILE__, __LINE__, keywordInfo.getValue().c_str(), what, rx)) {
|
||||
return true;
|
||||
@@ -96,10 +99,10 @@ bool WaapOverrideFunctor::operator()(const std::string& tag, const boost::regex&
|
||||
}
|
||||
return false;
|
||||
}
|
||||
else if (tag == "paramlocation" || tag == "paramLocation") {
|
||||
else if (tagLower == "paramlocation") {
|
||||
return NGEN::Regex::regexMatch(__FILE__, __LINE__, waf2Transaction.getLocation().c_str(), what, rx);
|
||||
}
|
||||
else if (tag == "responsebody" || tag == "responseBody") {
|
||||
else if (tagLower == "responsebody") {
|
||||
waf2Transaction.getResponseInspectReasons().setApplyOverride(true);
|
||||
if (!waf2Transaction.getResponseBody().empty()) {
|
||||
boost::smatch matcher;
|
||||
@@ -108,6 +111,32 @@ bool WaapOverrideFunctor::operator()(const std::string& tag, const boost::regex&
|
||||
} else {
|
||||
return false;
|
||||
}
|
||||
} else if (tagLower == "headername") {
|
||||
if (!waf2Transaction.checkIsHeaderOverrideScanRequired()) {
|
||||
dbgDebug(D_WAAP_OVERRIDE) << "Header name override scan is not required";
|
||||
return false;
|
||||
}
|
||||
for (auto& hdr_pair : waf2Transaction.getHdrPairs()) {
|
||||
std::string value = hdr_pair.first;
|
||||
std::transform(value.begin(), value.end(), value.begin(), ::tolower);
|
||||
if(NGEN::Regex::regexMatch(__FILE__, __LINE__, value.c_str(), what, rx)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
} else if (tagLower == "headervalue") {
|
||||
if (!waf2Transaction.checkIsHeaderOverrideScanRequired()) {
|
||||
dbgDebug(D_WAAP_OVERRIDE) << "Header value override scan is not required";
|
||||
return false;
|
||||
}
|
||||
for (auto& hdr_pair : waf2Transaction.getHdrPairs()) {
|
||||
std::string value = hdr_pair.second;
|
||||
std::transform(value.begin(), value.end(), value.begin(), ::tolower);
|
||||
if (NGEN::Regex::regexMatch(__FILE__, __LINE__, value.c_str(), what, rx)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
catch (std::runtime_error & e) {
|
||||
@@ -116,6 +145,6 @@ bool WaapOverrideFunctor::operator()(const std::string& tag, const boost::regex&
|
||||
}
|
||||
|
||||
// Unknown tag: should not occur
|
||||
dbgWarning(D_WAAP) << "Invalid override tag:" << tag;
|
||||
dbgWarning(D_WAAP) << "Invalid override tag: " << tag;
|
||||
return false;
|
||||
}
|
||||
|
||||
@@ -26,7 +26,8 @@ namespace Waap {
|
||||
errorLimiter(false),
|
||||
rateLimiting(false),
|
||||
collectResponseForLog(false),
|
||||
applyOverride(false)
|
||||
applyOverride(false),
|
||||
triggerReport(false)
|
||||
{
|
||||
}
|
||||
|
||||
@@ -39,11 +40,12 @@ namespace Waap {
|
||||
" RateLimiting=" << rateLimiting <<
|
||||
" ErrorLimiter=" << errorLimiter <<
|
||||
" collectResponseForLog=" << collectResponseForLog <<
|
||||
" applyOverride=" << applyOverride;
|
||||
" applyOverride=" << applyOverride <<
|
||||
" triggerReport=" << triggerReport;
|
||||
|
||||
return
|
||||
openRedirect || errorDisclosure || rateLimiting || errorLimiter ||
|
||||
collectResponseForLog || applyOverride;
|
||||
collectResponseForLog || applyOverride || triggerReport;
|
||||
}
|
||||
|
||||
void
|
||||
@@ -91,6 +93,14 @@ namespace Waap {
|
||||
applyOverride = flag;
|
||||
}
|
||||
|
||||
void
|
||||
ResponseInspectReasons::setTriggerReport(bool flag)
|
||||
{
|
||||
dbgTrace(D_WAAP) << "Change ResponseInspectReasons(setTriggerReport) " << triggerReport << " to " <<
|
||||
flag;
|
||||
triggerReport = flag;
|
||||
}
|
||||
|
||||
bool
|
||||
ResponseInspectReasons::getApplyOverride(void)
|
||||
{
|
||||
|
||||
@@ -25,6 +25,7 @@ public:
|
||||
void setErrorLimiter(bool flag);
|
||||
void setCollectResponseForLog(bool flag);
|
||||
void setApplyOverride(bool flag);
|
||||
void setTriggerReport(bool flag);
|
||||
|
||||
bool getApplyOverride(void);
|
||||
private:
|
||||
@@ -34,6 +35,7 @@ private:
|
||||
bool rateLimiting;
|
||||
bool collectResponseForLog;
