mirror of
https://github.com/openappsec/openappsec.git
synced 2025-11-16 01:12:18 +03:00
Compare commits
15 Commits
Feb_28_202
...
Apr_14_202
| Author | SHA1 | Date | |
|---|---|---|---|
|
1a1580081c | ||
|
|
942b2ef8b4 | ||
|
|
7a7f65a77a | ||
|
|
98639d9cb6 | ||
|
b3de81d9d9 | ||
|
|
a77fd9a6d0 | ||
|
|
8454b2dd9b | ||
|
|
3913e1e8b3 | ||
|
262b2e59ff | ||
|
|
a01c65994a | ||
|
|
1d13973ae2 | ||
|
|
c20fa9f966 | ||
|
|
0d22790ebe | ||
|
|
9f86c4607e | ||
|
|
0e47ed8595 |
@@ -3,4 +3,4 @@ dependencies:
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 12.2.8
|
||||
digest: sha256:0d13b8b0c66b8e18781eac510ce58b069518ff14a6a15ad90375e7f0ffad71fe
|
||||
generated: "2024-02-18T16:45:15.395307713Z"
|
||||
generated: "2024-03-26T14:53:49.928153508Z"
|
||||
|
||||
@@ -1,7 +1,5 @@
|
||||
annotations:
|
||||
artifacthub.io/changes: |-
|
||||
- "update web hook cert gen to latest release v20231226-1a7112e06"
|
||||
- "Update Ingress-Nginx version controller-v1.9.6"
|
||||
artifacthub.io/changes: '- "Update Ingress-Nginx version controller-v1.10.0"'
|
||||
artifacthub.io/prerelease: "false"
|
||||
apiVersion: v2
|
||||
appVersion: latest
|
||||
@@ -17,4 +15,4 @@ kubeVersion: '>=1.20.0-0'
|
||||
name: open-appsec-k8s-nginx-ingress
|
||||
sources:
|
||||
- https://github.com/kubernetes/ingress-nginx
|
||||
version: 4.9.1
|
||||
version: 4.10.0
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
[ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer
|
||||
|
||||
 
|
||||
 
|
||||
|
||||
To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources.
|
||||
|
||||
@@ -253,11 +253,11 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.admissionWebhooks.namespaceSelector | object | `{}` | |
|
||||
| controller.admissionWebhooks.objectSelector | object | `{}` | |
|
||||
| controller.admissionWebhooks.patch.enabled | bool | `true` | |
|
||||
| controller.admissionWebhooks.patch.image.digest | string | `"sha256:25d6a5f11211cc5c3f9f2bf552b585374af287b4debf693cacbe2da47daa5084"` | |
|
||||
| controller.admissionWebhooks.patch.image.digest | string | `"sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334"` | |
|
||||
| controller.admissionWebhooks.patch.image.image | string | `"ingress-nginx/kube-webhook-certgen"` | |
|
||||
| controller.admissionWebhooks.patch.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| controller.admissionWebhooks.patch.image.registry | string | `"registry.k8s.io"` | |
|
||||
| controller.admissionWebhooks.patch.image.tag | string | `"v20231226-1a7112e06"` | |
|
||||
| controller.admissionWebhooks.patch.image.tag | string | `"v1.4.0"` | |
|
||||
| controller.admissionWebhooks.patch.labels | object | `{}` | Labels to be added to patch job resources |
|
||||
| controller.admissionWebhooks.patch.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not |
|
||||
| controller.admissionWebhooks.patch.nodeSelector."kubernetes.io/os" | string | `"linux"` | |
|
||||
@@ -317,7 +317,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.hostname | object | `{}` | Optionally customize the pod hostname. |
|
||||
| controller.image.allowPrivilegeEscalation | bool | `false` | |
|
||||
| controller.image.chroot | bool | `false` | |
|
||||
| controller.image.digest | string | `"sha256:1405cc613bd95b2c6edd8b2a152510ae91c7e62aea4698500d23b2145960ab9c"` | |
|
||||
| controller.image.digest | string | `"sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c"` | |
|
||||
| controller.image.digestChroot | string | `"sha256:7eb46ff733429e0e46892903c7394aff149ac6d284d92b3946f3baf7ff26a096"` | |
|
||||
| controller.image.image | string | `"ingress-nginx/controller"` | |
|
||||
| controller.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
@@ -326,7 +326,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.image.runAsNonRoot | bool | `true` | |
|
||||
| controller.image.runAsUser | int | `101` | |
|
||||
| controller.image.seccompProfile.type | string | `"RuntimeDefault"` | |
|
||||
| controller.image.tag | string | `"v1.9.6"` | |
|
||||
| controller.image.tag | string | `"v1.10.0"` | |
|
||||
| controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation |
|
||||
| controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). |
|
||||
| controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass |
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
# Changelog
|
||||
|
||||
This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
|
||||
|
||||
### 4.10.0
|
||||
|
||||
* - "Update Ingress-Nginx version controller-v1.10.0"
|
||||
|
||||
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.9.1...helm-chart-4.10.0
|
||||
@@ -29,7 +29,7 @@
|
||||
- --watch-namespace={{ default "$(POD_NAMESPACE)" .Values.controller.scope.namespace }}
|
||||
{{- end }}
|
||||
{{- if and (not .Values.controller.scope.enabled) .Values.controller.scope.namespaceSelector }}
|
||||
- --watch-namespace-selector={{ default "" .Values.controller.scope.namespaceSelector }}
|
||||
- --watch-namespace-selector={{ .Values.controller.scope.namespaceSelector }}
|
||||
{{- end }}
|
||||
{{- if and .Values.controller.reportNodeInternalIp .Values.controller.hostNetwork }}
|
||||
- --report-node-internal-ip-address={{ .Values.controller.reportNodeInternalIp }}
|
||||
@@ -54,6 +54,9 @@
|
||||
{{- if .Values.controller.watchIngressWithoutClass }}
|
||||
- --watch-ingress-without-class=true
|
||||
{{- end }}
|
||||
{{- if not .Values.controller.metrics.enabled }}
|
||||
- --enable-metrics={{ .Values.controller.metrics.enabled }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.enableTopologyAwareRouting }}
|
||||
- --enable-topology-aware-routing=true
|
||||
{{- end }}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if and ( .Values.controller.metrics.enabled ) ( .Values.controller.metrics.prometheusRule.enabled ) ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) -}}
|
||||
{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.prometheusRule.enabled -}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
|
||||
@@ -34,7 +34,7 @@ spec:
|
||||
http-headers: false
|
||||
request-body: false
|
||||
log-destination:
|
||||
cloud: false
|
||||
cloud: true
|
||||
stdout:
|
||||
format: json-formatted
|
||||
---
|
||||
|
||||
@@ -15,3 +15,37 @@ tests:
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-controller
|
||||
|
||||
- it: should create a DaemonSet with argument `--enable-metrics=false` if `controller.metrics.enabled` is false
|
||||
set:
|
||||
controller.kind: DaemonSet
|
||||
kind: Vanilla
|
||||
controller.metrics.enabled: false
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].args
|
||||
content: --enable-metrics=false
|
||||
|
||||
- it: should create a DaemonSet without argument `--enable-metrics=false` if `controller.metrics.enabled` is true
|
||||
set:
|
||||
controller.kind: DaemonSet
|
||||
kind: Vanilla
|
||||
controller.metrics.enabled: true
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.containers[0].args
|
||||
content: --enable-metrics=false
|
||||
|
||||
- it: should create a DaemonSet with resource limits if `controller.resources.limits` is set
|
||||
set:
|
||||
controller.kind: DaemonSet
|
||||
kind: Vanilla
|
||||
controller.resources.limits.cpu: 500m
|
||||
controller.resources.limits.memory: 512Mi
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].resources.limits.cpu
|
||||
value: 500m
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].resources.limits.memory
|
||||
value: 512Mi
|
||||
|
||||
@@ -4,8 +4,6 @@ templates:
|
||||
|
||||
tests:
|
||||
- it: should create a Deployment
|
||||
set:
|
||||
kind: Vanilla
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
@@ -24,6 +22,22 @@ tests:
|
||||
path: spec.replicas
|
||||
value: 3
|
||||
|
||||
- it: should create a Deployment with argument `--enable-metrics=false` if `controller.metrics.enabled` is false
|
||||
set:
|
||||
controller.metrics.enabled: false
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].args
|
||||
content: --enable-metrics=false
|
||||
|
||||
- it: should create a Deployment without argument `--enable-metrics=false` if `controller.metrics.enabled` is true
|
||||
set:
|
||||
controller.metrics.enabled: true
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.containers[0].args
|
||||
content: --enable-metrics=false
|
||||
|
||||
- it: should create a Deployment with resource limits if `controller.resources.limits` is set
|
||||
set:
|
||||
controller.resources.limits.cpu: 500m
|
||||
|
||||
@@ -26,8 +26,8 @@ controller:
|
||||
## for backwards compatibility consider setting the full image url via the repository value below
|
||||
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
|
||||
## repository:
|
||||
tag: "v1.9.6"
|
||||
digest: sha256:1405cc613bd95b2c6edd8b2a152510ae91c7e62aea4698500d23b2145960ab9c
|
||||
tag: "v1.10.0"
|
||||
digest: sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c
|
||||
digestChroot: sha256:7eb46ff733429e0e46892903c7394aff149ac6d284d92b3946f3baf7ff26a096
|
||||
pullPolicy: IfNotPresent
|
||||
runAsNonRoot: true
|
||||
@@ -781,8 +781,8 @@ controller:
|
||||
## for backwards compatibility consider setting the full image url via the repository value below
|
||||
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
|
||||
## repository:
|
||||
tag: v20231226-1a7112e06
|
||||
digest: sha256:25d6a5f11211cc5c3f9f2bf552b585374af287b4debf693cacbe2da47daa5084
|
||||
tag: v1.4.0
|
||||
digest: sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334
|
||||
pullPolicy: IfNotPresent
|
||||
# -- Provide a priority class name to the webhook patching job
|
||||
##
|
||||
@@ -1198,7 +1198,7 @@ appsec:
|
||||
image:
|
||||
registry: ghcr.io/openappsec
|
||||
image: smartsync-tuning
|
||||
tag: 1.1.3
|
||||
tag: latest
|
||||
enabled: false
|
||||
replicaCount: 1
|
||||
securityContext:
|
||||
|
||||
@@ -1,5 +1,27 @@
|
||||
# Changelog
|
||||
|
||||
## 2.38.0
|
||||
|
||||
### Changes
|
||||
|
||||
* Added support for setting `SVC.tls.appProtocol` and `SVC.http.appProtocol` values to configure the appProtocol fields
|
||||
for Kubernetes Service HTTP and TLS ports. It might be useful for integration with external load balancers like GCP.
|
||||
[#1018](https://github.com/Kong/charts/pull/1018)
|
||||
|
||||
## 2.37.1
|
||||
|
||||
* Rename the controller status port. This fixes a collision with the proxy status port in the Prometheus ServiceMonitor.
|
||||
[#1008](https://github.com/Kong/charts/pull/1008)
|
||||
|
||||
## 2.37.0
|
||||
|
||||
### Changes
|
||||
|
||||
* Bumped default `kong/kubernetes-ingress-controller` image tag and updated CRDs to 3.1.
|
||||
[#1011](https://github.com/Kong/charts/pull/1011)
|
||||
* Bumped default `kong` image tag to 3.6.
|
||||
[#1011](https://github.com/Kong/charts/pull/1011)
|
||||
|
||||
## 2.36.0
|
||||
|
||||
### Fixed
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
apiVersion: v2
|
||||
appVersion: 1.1.6
|
||||
appVersion: 1.1.8
|
||||
dependencies:
|
||||
- condition: postgresql.enabled
|
||||
name: postgresql
|
||||
@@ -14,4 +14,4 @@ maintainers:
|
||||
name: open-appsec-kong
|
||||
sources:
|
||||
- https://github.com/Kong/charts/tree/main/charts/kong
|
||||
version: 2.36.0
|
||||
version: 2.38.0
|
||||
|
||||
@@ -666,40 +666,42 @@ nodes.
|
||||
mixed TCP/UDP LoadBalancer Services). It _does not_ support the `http`, `tls`,
|
||||
or `ingress` sections, as it is used only for stream listens.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|------------------------------------|---------------------------------------------------------------------------------------|--------------------------|
|
||||
| SVC.enabled | Create Service resource for SVC (admin, proxy, manager, etc.) | |
|
||||
| SVC.http.enabled | Enables http on the service | |
|
||||
| SVC.http.servicePort | Service port to use for http | |
|
||||
| SVC.http.containerPort | Container port to use for http | |
|
||||
| SVC.http.nodePort | Node port to use for http | |
|
||||
| SVC.http.hostPort | Host port to use for http | |
|
||||
| SVC.http.parameters | Array of additional listen parameters | `[]` |
|
||||
| SVC.tls.enabled | Enables TLS on the service | |
|
||||
| SVC.tls.containerPort | Container port to use for TLS | |
|
||||
| SVC.tls.servicePort | Service port to use for TLS | |
|
||||
| SVC.tls.nodePort | Node port to use for TLS | |
|
||||
| SVC.tls.hostPort | Host port to use for TLS | |
|
||||
| SVC.tls.overrideServiceTargetPort | Override service port to use for TLS without touching Kong containerPort | |
|
||||
| SVC.tls.parameters | Array of additional listen parameters | `["http2"]` |
|
||||
| SVC.type | k8s service type. Options: NodePort, ClusterIP, LoadBalancer | |
|
||||
| SVC.clusterIP | k8s service clusterIP | |
|
||||
| SVC.loadBalancerClass | loadBalancerClass to use for LoadBalancer provisionning | |
|
||||
| SVC.loadBalancerSourceRanges | Limit service access to CIDRs if set and service type is `LoadBalancer` | `[]` |
|
||||
| SVC.loadBalancerIP | Reuse an existing ingress static IP for the service | |
|
||||
| SVC.externalIPs | IPs for which nodes in the cluster will also accept traffic for the servic | `[]` |
|
||||
| SVC.externalTrafficPolicy | k8s service's externalTrafficPolicy. Options: Cluster, Local | |
|
||||
| SVC.ingress.enabled | Enable ingress resource creation (works with SVC.type=ClusterIP) | `false` |
|
||||
| SVC.ingress.ingressClassName | Set the ingressClassName to associate this Ingress with an IngressClass | |
|
||||
| SVC.ingress.hostname | Ingress hostname | `""` |
|
||||
| SVC.ingress.path | Ingress path. | `/` |
|
||||
| SVC.ingress.pathType | Ingress pathType. One of `ImplementationSpecific`, `Exact` or `Prefix` | `ImplementationSpecific` |
|
||||
| SVC.ingress.hosts | Slice of hosts configurations, including `hostname`, `path` and `pathType` keys | `[]` |
|
||||
| SVC.ingress.tls | Name of secret resource or slice of `secretName` and `hosts` keys | |
|
||||
| SVC.ingress.annotations | Ingress annotations. See documentation for your ingress controller for details | `{}` |
|
||||
| SVC.ingress.labels | Ingress labels. Additional custom labels to add to the ingress. | `{}` |
|
||||
| SVC.annotations | Service annotations | `{}` |
|
||||
| SVC.labels | Service labels | `{}` |
|
||||
| Parameter | Description | Default |
|
||||
|-----------------------------------|-------------------------------------------------------------------------------------------|--------------------------|
|
||||
| SVC.enabled | Create Service resource for SVC (admin, proxy, manager, etc.) | |
|
||||
| SVC.http.enabled | Enables http on the service | |
|
||||
| SVC.http.servicePort | Service port to use for http | |
|
||||
| SVC.http.containerPort | Container port to use for http | |
|
||||
| SVC.http.nodePort | Node port to use for http | |
|
||||
| SVC.http.hostPort | Host port to use for http | |
|
||||
| SVC.http.parameters | Array of additional listen parameters | `[]` |
|
||||
| SVC.http.appProtocol | `appProtocol` to be set in a Service's port. If left empty, no `appProtocol` will be set. | |
|
||||
| SVC.tls.enabled | Enables TLS on the service | |
|
||||
| SVC.tls.containerPort | Container port to use for TLS | |
|
||||
| SVC.tls.servicePort | Service port to use for TLS | |
|
||||
| SVC.tls.nodePort | Node port to use for TLS | |
|
||||
| SVC.tls.hostPort | Host port to use for TLS | |
|
||||
| SVC.tls.overrideServiceTargetPort | Override service port to use for TLS without touching Kong containerPort | |
|
||||
| SVC.tls.parameters | Array of additional listen parameters | `["http2"]` |
|
||||
| SVC.tls.appProtocol | `appProtocol` to be set in a Service's port. If left empty, no `appProtocol` will be set. | |
|
||||
| SVC.type | k8s service type. Options: NodePort, ClusterIP, LoadBalancer | |
|
||||
| SVC.clusterIP | k8s service clusterIP | |
|
||||
| SVC.loadBalancerClass | loadBalancerClass to use for LoadBalancer provisionning | |
|
||||
| SVC.loadBalancerSourceRanges | Limit service access to CIDRs if set and service type is `LoadBalancer` | `[]` |
|
||||
| SVC.loadBalancerIP | Reuse an existing ingress static IP for the service | |
|
||||
| SVC.externalIPs | IPs for which nodes in the cluster will also accept traffic for the servic | `[]` |
|
||||
| SVC.externalTrafficPolicy | k8s service's externalTrafficPolicy. Options: Cluster, Local | |
|
||||
| SVC.ingress.enabled | Enable ingress resource creation (works with SVC.type=ClusterIP) | `false` |
|
||||
| SVC.ingress.ingressClassName | Set the ingressClassName to associate this Ingress with an IngressClass | |
|
||||
| SVC.ingress.hostname | Ingress hostname | `""` |
|
||||
| SVC.ingress.path | Ingress path. | `/` |
|
||||
| SVC.ingress.pathType | Ingress pathType. One of `ImplementationSpecific`, `Exact` or `Prefix` | `ImplementationSpecific` |
|
||||
| SVC.ingress.hosts | Slice of hosts configurations, including `hostname`, `path` and `pathType` keys | `[]` |
|
||||
| SVC.ingress.tls | Name of secret resource or slice of `secretName` and `hosts` keys | |
|
||||
| SVC.ingress.annotations | Ingress annotations. See documentation for your ingress controller for details | `{}` |
|
||||
| SVC.ingress.labels | Ingress labels. Additional custom labels to add to the ingress. | `{}` |
|
||||
| SVC.annotations | Service annotations | `{}` |
|
||||
| SVC.labels | Service labels | `{}` |
|
||||
|
||||
#### Admin Service mTLS
|
||||
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -33,9 +33,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -90,7 +90,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -205,7 +205,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -274,8 +274,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-custom-dbless-config
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -286,8 +286,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-admin
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -309,8 +309,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -336,9 +336,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -364,8 +364,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -84,8 +84,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -108,9 +108,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -138,7 +138,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -159,7 +159,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -240,7 +240,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -350,7 +350,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -408,8 +408,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -617,6 +617,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -657,8 +689,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -677,8 +709,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -742,8 +774,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -766,8 +798,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -783,8 +815,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -797,8 +829,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -825,9 +857,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -854,8 +886,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -870,8 +902,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -881,8 +913,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -137,7 +137,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -158,7 +158,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -241,7 +241,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -353,7 +353,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -410,8 +410,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -619,6 +619,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -658,8 +690,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -677,8 +709,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -741,8 +773,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -764,8 +796,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -780,8 +812,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -793,8 +825,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -820,9 +852,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -848,8 +880,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -863,8 +895,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -873,8 +905,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -430,8 +430,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -639,6 +639,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -678,8 +710,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -697,8 +729,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -761,8 +793,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -784,8 +816,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -800,8 +832,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -822,8 +854,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -849,9 +881,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -877,8 +909,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -892,8 +924,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -902,8 +934,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -432,8 +432,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -641,6 +641,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -680,8 +712,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -699,8 +731,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -763,8 +795,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -786,8 +818,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -802,8 +834,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -824,8 +856,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -851,9 +883,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -879,8 +911,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -894,8 +926,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -904,8 +936,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -428,8 +428,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -637,6 +637,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -676,8 +708,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -695,8 +727,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -759,8 +791,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -782,8 +814,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -798,8 +830,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -811,8 +843,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -838,9 +870,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -866,8 +898,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -881,8 +913,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -891,8 +923,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -463,8 +463,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -672,6 +672,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -711,8 +743,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -730,8 +762,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -794,8 +826,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -817,8 +849,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -833,8 +865,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -864,8 +896,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -891,9 +923,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -919,8 +951,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -934,8 +966,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -944,8 +976,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -158,7 +158,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -241,7 +241,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -353,7 +353,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -410,8 +410,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -690,8 +690,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -709,8 +709,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -773,8 +773,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -796,8 +796,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -812,8 +812,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -825,8 +825,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -852,9 +852,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -880,8 +880,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -895,8 +895,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -905,8 +905,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -0,0 +1,908 @@
|
||||
[proxy-appprotocol-values]
|
||||
SnapShot = """
|
||||
- object:
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1beta1
|
||||
clientConfig:
|
||||
caBundle: '###DYNAMIC_FIELD###'
|
||||
service:
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
failurePolicy: Ignore
|
||||
name: validations.kong.konghq.com
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: owner
|
||||
operator: NotIn
|
||||
values:
|
||||
- helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
apiVersions:
|
||||
- '*'
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- kongconsumers
|
||||
- kongplugins
|
||||
- kongclusterplugins
|
||||
- kongingresses
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- secrets
|
||||
- services
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- ingresses
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
apiVersions:
|
||||
- v1alpha2
|
||||
- v1beta1
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- gateways
|
||||
- httproutes
|
||||
sideEffects: None
|
||||
- object:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/name: kong
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kuma.io/gateway: enabled
|
||||
kuma.io/service-account-token-volume: chartsnap-kong-token
|
||||
traffic.sidecar.istio.io/includeInboundPorts: \"\"
|
||||
labels:
|
||||
app: chartsnap-kong
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args: null
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: CONTROLLER_ADMISSION_WEBHOOK_LISTEN
|
||||
value: 0.0.0.0:8080
|
||||
- name: CONTROLLER_ELECTION_ID
|
||||
value: kong-ingress-controller-leader-kong
|
||||
- name: CONTROLLER_INGRESS_CLASS
|
||||
value: kong
|
||||
- name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY
|
||||
value: \"true\"
|
||||
- name: CONTROLLER_KONG_ADMIN_URL
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
name: ingress-controller
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: webhook
|
||||
protocol: TCP
|
||||
- containerPort: 10255
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /admission-webhook
|
||||
name: webhook-cert
|
||||
readOnly: true
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: chartsnap-kong-token
|
||||
readOnly: true
|
||||
- env:
|
||||
- name: KONG_ADMIN_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_GUI_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_GUI_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_LISTEN
|
||||
value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
|
||||
- name: KONG_CLUSTER_LISTEN
|
||||
value: \"off\"
|
||||
- name: KONG_DATABASE
|
||||
value: \"off\"
|
||||
- name: KONG_KIC
|
||||
value: \"on\"
|
||||
- name: KONG_LUA_PACKAGE_PATH
|
||||
value: /opt/?.lua;/opt/?/init.lua;;
|
||||
- name: KONG_NGINX_WORKER_PROCESSES
|
||||
value: \"2\"
|
||||
- name: KONG_PORTAL_API_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PORTAL_API_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PORT_MAPS
|
||||
value: 80:8000, 443:8443
|
||||
- name: KONG_PREFIX
|
||||
value: /kong_prefix/
|
||||
- name: KONG_PROXY_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PROXY_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PROXY_LISTEN
|
||||
value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl
|
||||
- name: KONG_PROXY_STREAM_ACCESS_LOG
|
||||
value: /dev/stdout basic
|
||||
- name: KONG_PROXY_STREAM_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ROUTER_FLAVOR
|
||||
value: traditional
|
||||
- name: KONG_STATUS_ACCESS_LOG
|
||||
value: \"off\"
|
||||
- name: KONG_STATUS_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_STATUS_LISTEN
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- kong
|
||||
- quit
|
||||
- --wait=15
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /status
|
||||
port: status
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
name: proxy
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
name: proxy
|
||||
protocol: TCP
|
||||
- containerPort: 8443
|
||||
name: proxy-tls
|
||||
protocol: TCP
|
||||
- containerPort: 8100
|
||||
name: status
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /status/ready
|
||||
port: status
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /kong_prefix/
|
||||
name: chartsnap-kong-prefix-dir
|
||||
- mountPath: /tmp
|
||||
name: chartsnap-kong-tmp
|
||||
initContainers:
|
||||
- command:
|
||||
- rm
|
||||
- -vrf
|
||||
- $KONG_PREFIX/pids
|
||||