|
||||
bool applyOverride;
|
||||
bool triggerReport;
|
||||
};
|
||||
|
||||
}
|
||||
|
||||
@@ -56,8 +56,10 @@ USE_DEBUG_FLAG(D_WAAP);
|
||||
USE_DEBUG_FLAG(D_WAAP_ULIMITS);
|
||||
USE_DEBUG_FLAG(D_WAAP_BOT_PROTECTION);
|
||||
USE_DEBUG_FLAG(D_OA_SCHEMA_UPDATER);
|
||||
USE_DEBUG_FLAG(D_WAAP_HEADERS);
|
||||
|
||||
using namespace ReportIS;
|
||||
using namespace std;
|
||||
|
||||
#define MAX_REQUEST_BODY_SIZE (2*1024)
|
||||
#define MAX_RESPONSE_BODY_SIZE (2*1024)
|
||||
@@ -89,6 +91,9 @@ void Waf2Transaction::start_response(int response_status, int http_version)
|
||||
dbgTrace(D_WAAP) << "[transaction:" << this << "] start_response(response_status=" << response_status
|
||||
<< "," << " http_version=" << http_version << ")";
|
||||
m_responseStatus = response_status;
|
||||
if (m_triggerReport) {
|
||||
m_responseInspectReasons.setTriggerReport(false);
|
||||
}
|
||||
|
||||
if(m_responseStatus == 404)
|
||||
{
|
||||
@@ -233,6 +238,12 @@ void Waf2Transaction::end_response_body()
|
||||
dbgTrace(D_WAAP) << "[transaction:" << this << "] end_response_body";
|
||||
}
|
||||
|
||||
const std::string &
|
||||
Waf2Transaction::getResponseBody()
|
||||
{
|
||||
return m_response_body;
|
||||
}
|
||||
|
||||
void Waf2Transaction::scanErrDisclosureBuffer()
|
||||
{
|
||||
if (m_responseStatus >= 400 && m_responseStatus <= 599) {
|
||||
@@ -302,19 +313,25 @@ Waf2Transaction::Waf2Transaction() :
|
||||
m_deepParser(m_pWaapAssetState, m_scanner, this),
|
||||
m_deepParserReceiver(m_deepParser),
|
||||
m_scanResult(NULL),
|
||||
m_response_body(),
|
||||
m_request_body_bytes_received(0),
|
||||
m_response_body_bytes_received(0),
|
||||
m_processedUri(false),
|
||||
m_processedHeaders(false),
|
||||
m_isHeaderOverrideScanRequired(false),
|
||||
m_isScanningRequired(false),
|
||||
m_responseStatus(0),
|
||||
m_responseInspectReasons(),
|
||||
m_responseInjectReasons(),
|
||||
m_index(-1),
|
||||
m_triggerLog(),
|
||||
m_triggerReport(false),
|
||||
is_schema_validation(false),
|
||||
m_waf2TransactionFlags()
|
||||
{}
|
||||
{
|
||||
I_TimeGet *timeGet = Singleton::Consume<I_TimeGet>::by<Waf2Transaction>();
|
||||
m_entry_time = chrono::duration_cast<chrono::milliseconds>(timeGet->getMonotonicTime());
|
||||
}
|
||||
|
||||
Waf2Transaction::Waf2Transaction(std::shared_ptr<WaapAssetState> pWaapAssetState) :
|
||||
TableOpaqueSerialize<Waf2Transaction>(this),
|
||||
@@ -334,19 +351,25 @@ Waf2Transaction::Waf2Transaction(std::shared_ptr<WaapAssetState> pWaapAssetState
|
||||
m_deepParser(m_pWaapAssetState, m_scanner, this),
|
||||
m_deepParserReceiver(m_deepParser),
|
||||
m_scanResult(NULL),
|
||||
m_response_body(),
|
||||
m_request_body_bytes_received(0),
|
||||
m_response_body_bytes_received(0),
|
||||
m_processedUri(false),
|
||||
m_processedHeaders(false),
|
||||
m_isHeaderOverrideScanRequired(false),
|
||||
m_isScanningRequired(false),
|
||||
m_responseStatus(0),
|
||||
m_responseInspectReasons(),
|
||||
m_responseInjectReasons(),
|
||||
m_index(-1),
|
||||
m_triggerLog(),
|
||||
m_triggerReport(false),
|
||||
is_schema_validation(false),
|
||||
m_waf2TransactionFlags()
|
||||
{}
|
||||
{
|
||||
I_TimeGet *timeGet = Singleton::Consume<I_TimeGet>::by<Waf2Transaction>();
|
||||
m_entry_time = chrono::duration_cast<chrono::milliseconds>(timeGet->getMonotonicTime());
|
||||
}
|
||||
|
||||
Waf2Transaction::~Waf2Transaction() {
|
||||
dbgTrace(D_WAAP) << "Waf2Transaction::~Waf2Transaction: deleting m_requestBodyParser";
|
||||
@@ -362,6 +385,8 @@ HeaderType Waf2Transaction::detectHeaderType(const char* name, int name_len) {
|
||||
static const char content_type[] = "content-Type";
|
||||
static const char cookie[] = "cookie";
|
||||
static const char referer[] = "referer";
|
||||
static const char authorization[] = "authorization";
|
||||
dbgTrace(D_WAAP_HEADERS) << "Detecting header type for header >>>" << std::string(name, name_len) << "<<<";
|
||||
|
||||
if (memcaseinsensitivecmp(name, name_len, host, sizeof(host) - 1)) {
|
||||
return HeaderType::HOST_HEADER;
|
||||
@@ -378,6 +403,9 @@ HeaderType Waf2Transaction::detectHeaderType(const char* name, int name_len) {
|
||||
if (memcaseinsensitivecmp(name, name_len, referer, sizeof(referer) - 1)) {
|
||||
return HeaderType::REFERER_HEADER;
|
||||
}
|
||||
if (memcaseinsensitivecmp(name, name_len, authorization, sizeof(authorization) - 1)) {
|
||||
return HeaderType::AUTHORIZATION_HEADER;
|
||||
}
|
||||
return UNKNOWN_HEADER;
|
||||
}
|
||||
|
||||
@@ -422,35 +450,98 @@ HeaderType Waf2Transaction::checkCleanHeader(const char* name, int name_len, con
|
||||
return CLEAN_HEADER;
|
||||
}
|
||||
}
|
||||
}
|
||||
return UNKNOWN_HEADER;
|
||||
}
|
||||
|
||||
void Waf2Transaction::parseAuthorization(const char* value, int value_len, const std::string &header_name)
|
||||
{
|
||||
#ifdef NO_HEADERS_SCAN
|
||||
return;
|
||||
#endif
|
||||
static const std::string authorization("authorization");
|
||||
if (memcaseinsensitivecmp(name, name_len, authorization.data(), authorization.size())) {
|
||||
dbgTrace(D_WAAP) << "[transaction:" << this << "] special header '" << std::string(name, name_len) <<
|
||||
"' - detect base64 to determine cleanliness ...";
|
||||
|
||||
dbgTrace(D_WAAP_HEADERS) << "[transaction:" << this
|
||||
<< "] special header '" << header_name;
|
||||
|
||||
std::string result;
|
||||
int decodedCount = 0;
|
||||
int deletedCount = 0;
|
||||
|
||||
std::string v(value, value_len);
|
||||
boost::algorithm::to_lower(v);
|
||||
const std::string negotiate("negotiate ");
|
||||
int decodedCount;
|
||||
int deletedCount;
|
||||
static const char *bearer = "bearer ";
|
||||
static const std::string bearer_str(bearer);
|
||||
if (memcaseinsensitivecmp(value, sizeof(bearer) - 1, bearer, sizeof(bearer) - 1)) {
|
||||
dbgTrace(D_WAAP_HEADERS) << "Checking JWT chunk for alg = none" << v;
|
||||
// parse buffer v till first dot,
|
||||
// convert this chunk from base 64 to json string and get value for "alg" key
|
||||
// if alg == "none" then this is JWT with no signature and we should block it
|
||||
// if alg != "none" then this is JWT with signature and we should not block it
|
||||
char* p = (char*)v.c_str() + bearer_str.size();
|
||||
char* p1 = strchr(p, '.');
|
||||
if (p1 != NULL) {
|
||||
*p1 = '\0';
|
||||
std::string header(p);
|
||||
alignBase64Chunk(header);
|
||||
Waap::Util::b64Decode(header, b64DecodeChunk, decodedCount, deletedCount, result);
|
||||
if (!result.empty()) {
|
||||
dbgTrace(D_WAAP_HEADERS) << "[transaction:" << this << "] special header '" << header_name
|
||||
<< " base64 encoded for JWT alg testing";
|
||||
// parse JSON string and get value for "alg" key and check its value to be equal to "none"
|
||||
// if alg == "none" then this is JWT with no signature and we should block it
|
||||
boost::algorithm::to_lower(result);
|
||||
static bool err = false;
|
||||
static const SingleRegex invalid_jwt_alg_re(
|
||||
"\"alg\"\\s*:\\s*\"none\"",
|
||||
err,
|
||||
"invalid_jwt_alg_"
|
||||
);
|
||||
if (invalid_jwt_alg_re.hasMatch(result)) {
|
||||
dbgTrace(D_WAAP_HEADERS) << "[transaction:" << this << "] special header '" << header_name
|
||||
<< " bad JWT algotitm detected, blocking";
|
||||
Waf2ScanResult new_res = Waf2ScanResult();
|
||||
new_res.location = "header";
|
||||
new_res.param_name = header_name;
|
||||
new_res.unescaped_line = header_name + ": " + result;
|
||||
new_res.score = 9.0;
|
||||
new_res.keyword_matches.push_back("alg:none");
|
||||
new_res.scoreArray.push_back(9.0);
|
||||
new_res.attack_types.insert("JWT");
|
||||
if (m_scanResult != NULL) {
|
||||
dbgTrace(D_WAAP_HEADERS) << "LastScanResult = " << m_scanResult;
|
||||
m_scanResult->mergeFrom(new_res);
|
||||
} else {
|
||||
dbgTrace(D_WAAP_HEADERS) << "LastScanResult is NULL";