env:
|
||||
- name: KONG_ADMIN_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_GUI_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_GUI_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_LISTEN
|
||||
value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
|
||||
- name: KONG_CLUSTER_LISTEN
|
||||
value: \"off\"
|
||||
- name: KONG_DATABASE
|
||||
value: \"off\"
|
||||
- name: KONG_KIC
|
||||
value: \"on\"
|
||||
- name: KONG_LUA_PACKAGE_PATH
|
||||
value: /opt/?.lua;/opt/?/init.lua;;
|
||||
- name: KONG_NGINX_WORKER_PROCESSES
|
||||
value: \"2\"
|
||||
- name: KONG_PORTAL_API_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PORTAL_API_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PORT_MAPS
|
||||
value: 80:8000, 443:8443
|
||||
- name: KONG_PREFIX
|
||||
value: /kong_prefix/
|
||||
- name: KONG_PROXY_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PROXY_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PROXY_LISTEN
|
||||
value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl
|
||||
- name: KONG_PROXY_STREAM_ACCESS_LOG
|
||||
value: /dev/stdout basic
|
||||
- name: KONG_PROXY_STREAM_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ROUTER_FLAVOR
|
||||
value: traditional
|
||||
- name: KONG_STATUS_ACCESS_LOG
|
||||
value: \"off\"
|
||||
- name: KONG_STATUS_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_STATUS_LISTEN
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /kong_prefix/
|
||||
name: chartsnap-kong-prefix-dir
|
||||
- mountPath: /tmp
|
||||
name: chartsnap-kong-tmp
|
||||
securityContext: {}
|
||||
serviceAccountName: chartsnap-kong
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- emptyDir:
|
||||
sizeLimit: 256Mi
|
||||
name: chartsnap-kong-prefix-dir
|
||||
- emptyDir:
|
||||
sizeLimit: 1Gi
|
||||
name: chartsnap-kong-tmp
|
||||
- name: chartsnap-kong-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
- name: webhook-cert
|
||||
secret:
|
||||
secretName: chartsnap-kong-validation-webhook-keypair
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongupstreampolicies
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongupstreampolicies/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumergroups
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumergroups/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- services/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- ingressclassparameterses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumers/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongplugins
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongplugins/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- tcpingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- tcpingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- udpingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- udpingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongclusterplugins
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongclusterplugins/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: chartsnap-kong
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- configmaps
|
||||
- pods
|
||||
- secrets
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resourceNames:
|
||||
- kong-ingress-controller-leader-kong-kong
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- configmaps
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: chartsnap-kong
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
- object:
|
||||
apiVersion: v1
|
||||
data:
|
||||
tls.crt: '###DYNAMIC_FIELD###'
|
||||
tls.key: '###DYNAMIC_FIELD###'
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
- object:
|
||||
apiVersion: v1
|
||||
data:
|
||||
tls.crt: '###DYNAMIC_FIELD###'
|
||||
tls.key: '###DYNAMIC_FIELD###'
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
ports:
|
||||
- name: kong-manager
|
||||
port: 8002
|
||||
protocol: TCP
|
||||
targetPort: 8002
|
||||
- name: kong-manager-tls
|
||||
port: 8445
|
||||
protocol: TCP
|
||||
targetPort: 8445
|
||||
selector:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/name: kong
|
||||
type: NodePort
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
ports:
|
||||
- appProtocol: http
|
||||
name: kong-proxy
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 8000
|
||||
- appProtocol: https
|
||||
name: kong-proxy-tls
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 8443
|
||||
selector:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/name: kong
|
||||
type: LoadBalancer
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
ports:
|
||||
- name: webhook
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: webhook
|
||||
selector:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -613,6 +613,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -652,8 +684,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -671,8 +703,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -735,8 +767,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -758,8 +790,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -774,8 +806,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -787,8 +819,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -814,9 +846,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -842,8 +874,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -857,8 +889,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -867,8 +899,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: my-kong-sa
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -158,7 +158,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -410,8 +410,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -619,6 +619,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -658,8 +690,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -677,8 +709,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -741,8 +773,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -764,8 +796,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -780,8 +812,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -793,8 +825,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -820,9 +852,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -848,8 +880,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -863,8 +895,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -873,8 +905,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -32,9 +32,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -249,8 +249,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -276,9 +276,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -304,8 +304,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -104,10 +104,10 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
environment: test
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -139,7 +139,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -160,7 +160,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -252,7 +252,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -370,7 +370,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -447,8 +447,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -473,8 +473,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -497,8 +497,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -706,6 +706,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -745,8 +777,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -764,8 +796,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -828,8 +860,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -851,8 +883,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -867,8 +899,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -880,8 +912,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -907,9 +939,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -935,8 +967,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -950,8 +982,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -960,8 +992,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -83,8 +83,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -111,9 +111,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -150,7 +150,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -171,7 +171,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -270,7 +270,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -404,7 +404,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -507,7 +507,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-db
|
||||
resources: {}
|
||||
@@ -724,8 +724,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-init-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -740,8 +740,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-init-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -819,7 +819,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-migrations
|
||||
resources: {}
|
||||
@@ -924,7 +924,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -977,8 +977,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-post-upgrade-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -993,8 +993,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-post-upgrade-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -1072,7 +1072,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-post-upgrade-migrations
|
||||
resources: {}
|
||||
@@ -1177,7 +1177,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -1232,8 +1232,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-pre-upgrade-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1248,8 +1248,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-pre-upgrade-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -1327,7 +1327,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-upgrade-migrations
|
||||
resources: {}
|
||||
@@ -1432,7 +1432,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -1481,8 +1481,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1505,10 +1505,26 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -1548,8 +1564,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -1567,8 +1583,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -1631,8 +1647,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-default
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -1841,6 +1857,22 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
@@ -1849,8 +1881,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -1869,8 +1901,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-default
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -1895,8 +1927,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-bash-wait-for-postgres
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -1917,8 +1949,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -1933,8 +1965,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -1961,8 +1993,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1988,9 +2020,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -2024,8 +2056,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -2039,8 +2071,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -2099,8 +2131,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -33,9 +33,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -92,7 +92,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -208,7 +208,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -295,8 +295,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-custom-dbless-config
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -307,8 +307,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -334,9 +334,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -362,8 +362,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -33,9 +33,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -92,7 +92,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:9000, [::]:9000, 0.0.0.0:9001 ssl, [::]:9001 ssl
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -212,7 +212,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: 0.0.0.0:9000, [::]:9000, 0.0.0.0:9001 ssl, [::]:9001 ssl
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -271,8 +271,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -304,8 +304,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-custom-dbless-config
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -316,8 +316,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -343,9 +343,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -379,8 +379,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -110,9 +110,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -142,7 +142,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -163,7 +163,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -261,7 +261,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -388,7 +388,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -477,7 +477,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-db
|
||||
resources: {}
|
||||
@@ -694,8 +694,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-init-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -710,8 +710,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-init-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -788,7 +788,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-migrations
|
||||
resources: {}
|
||||
@@ -879,7 +879,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -932,8 +932,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-post-upgrade-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -948,8 +948,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-post-upgrade-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -1026,7 +1026,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-post-upgrade-migrations
|
||||
resources: {}
|
||||
@@ -1117,7 +1117,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -1172,8 +1172,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-pre-upgrade-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1188,8 +1188,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-pre-upgrade-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -1266,7 +1266,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-upgrade-migrations
|
||||
resources: {}
|
||||
@@ -1357,7 +1357,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -1406,8 +1406,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1430,8 +1430,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -1639,6 +1639,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -1678,8 +1710,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -1697,8 +1729,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -1761,8 +1793,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -1787,8 +1819,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-bash-wait-for-postgres
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -1802,8 +1834,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -1818,8 +1850,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -1846,8 +1878,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1873,9 +1905,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1901,8 +1933,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1916,8 +1948,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -1976,8 +2008,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
# This values test that the `proxy.*.appProtocol` can be set to a custom value.
|
||||
|
||||
proxy:
|
||||
http:
|
||||
appProtocol: "http"
|
||||
tls:
|
||||
appProtocol: "https"
|
||||
File diff suppressed because it is too large
Load Diff
@@ -213,6 +213,9 @@ spec:
|
||||
- name: kong-{{ .serviceName }}
|
||||
port: {{ .http.servicePort }}
|
||||
targetPort: {{ .http.containerPort }}
|
||||
{{- if .http.appProtocol }}
|
||||
appProtocol: {{ .http.appProtocol }}
|
||||
{{- end }}
|
||||
{{- if (and (or (eq .type "LoadBalancer") (eq .type "NodePort")) (not (empty .http.nodePort))) }}
|
||||
nodePort: {{ .http.nodePort }}
|
||||
{{- end }}
|
||||
@@ -223,6 +226,9 @@ spec:
|
||||
- name: kong-{{ .serviceName }}-tls
|
||||
port: {{ .tls.servicePort }}
|
||||
targetPort: {{ .tls.overrideServiceTargetPort | default .tls.containerPort }}
|
||||
{{- if .tls.appProtocol }}
|
||||
appProtocol: {{ .tls.appProtocol }}
|
||||
{{- end }}
|
||||
{{- if (and (or (eq .type "LoadBalancer") (eq .type "NodePort")) (not (empty .tls.nodePort))) }}
|
||||
nodePort: {{ .tls.nodePort }}
|
||||
{{- end }}
|
||||
@@ -890,7 +896,7 @@ The name of the Service which will be used by the controller to update the Ingre
|
||||
containerPort: 10255
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
- name: status
|
||||
- name: cstatus
|
||||
containerPort: 10254
|
||||
protocol: TCP
|
||||
env:
|
||||
|
||||
@@ -34,7 +34,7 @@ spec:
|
||||
http-headers: false
|
||||
request-body: false
|
||||
log-destination:
|
||||
cloud: false
|
||||
cloud: true
|
||||
stdout:
|
||||
format: json-formatted
|
||||
---
|
||||
|
||||
@@ -130,7 +130,7 @@ extraLabels: {}
|
||||
# Specify Kong's Docker image and repository details here
|
||||
image:
|
||||
repository: kong
|
||||
tag: "3.5"
|
||||
tag: "3.6"
|
||||
# Kong Enterprise
|
||||
# repository: kong/kong-gateway
|
||||
# tag: "3.5"
|
||||
@@ -317,6 +317,10 @@ proxy:
|
||||
parameters:
|
||||
- http2
|
||||
|
||||
# Specify the Service's TLS port's appProtocol. This can be useful when integrating with
|
||||
# external load balancers that require the `appProtocol` field to be set (e.g. GCP).
|
||||
appProtocol: ""
|
||||
|
||||
# Define stream (TCP) listen
|
||||
# To enable, remove "[]", uncomment the section below, and select your desired
|
||||
# ports and parameters. Listens are dynamically named after their containerPort,
|
||||
@@ -525,7 +529,7 @@ ingressController:
|
||||
enabled: true
|
||||
image:
|
||||
repository: kong/kubernetes-ingress-controller
|
||||
tag: "3.0"
|
||||
tag: "3.1"
|
||||
# Optionally set a semantic version for version-gated features. This can normally
|
||||
# be left unset. You only need to set this if your tag is not a semver string,
|
||||
# such as when you are using a "next" tag. Set this to the effective semantic
|
||||
@@ -1255,7 +1259,7 @@ appsec:
|
||||
#registry:
|
||||
repository: ghcr.io/openappsec
|
||||
image: "agent"
|
||||
tag: "1.1.6"
|
||||
tag: "1.1.8"
|
||||
pullPolicy: Always
|
||||
|
||||
securityContext:
|
||||
@@ -1269,7 +1273,7 @@ appsec:
|
||||
kong:
|
||||
image:
|
||||
repository: "ghcr.io/openappsec/kong-attachment"
|
||||
tag: "1.1.6"
|
||||
tag: "1.1.8"
|
||||
configMapName: appsec-settings-configmap
|
||||
configMapContent:
|
||||
crowdsec:
|
||||
|
||||
@@ -18,6 +18,10 @@ if [ ! -f /nano-service-installers/$ORCHESTRATION_INSTALLATION_SCRIPT ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z $1 ]; then
|
||||
var_mode="--hybrid_mode"
|
||||
fi
|
||||
|
||||
while true; do
|
||||
if [ -z "$1" ]; then
|
||||
break
|
||||
@@ -27,24 +31,24 @@ while true; do
|
||||
elif [ "$1" == "--proxy" ]; then
|
||||
shift
|
||||
var_proxy="$1"
|
||||
elif [ "$1" == "--hybrid-mode" ]; then
|
||||
elif [ "$1" == "--hybrid-mode" ] || [ "$1" == "--standalone" ]; then
|
||||
var_mode="--hybrid_mode"
|
||||
elif [ "$1" == "--token" ]; then
|
||||
shift
|
||||
var_token="$1"
|
||||
elif [ "$1" == "--standalone" ]; then
|
||||
var_mode="--hybrid_mode"
|
||||
var_token="cp-3fb5c718-5e39-47e6-8d5e-99b4bc5660b74b4b7fc8-5312-451d-a763-aaf7872703c0"
|
||||
fi
|
||||
shift
|
||||
done
|
||||
|
||||
if [ -z $var_token ]; then
|
||||
if [ -z $var_token ] && [ $var_mode != "--hybrid_mode" ]; then
|
||||
echo "Error: Token was not provided as input argument."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
orchestration_service_installation_flags="--token $var_token --container_mode --skip_registration"
|
||||
orchestration_service_installation_flags="--container_mode --skip_registration"
|
||||
if [ ! -z $var_token ]; then
|
||||
orchestration_service_installation_flags="$orchestration_service_installation_flags --token $var_token"
|
||||
fi
|
||||
if [ ! -z $var_fog_address ]; then
|
||||
orchestration_service_installation_flags="$orchestration_service_installation_flags --fog $var_fog_address"
|
||||
fi
|
||||
@@ -67,7 +71,7 @@ fi
|
||||
/nano-service-installers/$CACHE_INSTALLATION_SCRIPT --install
|
||||
/nano-service-installers/$HTTP_TRANSACTION_HANDLER_SERVICE --install
|
||||
|
||||
if [ ! -z $CROWDSEC_ENABLED ]; then
|
||||
if [ "$CROWDSEC_ENABLED" == "true" ]; then
|
||||
/nano-service-installers/$INTELLIGENCE_INSTALLATION_SCRIPT --install
|
||||
/nano-service-installers/$CROWDSEC_INSTALLATION_SCRIPT --install
|
||||
fi
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
add_subdirectory(report_messaging)
|
||||
add_subdirectory(http_manager)
|
||||
add_subdirectory(generic_rulebase)
|
||||
add_subdirectory(signal_handler)
|
||||
add_subdirectory(gradual_deployment)
|
||||
add_subdirectory(packet)
|
||||
|
||||
@@ -34,6 +34,7 @@ public:
|
||||
~DetailsResolver();
|
||||
|
||||
void preload() override;
|
||||
void init() override;
|
||||
|
||||
private:
|
||||
class Impl;
|
||||
|
||||
@@ -21,6 +21,7 @@
|
||||
#include "url_parser.h"
|
||||
#include "i_agent_details.h"
|
||||
#include "i_mainloop.h"
|
||||
#include "i_environment.h"
|
||||
#include "singleton.h"
|
||||
#include "component.h"
|
||||
|
||||
@@ -32,6 +33,7 @@ class Downloader
|
||||
Singleton::Consume<I_Encryptor>,
|
||||
Singleton::Consume<I_MainLoop>,
|
||||
Singleton::Consume<I_OrchestrationTools>,
|
||||
Singleton::Consume<I_Environment>,
|
||||
Singleton::Consume<I_UpdateCommunication>
|
||||
{
|
||||
public:
|
||||
|
||||
@@ -17,6 +17,7 @@
|
||||
#include <vector>
|
||||
|
||||
#include "generic_rulebase/parameters_config.h"
|
||||
#include "generic_rulebase/triggers_config.h"
|
||||
#include "generic_rulebase/zone.h"
|
||||
#include "config.h"
|
||||
|
||||
@@ -26,6 +27,9 @@ public:
|
||||
virtual Maybe<Zone, Config::Errors> getLocalZone() const = 0;
|
||||
virtual Maybe<Zone, Config::Errors> getOtherZone() const = 0;
|
||||
|
||||
virtual LogTriggerConf getLogTriggerConf(const std::string &trigger_Id) const = 0;
|
||||
virtual ParameterException getParameterException(const std::string ¶meter_Id) const = 0;
|
||||
|
||||
using ParameterKeyValues = std::unordered_map<std::string, std::set<std::string>>;
|
||||
virtual std::set<ParameterBehavior> getBehavior(const ParameterKeyValues &key_value_pairs) const = 0;
|
||||
|
||||
|
||||
@@ -117,7 +117,7 @@ public:
|
||||
const std::string &conf_path) const = 0;
|
||||
virtual bool copyFile(const std::string &src_path, const std::string &dst_path) const = 0;
|
||||
virtual bool doesFileExist(const std::string &file_path) const = 0;
|
||||
virtual void getClusterId() const = 0;
|
||||
virtual void setClusterId() const = 0;
|
||||
virtual void fillKeyInJson(
|
||||
const std::string &filename,
|
||||
const std::string &_key,
|
||||
|
||||
@@ -25,6 +25,7 @@ struct DecisionTelemetryData
|
||||
std::string source;
|
||||
TrafficMethod method;
|
||||
int responseCode;
|
||||
uint64_t elapsedTime;
|
||||
std::set<std::string> attackTypes;
|
||||
|
||||
DecisionTelemetryData() :
|
||||
@@ -36,6 +37,7 @@ struct DecisionTelemetryData
|
||||
source(),
|
||||
method(POST),
|
||||
responseCode(0),
|
||||
elapsedTime(0),
|
||||
attackTypes()
|
||||
{
|
||||
}
|
||||
|
||||
@@ -40,7 +40,7 @@ public:
|
||||
~OrchestrationStatus();
|
||||
|
||||
void init() override;
|
||||
|
||||
|
||||
private:
|
||||
class Impl;
|
||||
std::unique_ptr<Impl> pimpl;
|
||||
|
||||
@@ -17,6 +17,7 @@
|
||||
#include "i_package_handler.h"
|
||||
#include "i_orchestration_tools.h"
|
||||
#include "i_shell_cmd.h"
|
||||
#include "i_environment.h"
|
||||
#include "component.h"
|
||||
|
||||
class PackageHandler
|
||||
@@ -24,7 +25,8 @@ class PackageHandler
|
||||
public Component,
|
||||
Singleton::Provide<I_PackageHandler>,
|
||||
Singleton::Consume<I_ShellCmd>,
|
||||
Singleton::Consume<I_OrchestrationTools>
|
||||
Singleton::Consume<I_OrchestrationTools>,
|
||||
Singleton::Consume<I_Environment>
|
||||
{
|
||||
public:
|
||||
PackageHandler();
|
||||
|
||||
@@ -141,9 +141,12 @@ public:
|
||||
|
||||
ReportMessaging & operator<<(const LogField &field);
|
||||
|
||||
void setForceBuffering(bool _force_buffering);
|
||||
|
||||
private:
|
||||
Report report;
|
||||
bool is_async_message;
|
||||
bool force_buffering = false;
|
||||
MessageCategory message_type_tag;
|
||||
};
|
||||
|
||||
|
||||
@@ -91,6 +91,7 @@ private:
|
||||
MetricCalculations::Counter response_2xx{this, "reservedNgenG"};
|
||||
MetricCalculations::Counter response_4xx{this, "reservedNgenH"};
|
||||
MetricCalculations::Counter response_5xx{this, "reservedNgenI"};
|
||||
MetricCalculations::Average<uint64_t> average_latency{this, "reservedNgenJ"};
|
||||
};
|
||||
|
||||
class WaapAttackTypesMetrics : public WaapTelemetryBase
|
||||
|
||||
@@ -35,8 +35,10 @@ public:
|
||||
bool isOverSSL() const { return over_ssl; }
|
||||
std::string getPort() const { return port; }
|
||||
std::string getQuery() const { return query; }
|
||||
std::string getHost() const;
|
||||
URLProtocol getProtocol() const { return protocol; }
|
||||
std::string toString() const;
|
||||
void setHost(const std::string &new_host);
|
||||
void setQuery(const std::string &new_query);
|
||||
|
||||
private:
|
||||
@@ -47,6 +49,7 @@ private:
|
||||
std::string base_url;
|
||||
std::string port;
|
||||
std::string query;
|
||||
std::string host;
|
||||
URLProtocol protocol;
|
||||
};
|
||||
|
||||
|
||||
@@ -33,7 +33,9 @@ ReportMessaging::~ReportMessaging()
|
||||
HTTPMethod::POST,
|
||||
url,
|
||||
log_rest,
|
||||
message_type_tag
|
||||
message_type_tag,
|
||||
MessageMetadata(),
|
||||
force_buffering
|
||||
);
|
||||
} catch (...) {}
|
||||
}
|
||||
@@ -44,3 +46,9 @@ ReportMessaging::operator<<(const LogField &field)
|
||||
report << field;
|
||||
return *this;
|
||||
}
|
||||
|
||||
void
|
||||
ReportMessaging::setForceBuffering(bool _force_buffering)
|
||||
{
|
||||
force_buffering = _force_buffering;
|
||||
}
|
||||
|
||||
@@ -99,12 +99,55 @@ TEST_F(ReportMessagingTest, title_only)
|
||||
" }\n"
|
||||
"}",
|
||||
_,
|
||||
_,
|
||||
_
|
||||
)
|
||||
).Times(1);
|
||||
ReportMessaging("test", ReportIS::AudienceTeam::AGENT_CORE, 1, true, ReportIS::Tags::ACCESS_CONTROL);
|
||||
}
|
||||
|
||||
TEST_F(ReportMessagingTest, with_buffering)
|
||||
{
|
||||
EXPECT_CALL(
|
||||
mock_messaging,
|
||||
sendAsyncMessage(
|
||||
_,
|
||||
_,
|
||||
"{\n"
|
||||
" \"log\": {\n"
|
||||
" \"eventTime\": \"Best Time ever\",\n"
|
||||
" \"eventName\": \"test\",\n"
|
||||
" \"eventSeverity\": \"Info\",\n"
|
||||
" \"eventPriority\": \"Low\",\n"
|
||||
" \"eventType\": \"Event Driven\",\n"
|
||||
" \"eventLevel\": \"Log\",\n"
|
||||
" \"eventLogLevel\": \"info\",\n"
|
||||
" \"eventAudience\": \"Internal\",\n"
|
||||
" \"eventAudienceTeam\": \"Agent Core\",\n"
|
||||
" \"eventFrequency\": 0,\n"
|
||||
" \"eventTags\": [\n"
|
||||
" \"Access Control\"\n"
|
||||
" ],\n"
|
||||
" \"eventSource\": {\n"
|
||||
" \"eventTraceId\": \"\",\n"
|
||||
" \"eventSpanId\": \"\",\n"
|
||||
" \"issuingEngineVersion\": \"\",\n"
|
||||
" \"serviceName\": \"Unnamed Nano Service\"\n"
|
||||
" },\n"
|
||||
" \"eventData\": {\n"
|
||||
" \"eventObject\": 1\n"
|
||||
" }\n"
|
||||
" }\n"
|
||||
"}",
|
||||
_,
|
||||
_,
|
||||
true
|
||||
)
|
||||
).Times(1);
|
||||
ReportMessaging report("test", ReportIS::AudienceTeam::AGENT_CORE, 1, true, ReportIS::Tags::ACCESS_CONTROL);
|
||||
report.setForceBuffering(true);
|
||||
}
|
||||
|
||||
TEST_F(ReportMessagingTest, with_dynamic_fields)
|
||||
{
|
||||
EXPECT_CALL(
|
||||
@@ -140,6 +183,7 @@ TEST_F(ReportMessagingTest, with_dynamic_fields)
|
||||
" }\n"
|
||||
"}",
|
||||
_,
|
||||
_,
|
||||
_
|
||||
)
|
||||
).Times(1);
|
||||
@@ -189,6 +233,7 @@ TEST_F(ReportMessagingTest, custom_event_object)
|
||||
" }\n"
|
||||
"}",
|
||||
_,
|
||||
_,
|
||||
_
|
||||
)
|
||||
).Times(1);
|
||||
@@ -243,6 +288,7 @@ TEST_F(ReportMessagingTest, custom_priority)
|
||||
" }\n"
|
||||
"}",
|
||||
_,
|
||||
_,
|
||||
_
|
||||
)
|
||||
).Times(1);
|
||||
@@ -309,6 +355,7 @@ TEST_F(ReportMessagingTest, with_env_details)
|
||||
" }\n"
|
||||
"}",
|
||||
_,
|
||||
_,
|
||||
_
|
||||
)
|
||||
).Times(1);
|
||||
|
||||
@@ -50,9 +50,13 @@ public:
|
||||
|
||||
private:
|
||||
void readRules(cereal::JSONInputArchive &ar);
|
||||
void readTriggerId(cereal::JSONInputArchive &ar);
|
||||
void readExceptionId(cereal::JSONInputArchive &ar);
|
||||
void readDefaultAction(cereal::JSONInputArchive &ar);
|
||||
|
||||
std::vector<Rule> rules;
|
||||
std::string trigger_id;
|
||||
std::string exception_id;
|
||||
};
|
||||
|
||||
#endif // __IPS_BASIC_POLICY_H__
|
||||
|
||||
@@ -27,6 +27,7 @@
|
||||
#include "log_generator.h"
|
||||
#include "parsed_context.h"
|
||||
#include "pm_hook.h"
|
||||
#include "i_generic_rulebase.h"
|
||||
|
||||
/// \namespace IPSSignatureSubTypes
|
||||
/// \brief Namespace containing subtypes for IPS signatures.