|
||||
m_scanResult = new Waf2ScanResult(new_res);
|
||||
}
|
||||
return;
|
||||
}
|
||||
dbgTrace(D_WAAP_HEADERS) << "[transaction:" << this << "] special header '" << header_name
|
||||
<< " clean JWT algotitm detected";
|
||||
return;
|
||||
} else {
|
||||
parseGenericHeaderValue(header_name, value, value_len);
|
||||
}
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
if (boost::algorithm::starts_with(v, negotiate)) {
|
||||
v = v.substr(negotiate.size(), v.size() - negotiate.size());
|
||||
static const char *negotiate = "negotiate ";
|
||||
static const std::string negotiate_str(negotiate);
|
||||
if (memcaseinsensitivecmp(value, sizeof(negotiate) - 1, negotiate, sizeof(negotiate) - 1)) {
|
||||
v = v.substr(negotiate_str.size(), v.size() - negotiate_str.size());
|
||||
|
||||
// Detect potential base64 match after the "Negotiate " prefix
|
||||
alignBase64Chunk(v);
|
||||
Waap::Util::b64Decode(v, b64DecodeChunk, decodedCount, deletedCount, result);
|
||||
if (result.empty() && (deletedCount + decodedCount == 1)) {
|
||||
// Decoded 1 base64 chunk and nothing left behind it
|
||||
dbgTrace(D_WAAP) << "[transaction:" << this << "] special header '" <<
|
||||
std::string(name, name_len) << " is clean";
|
||||
return CLEAN_HEADER;
|
||||
dbgTrace(D_WAAP_HEADERS) << "[transaction:" << this << "] special header '" << header_name
|
||||
<< " is clean - clean base64 for negotiate";
|
||||
return;
|
||||
} else {
|
||||
parseGenericHeaderValue(header_name, value, value_len);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return UNKNOWN_HEADER;
|
||||
}
|
||||
|
||||
// Methods below are callbacks that are called during HTTP transaction processing by the front-end server/proxy
|
||||
@@ -744,14 +835,14 @@ void Waf2Transaction::parseContentType(const char* value, int value_len)
|
||||
ctp.push(value, value_len);
|
||||
ctp.finish();
|
||||
|
||||
dbgTrace(D_WAAP) << "[transaction:" << this << "] ctp detected content type: '" <<
|
||||
dbgTrace(D_WAAP_HEADERS) << "[transaction:" << this << "] ctp detected content type: '" <<
|
||||
ctp.contentTypeDetected.c_str() << "'";
|
||||
// The above fills m_contentTypeDetected
|
||||
m_contentType = Waap::Util::detectContentType(ctp.contentTypeDetected.c_str());
|
||||
|
||||
// extract boundary string required for parsing multipart-form-data stream
|
||||
if (m_contentType == Waap::Util::CONTENT_TYPE_MULTIPART_FORM) {
|
||||
dbgTrace(D_WAAP) << "content_type detected: " << Waap::Util::getContentTypeStr(m_contentType) <<
|
||||
dbgTrace(D_WAAP_HEADERS) << "content_type detected: " << Waap::Util::getContentTypeStr(m_contentType) <<
|
||||
"; boundary='" << ctp.boundaryFound.c_str() << "'";
|
||||
m_deepParser.setMultipartBoundary(ctp.boundaryFound);
|
||||
}
|
||||
@@ -773,7 +864,7 @@ void Waf2Transaction::parseCookie(const char* value, int value_len)
|
||||
#endif
|
||||
|
||||
if (value_len > 0) {
|
||||
dbgTrace(D_WAAP) << "[transaction:" << this << "] scanning the cookie value";
|
||||
dbgTrace(D_WAAP_HEADERS) << "[transaction:" << this << "] scanning the cookie value";
|
||||
m_deepParser.m_key.push("cookie", 6);
|
||||
ParserUrlEncode cookieValueParser(m_deepParserReceiver, 0, ';');
|
||||
cookieValueParser.push(value, value_len);
|
||||
@@ -788,7 +879,7 @@ void Waf2Transaction::parseReferer(const char* value, int value_len)
|
||||
#ifdef NO_HEADERS_SCAN
|
||||
return;
|
||||
#endif
|
||||
dbgTrace(D_WAAP) << "Parsed Referer. Referer URI: " << m_uriReferer;
|
||||
dbgTrace(D_WAAP_HEADERS) << "Parsed Referer. Referer URI: " << m_uriReferer;
|
||||
|
||||
std::string referer(value, value_len);
|
||||
std::vector<RegexMatch> regex_matches;
|
||||
@@ -815,7 +906,7 @@ void Waf2Transaction::parseUnknownHeaderName(const char* name, int name_len)
|
||||
// Apply signatures on all other, header names, unless they are considered "good" ones to skip scanning them.
|
||||
if (name_len &&
|
||||
!m_pWaapAssetState->getSignatures()->good_header_name_re.hasMatch(std::string(name, name_len))) {
|
||||
dbgTrace(D_WAAP) << "[transaction:" << this << "] scanning the header name";
|
||||
dbgTrace(D_WAAP_HEADERS) << "[transaction:" << this << "] scanning the header name";
|
||||
m_deepParser.m_key.push("header", 6);
|
||||
ParserRaw headerNameParser(m_deepParserReceiver, 0, std::string(name, name_len));
|
||||
headerNameParser.push(name, name_len);
|
||||
@@ -834,7 +925,7 @@ void Waf2Transaction::parseGenericHeaderValue(const std::string &headerName, con
|
||||
return;
|
||||
}
|
||||
|
||||
dbgTrace(D_WAAP) << "[transaction:" << this << "] scanning the header value";
|
||||
dbgTrace(D_WAAP_HEADERS) << "[transaction:" << this << "] scanning the header value";
|
||||
m_deepParser.m_key.push("header", 6);
|
||||
ParserRaw headerValueParser(m_deepParserReceiver, 0, headerName);
|
||||
headerValueParser.push(value, value_len);
|
||||
@@ -844,11 +935,11 @@ void Waf2Transaction::parseGenericHeaderValue(const std::string &headerName, con
|
||||
};
|
||||
|
||||
// Scan relevant headers to detect attacks inside them
|
||||
void Waf2Transaction::scanSpecificHeder(const char* name, int name_len, const char* value, int value_len)
|
||||
void Waf2Transaction::scanSpecificHeader(const char* name, int name_len, const char* value, int value_len)
|
||||
{
|
||||
HeaderType header_t = detectHeaderType(name, name_len);
|
||||
std::string headerName = std::string(name, name_len);
|
||||
|
||||
dbgTrace(D_WAAP_HEADERS) << "Processing the header " << headerName;
|
||||
switch (header_t)
|
||||
{
|
||||
case HeaderType::COOKIE_HEADER:
|
||||
@@ -857,6 +948,9 @@ void Waf2Transaction::scanSpecificHeder(const char* name, int name_len, const ch
|
||||
case HeaderType::REFERER_HEADER:
|
||||
parseReferer(value, value_len);
|
||||
break;
|
||||
case HeaderType::AUTHORIZATION_HEADER:
|
||||
parseAuthorization(value, value_len, headerName);
|
||||
break;
|
||||
case HeaderType::UNKNOWN_HEADER: {
|
||||
HeaderType headerType = checkCleanHeader(name, name_len, value, value_len);
|
||||
if(headerType == HeaderType::CLEAN_HEADER) {
|
||||
@@ -954,7 +1048,7 @@ void Waf2Transaction::scanHeaders()
|
||||
// Scan relevant headers for attacks
|
||||
for (auto it = hdrs_map.begin(); it != hdrs_map.end(); ++it)
|
||||
{
|
||||
scanSpecificHeder(it->first.c_str(), it->first.size(),
|
||||
scanSpecificHeader(it->first.c_str(), it->first.size(),
|
||||
it->second.c_str(), it->second.size());
|
||||
}
|
||||
}
|
||||
@@ -1171,6 +1265,12 @@ void Waf2Transaction::end_request() {
|
||||
// Enable response headers processing if response scanning is enabled in policy
|
||||
auto errorDisclosurePolicy = m_siteConfig ? m_siteConfig->get_ErrorDisclosurePolicy() : NULL;
|
||||
m_responseInspectReasons.setErrorDisclosure(errorDisclosurePolicy && errorDisclosurePolicy->enable);
|
||||
|
||||
auto triggerPolicy = m_siteConfig ? m_siteConfig->get_TriggerPolicy() : NULL;
|
||||
if (isTriggerReportExists(triggerPolicy)) {
|
||||
m_responseInspectReasons.setTriggerReport(true);
|
||||
dbgTrace(D_WAAP) << "setTriggerReport(true)";
|
||||
}
|
||||
}
|
||||
|
||||
void Waf2Transaction::extractEnvSourceIdentifier()
|
||||
@@ -1393,6 +1493,7 @@ Waf2Transaction::decideAfterHeaders()
|
||||
return false;
|
||||
}
|
||||
|
||||
m_isHeaderOverrideScanRequired = true;
|
||||
m_overrideState = getOverrideState(sitePolicy);
|
||||
|
||||
// Select scores pool by location (but use forced pool when forced)
|
||||
@@ -1648,6 +1749,12 @@ Waf2Transaction::sendLog()
|
||||
const auto& autonomousSecurityDecision = std::dynamic_pointer_cast<AutonomousSecurityDecision>(
|
||||
m_waapDecision.getDecision(AUTONOMOUS_SECURITY_DECISION));
|
||||
|
||||
I_TimeGet *timeGet = Singleton::Consume<I_TimeGet>::by<Waf2Transaction>();
|
||||
auto finish = timeGet->getMonotonicTime();
|
||||
auto diff = chrono::duration_cast<chrono::milliseconds>(finish) - m_entry_time;
|
||||
telemetryData.elapsedTime = diff.count();
|
||||
dbgTrace(D_WAAP) << "latency updated, time: " << diff.count() << "ms";
|
||||
|
||||
if (m_methodStr == "POST") {
|
||||
telemetryData.method = POST;
|
||||
} else if (m_methodStr == "GET") {
|
||||
|
||||
@@ -38,6 +38,7 @@
|
||||
#include "i_transaction.h"
|
||||
#include "i_waap_telemetry.h"
|
||||
#include "i_deepAnalyzer.h"
|
||||
#include "i_time_get.h"
|
||||
#include "table_opaque.h"
|
||||
#include "WaapResponseInspectReasons.h"