|
||||
@@ -348,8 +349,16 @@ public:
|
||||
/// \brief Construct a SignatureAndAction object.
|
||||
/// \param _signature The complete signature.
|
||||
/// \param _action The signature action.
|
||||
SignatureAndAction(std::shared_ptr<CompleteSignature> _signature, SignatureAction _action) :
|
||||
signature(_signature), action(_action)
|
||||
SignatureAndAction(
|
||||
std::shared_ptr<CompleteSignature> _signature,
|
||||
SignatureAction _action,
|
||||
std::string _trigger_id,
|
||||
std::string _exception_id)
|
||||
:
|
||||
signature(_signature),
|
||||
action(_action),
|
||||
trigger_id(_trigger_id),
|
||||
exception_id(_exception_id)
|
||||
{}
|
||||
|
||||
/// \brief Check if the signature is matched for prevention.
|
||||
@@ -375,6 +384,11 @@ public:
|
||||
return signature->getContext();
|
||||
}
|
||||
|
||||
LogTriggerConf getTrigger() const;
|
||||
|
||||
std::set<ParameterBehavior>
|
||||
getBehavior(const std::unordered_map<std::string, std::set<std::string>> &exceptions_dict) const;
|
||||
|
||||
private:
|
||||
/// \brief Get the action results for the IPS state.
|
||||
/// \param ips_state The IPS entry.
|
||||
@@ -382,6 +396,8 @@ private:
|
||||
|
||||
std::shared_ptr<CompleteSignature> signature;
|
||||
SignatureAction action;
|
||||
std::string trigger_id;
|
||||
std::string exception_id;
|
||||
};
|
||||
} // namespace IPSSignatureSubTypes
|
||||
|
||||
|
||||
@@ -17,6 +17,8 @@ public:
|
||||
private:
|
||||
IPSSignatureSubTypes::SignatureAction action = IPSSignatureSubTypes::SignatureAction::IGNORE;
|
||||
std::vector<std::string> file_names;
|
||||
std::string trigger_id;
|
||||
std::string exception_id;
|
||||
};
|
||||
|
||||
#endif // __SNORT_BASIC_POLICY_H__
|
||||
|
||||
@@ -17,6 +17,8 @@ void
|
||||
RuleSelector::load(cereal::JSONInputArchive &ar)
|
||||
{
|
||||
readRules(ar);
|
||||
readTriggerId(ar);
|
||||
readExceptionId(ar);
|
||||
readDefaultAction(ar);
|
||||
}
|
||||
|
||||
@@ -36,7 +38,7 @@ RuleSelector::selectSignatures() const
|
||||
if (rule.isSignaturedMatched(*signature)) {
|
||||
if (rule.getAction() != IPSSignatureSubTypes::SignatureAction::IGNORE) {
|
||||
signature->setIndicators("Check Point", signatures_version);
|
||||
res.emplace_back(signature, rule.getAction());
|
||||
res.emplace_back(signature, rule.getAction(), trigger_id, exception_id);
|
||||
}
|
||||
break;
|
||||
}
|
||||
@@ -52,6 +54,28 @@ RuleSelector::readRules(cereal::JSONInputArchive &ar)
|
||||
ar(cereal::make_nvp("rules", rules));
|
||||
}
|
||||
|
||||
void
|
||||
RuleSelector::readTriggerId(cereal::JSONInputArchive &ar)
|
||||
{
|
||||
try {
|
||||
ar(cereal::make_nvp("triggers", trigger_id));
|
||||
} catch (const cereal::Exception &e) {
|
||||
ar.setNextName(nullptr);
|
||||
trigger_id = "";
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
RuleSelector::readExceptionId(cereal::JSONInputArchive &ar)
|
||||
{
|
||||
try {
|
||||
ar(cereal::make_nvp("exceptions", exception_id));
|
||||
} catch (const cereal::Exception &e) {
|
||||
ar.setNextName(nullptr);
|
||||
exception_id = "";
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
RuleSelector::readDefaultAction(cereal::JSONInputArchive &ar)
|
||||
{
|
||||
|
||||
@@ -280,8 +280,7 @@ SignatureAndAction::getAction(const IPSEntry &ips_state) const
|
||||
exceptions_dict["sourceIdentifier"].insert(*env_source_identifier);
|
||||
}
|
||||
|
||||
I_GenericRulebase *i_rulebase = Singleton::Consume<I_GenericRulebase>::by<IPSComp>();
|
||||
auto behaviors = i_rulebase->getBehavior(exceptions_dict);
|
||||
auto behaviors = getBehavior(exceptions_dict);
|
||||
|
||||
set<BehaviorValue> override_actions;
|
||||
vector<string> override_ids;
|
||||
@@ -315,6 +314,23 @@ static const auto url_query = LogTriggerConf::WebLogFields::webUrlQuery;
|
||||
static const auto res_body = LogTriggerConf::WebLogFields::responseBody;
|
||||
static const auto res_code = LogTriggerConf::WebLogFields::responseCode;
|
||||
|
||||
LogTriggerConf
|
||||
SignatureAndAction::getTrigger() const
|
||||
{
|
||||
if (trigger_id.empty()) return getConfigurationWithDefault(LogTriggerConf(), "rulebase", "log");
|
||||
|
||||
return Singleton::Consume<I_GenericRulebase>::by<IPSComp>()->getLogTriggerConf(trigger_id);
|
||||
}
|
||||
|
||||
set<ParameterBehavior>
|
||||
SignatureAndAction::getBehavior(const unordered_map<string, set<string>> &exceptions_dict) const
|
||||
{
|
||||
I_GenericRulebase *i_rulebase = Singleton::Consume<I_GenericRulebase>::by<IPSComp>();
|
||||
if (exception_id.empty()) return i_rulebase->getBehavior(exceptions_dict);
|
||||
|
||||
return i_rulebase->getParameterException(exception_id).getBehavior(exceptions_dict);
|
||||
}
|
||||
|
||||
bool
|
||||
SignatureAndAction::matchSilent(const Buffer &sample) const
|
||||
{
|
||||
@@ -398,7 +414,7 @@ SignatureAndAction::isMatchedPrevent(const Buffer &context_buffer, const set<PMP
|
||||
|
||||
dbgDebug(D_IPS) << "Signature matched - sending log";
|
||||
|
||||
auto &trigger = getConfigurationWithDefault(default_triger, "rulebase", "log");
|
||||
auto trigger = getTrigger();
|
||||
bool is_prevent = get<0>(override_action) == IPSSignatureSubTypes::SignatureAction::PREVENT;
|
||||
|
||||
auto severity = signature->getSeverity() < IPSLevel::HIGH ? Severity::HIGH : Severity::CRITICAL;
|
||||
|
||||
@@ -596,6 +596,8 @@ TEST_F(ComponentTest, check_filtering_by_year)
|
||||
|
||||
TEST_F(ComponentTest, log_fields)
|
||||
{
|
||||
generic_rulebase.preload();
|
||||
generic_rulebase.init();
|
||||
string config =
|
||||
"{"
|
||||
"\"IPS\": {"
|
||||
@@ -632,6 +634,8 @@ TEST_F(ComponentTest, log_fields)
|
||||
"\"assetId\": \"1-1-1\","
|
||||
"\"practiceId\": \"2-2-2\","
|
||||
"\"practiceName\": \"practice1\","
|
||||
"\"triggers\": \"5eaeefde6765c30010bae8b6\","
|
||||
"\"exceptions\": \"\","
|
||||
"\"defaultAction\": \"Detect\","
|
||||
"\"rules\": ["
|
||||
"{"
|
||||
@@ -643,10 +647,36 @@ TEST_F(ComponentTest, log_fields)
|
||||
"]"
|
||||
"}"
|
||||
"]"
|
||||
"},"
|
||||
"\"rulebase\": {"
|
||||
"\"log\": ["
|
||||
"{"
|
||||
"\"context\": \"triggerId(5eaeefde6765c30010bae8b6)\","
|
||||
"\"triggerName\": \"Logging Trigger\","
|
||||
"\"triggerType\": \"log\","
|
||||
"\"urlForSyslog\": \"\","
|
||||
"\"urlForCef\": \"128.1.1.1:333\","
|
||||
"\"acAllow\": false,"
|
||||
"\"acDrop\": true,"
|
||||
"\"complianceViolations\": true,"
|
||||
"\"complianceWarnings\": true,"
|
||||
"\"logToAgent\": true,"
|
||||
"\"logToCloud\": true,"
|
||||
"\"logToSyslog\": false,"
|
||||
"\"logToCef\": true,"
|
||||
"\"tpDetect\": true,"
|
||||
"\"tpPrevent\": true,"
|
||||
"\"verbosity\": \"Standard\","
|
||||
"\"webBody\": true,"
|
||||
"\"webHeaders\": true,"
|
||||
"\"webRequests\": true,"
|
||||
"\"webUrlPath\": true,"
|
||||
"\"webUrlQuery\": true"
|
||||
"}"
|
||||
"]"
|
||||
"}"
|
||||
"}";
|
||||
loadPolicy(config);
|
||||
setTrigger();
|
||||
|
||||
EXPECT_CALL(table, createStateRValueRemoved(_, _));
|
||||
EXPECT_CALL(table, getState(_)).WillRepeatedly(Return(&entry));
|
||||
@@ -829,6 +859,8 @@ TEST_F(ComponentTest, prxeem_exception_bug)
|
||||
" \"practiceId\": \"2-2-2\","
|
||||
" \"practiceName\": \"practice1\","
|
||||
" \"defaultAction\": \"Prevent\","
|
||||
" \"triggers\": \"\","
|
||||
" \"exceptions\": \"6c3867be-4da5-42c2-93dc-8f509a764004\","
|
||||
" \"rules\": []"
|
||||
" }"
|
||||
" ]"
|
||||
@@ -847,6 +879,11 @@ TEST_F(ComponentTest, prxeem_exception_bug)
|
||||
" \"parameterId\": \"6c3867be-4da5-42c2-93dc-8f509a764003\","
|
||||
" \"parameterType\": \"exceptions\","
|
||||
" \"parameterName\": \"exception\""
|
||||
" },"
|
||||
" {"
|
||||
" \"parameterId\": \"6c3867be-4da5-42c2-93dc-8f509a764004\","
|
||||
" \"parameterType\": \"exceptions\","
|
||||
" \"parameterName\": \"exception\""
|
||||
" }"
|
||||
" ],"
|
||||
" \"zoneId\": \"\","
|
||||
@@ -855,7 +892,7 @@ TEST_F(ComponentTest, prxeem_exception_bug)
|
||||
" ],"
|
||||
" \"exception\": ["
|
||||
" {"
|
||||
" \"context\": \"parameterId(6c3867be-4da5-42c2-93dc-8f509a764003)\","
|
||||
" \"context\": \"parameterId(6c3867be-4da5-42c2-93dc-8f509a764004)\","
|
||||
" \"match\": {"
|
||||
" \"type\": \"operator\","
|
||||
" \"op\": \"and\","
|
||||
|
||||
@@ -16,6 +16,19 @@ using namespace std;
|
||||
void
|
||||
SnortRuleSelector::load(cereal::JSONInputArchive &ar)
|
||||
{
|
||||
try {
|
||||
ar(cereal::make_nvp("triggers", trigger_id));
|
||||
} catch (const cereal::Exception &e) {
|
||||
ar.setNextName(nullptr);
|
||||
trigger_id = "";
|
||||
}
|
||||
|
||||
try {
|
||||
ar(cereal::make_nvp("exceptions", exception_id));
|
||||
} catch (const cereal::Exception &e) {
|
||||
ar.setNextName(nullptr);
|
||||
exception_id = "";
|
||||
}
|
||||
string mode;
|
||||
ar(cereal::make_nvp("mode", mode), cereal::make_nvp("files", file_names));
|
||||
|
||||
@@ -38,7 +51,7 @@ SnortRuleSelector::selectSignatures() const
|
||||
|
||||
for (auto &file : file_names) {
|
||||
for (auto &signature : (*signatures).getSignatures(file)) {
|
||||
res.emplace_back(signature, action);
|
||||
res.emplace_back(signature, action, trigger_id, exception_id);
|
||||
}
|
||||
}
|
||||
return res;
|
||||
|
||||
@@ -37,6 +37,7 @@ public:
|
||||
if (!ipv4_addresses.empty()) ipv4_address = ipv4_addresses.front();
|
||||
} catch (const cereal::Exception &e) {
|
||||
dbgWarning(D_L7_ACCESS_CONTROL) << "Failed to load IP reputation data JSON. Error: " << e.what();
|
||||
ar.setNextName(nullptr);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -12,20 +12,34 @@
|
||||
// limitations under the License.