|
||||
#include "WaapResponseInjectReasons.h"
|
||||
@@ -45,6 +46,7 @@
|
||||
#include "WaapOpenRedirectPolicy.h"
|
||||
#include "WaapScanner.h"
|
||||
#include "singleton.h"
|
||||
#include "OASchemaUpdaterConfConstant.h"
|
||||
|
||||
struct DecisionTelemetryData;
|
||||
class Waf2Transaction;
|
||||
@@ -60,6 +62,7 @@ class Waf2Transaction :
|
||||
public Singleton::Consume<I_Table>,
|
||||
private boost::noncopyable,
|
||||
Singleton::Consume<I_AgentDetails>,
|
||||
Singleton::Consume<I_TimeGet>,
|
||||
Singleton::Consume<I_Environment>
|
||||
{
|
||||
public:
|
||||
@@ -76,6 +79,7 @@ public:
|
||||
void set_host(const char *host);
|
||||
|
||||
// getters
|
||||
uint64_t getElapsedTime() const;
|
||||
const std::string& getRemoteAddr() const;
|
||||
virtual const std::string getUri() const;
|
||||
const std::string getUriStr() const;
|
||||
@@ -143,6 +147,7 @@ public:
|
||||
void start_response_body();
|
||||
void add_response_body_chunk(const char* data, int data_len);
|
||||
void end_response_body();
|
||||
const std::string & getResponseBody();
|
||||
void end_response();
|
||||
void extractEnvSourceIdentifier();
|
||||
void finish();
|
||||
@@ -212,19 +217,21 @@ public:
|
||||
}
|
||||
|
||||
// LCOV_EXCL_STOP
|
||||
|
||||
bool reportScanResult(const Waf2ScanResult &res);
|
||||
bool shouldIgnoreOverride(const Waf2ScanResult &res);
|
||||
Waap::OpenRedirect::State &getOpenRedirectState() { return m_openRedirectState; }
|
||||
IWaapConfig* getSiteConfig() { return m_siteConfig; }
|
||||
void addNote(const std::string ¬e) { m_notes.push_back(note); }
|
||||
const std::string &getResponseBody(void) const { return m_response_body; }
|
||||
Waap::ResponseInspectReasons &getResponseInspectReasons(void) { return m_responseInspectReasons; }
|
||||
// LCOV_EXCL_START Reason: This function is tested in system tests
|
||||
bool checkIsHeaderOverrideScanRequired();
|
||||
// LCOV_EXCL_STOP
|
||||
|
||||
private:
|
||||
int finalizeDecision(IWaapConfig *sitePolicy, bool shouldBlock);
|
||||
const std::shared_ptr<Waap::Trigger::Log> getTriggerLog(const std::shared_ptr<Waap::Trigger::Policy>&
|
||||
triggerPolicy) const;
|
||||
bool isTriggerReportExists(const std::shared_ptr<Waap::Trigger::Policy> &triggerPolicy);
|
||||
void sendAutonomousSecurityLog(
|
||||
const std::shared_ptr<Waap::Trigger::Log>& triggerLog,
|
||||
bool shouldBlock,
|
||||
@@ -261,15 +268,17 @@ private:
|
||||
void parseContentType(const char* value, int value_len);
|
||||
void parseCookie(const char* value, int value_len);
|
||||
void parseReferer(const char* value, int value_len);
|
||||
void parseAuthorization(const char* value, int value_len, const std::string &header_name);
|
||||
void parseUnknownHeaderName(const char* name, int name_len);
|
||||
void parseGenericHeaderValue(const std::string &headerName, const char* value, int value_len);
|
||||
void scanSpecificHeder(const char* name, int name_len, const char* value, int value_len);
|
||||
void scanSpecificHeader(const char* name, int name_len, const char* value, int value_len);
|
||||
void detectSpecificHeader(const char* name, int name_len, const char* value, int value_len);
|
||||
void detectHeaders();
|
||||
void scanHeaders();
|
||||
void clearRequestParserState();
|
||||
void scanErrDisclosureBuffer();
|
||||
|
||||
std::chrono::milliseconds m_entry_time;
|
||||
std::shared_ptr<WaapAssetState> m_pWaapAssetState;
|
||||
bool m_ignoreScore; // override the scoring filter and (effectively) take the last suspicious parameter,
|
||||
// instead of the one with highest score that is > SCORE_THRESHOLD
|
||||
@@ -334,6 +343,7 @@ private:
|
||||
|
||||
bool m_processedUri;
|
||||
bool m_processedHeaders;
|
||||
bool m_isHeaderOverrideScanRequired;
|
||||
bool m_isScanningRequired;
|
||||
int m_responseStatus;
|
||||
Waap::ResponseInspectReasons m_responseInspectReasons;
|
||||
@@ -345,6 +355,7 @@ private:
|
||||
|
||||
// Cached pointer to const triggerLog (hence mutable)
|
||||
mutable std::shared_ptr<Waap::Trigger::Log> m_triggerLog;
|
||||
bool m_triggerReport;
|
||||
bool is_schema_validation = false;
|
||||
Waf2TransactionFlags m_waf2TransactionFlags;
|
||||
};
|
||||
|
||||
@@ -551,6 +551,11 @@ const std::set<std::string> Waf2Transaction::getFoundPatterns() const
|
||||
return m_found_patterns;
|
||||
}
|
||||
|
||||
bool Waf2Transaction::checkIsHeaderOverrideScanRequired()
|
||||
{
|
||||
return m_isHeaderOverrideScanRequired;
|
||||
}
|
||||
|