|
||||
|
||||
#include "access_control_practice.h"
|
||||
#include "new_practice.h"
|
||||
|
||||
using namespace std;
|
||||
|
||||
USE_DEBUG_FLAG(D_LOCAL_POLICY);
|
||||
// LCOV_EXCL_START Reason: no test exist
|
||||
|
||||
static const map<string, string> valid_modes_to_key = {
|
||||
static const set<string> valid_modes = {
|
||||
"prevent",
|
||||
"detect",
|
||||
"inactive",
|
||||
"prevent-learn",
|
||||
"detect-learn",
|
||||
"as-top-level",
|
||||
"inherited"
|
||||
};
|
||||
|
||||
static const unordered_map<string, string> valid_modes_to_key = {
|
||||
{"prevent", "Active"},
|
||||
{"prevent-learn", "Active"},
|
||||
{"detect", "Detect"},
|
||||
{"detect-learn", "Detect"},
|
||||
{"inactive", "Inactive"}
|
||||
};
|
||||
|
||||
static const set<string> valid_units = {"minute", "second"};
|
||||
|
||||
static const std::unordered_map<std::string, std::string> key_to_units_val = {
|
||||
static const unordered_map<std::string, std::string> key_to_units_val = {
|
||||
{ "second", "Second"},
|
||||
{ "minute", "Minute"}
|
||||
};
|
||||
@@ -177,13 +191,10 @@ void
|
||||
AccessControlRateLimit::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading Access control rate limit";
|
||||
string in_mode;
|
||||
parseAppsecJSONKey<string>("overrideMode", in_mode, archive_in, "detect");
|
||||
if (valid_modes_to_key.find(in_mode) == valid_modes_to_key.end()) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec access control rate limit override mode invalid: " << in_mode;
|
||||
throw PolicyGenException("AppSec access control rate limit override mode invalid: " + in_mode);
|
||||
} else {
|
||||
mode = valid_modes_to_key.at(in_mode);
|
||||
parseMandatoryAppsecJSONKey<string>("overrideMode", mode, archive_in, "inactive");
|
||||
if (valid_modes.find(mode) == valid_modes.end()) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec access control rate limit override mode invalid: " << mode;
|
||||
throw PolicyGenException("AppSec access control rate limit override mode invalid: " + mode);
|
||||
}
|
||||
parseAppsecJSONKey<std::vector<AccessControlRateLimiteRules>>("rules", rules, archive_in);
|
||||
}
|
||||
@@ -205,9 +216,10 @@ AccessControlRateLimit::getRules() const
|
||||
}
|
||||
|
||||
const string &
|
||||
AccessControlRateLimit::getMode() const
|
||||
AccessControlRateLimit::getMode(const std::string &default_mode) const
|
||||
{
|
||||
return mode;
|
||||
const string &res = getModeWithDefault(mode, default_mode, valid_modes_to_key);
|
||||
return res;
|
||||
}
|
||||
|
||||
void
|
||||
@@ -216,6 +228,7 @@ AccessControlPracticeSpec::load(cereal::JSONInputArchive &archive_in)
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec practice spec";
|
||||
|
||||
parseAppsecJSONKey<string>("name", practice_name, archive_in);
|
||||
parseAppsecJSONKey<string>("practiceMode", mode, archive_in);
|
||||
parseAppsecJSONKey<string>("appsecClassName", appsec_class_name, archive_in);
|
||||
parseMandatoryAppsecJSONKey<AccessControlRateLimit>("rateLimit", rate_limit, archive_in);
|
||||
}
|
||||
@@ -227,7 +240,7 @@ AccessControlPracticeSpec::setName(const string &_name)
|
||||
}
|
||||
|
||||
const AccessControlRateLimit &
|
||||
AccessControlPracticeSpec::geRateLimit() const
|
||||
AccessControlPracticeSpec::getRateLimit() const
|
||||
{
|
||||
return rate_limit;
|
||||
}
|
||||
@@ -243,4 +256,10 @@ AccessControlPracticeSpec::getName() const
|
||||
{
|
||||
return practice_name;
|
||||
}
|
||||
|
||||
const string &
|
||||
AccessControlPracticeSpec::getMode(const std::string &default_mode) const
|
||||
{
|
||||
return isModeInherited(mode) ? default_mode : mode;
|
||||
}
|
||||
// LCOV_EXCL_STOP
|
||||
|
||||
@@ -133,7 +133,7 @@ AppSecPracticeWebAttacks::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec practice spec";
|
||||
parseAppsecJSONKey<AppSecWebAttackProtections>("protections", protections, archive_in);
|
||||
parseAppsecJSONKey<string>("override-mode", mode, archive_in, "Unset");
|
||||
parseAppsecJSONKey<string>("override-mode", mode, archive_in, "as-top-level");
|
||||
if (valid_modes.count(mode) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec practice override mode invalid: " << mode;
|
||||
}
|
||||
@@ -187,7 +187,7 @@ AppSecPracticeWebAttacks::getMinimumConfidence() const
|
||||
const string &
|
||||
AppSecPracticeWebAttacks::getMode(const string &default_mode) const
|
||||
{
|
||||
if (mode == "Unset" || (key_to_practices_val2.find(mode) == key_to_practices_val2.end())) {
|
||||
if (isModeInherited(mode) || (key_to_practices_val2.find(mode) == key_to_practices_val2.end())) {
|
||||
dbgError(D_LOCAL_POLICY) << "Couldn't find a value for key: " << mode << ". Returning " << default_mode;
|
||||
return default_mode;
|
||||
}
|
||||
@@ -429,6 +429,9 @@ WebAppSection::WebAppSection(
|
||||
context(_context),
|
||||
web_attack_mitigation_severity(parsed_appsec_spec.getWebAttacks().getMinimumConfidence()),
|
||||
web_attack_mitigation_mode(parsed_appsec_spec.getWebAttacks().getMode(default_mode)),
|
||||
csrf_protection_mode("Disabled"),
|
||||
open_redirect_mode("Disabled"),
|
||||
error_disclosure_mode("Disabled"),
|
||||
practice_advanced_config(parsed_appsec_spec),
|
||||
anti_bots(parsed_appsec_spec.getAntiBot()),
|
||||
trusted_sources({ parsed_trusted_sources })
|
||||
@@ -451,6 +454,7 @@ WebAppSection::WebAppSection(
|
||||
}
|
||||
}
|
||||
|
||||
// Used for V1Beta2
|
||||
WebAppSection::WebAppSection(
|
||||
const string &_application_urls,
|
||||
const string &_asset_id,
|
||||
@@ -465,7 +469,8 @@ WebAppSection::WebAppSection(
|
||||
const PracticeAdvancedConfig &_practice_advanced_config,
|
||||
const AppsecPracticeAntiBotSection &_anti_bots,
|
||||
const LogTriggerSection &parsed_log_trigger,
|
||||
const AppSecTrustedSources &parsed_trusted_sources)
|
||||
const AppSecTrustedSources &parsed_trusted_sources,
|
||||
const NewAppSecWebAttackProtections &protections)
|
||||
:
|
||||
application_urls(_application_urls),
|
||||
asset_id(_asset_id),
|
||||
@@ -489,6 +494,10 @@ WebAppSection::WebAppSection(
|
||||
web_attack_mitigation_severity == "medium" ? "high" :
|
||||
"Error";
|
||||
|
||||
csrf_protection_mode = protections.getCsrfProtectionMode(_web_attack_mitigation_mode);
|
||||
open_redirect_mode = protections.getOpenRedirectMode(_web_attack_mitigation_mode);
|
||||
error_disclosure_mode = protections.getErrorDisclosureMode(_web_attack_mitigation_mode);
|
||||
|
||||
triggers.push_back(TriggersInWaapSection(parsed_log_trigger));
|
||||
for (const SourcesIdentifiers &source_ident : parsed_trusted_sources.getSourcesIdentifiers()) {
|
||||
overrides.push_back(AppSecOverride(source_ident));
|
||||
@@ -510,9 +519,9 @@ WebAppSection::save(cereal::JSONOutputArchive &out_ar) const
|
||||
cereal::make_nvp("webAttackMitigationAction", web_attack_mitigation_action),
|
||||
cereal::make_nvp("webAttackMitigationMode", web_attack_mitigation_mode),
|
||||
cereal::make_nvp("practiceAdvancedConfig", practice_advanced_config),
|
||||
cereal::make_nvp("csrfProtection", disabled_str),
|
||||
cereal::make_nvp("openRedirect", disabled_str),
|
||||
cereal::make_nvp("errorDisclosure", disabled_str),
|
||||
cereal::make_nvp("csrfProtection", csrf_protection_mode),
|
||||
cereal::make_nvp("openRedirect", open_redirect_mode),
|
||||
cereal::make_nvp("errorDisclosure", error_disclosure_mode),
|
||||
cereal::make_nvp("practiceId", practice_id),
|
||||
cereal::make_nvp("practiceName", practice_name),
|
||||
cereal::make_nvp("assetId", asset_id),
|
||||
|
||||
@@ -165,7 +165,7 @@ public:
|
||||
void load(cereal::JSONInputArchive &archive_in);
|
||||
|
||||
const std::vector<AccessControlRateLimiteRules> & getRules() const;
|
||||
const std::string & getMode() const;
|
||||
const std::string & getMode(const std::string &default_mode = "inactive") const;
|
||||
std::vector<RateLimitRulesSection> createRateLimitRulesSection(const RateLimitRulesTriggerSection &trigger) const;
|
||||
|
||||
private:
|
||||
@@ -178,15 +178,17 @@ class AccessControlPracticeSpec
|
||||
public:
|
||||
void load(cereal::JSONInputArchive &archive_in);
|
||||
|
||||
const AccessControlRateLimit & geRateLimit() const;
|
||||
const AccessControlRateLimit &getRateLimit() const;
|
||||
const std::string & getAppSecClassName() const;
|
||||
const std::string & getName() const;
|
||||
const std::string & getMode(const std::string &default_mode = "inactive") const;
|
||||
void setName(const std::string &_name);
|
||||
|
||||
private:
|
||||
AccessControlRateLimit rate_limit;
|
||||
std::string appsec_class_name;
|
||||
std::string practice_name;
|
||||
std::string mode;
|
||||
};
|
||||
|
||||
#endif // __ACCESS_CONTROL_PRACTICE_H__
|
||||
|
||||
@@ -278,6 +278,7 @@ public:
|
||||
const std::vector<InnerException> &parsed_exceptions
|
||||
);
|
||||
|
||||
// used for V1beta2
|
||||
WebAppSection(
|
||||
const std::string &_application_urls,
|
||||
const std::string &_asset_id,
|
||||
@@ -292,7 +293,8 @@ public:
|
||||
const PracticeAdvancedConfig &_practice_advanced_config,
|
||||
const AppsecPracticeAntiBotSection &_anti_bots,
|
||||
const LogTriggerSection &parsed_log_trigger,
|
||||
const AppSecTrustedSources &parsed_trusted_sources);
|
||||
const AppSecTrustedSources &parsed_trusted_sources,
|
||||
const NewAppSecWebAttackProtections &protections);
|
||||
|
||||
void save(cereal::JSONOutputArchive &out_ar) const;
|
||||
|
||||
@@ -310,6 +312,9 @@ private:
|
||||
std::string web_attack_mitigation_action;
|
||||
std::string web_attack_mitigation_severity;
|
||||
std::string web_attack_mitigation_mode;
|
||||
std::string csrf_protection_mode;
|
||||
std::string open_redirect_mode;
|
||||
std::string error_disclosure_mode;
|
||||
bool web_attack_mitigation;
|
||||
std::vector<TriggersInWaapSection> triggers;
|
||||
PracticeAdvancedConfig practice_advanced_config;
|
||||
|
||||
@@ -97,8 +97,7 @@ parseAppsecJSONKey(
|
||||
value = default_value;
|
||||
if (!mandatory) {
|
||||
dbgDebug(D_LOCAL_POLICY)
|
||||
<< "Could not parse the required key. Key: \""<< key_name
|
||||
<< "\", Error: " << e.what();
|
||||
<< "Could not parse a non-mandatory key: \""<< key_name << "\", Error: " << e.what();
|
||||
} else {
|
||||
throw PolicyGenException(
|
||||
"Could not parse a mandatory key: \"" + key_name + "\", Error: " + std::string(e.what())
|
||||
|
||||
@@ -24,6 +24,14 @@
|
||||
#include "debug.h"
|
||||
#include "local_policy_common.h"
|
||||
|
||||
bool isModeInherited(const std::string &mode);
|
||||
|
||||
const std::string &getModeWithDefault(
|
||||
const std::string &mode,
|
||||
const std::string &default_mode,
|
||||
const std::unordered_map<std::string, std::string> &key_to_val
|
||||
);
|
||||
|
||||
class IpsProtectionsRulesSection
|
||||
{
|
||||
public:
|
||||
@@ -126,8 +134,8 @@ class NewIntrusionPrevention
|
||||
public:
|
||||
void load(cereal::JSONInputArchive &archive_in);
|
||||
|
||||
std::vector<IpsProtectionsRulesSection> createIpsRules() const;
|
||||
const std::string & getMode() const;
|
||||
std::vector<IpsProtectionsRulesSection> createIpsRules(const std::string &default_mode) const;
|
||||
const std::string & getMode(const std::string &default_mode = "inactive") const;
|
||||
|
||||
private:
|
||||
std::string override_mode;
|
||||
@@ -273,7 +281,8 @@ public:
|
||||
const std::string &asset_name,
|
||||
const std::string &asset_id,
|
||||
const std::string &practice_name,
|
||||
const std::string &practice_id
|
||||
const std::string &practice_id,
|
||||
const std::string &default_mode
|
||||
) const;
|
||||
|
||||
private:
|
||||
@@ -486,7 +495,7 @@ public:
|
||||
void load(cereal::JSONInputArchive &archive_in);
|
||||
|
||||
void addFile(const std::string &file_name);
|
||||
const std::string & getOverrideMode() const;
|
||||
const std::string & getOverrideMode(const std::string &default_mode = "inactive") const;
|
||||
const std::vector<std::string> & getConfigMap() const;
|
||||
const std::vector<std::string> & getFiles() const;
|
||||
bool isTemporary() const;
|
||||
@@ -530,10 +539,10 @@ class NewAppSecWebAttackProtections
|
||||
public:
|
||||
void load(cereal::JSONInputArchive &archive_in);
|
||||
|
||||
const std::string getCsrfProtectionMode() const;
|
||||
const std::string & getErrorDisclosureMode() const;
|
||||
const std::string & getCsrfProtectionMode(const std::string &default_mode = "inactive") const;
|
||||
const std::string & getErrorDisclosureMode(const std::string &default_mode = "inactive") const;
|
||||
const std::string & getOpenRedirectMode(const std::string &default_mode = "inactive") const;
|
||||
bool getNonValidHttpMethods() const;
|
||||
const std::string getOpenRedirectMode() const;
|
||||
|
||||
private:
|
||||
std::string csrf_protection;
|
||||
@@ -551,9 +560,9 @@ public:
|
||||
int getMaxHeaderSizeBytes() const;
|
||||
int getMaxObjectDepth() const;
|
||||
int getMaxUrlSizeBytes() const;
|
||||
const std::string & getMinimumConfidence() const;
|
||||
const NewAppSecWebAttackProtections & getprotections() const;
|
||||
const std::string & getMode(const std::string &default_mode = "Inactive") const;
|
||||
const std::string & getMinimumConfidence(const std::string &default_mode = "inactive") const;
|
||||
const NewAppSecWebAttackProtections & getProtections() const;
|
||||
const std::string & getMode(const std::string &default_mode = "inactive") const;
|
||||
|
||||
private:
|
||||
int max_body_size_kb;
|
||||
@@ -578,6 +587,7 @@ public:
|
||||
const NewFileSecurity & getFileSecurity() const;
|
||||
const std::string & getAppSecClassName() const;
|
||||
const std::string & getName() const;
|
||||
const std::string & getMode(const std::string &default_mode = "inactive") const;
|
||||
void setName(const std::string &_name);
|
||||
|
||||
private:
|
||||
@@ -589,6 +599,7 @@ private:
|
||||
NewAppSecPracticeAntiBot anti_bot;
|
||||
std::string appsec_class_name;
|
||||
std::string practice_name;
|
||||
std::string mode;
|
||||
};
|
||||
|
||||
#endif // __NEW_PRACTICE_H__
|
||||
|
||||
@@ -158,7 +158,8 @@ private:
|
||||
const std::string &source_identifier,
|
||||
const std::string & context,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
std::map<AnnotationTypes, std::string> &rule_annotations
|
||||
std::map<AnnotationTypes, std::string> &rule_annotations,
|
||||
const std::string &default_mode
|
||||
);
|
||||
|
||||
void createSnortProtecionsSection(const std::string &file_name, bool is_temporary);
|
||||
@@ -172,7 +173,8 @@ private:
|
||||
const std::string &practice_id,
|
||||
const std::string &source_identifier,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
std::map<AnnotationTypes, std::string> &rule_annotations
|
||||
std::map<AnnotationTypes, std::string> &rule_annotations,
|
||||
const std::string &default_mode
|
||||
);
|
||||
|
||||
void
|
||||
@@ -183,7 +185,8 @@ private:
|
||||
const std::string &practice_name,
|
||||
const std::string & context,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
std::map<AnnotationTypes, std::string> &rule_annotations
|
||||
std::map<AnnotationTypes, std::string> &rule_annotations,
|
||||
const std::string &default_mode
|
||||
);
|
||||
|
||||
void
|
||||
@@ -192,6 +195,7 @@ private:
|
||||
const std::string &url,
|
||||
const std::string &uri,
|
||||
const std::string &trigger_id,
|
||||
const std::string &default_mode,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
std::map<AnnotationTypes, std::string> &rule_annotations
|
||||
);
|
||||
|
||||
@@ -414,7 +414,7 @@ K8sPolicyUtils::createAppsecPolicyK8sFromV1beta2Crds(
|
||||
|
||||
vector<AccessControlPracticeSpec> access_control_practices =
|
||||
extractV1Beta2ElementsFromCluster<AccessControlPracticeSpec>(
|
||||
"accesscontrolpractice",
|
||||
"accesscontrolpractices",
|
||||
policy_elements_names[AnnotationTypes::ACCESS_CONTROL_PRACTICE]
|
||||
);
|
||||
|
||||
@@ -489,6 +489,8 @@ K8sPolicyUtils::createAppsecPolicyK8s(const string &policy_name, const string &i
|
||||
!doesVersionExist(maybe_appsec_policy_spec.unpack().getMetaData().getAnnotations(), "v1beta1")
|
||||
) {
|
||||
try {
|
||||
std::string v1beta1_error =
|
||||
maybe_appsec_policy_spec.ok() ? "There is no v1beta1 policy" : maybe_appsec_policy_spec.getErr();
|
||||
dbgWarning(D_LOCAL_POLICY
|
||||
) << "Failed to retrieve Appsec policy with crds version: v1beta1, Trying version: v1beta2";
|
||||
auto maybe_v1beta2_appsec_policy_spec = getObjectFromCluster<AppsecSpecParser<NewAppsecPolicySpec>>(
|
||||
@@ -498,7 +500,7 @@ K8sPolicyUtils::createAppsecPolicyK8s(const string &policy_name, const string &i
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "Failed to retrieve AppSec policy. Error: " << maybe_v1beta2_appsec_policy_spec.getErr();
|
||||
return std::make_tuple(
|
||||
genError("Failed to retrieve AppSec v1beta1 policy. Error: " + maybe_appsec_policy_spec.getErr()),
|
||||
genError("Failed to retrieve AppSec v1beta1 policy. Error: " + v1beta1_error),
|
||||
genError(
|
||||
"Failed to retrieve AppSec v1beta2 policy. Error: " + maybe_v1beta2_appsec_policy_spec.getErr()
|
||||
)
|
||||
@@ -584,7 +586,9 @@ K8sPolicyUtils::createAppsecPoliciesFromIngresses()
|
||||
);
|
||||
if (!std::get<0>(maybe_appsec_policy).ok() && !std::get<1>(maybe_appsec_policy).ok()) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "Failed to create appsec policy. Error: "
|
||||
<< "Failed to create appsec policy. v1beta1 Error: "
|
||||
<< std::get<0>(maybe_appsec_policy).getErr()
|
||||
<< ". v1beta2 Error: "
|
||||
<< std::get<1>(maybe_appsec_policy).getErr();
|
||||
continue;
|
||||
}
|
||||
|
||||
@@ -99,7 +99,7 @@ V1beta2AppsecLinuxPolicy::serialize(cereal::JSONInputArchive &archive_in)
|
||||
archive_in
|
||||
);
|
||||
parseAppsecJSONKey<vector<NewAppsecLogTrigger>>("logTriggers", log_triggers, archive_in);
|
||||
parseAppsecJSONKey<vector<NewAppSecCustomResponse>>("customResponse", custom_responses, archive_in);
|
||||
parseAppsecJSONKey<vector<NewAppSecCustomResponse>>("customResponses", custom_responses, archive_in);
|
||||
parseAppsecJSONKey<vector<NewAppsecException>>("exceptions", exceptions, archive_in);
|
||||
parseAppsecJSONKey<vector<NewTrustedSourcesSpec>>("trustedSources", trusted_sources, archive_in);
|
||||
parseAppsecJSONKey<vector<NewSourcesIdentifiers>>("sourcesIdentifiers", sources_identifiers, archive_in);
|
||||
|
||||
@@ -44,7 +44,7 @@ void
|
||||
NewAppsecException::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading New AppSec exception";
|
||||
parseAppsecJSONKey<string>("name", name, archive_in, "exception");
|
||||
parseAppsecJSONKey<string>("name", name, archive_in);
|
||||
parseMandatoryAppsecJSONKey<string>("action", action, archive_in, "accept");
|
||||
parseAppsecJSONKey<string>("appsecClassName", appsec_class_name, archive_in);
|
||||
if (valid_actions.count(action) == 0) {
|
||||
|
||||
@@ -21,8 +21,16 @@ USE_DEBUG_FLAG(D_LOCAL_POLICY);
|
||||
static const set<string> performance_impacts = {"low", "medium", "high"};
|
||||
static const set<string> severity_levels = {"low", "medium", "high", "critical"};
|
||||
static const set<string> size_unit = {"bytes", "KB", "MB", "GB"};
|
||||
static const set<string> confidences_actions = {"prevent", "detect", "inactive"};
|
||||
static const set<string> valid_modes = {"prevent", "detect", "inactive", "prevent-learn", "detect-learn"};
|
||||
static const set<string> confidences_actions = {"prevent", "detect", "inactive", "as-top-level", "inherited"};
|
||||
static const set<string> valid_modes = {
|
||||
"prevent",
|
||||
"detect",
|
||||
"inactive",
|
||||
"prevent-learn",
|
||||
"detect-learn",
|
||||
"as-top-level",
|
||||
"inherited"
|
||||
};
|
||||
static const set<string> valid_confidences = {"medium", "high", "critical"};
|
||||
static const std::unordered_map<std::string, std::string> key_to_performance_impact_val = {
|
||||
{ "low", "Low or lower"},
|
||||
@@ -48,6 +56,30 @@ static const std::unordered_map<std::string, uint64_t> unit_to_int = {
|
||||
{ "MB", 1048576},
|
||||
{ "GB", 1073741824}
|
||||
};
|
||||
static const std::string TRANSPARENT_MODE = "Transparent";
|
||||
|
||||
bool
|
||||
isModeInherited(const string &mode)
|
||||
{
|
||||
return mode == "as-top-level" || mode == "inherited";
|
||||
}
|
||||
|
||||
const std::string &
|
||||
getModeWithDefault(
|
||||
const std::string &mode,
|
||||
const std::string &default_mode,
|
||||
const std::unordered_map<std::string, std::string> &key_to_val)
|
||||
{
|
||||
if (isModeInherited(mode) && (key_to_val.find(default_mode) != key_to_val.end())) {
|
||||
dbgError(D_LOCAL_POLICY) << "Setting to top-level mode: " << default_mode;
|
||||
return key_to_val.at(default_mode);
|
||||
}
|
||||
else if (key_to_val.find(mode) == key_to_val.end()) {
|
||||
dbgError(D_LOCAL_POLICY) << "Given mode: " << mode << " or top-level: " << default_mode << " is invalid.";
|
||||
return key_to_val.at("inactive");
|
||||
}
|
||||
return key_to_val.at(mode);
|
||||
}
|
||||
|
||||
void
|
||||
NewAppSecWebBotsURI::load(cereal::JSONInputArchive &archive_in)
|
||||
@@ -84,7 +116,7 @@ NewAppSecPracticeAntiBot::load(cereal::JSONInputArchive &archive_in)
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec Web Bots";
|
||||
parseAppsecJSONKey<vector<NewAppSecWebBotsURI>>("injectedUris", injected_uris, archive_in);
|
||||
parseAppsecJSONKey<vector<NewAppSecWebBotsURI>>("validatedUris", validated_uris, archive_in);
|
||||
parseAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "Inactive");
|
||||
parseMandatoryAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "inactive");
|
||||
if (valid_modes.count(override_mode) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec Web Bots override mode invalid: " << override_mode;
|
||||
}
|
||||
@@ -110,26 +142,33 @@ NewAppSecWebAttackProtections::load(cereal::JSONInputArchive &archive_in)
|
||||
parseAppsecJSONKey<string>("csrfProtection", csrf_protection, archive_in, "inactive");
|
||||
parseAppsecJSONKey<string>("errorDisclosure", error_disclosure, archive_in, "inactive");
|
||||
parseAppsecJSONKey<string>("openRedirect", open_redirect, archive_in, "inactive");
|
||||
if (valid_modes.count(csrf_protection) == 0 ||
|
||||
valid_modes.count(error_disclosure) == 0 ||
|
||||
valid_modes.count(open_redirect) == 0) {
|
||||
string error_msg = "AppSec Attack Protections mode invalid. csrf_protection: " + csrf_protection +
|
||||
" error_disclosure: " + error_disclosure + " open_redirect: " + open_redirect;
|
||||
dbgWarning(D_LOCAL_POLICY) << error_msg;
|
||||
throw PolicyGenException(error_msg);
|
||||
}
|
||||
parseAppsecJSONKey<bool>("nonValidHttpMethods", non_valid_http_methods, archive_in, false);
|
||||
}
|
||||
|
||||
const string
|
||||
NewAppSecWebAttackProtections::getCsrfProtectionMode() const
|
||||
const string &
|
||||
NewAppSecWebAttackProtections::getCsrfProtectionMode(const string &default_mode) const
|
||||
{
|
||||
if (key_to_practices_val.find(csrf_protection) == key_to_practices_val.end()) {
|
||||
dbgError(D_LOCAL_POLICY)
|
||||
<< "Failed to find a value for "
|
||||
<< csrf_protection
|
||||
<< ". Setting CSRF protection to Inactive";
|
||||
return "Inactive";
|
||||
}
|
||||
return key_to_practices_val.at(csrf_protection);
|
||||
return getModeWithDefault(csrf_protection, default_mode, key_to_practices_val2);
|
||||
}
|
||||
|
||||
const string &
|
||||
NewAppSecWebAttackProtections::getErrorDisclosureMode() const
|
||||
NewAppSecWebAttackProtections::getErrorDisclosureMode(const string &default_mode) const
|
||||
{
|
||||
return error_disclosure;
|
||||
return getModeWithDefault(error_disclosure, default_mode, key_to_practices_val2);
|
||||
}
|
||||
|
||||
const string &
|
||||
NewAppSecWebAttackProtections::getOpenRedirectMode(const string &default_mode) const
|
||||
{
|
||||
return getModeWithDefault(open_redirect, default_mode, key_to_practices_val2);
|
||||
}
|
||||
|
||||
bool
|
||||
@@ -138,40 +177,24 @@ NewAppSecWebAttackProtections::getNonValidHttpMethods() const
|
||||
return non_valid_http_methods;
|
||||
}
|
||||
|
||||
const string
|
||||
NewAppSecWebAttackProtections::getOpenRedirectMode() const
|
||||
{
|
||||
if (key_to_practices_val.find(open_redirect) == key_to_practices_val.end()) {
|
||||
dbgError(D_LOCAL_POLICY)
|
||||
<< "Failed to find a value for "
|
||||
<< open_redirect
|
||||
<< ". Setting Open Redirect mode to Inactive";
|
||||
return "Inactive";
|
||||
}
|
||||
return key_to_practices_val.at(open_redirect);
|
||||
}
|
||||
|
||||
void
|
||||
NewAppSecPracticeWebAttacks::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec practice web attacks spec";
|
||||
parseAppsecJSONKey<NewAppSecWebAttackProtections>("protections", protections, archive_in);
|
||||
parseAppsecJSONKey<string>("overrideMode", mode, archive_in, "Unset");
|
||||
parseMandatoryAppsecJSONKey<string>("overrideMode", mode, archive_in, "inactive");
|
||||
if (valid_modes.count(mode) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec practice override mode invalid: " << mode;
|
||||
}
|
||||
|
||||
if (getMode() == "Prevent") {
|
||||
parseMandatoryAppsecJSONKey<string>("minimumConfidence", minimum_confidence, archive_in, "critical");
|
||||
if (valid_confidences.count(minimum_confidence) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec practice override minimum confidence invalid: "
|
||||
<< minimum_confidence;
|
||||
throw PolicyGenException("AppSec practice override minimum confidence invalid: " + minimum_confidence);
|
||||
}
|
||||
} else {
|
||||
minimum_confidence = "Transparent";
|
||||
parseAppsecJSONKey<string>("minimumConfidence", minimum_confidence, archive_in, "critical");
|
||||
if (valid_confidences.count(minimum_confidence) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec practice override minimum confidence invalid: "
|
||||
<< minimum_confidence;
|
||||
throw PolicyGenException("AppSec practice override minimum confidence invalid: " + minimum_confidence);
|
||||
}
|
||||
|
||||
parseAppsecJSONKey<int>("maxBodySizeKb", max_body_size_kb, archive_in, 1000000);
|
||||
parseAppsecJSONKey<int>("maxHeaderSizeBytes", max_header_size_bytes, archive_in, 102400);
|
||||
parseAppsecJSONKey<int>("maxObjectDepth", max_object_depth, archive_in, 40);
|
||||
@@ -203,19 +226,25 @@ NewAppSecPracticeWebAttacks::getMaxUrlSizeBytes() const
|
||||
}
|
||||
|
||||
const string &
|
||||
NewAppSecPracticeWebAttacks::getMinimumConfidence() const
|
||||
NewAppSecPracticeWebAttacks::getMinimumConfidence(const string &default_mode) const
|
||||
{
|
||||
if (getMode(default_mode) != "Prevent") {
|
||||
return TRANSPARENT_MODE;
|
||||
}
|
||||
return minimum_confidence;
|
||||
}
|
||||
|
||||
const string &
|
||||
NewAppSecPracticeWebAttacks::getMode(const string &default_mode) const
|
||||
{
|
||||
if (mode == "Unset" || (key_to_practices_val2.find(mode) == key_to_practices_val2.end())) {
|
||||
dbgError(D_LOCAL_POLICY) << "Couldn't find a value for key: " << mode << ". Returning " << default_mode;
|
||||
return default_mode;
|
||||
}
|
||||
return key_to_practices_val2.at(mode);
|
||||
const string &res = getModeWithDefault(mode, default_mode, key_to_practices_val);
|
||||
return res;
|
||||
}
|
||||
|
||||
const NewAppSecWebAttackProtections &
|
||||
NewAppSecPracticeWebAttacks::getProtections() const
|
||||
{
|
||||
return protections;
|
||||
}
|
||||
|
||||
SnortProtectionsSection::SnortProtectionsSection(
|
||||
@@ -244,7 +273,7 @@ SnortProtectionsSection::save(cereal::JSONOutputArchive &out_ar) const
|
||||
{
|
||||
out_ar(
|
||||
cereal::make_nvp("context", context),
|
||||
cereal::make_nvp("mode", key_to_mode_val.at(mode)),
|
||||
cereal::make_nvp("mode", mode),
|
||||
cereal::make_nvp("files", files),
|
||||
cereal::make_nvp("assetName", asset_name),
|
||||
cereal::make_nvp("assetId", asset_id),
|
||||
@@ -440,8 +469,8 @@ void
|
||||
NewSnortSignaturesAndOpenSchemaAPI::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec Snort Signatures practice";
|
||||
parseAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "inactive");
|
||||
parseMandatoryAppsecJSONKey<vector<string>>("configmap", config_map, archive_in);
|
||||
parseMandatoryAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "inactive");
|
||||
parseAppsecJSONKey<vector<string>>("configmap", config_map, archive_in);
|
||||
parseAppsecJSONKey<vector<string>>("files", files, archive_in);
|
||||
is_temporary = false;
|
||||
if (valid_modes.count(override_mode) == 0) {
|
||||
@@ -457,9 +486,10 @@ NewSnortSignaturesAndOpenSchemaAPI::addFile(const string &file_name)
|
||||
}
|
||||
|
||||
const string &
|
||||
NewSnortSignaturesAndOpenSchemaAPI::getOverrideMode() const
|
||||
NewSnortSignaturesAndOpenSchemaAPI::getOverrideMode(const string &default_mode) const
|
||||
{
|
||||
return override_mode;
|
||||
const string &res = getModeWithDefault(override_mode, default_mode, key_to_practices_val);
|
||||
return res;
|
||||
}
|
||||
|
||||
const vector<string> &
|
||||
@@ -491,7 +521,7 @@ IpsProtectionsRulesSection::save(cereal::JSONOutputArchive &out_ar) const
|
||||
{
|
||||
vector<string> protections;
|
||||
out_ar(
|
||||
cereal::make_nvp("action", key_to_mode_val.at(action)),
|
||||
cereal::make_nvp("action", action),
|
||||
cereal::make_nvp("confidenceLevel", confidence_level),
|
||||
cereal::make_nvp("clientProtections", true),
|
||||
cereal::make_nvp("serverProtections", true),
|
||||
@@ -541,7 +571,7 @@ IpsProtectionsSection::save(cereal::JSONOutputArchive &out_ar) const
|
||||
cereal::make_nvp("practiceName", practice_name),
|
||||
cereal::make_nvp("practiceId", practice_id),
|
||||
cereal::make_nvp("sourceIdentifier", source_identifier),
|
||||
cereal::make_nvp("defaultAction", key_to_mode_val.at(mode)),
|
||||
cereal::make_nvp("defaultAction", mode),
|
||||
cereal::make_nvp("rules", rules)
|
||||
);
|
||||
}
|
||||
@@ -566,7 +596,7 @@ void
|
||||
NewIntrusionPrevention::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec Intrusion Prevention practice";
|
||||
parseAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "inactive");
|
||||
parseMandatoryAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "inactive");
|
||||
if (valid_modes.count(override_mode) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec Intrusion Prevention override mode invalid: " << override_mode;
|
||||
throw PolicyGenException("AppSec Intrusion Prevention override mode invalid: " + override_mode);
|
||||
@@ -580,13 +610,13 @@ NewIntrusionPrevention::load(cereal::JSONInputArchive &archive_in)
|
||||
"AppSec Intrusion Prevention max performance impact invalid: " + max_performance_impact
|
||||
);
|
||||
}
|
||||
parseAppsecJSONKey<string>("minSeverityLevel", min_severity_level, archive_in, "low");
|
||||
parseAppsecJSONKey<string>("minSeverityLevel", min_severity_level, archive_in, "medium");
|
||||
if (severity_levels.count(min_severity_level) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec Intrusion Prevention min severity level invalid: "
|
||||
<< min_severity_level;
|
||||
}
|
||||
parseAppsecJSONKey<string>("highConfidenceEventAction", high_confidence_event_action, archive_in, "prevent");
|
||||
parseAppsecJSONKey<string>("highConfidenceEventAction", high_confidence_event_action, archive_in, "inherited");
|
||||
if (confidences_actions.count(high_confidence_event_action) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec Intrusion Prevention high confidence event invalid: "
|
||||
@@ -595,7 +625,9 @@ NewIntrusionPrevention::load(cereal::JSONInputArchive &archive_in)
|
||||
"AppSec Intrusion Prevention high confidence event invalid: " + high_confidence_event_action
|
||||
);
|
||||
}
|
||||
parseAppsecJSONKey<string>("mediumConfidenceEventAction", medium_confidence_event_action, archive_in, "prevent");
|
||||
parseAppsecJSONKey<string>(
|
||||
"mediumConfidenceEventAction", medium_confidence_event_action, archive_in, "inherited"
|
||||
);
|
||||
if (confidences_actions.count(medium_confidence_event_action) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec Intrusion Prevention medium confidence event invalid: "
|
||||
@@ -613,16 +645,16 @@ NewIntrusionPrevention::load(cereal::JSONInputArchive &archive_in)
|
||||
"AppSec Intrusion Prevention low confidence event action invalid: " + low_confidence_event_action
|
||||
);
|
||||
}
|
||||
parseAppsecJSONKey<int>("minCveYear", min_cve_Year, archive_in);
|
||||
parseAppsecJSONKey<int>("minCveYear", min_cve_Year, archive_in, 2016);
|
||||
}
|
||||
|
||||
vector<IpsProtectionsRulesSection>
|
||||
NewIntrusionPrevention::createIpsRules() const
|
||||
NewIntrusionPrevention::createIpsRules(const string &default_mode) const
|
||||
{
|
||||
vector<IpsProtectionsRulesSection> ips_rules;
|
||||
IpsProtectionsRulesSection high_rule(
|
||||
min_cve_Year,
|
||||
high_confidence_event_action,
|
||||
getModeWithDefault(high_confidence_event_action, default_mode, key_to_practices_val),
|
||||
string("High"),
|
||||
max_performance_impact,
|
||||
string(""),
|
||||
@@ -632,7 +664,7 @@ NewIntrusionPrevention::createIpsRules() const
|
||||
|
||||
IpsProtectionsRulesSection med_rule(
|
||||
min_cve_Year,
|
||||
medium_confidence_event_action,
|
||||
getModeWithDefault(medium_confidence_event_action, default_mode, key_to_practices_val),
|
||||
string("Medium"),
|
||||
max_performance_impact,
|
||||
string(""),
|
||||
@@ -642,7 +674,7 @@ NewIntrusionPrevention::createIpsRules() const
|
||||
|
||||
IpsProtectionsRulesSection low_rule(
|
||||
min_cve_Year,
|
||||
low_confidence_event_action,
|
||||
getModeWithDefault(low_confidence_event_action, default_mode, key_to_practices_val),
|
||||
string("Low"),
|
||||
max_performance_impact,
|
||||
string(""),
|
||||
@@ -654,9 +686,10 @@ NewIntrusionPrevention::createIpsRules() const
|
||||
}
|
||||
|
||||
const std::string &
|
||||
NewIntrusionPrevention::getMode() const
|
||||
NewIntrusionPrevention::getMode(const std::string &default_mode) const
|
||||
{
|
||||
return override_mode;
|
||||
const string &res = getModeWithDefault(override_mode, default_mode, key_to_practices_val);
|
||||
return res;
|
||||
}
|
||||
|
||||
FileSecurityProtectionsSection::FileSecurityProtectionsSection(
|
||||
@@ -711,20 +744,20 @@ FileSecurityProtectionsSection::save(cereal::JSONOutputArchive &out_ar) const
|
||||
cereal::make_nvp("assetId", asset_id),
|
||||
cereal::make_nvp("practiceName", practice_name),
|
||||
cereal::make_nvp("practiceId", practice_id),
|
||||
cereal::make_nvp("action", key_to_mode_val.at(action)),
|
||||
cereal::make_nvp("filesWithoutNameAction", key_to_mode_val.at(files_without_name_action)),
|
||||
cereal::make_nvp("action", action),
|
||||
cereal::make_nvp("filesWithoutNameAction", files_without_name_action),
|
||||
cereal::make_nvp("allowFilesWithoutName", allow_files_without_name),
|
||||
cereal::make_nvp("highConfidence", key_to_mode_val.at(high_confidence_action)),
|
||||
cereal::make_nvp("mediumConfidence", key_to_mode_val.at(medium_confidence_action)),
|
||||
cereal::make_nvp("lowConfidence", key_to_mode_val.at(low_confidence_action)),
|
||||
cereal::make_nvp("highConfidence", high_confidence_action),
|
||||
cereal::make_nvp("mediumConfidence", medium_confidence_action),
|
||||
cereal::make_nvp("lowConfidence", low_confidence_action),
|
||||
cereal::make_nvp("severityLevel", key_to_severity_level_val.at(severity_level)),
|
||||
cereal::make_nvp("fileSizeLimitAction", key_to_mode_val.at(file_size_limit_action)),
|
||||
cereal::make_nvp("fileSizeLimitAction", file_size_limit_action),
|
||||
cereal::make_nvp("fileSizeLimit", file_size_limit),
|
||||
cereal::make_nvp("requiredFileSizeLimit", required_file_size_limit),
|
||||
cereal::make_nvp("requiredArchiveExtraction", required_archive_extraction),
|
||||
cereal::make_nvp("archiveFileSizeLimit", archive_file_size_limit),
|
||||
cereal::make_nvp("MultiLevelArchiveAction", key_to_mode_val.at(multi_level_archive_action)),
|
||||
cereal::make_nvp("UnopenedArchiveAction", key_to_mode_val.at(unopened_archive_action))
|
||||
cereal::make_nvp("MultiLevelArchiveAction", multi_level_archive_action),
|
||||
cereal::make_nvp("UnopenedArchiveAction", unopened_archive_action)
|
||||
);
|
||||
}
|
||||
|
||||
@@ -748,7 +781,7 @@ void
|
||||
NewFileSecurityArchiveInspection::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec File Security Archive Inspection practice";
|
||||
parseAppsecJSONKey<bool>("extractArchiveFiles", extract_archive_files, archive_in, true);
|
||||
parseAppsecJSONKey<bool>("extractArchiveFiles", extract_archive_files, archive_in, false);
|
||||
parseAppsecJSONKey<uint64_t>("scanMaxFileSize", scan_max_file_size, archive_in, 10);
|
||||
parseAppsecJSONKey<string>("scanMaxFileSizeUnit", scan_max_file_size_unit, archive_in, "MB");
|
||||
if (size_unit.count(scan_max_file_size_unit) == 0) {
|
||||
@@ -763,7 +796,7 @@ NewFileSecurityArchiveInspection::load(cereal::JSONInputArchive &archive_in)
|
||||
"archivedFilesWithinArchivedFiles",
|
||||
archived_files_within_archived_files,
|
||||
archive_in,
|
||||
"prevent");
|
||||
"inherited");
|
||||
if (confidences_actions.count(archived_files_within_archived_files) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec File Security Archive Inspection archived files within archived files invalid: "
|
||||
@@ -777,7 +810,7 @@ NewFileSecurityArchiveInspection::load(cereal::JSONInputArchive &archive_in)
|
||||
"archivedFilesWhereContentExtractionFailed",
|
||||
archived_files_where_content_extraction_failed,
|
||||
archive_in,
|
||||
"prevent");
|
||||
"inherited");
|
||||
if (confidences_actions.count(archived_files_where_content_extraction_failed) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec File Security Archive Inspection archived files within archived file invalid: "
|
||||
@@ -834,7 +867,7 @@ NewFileSecurityLargeFileInspection::load(cereal::JSONInputArchive &archive_in)
|
||||
"filesExceedingSizeLimitAction",
|
||||
files_exceeding_size_limit_action,
|
||||
archive_in,
|
||||
"prevent");
|
||||
"inherited");
|
||||
if (confidences_actions.count(files_exceeding_size_limit_action) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec File Security Archive Inspection archived files within archived files invalid: "
|
||||
@@ -869,18 +902,18 @@ void
|
||||
NewFileSecurity::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec File Security practice";
|
||||
parseAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "inactive");
|
||||
parseMandatoryAppsecJSONKey<string>("overrideMode", override_mode, archive_in, "inactive");
|
||||
if (valid_modes.count(override_mode) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec File Security override mode invalid: " << override_mode;
|
||||
throw PolicyGenException("AppSec File Security override mode invalid: " + override_mode);
|
||||
}
|
||||
parseMandatoryAppsecJSONKey<string>("minSeverityLevel", min_severity_level, archive_in, "low");
|
||||
parseAppsecJSONKey<string>("minSeverityLevel", min_severity_level, archive_in, "medium");
|
||||
if (severity_levels.count(min_severity_level) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec File Security min severity level invalid: " << min_severity_level;
|
||||
min_severity_level = "low";
|
||||
}
|
||||
parseMandatoryAppsecJSONKey<string>(
|
||||
"highConfidenceEventAction", high_confidence_event_action, archive_in, "inactive"
|
||||
parseAppsecJSONKey<string>(
|
||||
"highConfidenceEventAction", high_confidence_event_action, archive_in, "inherited"
|
||||
);
|
||||
if (confidences_actions.count(high_confidence_event_action) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
@@ -888,8 +921,8 @@ NewFileSecurity::load(cereal::JSONInputArchive &archive_in)
|
||||
<< high_confidence_event_action;
|
||||
high_confidence_event_action = "inactive";
|
||||
}
|
||||
parseMandatoryAppsecJSONKey<string>(
|
||||
"mediumConfidenceEventAction", medium_confidence_event_action, archive_in, "inactive"
|
||||
parseAppsecJSONKey<string>(
|
||||
"mediumConfidenceEventAction", medium_confidence_event_action, archive_in, "inherited"
|
||||
);
|
||||
if (confidences_actions.count(medium_confidence_event_action) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
@@ -897,8 +930,8 @@ NewFileSecurity::load(cereal::JSONInputArchive &archive_in)
|
||||
<< medium_confidence_event_action;
|
||||
medium_confidence_event_action = "inactive";
|
||||
}
|
||||
parseMandatoryAppsecJSONKey<string>(
|
||||
"lowConfidenceEventAction", low_confidence_event_action, archive_in, "inactive"
|
||||
parseAppsecJSONKey<string>(
|
||||
"lowConfidenceEventAction", low_confidence_event_action, archive_in, "detect"
|
||||
);
|
||||
if (confidences_actions.count(low_confidence_event_action) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
@@ -906,7 +939,7 @@ NewFileSecurity::load(cereal::JSONInputArchive &archive_in)
|
||||
<< low_confidence_event_action;
|
||||
low_confidence_event_action = "inactive";
|
||||
}
|
||||
parseMandatoryAppsecJSONKey<string>("unnamedFilesAction", unnamed_files_action, archive_in, "inactive");
|
||||