||||
Waap::Override::State Waf2Transaction::getOverrideState(IWaapConfig* sitePolicy)
|
||||
{
|
||||
Waap::Override::State overrideState;
|
||||
@@ -566,6 +571,7 @@ Waap::Override::State Waf2Transaction::getOverrideState(IWaapConfig* sitePolicy)
|
||||
if (overridePolicy) { // later we will run response overrides
|
||||
overrideStateResponse.applyOverride(*overridePolicy, WaapOverrideFunctor(*this), m_matchedOverrideIds, false);
|
||||
}
|
||||
m_isHeaderOverrideScanRequired = false;
|
||||
return overrideStateResponse;
|
||||
}
|
||||
|
||||
@@ -592,6 +598,23 @@ const std::shared_ptr<Waap::Trigger::Log> Waf2Transaction::getTriggerLog(const s
|
||||
return m_triggerLog;
|
||||
}
|
||||
|
||||
bool Waf2Transaction::isTriggerReportExists(const std::shared_ptr<
|
||||
Waap::Trigger::Policy> &triggerPolicy)
|
||||
{
|
||||
if (!triggerPolicy) {
|
||||
return false;
|
||||
}
|
||||
if (m_triggerReport) {
|
||||
return m_triggerReport;
|
||||
}
|
||||
for (const Waap::Trigger::Trigger &trigger : triggerPolicy->triggers) {
|
||||
if (trigger.triggerType == "report") {
|
||||
return m_triggerReport = true;
|
||||
}
|
||||
}
|
||||
return m_triggerReport;
|
||||
}
|
||||
|
||||
ReportIS::Severity Waf2Transaction::computeEventSeverityFromDecision() const
|
||||
{
|
||||
DecisionType type = m_waapDecision.getHighestPriorityDecisionToLog();
|
||||
|
||||
@@ -732,6 +732,13 @@ inline void replaceAll(std::string& str, const std::string& from, const std::str
|
||||
start_pos += to.length(); // In case 'to' contains 'from', like replacing 'x' with 'yx'
|
||||
}
|
||||
}
|
||||
inline void alignBase64Chunk (std::string &chunk)
|
||||
{
|
||||
size_t len = chunk.length() % 4;
|
||||
if (len >= 2) {
|
||||
chunk.append(4-len, '=');
|
||||
}
|
||||
}
|
||||
|
||||
// Count items in v that are not in ignored_set
|
||||
inline size_t countNotInSet(const std::vector<std::string> &v, const std::set<std::string> &ignored_set) {
|
||||
|
||||
@@ -170,11 +170,15 @@ WaapComponent::Impl::respond(const NewHttpTransactionEvent &event)
|
||||
|
||||
waf2Transaction.start();
|
||||
|
||||
char sourceIpStr[INET_ADDRSTRLEN];
|
||||
inet_ntop(AF_INET, &(event.getSourceIP()), sourceIpStr, INET_ADDRSTRLEN);
|
||||
|
||||
char listeningIpStr[INET_ADDRSTRLEN];
|
||||
inet_ntop(AF_INET, &(event.getListeningIP()), listeningIpStr, INET_ADDRSTRLEN);
|
||||
char sourceIpStr[INET6_ADDRSTRLEN];
|
||||
char listeningIpStr[INET6_ADDRSTRLEN];
|
||||
if (event.getSourceIP().getType() == IPType::V4) {
|
||||
inet_ntop(AF_INET, &(event.getSourceIP()), sourceIpStr, INET6_ADDRSTRLEN);
|
||||
inet_ntop(AF_INET, &(event.getListeningIP()), listeningIpStr, INET6_ADDRSTRLEN);
|
||||
} else {
|
||||
inet_ntop(AF_INET6, &(event.getSourceIP()), sourceIpStr, INET6_ADDRSTRLEN);
|
||||
inet_ntop(AF_INET6, &(event.getListeningIP()), listeningIpStr, INET6_ADDRSTRLEN);
|
||||
}
|
||||
|
||||
// Set envelope data
|
||||
waf2Transaction.set_transaction_remote(sourceIpStr, event.getSourcePort());
|
||||
@@ -515,7 +519,6 @@ WaapComponent::Impl::respond(const HttpResponseBodyEvent &event)
|
||||
|
||||
dbgTrace(D_WAAP) << "HttpBodyResponse";
|
||||
|
||||
|
||||
// Push the response data chunk to the waf2 engine
|
||||
const char *dataBuf = (const char*)event.getData().data();
|
||||
size_t dataBufLen = event.getData().size();
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
add_subdirectory(generic_rulebase)
|
||||
add_subdirectory(geo_location)
|
||||
add_subdirectory(http_transaction_data)
|
||||
add_subdirectory(ip_utilities)
|
||||
|
||||
137
components/utils/generic_rulebase/assets_config.cc
Normal file
137
components/utils/generic_rulebase/assets_config.cc
Normal file
@@ -0,0 +1,137 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/assets_config.h"
|
||||
|
||||
#include <string>
|
||||
#include <algorithm>
|
||||
#include <unordered_map>
|
||||
|
||||
#include "generic_rulebase/generic_rulebase_utils.h"
|
||||
#include "config.h"
|
||||
#include "debug.h"
|
||||
#include "ip_utilities.h"
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
using namespace std;
|
||||
|
||||
void
|
||||
RuleAsset::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
archive_in(cereal::make_nvp("assetId", asset_id));
|
||||
archive_in(cereal::make_nvp("assetName", asset_name));
|
||||
archive_in(cereal::make_nvp("assetUrls", asset_urls));
|
||||
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Adding asset with UID: " << asset_id;
|
||||
}
|
||||
|
||||