parseAppsecJSONKey<string>("unnamedFilesAction", unnamed_files_action, archive_in, "inherited");
|
||||
if (confidences_actions.count(unnamed_files_action) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
<< "AppSec File Security low unnamed files action invalid: "
|
||||
@@ -914,10 +947,8 @@ NewFileSecurity::load(cereal::JSONInputArchive &archive_in)
|
||||
unnamed_files_action = "inactive";
|
||||
}
|
||||
parseAppsecJSONKey<bool>("threatEmulationEnabled", threat_emulation_enabled, archive_in);
|
||||
parseMandatoryAppsecJSONKey<NewFileSecurityArchiveInspection>("archiveInspection", archive_inspection, archive_in);
|
||||
parseMandatoryAppsecJSONKey<NewFileSecurityLargeFileInspection>(
|
||||
"largeFileInspection", large_file_inspection, archive_in
|
||||
);
|
||||
parseAppsecJSONKey<NewFileSecurityArchiveInspection>("archiveInspection", archive_inspection, archive_in);
|
||||
parseAppsecJSONKey<NewFileSecurityLargeFileInspection>("largeFileInspection", large_file_inspection, archive_in);
|
||||
}
|
||||
|
||||
const string &
|
||||
@@ -944,28 +975,37 @@ NewFileSecurity::createFileSecurityProtectionsSection(
|
||||
const string &asset_name,
|
||||
const string &asset_id,
|
||||
const string &practice_name,
|
||||
const string &practice_id) const
|
||||
const string &practice_id,
|
||||
const string &default_mode) const
|
||||
{
|
||||
string practice_action = (isModeInherited(override_mode) ? default_mode : override_mode);
|
||||
const string &unnamed_files_action_val =
|
||||
getModeWithDefault(unnamed_files_action, practice_action, key_to_mode_val);
|
||||
const string &large_file_action_val = getModeWithDefault(
|
||||
getLargeFileInspection().getFileSizeLimitAction(),
|
||||
practice_action,
|
||||
key_to_mode_val
|
||||
);
|
||||
return FileSecurityProtectionsSection(
|
||||
getLargeFileInspection().getFileSizeLimit(),
|
||||
getArchiveInspection().getArchiveFileSizeLimit(),
|
||||
unnamed_files_action == "prevent" ? true : false,
|
||||
getLargeFileInspection().getFileSizeLimitAction() == "prevent" ? true : false,
|
||||
unnamed_files_action_val == "Prevent" ? true : false,
|
||||
large_file_action_val == "Prevent" ? true : false,
|
||||
getArchiveInspection().getrequiredArchiveExtraction(),
|
||||
context,
|
||||
asset_name,
|
||||
asset_id,
|
||||
practice_name,
|
||||
practice_id,
|
||||
override_mode,
|
||||
unnamed_files_action,
|
||||
high_confidence_event_action,
|
||||
medium_confidence_event_action,
|
||||
low_confidence_event_action,
|
||||
getModeWithDefault(override_mode, practice_action, key_to_mode_val),
|
||||
unnamed_files_action_val,
|
||||
getModeWithDefault(high_confidence_event_action, practice_action, key_to_mode_val),
|
||||
getModeWithDefault(medium_confidence_event_action, practice_action, key_to_mode_val),
|
||||
getModeWithDefault(low_confidence_event_action, practice_action, key_to_mode_val),
|
||||
min_severity_level,
|
||||
getLargeFileInspection().getFileSizeLimitAction(),
|
||||
getArchiveInspection().getMultiLevelArchiveAction(),
|
||||
getArchiveInspection().getUnopenedArchiveAction()
|
||||
large_file_action_val,
|
||||
getModeWithDefault(getArchiveInspection().getMultiLevelArchiveAction(), practice_action, key_to_mode_val),
|
||||
getModeWithDefault(getArchiveInspection().getUnopenedArchiveAction(), practice_action, key_to_mode_val)
|
||||
);
|
||||
}
|
||||
|
||||
@@ -974,17 +1014,18 @@ NewAppSecPracticeSpec::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec practice spec";
|
||||
parseAppsecJSONKey<NewSnortSignaturesAndOpenSchemaAPI>(
|
||||
"openapi-schema-validation",
|
||||
"schemaValidation",
|
||||
openapi_schema_validation,
|
||||
archive_in
|
||||
);
|
||||
parseAppsecJSONKey<string>("appsecClassName", appsec_class_name, archive_in);
|
||||
parseAppsecJSONKey<NewFileSecurity>("fileSecurity", file_security, archive_in);
|
||||
parseAppsecJSONKey<NewIntrusionPrevention>("intrusionPrevention", intrusion_prevention, archive_in);
|
||||
parseAppsecJSONKey<NewSnortSignaturesAndOpenSchemaAPI>("snortSignatures", snort_signatures, archive_in);
|
||||
parseMandatoryAppsecJSONKey<NewFileSecurity>("fileSecurity", file_security, archive_in);
|
||||
parseMandatoryAppsecJSONKey<NewIntrusionPrevention>("intrusionPrevention", intrusion_prevention, archive_in);
|
||||
parseMandatoryAppsecJSONKey<NewSnortSignaturesAndOpenSchemaAPI>("snortSignatures", snort_signatures, archive_in);
|
||||
parseMandatoryAppsecJSONKey<NewAppSecPracticeWebAttacks>("webAttacks", web_attacks, archive_in);
|
||||
parseAppsecJSONKey<NewAppSecPracticeAntiBot>("antiBot", anti_bot, archive_in);
|
||||
parseAppsecJSONKey<string>("name", practice_name, archive_in);
|
||||
parseAppsecJSONKey<string>("practiceMode", mode, archive_in, "inherited");
|
||||
}
|
||||
|
||||
void
|
||||
@@ -1040,4 +1081,11 @@ NewAppSecPracticeSpec::getName() const
|
||||
{
|
||||
return practice_name;
|
||||
}
|
||||
|
||||
const string &
|
||||
NewAppSecPracticeSpec::getMode(const string &default_mode) const
|
||||
{
|
||||
return isModeInherited(mode) ? default_mode : mode;
|
||||
}
|
||||
|
||||
// LCOV_EXCL_STOP
|
||||
|
||||
@@ -996,13 +996,16 @@ PolicyMakerUtils::createIpsSections(
|
||||
const string &source_identifier,
|
||||
const string & context,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
map<AnnotationTypes, string> &rule_annotations)
|
||||
map<AnnotationTypes, string> &rule_annotations,
|
||||
const string &default_mode)
|
||||
{
|
||||
auto apssec_practice = getAppsecPracticeSpec<V1beta2AppsecLinuxPolicy, NewAppSecPracticeSpec>(
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
policy);
|
||||
const string &override_mode =
|
||||
apssec_practice.getIntrusionPrevention().getMode(apssec_practice.getMode(default_mode));
|
||||
|
||||
if (apssec_practice.getIntrusionPrevention().getMode().empty()) return;
|
||||
if (override_mode == "Inactive" || override_mode == "Disabled") return;
|
||||
|
||||
IpsProtectionsSection ips_section = IpsProtectionsSection(
|
||||
context,
|
||||
@@ -1011,8 +1014,8 @@ PolicyMakerUtils::createIpsSections(
|
||||
practice_name,
|
||||
practice_id,
|
||||
source_identifier,
|
||||
apssec_practice.getIntrusionPrevention().getMode(),
|
||||
apssec_practice.getIntrusionPrevention().createIpsRules()
|
||||
override_mode,
|
||||
apssec_practice.getIntrusionPrevention().createIpsRules(override_mode)
|
||||
);
|
||||
|
||||
ips[asset_name] = ips_section;
|
||||
@@ -1068,13 +1071,17 @@ PolicyMakerUtils::createSnortSections(
|
||||
const string &practice_id,
|
||||
const string &source_identifier,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
map<AnnotationTypes, string> &rule_annotations)
|
||||
map<AnnotationTypes, string> &rule_annotations,
|
||||
const string &default_mode)
|
||||
{
|
||||
auto apssec_practice = getAppsecPracticeSpec<V1beta2AppsecLinuxPolicy, NewAppSecPracticeSpec>(
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
policy);
|
||||
const string &override_mode =
|
||||
apssec_practice.getSnortSignatures().getOverrideMode(apssec_practice.getMode(default_mode));
|
||||
|
||||
if (apssec_practice.getSnortSignatures().getOverrideMode() == "inactive" ||
|
||||
if (override_mode == "Inactive" ||
|
||||
override_mode == "Disabled" ||
|
||||
apssec_practice.getSnortSignatures().getFiles().size() == 0) {
|
||||
return;
|
||||
}
|
||||
@@ -1094,7 +1101,7 @@ PolicyMakerUtils::createSnortSections(
|
||||
practice_name,
|
||||
practice_id,
|
||||
source_identifier,
|
||||
apssec_practice.getSnortSignatures().getOverrideMode(),
|
||||
override_mode,
|
||||
apssec_practice.getSnortSignatures().getFiles()
|
||||
);
|
||||
|
||||
@@ -1109,7 +1116,8 @@ PolicyMakerUtils::createFileSecuritySections(
|
||||
const string &practice_name,
|
||||
const string &context,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
map<AnnotationTypes, string> &rule_annotations)
|
||||
map<AnnotationTypes, string> &rule_annotations,
|
||||
const string &default_mode)
|
||||
{
|
||||
auto apssec_practice = getAppsecPracticeSpec<V1beta2AppsecLinuxPolicy, NewAppSecPracticeSpec>(
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
@@ -1122,7 +1130,8 @@ PolicyMakerUtils::createFileSecuritySections(
|
||||
asset_name,
|
||||
asset_id,
|
||||
practice_name,
|
||||
practice_id
|
||||
practice_id,
|
||||
apssec_practice.getMode(default_mode)
|
||||
);
|
||||
|
||||
file_security[asset_name] = file_security_section;
|
||||
@@ -1134,6 +1143,7 @@ PolicyMakerUtils::createRateLimitSection(
|
||||
const string &url,
|
||||
const string &uri,
|
||||
const string &trigger_id,
|
||||
const std::string &default_mode,
|
||||
const V1beta2AppsecLinuxPolicy &policy,
|
||||
map<AnnotationTypes, string> &rule_annotations)
|
||||
{
|
||||
@@ -1157,13 +1167,13 @@ PolicyMakerUtils::createRateLimitSection(
|
||||
trigger = RateLimitRulesTriggerSection(trigger_id, trigger_name, "Trigger");
|
||||
}
|
||||
|
||||
auto rules = access_control_practice.geRateLimit().createRateLimitRulesSection(trigger);
|
||||
auto rules = access_control_practice.getRateLimit().createRateLimitRulesSection(trigger);
|
||||
|
||||
rate_limit[rule_annotations[AnnotationTypes::ACCESS_CONTROL_PRACTICE]] = RateLimitSection(
|
||||
asset_name,
|
||||
url,
|
||||
uri,
|
||||
access_control_practice.geRateLimit().getMode(),
|
||||
access_control_practice.getRateLimit().getMode(access_control_practice.getMode(default_mode)),
|
||||
practice_id,
|
||||
rule_annotations[AnnotationTypes::ACCESS_CONTROL_PRACTICE],
|
||||
rules
|
||||
@@ -1183,6 +1193,8 @@ PolicyMakerUtils::createWebAppSection(
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
policy
|
||||
);
|
||||
const string &practice_mode = apssec_practice.getMode(default_mode);
|
||||
|
||||
PracticeAdvancedConfig practice_advance_config(
|
||||
apssec_practice.getWebAttacks().getMaxHeaderSizeBytes(),
|
||||
apssec_practice.getWebAttacks().getMaxBodySizeKb(),
|
||||
@@ -1198,12 +1210,13 @@ PolicyMakerUtils::createWebAppSection(
|
||||
practice_id,
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
rule_config.getContext(),
|
||||
apssec_practice.getWebAttacks().getMinimumConfidence(),
|
||||
apssec_practice.getWebAttacks().getMode(default_mode),
|
||||
apssec_practice.getWebAttacks().getMinimumConfidence(practice_mode),
|
||||
apssec_practice.getWebAttacks().getMode(practice_mode),
|
||||
practice_advance_config,
|
||||
apssec_practice.getAntiBot(),
|
||||
log_triggers[rule_annotations[AnnotationTypes::TRIGGER]],
|
||||
trusted_sources[rule_annotations[AnnotationTypes::TRUSTED_SOURCES]]
|
||||
trusted_sources[rule_annotations[AnnotationTypes::TRUSTED_SOURCES]],
|
||||
apssec_practice.getWebAttacks().getProtections()
|
||||
);
|
||||
web_apps[rule_config.getAssetName()] = web_app;
|
||||
}
|
||||
@@ -1271,7 +1284,8 @@ PolicyMakerUtils::createThreatPreventionPracticeSections(
|
||||
current_identifier,
|
||||
rule_config.getContext(),
|
||||
policy,
|
||||
rule_annotations
|
||||
rule_annotations,
|
||||
default_mode
|
||||
);
|
||||
|
||||
createSnortSections(
|
||||
@@ -1282,7 +1296,8 @@ PolicyMakerUtils::createThreatPreventionPracticeSections(
|
||||
practice_id,
|
||||
current_identifier,
|
||||
policy,
|
||||
rule_annotations
|
||||
rule_annotations,
|
||||
default_mode
|
||||
);
|
||||
|
||||
createFileSecuritySections(
|
||||
@@ -1292,11 +1307,18 @@ PolicyMakerUtils::createThreatPreventionPracticeSections(
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
"assetId(" + rule_config.getAssetId() + ")",
|
||||
policy,
|
||||
rule_annotations
|
||||
rule_annotations,
|
||||
default_mode
|
||||
);
|
||||
|
||||
if (!web_apps.count(rule_config.getAssetName())) {
|
||||
createWebAppSection(policy, rule_config, practice_id, asset_name, default_mode, rule_annotations);
|
||||
createWebAppSection(
|
||||
policy,
|
||||
rule_config,
|
||||
practice_id,
|
||||
asset_name,
|
||||
default_mode,
|
||||
rule_annotations);
|
||||
}
|
||||
|
||||
}
|
||||
@@ -1568,6 +1590,7 @@ PolicyMakerUtils::createPolicyElementsByRule<V1beta2AppsecLinuxPolicy, NewParsed
|
||||
std::get<0>(splited_host_name),
|
||||
std::get<2>(splited_host_name),
|
||||
log_triggers[rule_annotations[AnnotationTypes::TRIGGER]].getTriggerId(),
|
||||
rule.getMode(),
|
||||
policy,
|
||||
rule_annotations
|
||||
);
|
||||
|
||||
@@ -32,6 +32,7 @@ class DetailsResolver::Impl
|
||||
Singleton::Provide<I_DetailsResolver>::From<DetailsResolver>
|
||||
{
|
||||
public:
|
||||
void init() { handler.init(); }
|
||||
Maybe<string> getHostname() override;
|
||||
Maybe<string> getPlatform() override;
|
||||
Maybe<string> getArch() override;
|
||||
@@ -290,6 +291,12 @@ DetailsResolver::DetailsResolver() : Component("DetailsResolver"), pimpl(make_un
|
||||
|
||||
DetailsResolver::~DetailsResolver() {}
|
||||
|
||||
void
|
||||
DetailsResolver::init()
|
||||
{
|
||||
pimpl->init();
|
||||
}
|
||||
|
||||
void
|
||||
DetailsResolver::preload()
|
||||
{
|
||||
|
||||
@@ -216,6 +216,18 @@ getFecApplicable(const string &command_output)
|
||||
return genError("Could not determine if fec applicable");
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
getSMCBasedMgmtId(const string &command_output)
|
||||
{
|
||||
return getAttr(command_output, "Mgmt object UUID was not found");
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
getSMCBasedMgmtName(const string &command_output)
|
||||
{
|
||||
return getAttr(command_output, "Mgmt object Name was not found");
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
getSmbObjectName(const string &command_output)
|
||||
{
|
||||
|
||||
@@ -33,7 +33,10 @@
|
||||
SHELL_PRE_CMD("read sdwan data",
|
||||
"(cpsdwan get_data > /tmp/cpsdwan_getdata_orch.json~) "
|
||||
"&& (mv /tmp/cpsdwan_getdata_orch.json~ /tmp/cpsdwan_getdata_orch.json)")
|
||||
#endif
|
||||
#endif //gaia || smb
|
||||
#if defined(smb)
|
||||
SHELL_PRE_CMD("gunzip local.cfg", "gunzip -c $FWDIR/state/local/FW1/local.cfg.gz > /tmp/local.cfg")
|
||||
#endif //smb
|
||||
#endif
|
||||
|
||||
#ifdef SHELL_CMD_HANDLER
|
||||
@@ -115,6 +118,22 @@ SHELL_CMD_HANDLER(
|
||||
"cat $FWDIR/database/myself_objects.C | awk -F '[:()]' '/:VPN_1/ {print $3}' | head -n 1",
|
||||
getGWIPSecVPNBlade
|
||||
)
|
||||
SHELL_CMD_HANDLER(
|
||||
"SMCBasedMgmtId",
|
||||
"domain_uuid=$(jq -r .domain_uuid /tmp/cpsdwan_getdata_orch.json);"
|
||||
"[ \"$domain_uuid\" != \"null\" ] && echo \"$domain_uuid\" ||"
|
||||
"cat $FWDIR/database/myself_objects.C "
|
||||
"| awk -F'[{}]' '/:masters/ { found=1; next } found && /:Uid/ { uid=tolower($2); print uid; exit }'",
|
||||
getSMCBasedMgmtId
|
||||
)
|
||||
SHELL_CMD_HANDLER(
|
||||
"SMCBasedMgmtName",
|
||||
"domain_name=$(jq -r .domain_name /tmp/cpsdwan_getdata_orch.json);"
|
||||
"[ \"$domain_name\" != \"null\" ] && echo \"$domain_name\" ||"
|
||||
"cat $FWDIR/database/myself_objects.C "
|
||||
"| awk -F '[:()]' '/:masters/ {found=1; next} found && /:Name/ {print $3; exit}'",
|
||||
getSMCBasedMgmtName
|
||||
)
|
||||
#endif //gaia
|
||||
|
||||
#if defined(smb)
|
||||
@@ -148,6 +167,23 @@ SHELL_CMD_HANDLER(
|
||||
"cat $FWDIR/conf/active_blades.txt | grep -o 'IPS [01]' | cut -d ' ' -f2",
|
||||
getSmbGWIPSecVPNBlade
|
||||
)
|
||||
SHELL_CMD_HANDLER(
|
||||
"SMCBasedMgmtId",
|
||||
"domain_uuid=$(jq -r .domain_uuid /tmp/cpsdwan_getdata_orch.json);"
|
||||
"[ \"$domain_uuid\" != \"null\" ] && echo \"$domain_uuid\" ||"
|
||||
"cat /tmp/local.cfg "
|
||||
"| awk -F'[{}]' '/:masters/ { found=1; next } found && /:Uid/ { uid=tolower($2); print uid; exit }'",
|
||||
getSMCBasedMgmtId
|
||||
)
|
||||
|
||||
SHELL_CMD_HANDLER(
|
||||
"SMCBasedMgmtName",
|
||||
"domain_name=$(jq -r .domain_name /tmp/cpsdwan_getdata_orch.json);"
|
||||
"[ \"$domain_name\" != \"null\" ] && echo \"$domain_name\" ||"
|
||||
"cat /tmp/local.cfg "
|
||||
"| awk -F '[:()]' '/:masters/ {found=1; next} found && /:Name/ {print $3; exit}'",
|
||||
getSMCBasedMgmtName
|
||||
)
|
||||
#endif//smb
|
||||
|
||||
SHELL_CMD_OUTPUT("kernel_version", "uname -r")
|
||||
@@ -187,6 +223,12 @@ FILE_CONTENT_HANDLER(
|
||||
FILE_CONTENT_HANDLER("os_release", "/etc/os-release", getOsRelease)
|
||||
#endif // gaia || smb
|
||||
|
||||
FILE_CONTENT_HANDLER("AppSecModelVersion", "/etc/cp/conf/waap/waap.data", getWaapModelVersion)
|
||||
FILE_CONTENT_HANDLER("AppSecModelVersion", "<FILESYSTEM-PREFIX>/conf/waap/waap.data", getWaapModelVersion)
|
||||
|
||||
#endif // FILE_CONTENT_HANDLER
|
||||
|
||||
#ifdef SHELL_POST_CMD
|
||||
#if defined(smb)
|
||||
SHELL_POST_CMD("remove local.cfg", "rm -rf /tmp/local.cfg")
|
||||
#endif //smb
|
||||
#endif
|
||||
|
||||
@@ -36,9 +36,12 @@ using FileContentHandler = function<Maybe<string>(shared_ptr<istream> file_otput
|
||||
|
||||
#include "checkpoint_product_handlers.h"
|
||||
|
||||
static const string filesystem_place_holder = "<FILESYSTEM-PREFIX>";
|
||||
|
||||
class DetailsResolvingHanlder::Impl
|
||||
{
|
||||
public:
|
||||
void init();
|
||||
map<string, string> getResolvedDetails() const;
|
||||
static Maybe<string> getCommandOutput(const string &cmd);
|
||||
|
||||
@@ -64,6 +67,26 @@ private:
|
||||
#undef FILE_CONTENT_HANDLER
|
||||
};
|
||||
|
||||
#define SHELL_POST_CMD(NAME, COMMAND) {NAME, COMMAND},
|
||||
map<string, string> shell_post_commands = {
|
||||
#include "details_resolver_impl.h"
|
||||
};
|
||||
#undef SHELL_POST_CMD
|
||||
|
||||
void
|
||||
DetailsResolvingHanlder::Impl::init()
|
||||
{
|
||||
string actual_filesystem_prefix = getFilesystemPathConfig();
|
||||
|
||||
for (auto &file_handler : file_content_handlers) {
|
||||
string &path = file_handler.second.first;
|
||||
size_t place_holder_size = filesystem_place_holder.size();
|
||||
if (path.substr(0, place_holder_size) == filesystem_place_holder) {
|
||||
path = actual_filesystem_prefix + path.substr(place_holder_size);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
map<string, string>
|
||||
DetailsResolvingHanlder::Impl::getResolvedDetails() const
|
||||
{
|
||||
@@ -114,6 +137,18 @@ DetailsResolvingHanlder::Impl::getResolvedDetails() const
|
||||
in_file->close();
|
||||
}
|
||||
|
||||
for (auto &shell_post_command : shell_post_commands) {
|
||||
const string &name = shell_post_command.first;
|
||||
const string &command = shell_post_command.second;
|
||||
Maybe<int> command_ret = shell->getExecReturnCode(command, timeout);
|
||||
|
||||
if (!command_ret.ok()) {
|
||||
dbgWarning(D_AGENT_DETAILS) << "Failed to run post-command " << name;
|
||||
} else if (*command_ret) {
|
||||
dbgWarning(D_AGENT_DETAILS) << "Post-command " << name << " failed (rc: " << *command_ret << ")";
|
||||
}
|
||||
}
|
||||
|
||||
I_AgentDetailsReporter *reporter = Singleton::Consume<I_AgentDetailsReporter>::by<DetailsResolvingHanlder>();
|
||||
reporter->addAttr(resolved_details, true);
|
||||
|
||||
@@ -137,6 +172,12 @@ DetailsResolvingHanlder::Impl::getCommandOutput(const string &cmd)
|
||||
DetailsResolvingHanlder::DetailsResolvingHanlder() : pimpl(make_unique<Impl>()) {}
|
||||
DetailsResolvingHanlder::~DetailsResolvingHanlder() {}
|
||||
|
||||
void
|
||||
DetailsResolvingHanlder::init()
|
||||
{
|
||||
return pimpl->init();
|
||||
}
|
||||
|
||||
map<string, string>
|
||||
DetailsResolvingHanlder::getResolvedDetails() const
|
||||
{
|
||||
|
||||
@@ -31,6 +31,7 @@ public:
|
||||
DetailsResolvingHanlder();
|
||||
~DetailsResolvingHanlder();
|
||||
|
||||
void init();
|
||||
std::map<std::string, std::string> getResolvedDetails() const;
|
||||
|
||||
static Maybe<std::string> getCommandOutput(const std::string &cmd);
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
ADD_DEFINITIONS(-Wno-deprecated-declarations -Dalpine)
|
||||
|
||||
add_library(orchestration_downloader curl_client.cc downloader.cc http_client.cc https_client.cc)
|
||||
add_library(orchestration_downloader curl_client.cc downloader.cc http_client.cc https_client.cc https_client_helper.cc)
|
||||
|
||||
#add_subdirectory(downloader_ut)
|
||||
|
||||
@@ -121,6 +121,11 @@ Downloader::Impl::init()
|
||||
"Default file download path"
|
||||
);
|
||||
|
||||
auto maybe_vs_id = Singleton::Consume<I_Environment>::by<Downloader>()->get<string>("VS ID");
|
||||
if (maybe_vs_id.ok()) {
|
||||
dir_path = dir_path + "/vs" + maybe_vs_id.unpack();
|
||||
}
|
||||
|
||||
Singleton::Consume<I_OrchestrationTools>::by<Downloader>()->createDirectory(dir_path);
|
||||
}
|
||||
|
||||
|
||||
@@ -189,14 +189,12 @@ HTTPClient::getFile(const URLParser &url, ofstream &out_file, bool auth_required
|
||||
}
|
||||
|
||||
if (url.isOverSSL()) {
|
||||
auto get_file_over_ssl_res = getFileSSL(url, out_file, token);
|
||||
if (!get_file_over_ssl_res.ok())
|
||||
{
|
||||
//CURL fallback
|
||||
dbgWarning(D_ORCHESTRATOR) << "Failed to get file over SSL. Trying via CURL (SSL).";
|
||||
return curlGetFileOverSSL(url, out_file, token);
|
||||
}
|
||||
return get_file_over_ssl_res;
|
||||
if (getFileSSLDirect(url, out_file, token).ok()) return Maybe<void>();
|
||||
dbgWarning(D_ORCHESTRATOR) << "Failed to get file over SSL directly. Trying indirectly.";
|
||||
if (getFileSSL(url, out_file, token).ok()) return Maybe<void>();
|
||||
//CURL fallback
|
||||
dbgWarning(D_ORCHESTRATOR) << "Failed to get file over SSL. Trying via CURL (SSL).";
|
||||
return curlGetFileOverSSL(url, out_file, token);
|
||||
}
|
||||
auto get_file_http_res = getFileHttp(url, out_file, token);
|
||||
if (!get_file_http_res.ok())
|
||||
|
||||
@@ -34,6 +34,7 @@ public:
|
||||
private:
|
||||
std::string loadCAChainDir();
|
||||
Maybe<void> getFileSSL(const URLParser &url, std::ofstream &out_file, const std::string &_token);
|
||||
Maybe<void> getFileSSLDirect(const URLParser &url, std::ofstream &out_file, const std::string &_token);
|
||||
Maybe<void> getFileHttp(const URLParser &url, std::ofstream &out_file, const std::string &_token);
|
||||
Maybe<void> curlGetFileOverHttp(const URLParser &url, std::ofstream &out_file, const std::string &_token);
|
||||
Maybe<void> curlGetFileOverSSL(const URLParser &url, std::ofstream &out_file, const std::string &_token);
|
||||
|
||||
@@ -90,7 +90,7 @@ public:
|
||||
ostream request_stream(&request_);
|
||||
stringstream http_request;
|
||||
http_request << "GET " << url.getQuery() << " HTTP/1.1\r\n";
|
||||
string host = url.getBaseURL().unpack();
|
||||
string host = url.getHost();
|
||||
string port = url.getPort();
|
||||
int port_int;
|
||||
try {
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "http_client.h"
|
||||
|
||||
Maybe<void>
|
||||
HTTPClient::getFileSSLDirect(const URLParser &, std::ofstream &, const std::string &)
|
||||
{
|
||||
return genError("No direct downloading in open-source");
|
||||
}
|
||||
@@ -47,6 +47,7 @@ HybridModeMetric::upon(const HybridModeMetricEvent &)
|
||||
string cmd_output = maybe_cmd_output.unpack();
|
||||
trim(cmd_output);
|
||||
dbgDebug(D_ORCHESTRATOR) << "Watchdog process counter: " << cmd_output;
|
||||
if (cmd_output.empty()) return;
|
||||
|
||||
try {
|
||||
wd_process_restart.report(stoi(cmd_output));
|
||||
|
||||
@@ -26,7 +26,7 @@ class NamespaceData : public ClientRest
|
||||
{
|
||||
public:
|
||||
bool loadJson(const std::string &json);
|
||||
Maybe<std::string> getNamespaceUidByName(const std::string &name);
|
||||
Maybe<std::string> getNamespaceUidByName(const std::string &name) const;
|
||||
|
||||
private:
|
||||
std::map<std::string, std::string> ns_name_to_uid;
|
||||
|
||||
@@ -21,8 +21,8 @@ class OrchestrationPolicy
|
||||
{
|
||||
public:
|
||||
const std::string & getFogAddress() const;
|
||||
const unsigned long & getSleepInterval() const;
|
||||
const unsigned long & getErrorSleepInterval() const;
|
||||
unsigned int getSleepInterval() const;
|
||||
unsigned int getErrorSleepInterval() const;
|
||||
|
||||
void serialize(cereal::JSONInputArchive & archive);
|
||||
|
||||
@@ -31,8 +31,8 @@ public:
|
||||
|
||||
private:
|
||||
std::string fog_address;
|
||||
unsigned long sleep_interval;
|
||||
unsigned long error_sleep_interval;
|
||||
unsigned int sleep_interval;
|
||||
unsigned int error_sleep_interval;
|
||||
};
|
||||
|
||||
#endif // __ORCHESTRATION_POLICY_H__
|
||||
|
||||
@@ -43,8 +43,8 @@ TEST_F(PolicyTest, serialization)
|
||||
ASSERT_TRUE(false) << "Cereal threw an exception: " << e.what();
|
||||
}
|
||||
|
||||
EXPECT_EQ(15u, orchestration_policy.getErrorSleepInterval());
|
||||
EXPECT_EQ(20u, orchestration_policy.getSleepInterval());
|
||||
EXPECT_EQ(15, orchestration_policy.getErrorSleepInterval());
|
||||
EXPECT_EQ(20, orchestration_policy.getSleepInterval());
|
||||
EXPECT_EQ("http://10.0.0.18:81/control/", orchestration_policy.getFogAddress());
|
||||
}
|
||||
|
||||
@@ -63,8 +63,8 @@ TEST_F(PolicyTest, noAgentType)
|
||||
ASSERT_TRUE(false) << "Cereal threw an exception: " << e.what();
|
||||
}
|
||||
|
||||
EXPECT_EQ(15u, orchestration_policy.getErrorSleepInterval());
|
||||
EXPECT_EQ(20u, orchestration_policy.getSleepInterval());
|
||||
EXPECT_EQ(15, orchestration_policy.getErrorSleepInterval());
|
||||
EXPECT_EQ(20, orchestration_policy.getSleepInterval());
|
||||
EXPECT_EQ("http://10.0.0.18:81/control/", orchestration_policy.getFogAddress());
|
||||
}
|
||||
|
||||
@@ -83,8 +83,8 @@ TEST_F(PolicyTest, zeroSleepIntervels)
|
||||
ASSERT_TRUE(false) << "Cereal threw an exception: " << e.what();
|
||||
}
|
||||
|
||||
EXPECT_EQ(0u, orchestration_policy.getErrorSleepInterval());
|
||||
EXPECT_EQ(0u, orchestration_policy.getSleepInterval());
|
||||
EXPECT_EQ(0, orchestration_policy.getErrorSleepInterval());
|
||||
EXPECT_EQ(0, orchestration_policy.getSleepInterval());
|
||||
EXPECT_EQ("http://10.0.0.18:81/control/", orchestration_policy.getFogAddress());
|
||||
}
|
||||
|
||||
@@ -152,7 +152,7 @@ TEST_F(PolicyTest, newOptionalFields)
|
||||
ASSERT_TRUE(false) << "Cereal threw an exception: " << e.what();
|
||||
}
|
||||
|
||||
EXPECT_EQ(10u, orchestration_policy.getErrorSleepInterval());
|
||||
EXPECT_EQ(30u, orchestration_policy.getSleepInterval());
|
||||
EXPECT_EQ(10, orchestration_policy.getErrorSleepInterval());
|
||||
EXPECT_EQ(30, orchestration_policy.getSleepInterval());
|
||||
EXPECT_EQ("https://fog-api-gw-agents.cloud.ngen.checkpoint.com", orchestration_policy.getFogAddress());
|
||||
}
|
||||
|
||||
@@ -59,6 +59,15 @@ TEST_F(URLParserTest, parseAWSWithoutSlash)
|
||||
EXPECT_EQ("", link.getQuery());
|
||||
}
|
||||
|
||||
TEST_F(URLParserTest, setHost)
|
||||
{
|
||||
URLParser link("http://172.23.92.180:180/something");
|
||||
|
||||
EXPECT_EQ(link.getHost(), "172.23.92.180");
|
||||
link.setHost("my.domain");
|
||||
EXPECT_EQ(link.getHost(), "my.domain");
|
||||
}
|
||||
|
||||
TEST_F(URLParserTest, protocolIsMissing)
|
||||
{
|
||||
// HTTPS is set by default when protocol is not present in URL.
|
||||
|
||||
@@ -22,13 +22,13 @@ OrchestrationPolicy::getFogAddress() const
|
||||
return fog_address;
|
||||
}
|
||||
|
||||
const unsigned long &
|
||||
unsigned int
|
||||
OrchestrationPolicy::getSleepInterval() const
|
||||
{
|
||||
return sleep_interval;
|
||||
}
|
||||
|
||||
const unsigned long &
|
||||
unsigned int
|
||||
OrchestrationPolicy::getErrorSleepInterval() const
|
||||
{
|
||||
return error_sleep_interval;
|
||||
@@ -37,10 +37,13 @@ OrchestrationPolicy::getErrorSleepInterval() const
|
||||
void
|
||||
OrchestrationPolicy::serialize(JSONInputArchive &archive)
|
||||
{
|
||||
// Split it, so the order doesn't matter.
|
||||
archive(make_nvp("fog-address", fog_address));
|
||||
archive(make_nvp("pulling-interval", sleep_interval));
|
||||
archive(make_nvp("error-pulling-interval", error_sleep_interval));
|
||||
try {
|
||||
archive(make_nvp("fog-address", fog_address));
|
||||
archive(make_nvp("pulling-interval", sleep_interval));
|
||||
archive(make_nvp("error-pulling-interval", error_sleep_interval));
|
||||
} catch (const cereal::Exception&) {
|
||||
archive(make_nvp("orchestration", *this));
|
||||
}
|
||||
}
|
||||
|
||||
bool
|
||||
|
||||
@@ -399,7 +399,6 @@ public:
|
||||
if (!write_result) {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Failed to write Orchestration status. File: " << orchestration_status_path;
|
||||
}
|
||||
dbgTrace(D_ORCHESTRATOR) << "Orchestration status file has been updated. File: " << orchestration_status_path;
|
||||
}
|
||||
|
||||
void
|
||||
@@ -459,7 +458,6 @@ public:
|
||||
seconds(5),
|
||||
[this] ()
|
||||
{
|
||||
dbgTrace(D_ORCHESTRATOR) << "Write Orchestration status file <co-routine>";
|
||||
writeStatusToFile();
|
||||
},
|
||||
"Write Orchestration status file"
|
||||
|
||||
@@ -129,6 +129,18 @@ URLParser::parseProtocol(const string &url) const
|
||||
return URLProtocol::HTTPS;
|
||||
}
|
||||
|
||||
string
|
||||
URLParser::getHost() const
|
||||
{
|
||||
return host.empty() ? base_url : host;
|
||||
}
|
||||
|
||||
void
|
||||
URLParser::setHost(const string &new_host)
|
||||
{
|
||||
host = new_host;
|
||||
}
|
||||
|
||||
void
|
||||
URLParser::setQuery(const string &new_query)
|
||||
{
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -108,7 +108,7 @@ NamespaceData::loadJson(const string &json)
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
NamespaceData::getNamespaceUidByName(const string &name)
|
||||
NamespaceData::getNamespaceUidByName(const string &name) const
|
||||
{
|
||||
if (ns_name_to_uid.find(name) == ns_name_to_uid.end()) {
|
||||
return genError("Namespace doesn't exist. Name: " + name);
|
||||
|
||||
@@ -54,7 +54,7 @@ public:
|
||||
bool removeFile(const string &path) const override;
|
||||
bool copyFile(const string &src_path, const string &dst_path) const override;
|
||||
bool doesFileExist(const string &file_path) const override;
|
||||
void getClusterId() const override;
|
||||
void setClusterId() const override;
|
||||
void fillKeyInJson(const string &filename, const string &_key, const string &_val) const override;
|
||||
bool createDirectory(const string &directory_path) const override;
|
||||
bool doesDirectoryExist(const string &dir_path) const override;
|
||||
@@ -143,83 +143,55 @@ isPlaygroundEnv()
|
||||
}
|
||||
|
||||
Maybe<NamespaceData, string>
|
||||
getNamespaceDataFromCluster(const string &path)
|
||||
getNamespaceDataFromCluster()
|
||||
{
|
||||
NamespaceData name_space;
|
||||
string token = Singleton::Consume<I_EnvDetails>::by<OrchestrationTools>()->getToken();
|
||||
auto messaging = Singleton::Consume<I_Messaging>::by<OrchestrationTools>();
|
||||
string auth_header = "Authorization: Bearer " + token;
|
||||
string connection_header = "Connection: close";
|
||||
string host = "https://kubernetes.default.svc:443/api/v1/namespaces/";
|
||||
string culr_cmd = "curl -s -k -H \"" + auth_header + "\" -H \"" + connection_header + "\" " + host +
|
||||
" | /etc/cp/bin/cpnano_json";
|
||||
|
||||
MessageMetadata get_ns_md("kubernetes.default.svc", 443);
|
||||
get_ns_md.insertHeader("Authorization", "Bearer " + token);
|
||||
get_ns_md.insertHeader("Connection", "close");
|
||||
get_ns_md.setConnectioFlag(MessageConnectionConfig::IGNORE_SSL_VALIDATION);
|
||||
auto res = messaging->sendSyncMessage(
|
||||
HTTPMethod::GET,
|
||||
path,
|
||||
name_space,
|
||||
MessageCategory::GENERIC,
|
||||
get_ns_md
|
||||
);
|
||||
auto output_res = Singleton::Consume<I_ShellCmd>::by<OrchestrationTools>()->getExecOutput(culr_cmd);
|
||||
if (!output_res.ok()) {
|
||||
return genError("Failed to get namespace data from the cluster: " + output_res.getErr());
|
||||
}
|
||||
|
||||
if (res.ok()) return name_space;
|
||||
|
||||
return genError(string("Was not able to get object form k8s cluser in path: " + path));
|
||||
dbgTrace(D_ORCHESTRATOR) << "Got the repsonse from the cluster: " << output_res.unpack();
|
||||
NamespaceData name_space;
|
||||
if (name_space.loadJson(output_res.unpack())) return name_space;
|
||||
return genError("Was not able to parse the object form k8s cluser");
|
||||
}
|
||||
|
||||
bool
|
||||
doesClusterIdExists()
|
||||
void
|
||||
OrchestrationTools::Impl::setClusterId() const
|
||||
{
|
||||
auto env_type = Singleton::Consume<I_EnvDetails>::by<OrchestrationTools>()->getEnvType();
|
||||
if (env_type != EnvType::K8S) return;
|
||||
|
||||
dbgTrace(D_ORCHESTRATOR) << "Setting cluster UID";
|
||||
|
||||
Maybe<NamespaceData> namespaces_data = getNamespaceDataFromCluster();
|
||||
if (!namespaces_data.ok()) {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Failed to retrieve namespace data. Error: " << namespaces_data.getErr();
|
||||
return;
|
||||
}
|
||||
|
||||
auto ns_uid = (*namespaces_data).getNamespaceUidByName("kube-system");
|
||||
if (!ns_uid.ok()) {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Failed to retrieve namespace UID. Error: " << ns_uid.getErr();
|
||||
return;
|
||||
}
|
||||
|
||||
string playground_uid = isPlaygroundEnv() ? "playground-" : "";
|
||||
|
||||
dbgTrace(D_ORCHESTRATOR) << "Getting cluster UID";
|
||||
|
||||
auto maybe_namespaces_data = getNamespaceDataFromCluster("/api/v1/namespaces/");
|
||||
|
||||
if (!maybe_namespaces_data.ok()) {
|
||||
dbgWarning(D_ORCHESTRATOR)
|
||||
<< "Failed to retrieve K8S namespace data. Error: "
|
||||
<< maybe_namespaces_data.getErr();
|
||||
return false;
|
||||
}
|
||||
|
||||
NamespaceData namespaces_data = maybe_namespaces_data.unpack();
|
||||
|
||||
Maybe<string> maybe_ns_uid = namespaces_data.getNamespaceUidByName("kube-system");
|
||||
if (!maybe_ns_uid.ok()) {
|
||||
dbgWarning(D_ORCHESTRATOR) << maybe_ns_uid.getErr();
|
||||
return false;
|
||||
}
|
||||
string uid = playground_uid + maybe_ns_uid.unpack();
|
||||
string uid = playground_uid + ns_uid.unpack();
|
||||
dbgTrace(D_ORCHESTRATOR) << "Found k8s cluster UID: " << uid;
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<OrchestrationTools>();
|
||||
env->getConfigurationContext().registerValue<string>(
|
||||
Singleton::Consume<I_Environment>::by<OrchestrationTools>()->getConfigurationContext().registerValue<string>(
|
||||
"k8sClusterId",
|
||||
uid,
|
||||
EnvKeyAttr::LogSection::SOURCE
|
||||
);
|
||||
I_AgentDetails *i_agent_details = Singleton::Consume<I_AgentDetails>::by<OrchestrationTools>();
|
||||
i_agent_details->setClusterId(uid);
|
||||
return true;
|
||||
}
|
||||
|
||||
void
|
||||
OrchestrationTools::Impl::getClusterId() const
|
||||
{
|
||||
auto env_type = Singleton::Consume<I_EnvDetails>::by<OrchestrationTools>()->getEnvType();
|
||||
|
||||
if (env_type == EnvType::K8S) {
|
||||
Singleton::Consume<I_MainLoop>::by<OrchestrationTools>()->addOneTimeRoutine(
|
||||
I_MainLoop::RoutineType::Offline,
|
||||
[this] ()
|
||||
{
|
||||
while(!doesClusterIdExists()) {
|
||||
Singleton::Consume<I_MainLoop>::by<OrchestrationTools>()->yield(chrono::seconds(1));
|
||||
}
|
||||
return;
|
||||
},
|
||||
"Get k8s cluster ID"
|
||||
);
|
||||
}
|
||||
Singleton::Consume<I_AgentDetails>::by<OrchestrationTools>()->setClusterId(uid);
|
||||
}
|
||||
|
||||
bool
|
||||
|
||||
@@ -77,30 +77,23 @@ TEST_F(OrchestrationToolsTest, doNothing)
|
||||
{
|
||||
}
|
||||
|
||||
TEST_F(OrchestrationToolsTest, getClusterId)
|
||||
TEST_F(OrchestrationToolsTest, setClusterId)
|
||||
{
|
||||
EXPECT_CALL(mock_env_details, getToken()).WillOnce(Return("123"));
|
||||
EXPECT_CALL(mock_env_details, getEnvType()).WillOnce(Return(EnvType::K8S));
|
||||
I_MainLoop::Routine routine;
|
||||
EXPECT_CALL(
|
||||
mock_mainloop,
|
||||
addOneTimeRoutine(I_MainLoop::RoutineType::Offline, _, "Get k8s cluster ID", _)
|
||||
).WillOnce(DoAll(SaveArg<1>(&routine), Return(1)));
|
||||
|
||||
string namespaces = getResource("k8s_namespaces.json");
|
||||
EXPECT_CALL(
|
||||
mock_messaging,
|
||||
sendSyncMessage(
|
||||
HTTPMethod::GET,
|
||||
"/api/v1/namespaces/",
|
||||
_,
|
||||
_,
|
||||
_
|
||||
mock_shell_cmd,
|
||||
getExecOutput(
|
||||
"curl -s -k -H \"Authorization: Bearer 123\" -H \"Connection: close\" "
|
||||
"https://kubernetes.default.svc:443/api/v1/namespaces/ | /etc/cp/bin/cpnano_json",
|
||||
200,
|
||||
false
|
||||
)
|
||||
).WillOnce(Return(HTTPResponse(HTTPStatusCode::HTTP_OK, namespaces)));
|
||||
).WillOnce(Return(namespaces));
|
||||
|
||||
i_orchestration_tools->getClusterId();
|
||||
routine();
|
||||
i_orchestration_tools->setClusterId();
|
||||
}
|
||||
|
||||
TEST_F(OrchestrationToolsTest, writeReadTextToFile)
|
||||
|
||||
@@ -24,6 +24,21 @@
|
||||
using namespace testing;
|
||||
using namespace std;
|
||||
|
||||
string host_address = "1.2.3.5";
|
||||
string host_url = "https://" + host_address + "/";
|
||||
Maybe<string> response(
|
||||
string(
|
||||
"{\n"
|
||||
" \"fog-address\": \"" + host_url + "\",\n"
|
||||
" \"agent-type\": \"test\",\n"
|
||||
" \"pulling-interval\": 25,\n"
|
||||
" \"error-pulling-interval\": 15\n"
|
||||
"}"
|
||||
)
|
||||
);
|
||||
string orchestration_policy_file_path = "/etc/cp/conf/orchestration/orchestration.policy";
|
||||
string orchestration_policy_file_path_bk = orchestration_policy_file_path + ".bk";
|
||||
|
||||
class OrchestrationMultitenancyTest : public Test
|
||||
{
|
||||
public:
|
||||
@@ -54,6 +69,11 @@ public:
|
||||
void
|
||||
init()
|
||||
{
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(orchestration_policy_file_path)).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(orchestration_policy_file_path)).WillOnce(Return(response));
|
||||
EXPECT_CALL(mock_status, setFogAddress(host_url)).WillRepeatedly(Return());
|
||||
EXPECT_CALL(mock_orchestration_tools, setClusterId());
|
||||
|
||||
EXPECT_CALL(mock_service_controller, isServiceInstalled("Access Control")).WillRepeatedly(Return(false));
|
||||
|
||||
// This Holding the Main Routine of the Orchestration.
|
||||
@@ -62,8 +82,6 @@ public:
|
||||
addOneTimeRoutine(I_MainLoop::RoutineType::RealTime, _, "Orchestration runner", true)
|
||||
).WillOnce(DoAll(SaveArg<1>(&routine), Return(1)));
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, getClusterId());
|
||||
|
||||
EXPECT_CALL(mock_shell_cmd, getExecOutput("openssl version -d | cut -d\" \" -f2 | cut -d\"\\\"\" -f2", _, _))
|
||||
.WillOnce(Return(string("OpenSSL certificates Directory")));
|
||||
|
||||
@@ -209,7 +227,6 @@ TEST_F(OrchestrationMultitenancyTest, init)
|
||||
|
||||
TEST_F(OrchestrationMultitenancyTest, handle_virtual_resource)
|
||||
{
|
||||
string orchestration_policy_file_path = "/etc/cp/conf/orchestration/orchestration.policy";
|
||||
string manifest_file_path = "/etc/cp/conf/manifest.json";
|
||||
string setting_file_path = "/etc/cp/conf/settings.json";
|
||||
string policy_file_path = "/etc/cp/conf/policy.json";
|
||||
@@ -237,22 +254,6 @@ TEST_F(OrchestrationMultitenancyTest, handle_virtual_resource)
|
||||
init();
|
||||
expectDetailsResolver();
|
||||
|
||||
Maybe<string> response(
|
||||
string(
|
||||
"{\n"
|
||||
" \"fog-address\": \"" + host_url + "\",\n"
|
||||
" \"agent-type\": \"test\",\n"
|
||||
" \"pulling-interval\": 25,\n"
|
||||
" \"error-pulling-interval\": 15\n"
|
||||
"}"
|
||||
)
|
||||
);
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(orchestration_policy_file_path)).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(orchestration_policy_file_path)).WillOnce(Return(response));
|
||||
EXPECT_CALL(mock_message, setFogConnection(host_address, 443, true, MessageCategory::GENERIC))
|
||||
.WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_update_communication, setAddressExtenesion(""));
|
||||
EXPECT_CALL(mock_update_communication, authenticateAgent()).WillOnce(Return(Maybe<void>()));
|
||||
EXPECT_CALL(mock_manifest_controller, loadAfterSelfUpdate()).WillOnce(Return(false));
|
||||
EXPECT_CALL(mock_orchestration_tools, calculateChecksum(Package::ChecksumTypes::SHA256, manifest_file_path))
|
||||
@@ -268,7 +269,11 @@ TEST_F(OrchestrationMultitenancyTest, handle_virtual_resource)
|
||||
.WillOnce(Return(data_checksum));
|
||||
|
||||
EXPECT_CALL(mock_service_controller, getPolicyVersion())
|
||||
.Times(2).WillRepeatedly(ReturnRef(first_policy_version));
|
||||
.Times(3).WillRepeatedly(ReturnRef(first_policy_version));
|
||||
|
||||
map<string, PortNumber> empty_service_to_port_map;
|
||||
EXPECT_CALL(mock_service_controller, getServiceToPortMap()).WillRepeatedly(Return(empty_service_to_port_map));
|
||||
|
||||
|
||||
set<string> active_tenants = { "1236", "1235" };
|
||||
map<string, set<string>> old_tenant_profile_set;
|
||||
|
||||
@@ -26,6 +26,21 @@
|
||||
using namespace testing;
|
||||
using namespace std;
|
||||
|
||||
string host_address = "1.2.3.5";
|
||||
string host_url = "https://" + host_address + "/";
|
||||
Maybe<string> response(
|
||||
string(
|
||||
"{\n"
|
||||
" \"fog-address\": \"" + host_url + "\",\n"
|
||||
" \"agent-type\": \"test\",\n"
|
||||
" \"pulling-interval\": 25,\n"
|
||||
" \"error-pulling-interval\": 15\n"
|
||||
"}"
|
||||
)
|
||||
);
|
||||
string orchestration_policy_file_path = "/etc/cp/conf/orchestration/orchestration.policy";
|
||||
string orchestration_policy_file_path_bk = orchestration_policy_file_path + ".bk";
|
||||
|
||||
class OrchestrationTest : public testing::TestWithParam<bool>
|
||||
{
|
||||
public:
|
||||
@@ -48,14 +63,15 @@ public:
|
||||
void
|
||||
init()
|
||||
{
|
||||
// This Holding the Main Routine of the Orchestration.