void
|
||||
RuleAsset::AssetUrl::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
archive_in(cereal::make_nvp("protocol", protocol));
|
||||
transform(protocol.begin(), protocol.end(), protocol.begin(), [](unsigned char c) { return tolower(c); });
|
||||
|
||||
archive_in(cereal::make_nvp("ip", ip));
|
||||
archive_in(cereal::make_nvp("port", port));
|
||||
|
||||
int value;
|
||||
if (protocol == "*") {
|
||||
is_any_proto = true;
|
||||
} else {
|
||||
is_any_proto = false;
|
||||
try {
|
||||
value = 0;
|
||||
if(protocol == "udp") value = IPPROTO_UDP;
|
||||
if(protocol == "tcp") value = IPPROTO_TCP;
|
||||
if(protocol == "dccp") value = IPPROTO_DCCP;
|
||||
if(protocol == "sctp") value = IPPROTO_SCTP;
|
||||
if(protocol == "icmp") value = IPPROTO_ICMP;
|
||||
if(protocol == "icmpv6") value = IPPROTO_ICMP;
|
||||
|
||||
if (value > static_cast<int>(UINT8_MAX) || value < 0) {
|
||||
dbgWarning(D_RULEBASE_CONFIG)
|
||||
<< "provided value is not a legal IP protocol number. Value: "
|
||||
<< protocol;
|
||||
} else {
|
||||
parsed_proto = value;
|
||||
}
|
||||
} catch (...) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal IP protocol. Value: " << protocol;
|
||||
}
|
||||
}
|
||||
|
||||
if (port == "*") {
|
||||
is_any_port = true;
|
||||
} else {
|
||||
is_any_port = false;
|
||||
try {
|
||||
value = stoi(port);
|
||||
if (value > static_cast<int>(UINT16_MAX) || value < 0) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal port number. Value: " << port;
|
||||
} else {
|
||||
parsed_port = value;
|
||||
}
|
||||
} catch (...) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal port. Value: " << port;
|
||||
}
|
||||
}
|
||||
|
||||
if (ip == "*") {
|
||||
is_any_ip = true;
|
||||
} else {
|
||||
is_any_ip = false;
|
||||
auto ip_addr = IPAddr::createIPAddr(ip);
|
||||
if (!ip_addr.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Could not create IP address. Error: " << ip_addr.getErr();
|
||||
} else {
|
||||
parsed_ip = ConvertToIpAddress(ip_addr.unpackMove());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
IpAddress
|
||||
RuleAsset::AssetUrl::ConvertToIpAddress(const IPAddr &addr)
|
||||
{
|
||||
IpAddress address;
|
||||
switch (addr.getType()) {
|
||||
case IPType::UNINITIALIZED: {
|
||||
address.addr4_t = {0};
|
||||
address.ip_type = IP_VERSION_ANY;
|
||||
break;
|
||||
}
|
||||
case IPType::V4: {
|
||||
address.addr4_t = addr.getIPv4();
|
||||
address.ip_type = IP_VERSION_4;
|
||||
break;
|
||||
}
|
||||
case IPType::V6: {
|
||||
address.addr6_t = addr.getIPv6();
|
||||
address.ip_type = IP_VERSION_6;
|
||||
break;
|
||||
}
|
||||
default:
|
||||
address.addr4_t = {0};
|
||||
address.ip_type = IP_VERSION_ANY;
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Unsupported IP type: " << static_cast<int>(addr.getType());
|
||||
}
|
||||
return address;
|
||||
}
|
||||
|
||||
const Assets Assets::empty_assets_config = Assets();
|
||||
|
||||
void
|
||||
Assets::preload()
|
||||
{
|
||||
registerExpectedSetting<Assets>("rulebase", "usedAssets");
|
||||
}
|
||||
52
components/utils/generic_rulebase/evaluators/asset_eval.cc
Normal file
52
components/utils/generic_rulebase/evaluators/asset_eval.cc
Normal file
@@ -0,0 +1,52 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/evaluators/asset_eval.h"
|
||||
|
||||
#include <vector>
|
||||
#include <string>
|
||||
|
||||
#include "generic_rulebase/assets_config.h"
|
||||
#include "config.h"
|
||||
#include "debug.h"
|
||||
|
||||
using namespace std;
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
string AssetMatcher::ctx_key = "asset_id";
|
||||
|
||||
AssetMatcher::AssetMatcher(const vector<string> ¶ms)
|
||||
{
|
||||
if (params.size() != 1) reportWrongNumberOfParams(AssetMatcher::getName(), params.size(), 1, 1);
|
||||
asset_id = params[0];
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
AssetMatcher::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<AssetMatcher>();
|
||||
auto bc_asset_id_ctx = env->get<GenericConfigId>(AssetMatcher::ctx_key);
|
||||
|
||||
if (bc_asset_id_ctx.ok()) {
|
||||
dbgTrace(D_RULEBASE_CONFIG)
|
||||
<< "Asset ID: "
|
||||
<< asset_id
|
||||
<< "; Current set assetId context: "
|
||||
<< *bc_asset_id_ctx;
|
||||
} else {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Asset ID: " << asset_id << ". Empty context";
|
||||
}
|
||||
|
||||
return bc_asset_id_ctx.ok() && *bc_asset_id_ctx == asset_id;
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user