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(orchestration_policy_file_path)).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(orchestration_policy_file_path)).WillOnce(Return(response));
|
||||
EXPECT_CALL(mock_status, setFogAddress(host_url)).WillRepeatedly(Return());
|
||||
EXPECT_CALL(mock_orchestration_tools, setClusterId());
|
||||
EXPECT_CALL(
|
||||
mock_ml,
|
||||
addOneTimeRoutine(I_MainLoop::RoutineType::RealTime, _, "Orchestration runner", true)
|
||||
).WillOnce(DoAll(SaveArg<1>(&routine), Return(1)));
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, getClusterId());
|
||||
|
||||
EXPECT_CALL(
|
||||
mock_shell_cmd,
|
||||
getExecOutput("openssl version -d | cut -d\" \" -f2 | cut -d\"\\\"\" -f2", _, _)
|
||||
@@ -90,6 +106,7 @@ public:
|
||||
"/api/v1/agents/events",
|
||||
_,
|
||||
MessageCategory::LOG,
|
||||
_,
|
||||
_
|
||||
)).WillRepeatedly(SaveArg<2>(&message_body));
|
||||
|
||||
@@ -269,8 +286,6 @@ public:
|
||||
NiceMock<MockTimeGet> mock_time_get;
|
||||
::Environment env;
|
||||
string first_policy_version = "";
|
||||
string host_address = "1.2.3.5";
|
||||
string host_url = "https://" + host_address + "/";
|
||||
ConfigComponent config_comp;
|
||||
StrictMock<MockEncryptor> mock_encryptor;
|
||||
NiceMock<MockLogging> mock_log;
|
||||
@@ -489,27 +504,12 @@ TEST_F(OrchestrationTest, check_sending_registration_data)
|
||||
env.init();
|
||||
init();
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(_)).WillOnce(Return(false));
|
||||
Maybe<string> response(
|
||||
string(
|
||||
"{\n"
|
||||
" \"fog-address\": \"" + host_url + "\",\n"
|
||||
" \"agent-type\": \"test\",\n"
|
||||
" \"pulling-interval\": 25,\n"
|
||||
" \"error-pulling-interval\": 15\n"
|
||||
"}"
|
||||
)
|
||||
);
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(_)).WillOnce(Return(response));
|
||||
EXPECT_CALL(mock_service_controller, updateServiceConfiguration(_, _, _, _, _, _))
|
||||
.WillOnce(Return(Maybe<void>()));
|
||||
EXPECT_CALL(mock_message, setFogConnection(_, _, _, _)).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_tools, calculateChecksum(_, _)).WillRepeatedly(Return(string()));
|
||||
EXPECT_CALL(mock_service_controller, getPolicyVersion()).WillRepeatedly(ReturnRef(first_policy_version));
|
||||
EXPECT_CALL(mock_shell_cmd, getExecOutput(_, _, _)).WillRepeatedly(Return(string()));
|
||||
EXPECT_CALL(mock_update_communication, authenticateAgent()).WillOnce(Return(Maybe<void>()));
|
||||
EXPECT_CALL(mock_update_communication, setAddressExtenesion(_));
|
||||
EXPECT_CALL(mock_status, setFogAddress(_));
|
||||
EXPECT_CALL(mock_manifest_controller, loadAfterSelfUpdate()).WillOnce(Return(false));
|
||||
expectDetailsResolver();
|
||||
EXPECT_CALL(mock_update_communication, getUpdate(_));
|
||||
@@ -553,7 +553,6 @@ TEST_F(OrchestrationTest, orchestrationPolicyUpdatRollback)
|
||||
rest,
|
||||
mockRestCall(RestAction::ADD, "proxy", _)
|
||||
).WillOnce(WithArg<2>(Invoke(this, &OrchestrationTest::restHandler)));
|
||||
EXPECT_CALL(mock_status, setFogAddress(host_url)).Times(2);
|
||||
|
||||
string config_json =
|
||||
"{\n"
|
||||
@@ -591,17 +590,6 @@ TEST_F(OrchestrationTest, orchestrationPolicyUpdatRollback)
|
||||
string second_val = "12";
|
||||
string third_val = "13";
|
||||
|
||||
Maybe<string> policy_response(
|
||||
string(
|
||||
"{\n"
|
||||
" \"fog-address\": \"" + host_url + "\",\n"
|
||||
" \"agent-type\": \"test\",\n"
|
||||
" \"pulling-interval\": 25,\n"
|
||||
" \"error-pulling-interval\": 15\n"
|
||||
"}"
|
||||
)
|
||||
);
|
||||
|
||||
Maybe<string> new_policy_response(
|
||||
string(
|
||||
"{\n"
|
||||
@@ -617,20 +605,21 @@ TEST_F(OrchestrationTest, orchestrationPolicyUpdatRollback)
|
||||
EXPECT_CALL(mock_service_controller, mockMoveChangedPolicies()).WillOnce(Return(expected_changed_policies));
|
||||
|
||||
EXPECT_CALL(mock_status, setFogAddress(new_host_url));
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(orchestration_policy_file_path)).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(orchestration_policy_file_path))
|
||||
.WillOnce(Return(true))
|
||||
.WillOnce(Return(true));
|
||||
// Rollback related test: The readFile function is called 3 times:
|
||||
// 1. Read the current policy file
|
||||
// 2. Read the new policy file - The one that should fail
|
||||
// 3. Read the current policy file again - The one that should be restored
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(orchestration_policy_file_path))
|
||||
.WillOnce(Return(policy_response))
|
||||
.WillOnce(Return(new_policy_response))
|
||||
.WillOnce(Return(policy_response));
|
||||
.WillOnce(Return(response));
|
||||
EXPECT_CALL(mock_orchestration_tools, copyFile(new_policy_path, policy_file_path + ".last"))
|
||||
.WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_message, setFogConnection(host_address, 443, true, MessageCategory::GENERIC))
|
||||
.Times(2).WillRepeatedly(Return(true));
|
||||
EXPECT_CALL(mock_update_communication, setAddressExtenesion("")).Times(2);
|
||||
.WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_update_communication, setAddressExtenesion(""));
|
||||
EXPECT_CALL(mock_update_communication, authenticateAgent()).WillOnce(Return(Maybe<void>()));
|
||||
expectDetailsResolver();
|
||||
EXPECT_CALL(mock_manifest_controller, loadAfterSelfUpdate()).WillOnce(Return(false));
|
||||
@@ -648,7 +637,8 @@ TEST_F(OrchestrationTest, orchestrationPolicyUpdatRollback)
|
||||
|
||||
// Rollback related test: After failing to update the policy file, the policy version should be restored
|
||||
EXPECT_CALL(mock_service_controller, getPolicyVersion())
|
||||
.Times(5)
|
||||
.Times(6)
|
||||
.WillOnce(ReturnRef(first_policy_version))
|
||||
.WillOnce(ReturnRef(first_policy_version))
|
||||
.WillOnce(ReturnRef(first_policy_version))
|
||||
.WillOnce(ReturnRef(second_val))
|
||||
@@ -771,7 +761,6 @@ TEST_F(OrchestrationTest, orchestrationPolicyUpdate)
|
||||
rest,
|
||||
mockRestCall(RestAction::ADD, "proxy", _)
|
||||
).WillOnce(WithArg<2>(Invoke(this, &OrchestrationTest::restHandler)));
|
||||
EXPECT_CALL(mock_status, setFogAddress(host_url));
|
||||
|
||||
init();
|
||||
|
||||
@@ -795,17 +784,6 @@ TEST_F(OrchestrationTest, orchestrationPolicyUpdate)
|
||||
string second_val = "12";
|
||||
string third_val = "13";
|
||||
|
||||
Maybe<string> policy_response(
|
||||
string(
|
||||
"{\n"
|
||||
" \"fog-address\": \"" + host_url + "\",\n"
|
||||
" \"agent-type\": \"test\",\n"
|
||||
" \"pulling-interval\": 25,\n"
|
||||
" \"error-pulling-interval\": 15\n"
|
||||
"}"
|
||||
)
|
||||
);
|
||||
|
||||
Maybe<string> new_policy_response(
|
||||
string(
|
||||
"{\n"
|
||||
@@ -823,13 +801,9 @@ TEST_F(OrchestrationTest, orchestrationPolicyUpdate)
|
||||
EXPECT_CALL(mock_status, setFogAddress(new_host_url));
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(orchestration_policy_file_path)).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(orchestration_policy_file_path))
|
||||
.WillOnce(Return(policy_response))
|
||||
.WillOnce(Return(new_policy_response));
|
||||
EXPECT_CALL(mock_orchestration_tools, copyFile(new_policy_path, policy_file_path + ".last"))
|
||||
.WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_message, setFogConnection(host_address, 443, true, MessageCategory::GENERIC))
|
||||
.WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_update_communication, setAddressExtenesion(""));
|
||||
EXPECT_CALL(mock_update_communication, authenticateAgent()).WillOnce(Return(Maybe<void>()));
|
||||
expectDetailsResolver();
|
||||
EXPECT_CALL(mock_manifest_controller, loadAfterSelfUpdate()).WillOnce(Return(false));
|
||||
@@ -846,7 +820,8 @@ TEST_F(OrchestrationTest, orchestrationPolicyUpdate)
|
||||
.WillOnce(Return(data_checksum));
|
||||
|
||||
EXPECT_CALL(mock_service_controller, getPolicyVersion())
|
||||
.Times(4)
|
||||
.Times(5)
|
||||
.WillOnce(ReturnRef(first_policy_version))
|
||||
.WillOnce(ReturnRef(first_policy_version))
|
||||
.WillOnce(ReturnRef(first_policy_version))
|
||||
.WillOnce(ReturnRef(second_val))
|
||||
@@ -938,178 +913,52 @@ TEST_F(OrchestrationTest, orchestrationPolicyUpdate)
|
||||
} catch (const invalid_argument& e) {}
|
||||
}
|
||||
|
||||
TEST_F(OrchestrationTest, startOrchestrationPoliceWithFailures)
|
||||
{
|
||||
waitForRestCall();
|
||||
preload();
|
||||
Maybe<string> msg_err = genError("Failed to send message");
|
||||
EXPECT_CALL(mock_status, setFogAddress(host_url));
|
||||
EXPECT_CALL(
|
||||
rest,
|
||||
mockRestCall(RestAction::ADD, "proxy", _)
|
||||
).WillOnce(WithArg<2>(Invoke(this, &OrchestrationTest::restHandler)));
|
||||
init();
|
||||
string orchestration_policy_file_path = getPolicyConfigPath("orchestration", Config::ConfigFileType::Policy);
|
||||
string orchestration_policy_file_path_bk = orchestration_policy_file_path + ".bk";
|
||||
string manifest_file_path = "/etc/cp/conf/manifest.json";
|
||||
string setting_file_path = "/etc/cp/conf/settings.json";
|
||||
string policy_file_path = "/etc/cp/conf/policy.json";
|
||||
string last_policy_file_path = "/etc/cp/conf/policy.json.last";
|
||||
string data_file_path = "/etc/cp/conf/data.json";
|
||||
|
||||
string host_address = "1.2.3.5";
|
||||
string manifest_checksum = "manifest";
|
||||
string policy_checksum = "policy";
|
||||
string settings_checksum = "settings";
|
||||
string data_checksum = "data";
|
||||
|
||||
Maybe<string> response(
|
||||
string(
|
||||
"{\n"
|
||||
" \"fog-address\": \"" + host_url + "\",\n"
|
||||
" \"agent-type\": \"test\",\n"
|
||||
" \"pulling-interval\": 25,\n"
|
||||
" \"error-pulling-interval\": 15\n"
|
||||
"}"
|
||||
)
|
||||
);
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(orchestration_policy_file_path)).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(orchestration_policy_file_path))
|
||||
.WillOnce(Return(Maybe<string>(genError("Failed"))))
|
||||
.WillOnce(Return(response));
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(orchestration_policy_file_path_bk)).WillOnce(
|
||||
Return(Maybe<string>(genError("Failed")))
|
||||
);
|
||||
|
||||
vector<string> expected_data_types = {};
|
||||
EXPECT_CALL(
|
||||
mock_service_controller,
|
||||
updateServiceConfiguration(policy_file_path, setting_file_path, expected_data_types, "", "", _)
|
||||
).Times(2).WillRepeatedly(Return(Maybe<void>()));
|
||||
|
||||
EXPECT_CALL(mock_message, setFogConnection(host_address, 443, true, MessageCategory::GENERIC))
|
||||
.WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_update_communication, setAddressExtenesion(""));
|
||||
EXPECT_CALL(mock_update_communication, authenticateAgent()).WillOnce(Return(Maybe<void>()));
|
||||
expectDetailsResolver();
|
||||
EXPECT_CALL(mock_manifest_controller, loadAfterSelfUpdate()).WillOnce(Return(false));
|
||||
EXPECT_CALL(mock_orchestration_tools, calculateChecksum(Package::ChecksumTypes::SHA256, manifest_file_path))
|
||||
.WillOnce(Return(manifest_checksum));
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, calculateChecksum(Package::ChecksumTypes::SHA256, setting_file_path))
|
||||
.WillOnce(Return(settings_checksum));
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, calculateChecksum(Package::ChecksumTypes::SHA256, policy_file_path))
|
||||
.WillOnce(Return(policy_checksum));
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, calculateChecksum(Package::ChecksumTypes::SHA256, data_file_path))
|
||||
.WillOnce(Return(data_checksum));
|
||||
|
||||
EXPECT_CALL(mock_service_controller, getPolicyVersion())
|
||||
.Times(2).WillRepeatedly(ReturnRef(first_policy_version));
|
||||
|
||||
EXPECT_CALL(mock_update_communication, getUpdate(_)).WillOnce(
|
||||
Invoke(
|
||||
[&](CheckUpdateRequest &req)
|
||||
{
|
||||
EXPECT_THAT(req.getPolicy(), IsValue(policy_checksum));
|
||||
EXPECT_THAT(req.getSettings(), IsValue(settings_checksum));
|
||||
EXPECT_THAT(req.getManifest(), IsValue(manifest_checksum));
|
||||
EXPECT_THAT(req.getData(), IsValue(data_checksum));
|
||||
req = CheckUpdateRequest("", "", "", "", "", "");
|
||||
return Maybe<void>();
|
||||
}
|
||||
)
|
||||
);
|
||||
|
||||
EXPECT_CALL(mock_status, setLastUpdateAttempt());
|
||||
EXPECT_CALL(
|
||||
mock_status,
|
||||
setFieldStatus(OrchestrationStatusFieldType::LAST_UPDATE, OrchestrationStatusResult::SUCCESS, "")
|
||||
);
|
||||
|
||||
EXPECT_CALL(mock_status, setIsConfigurationUpdated(A<EnumArray<OrchestrationStatusConfigType, bool>>())
|
||||
).WillOnce(
|
||||
Invoke(
|
||||
[](EnumArray<OrchestrationStatusConfigType, bool> arr)
|
||||
{
|
||||
EXPECT_EQ(arr[OrchestrationStatusConfigType::MANIFEST], false);
|
||||
EXPECT_EQ(arr[OrchestrationStatusConfigType::POLICY], false);
|
||||
EXPECT_EQ(arr[OrchestrationStatusConfigType::SETTINGS], false);
|
||||
}
|
||||
)
|
||||
);
|
||||
|
||||
EXPECT_CALL(mock_ml, yield(A<chrono::microseconds>()))
|
||||
.WillOnce(
|
||||
Invoke(
|
||||
[] (chrono::microseconds microseconds)
|
||||
{
|
||||
EXPECT_EQ(1000000, microseconds.count());
|
||||
}
|
||||
)
|
||||
)
|
||||
.WillOnce(
|
||||
Invoke(
|
||||
[] (chrono::microseconds microseconds)
|
||||
{
|
||||
EXPECT_EQ(25000000, microseconds.count());
|
||||
throw invalid_argument("stop while loop");
|
||||
}
|
||||
)
|
||||
);
|
||||
EXPECT_CALL(
|
||||
mock_shell_cmd,
|
||||
getExecOutput(_, _, _)
|
||||
).WillRepeatedly(Return(string("daniel\n1\n")));
|
||||
try {
|
||||
runRoutine();
|
||||
} catch (const invalid_argument& e) {}
|
||||
}
|
||||
|
||||
TEST_F(OrchestrationTest, loadOrchestrationPolicyFromBackup)
|
||||
{
|
||||
EXPECT_CALL(
|
||||
rest,
|
||||
mockRestCall(RestAction::ADD, "proxy", _)
|
||||
).WillOnce(WithArg<2>(Invoke(this, &OrchestrationTest::restHandler)));
|
||||
);
|
||||
waitForRestCall();
|
||||
init();
|
||||
string orchestration_policy_file_path = "/etc/cp/conf/orchestration/orchestration.policy";
|
||||
string orchestration_policy_file_path_bk = orchestration_policy_file_path + ".bk";
|
||||
string manifest_file_path = "/etc/cp/conf/manifest.json";
|
||||
string setting_file_path = "/etc/cp/conf/settings.json";
|
||||
string policy_file_path = "/etc/cp/conf/policy.json";
|
||||
string last_policy_file_path = "/etc/cp/conf/policy.json.last";
|
||||
string data_file_path = "/etc/cp/conf/data.json";
|
||||
|
||||
string host_address = "1.2.3.5";
|
||||
string manifest_checksum = "manifest";
|
||||
string policy_checksum = "policy";
|
||||
string settings_checksum = "settings";
|
||||
string data_checksum = "data";
|
||||
EXPECT_CALL(
|
||||
mock_ml,
|
||||
addOneTimeRoutine(I_MainLoop::RoutineType::RealTime, _, "Orchestration runner", true)
|
||||
);
|
||||
|
||||
Maybe<string> response(
|
||||
string(
|
||||
"{\n"
|
||||
" \"fog-address\": \"https://1.2.3.5/\",\n"
|
||||
" \"agent-type\": \"test\",\n"
|
||||
" \"pulling-interval\": 25,\n"
|
||||
" \"error-pulling-interval\": 15\n"
|
||||
"}"
|
||||
EXPECT_CALL(
|
||||
mock_shell_cmd,
|
||||
getExecOutput("openssl version -d | cut -d\" \" -f2 | cut -d\"\\\"\" -f2", _, _)
|
||||
).WillOnce(Return(string("OpenSSL certificates Directory")));
|
||||
|
||||
EXPECT_CALL(mock_service_controller, isServiceInstalled("Access Control")).WillRepeatedly(
|
||||
InvokeWithoutArgs(
|
||||
[]()
|
||||
{
|
||||
static int count = 0;
|
||||
if (count > 0) return false;
|
||||
count++;
|
||||
return true;
|
||||
}
|
||||
)
|
||||
);
|
||||
|
||||
EXPECT_CALL(mock_status, setFogAddress(host_url));
|
||||
map<string, PortNumber> empty_service_to_port_map;
|
||||
EXPECT_CALL(mock_service_controller, getServiceToPortMap()).WillRepeatedly(Return(empty_service_to_port_map));
|
||||
|
||||
EXPECT_CALL(rest, mockRestCall(RestAction::SHOW, "orchestration-status", _));
|
||||
|
||||
vector<string> expected_data_types = {};
|
||||
EXPECT_CALL(
|
||||
mock_service_controller,
|
||||
updateServiceConfiguration(policy_file_path, setting_file_path, expected_data_types, "", "", _)
|
||||
).WillOnce(Return(Maybe<void>()));
|
||||
rest,
|
||||
mockRestCall(RestAction::SET, "agent-uninstall", _)
|
||||
);
|
||||
|
||||
doEncrypt();
|
||||
EXPECT_CALL(mock_orchestration_tools, loadTenantsFromDir(_)).Times(1);
|
||||
|
||||
EXPECT_CALL(mock_status, setFogAddress(host_url));
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(orchestration_policy_file_path)).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_tools, setClusterId());
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(orchestration_policy_file_path))
|
||||
.WillOnce(Return(Maybe<string>(genError("Failed"))));
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(orchestration_policy_file_path_bk)).WillOnce(Return(response));
|
||||
@@ -1117,81 +966,8 @@ TEST_F(OrchestrationTest, loadOrchestrationPolicyFromBackup)
|
||||
mock_orchestration_tools,
|
||||
copyFile(orchestration_policy_file_path_bk, orchestration_policy_file_path)
|
||||
).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_message, setFogConnection(host_address, 443, true, MessageCategory::GENERIC))
|
||||
.WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_update_communication, setAddressExtenesion(""));
|
||||
EXPECT_CALL(mock_update_communication, authenticateAgent()).WillOnce(Return(Maybe<void>()));
|
||||
expectDetailsResolver();
|
||||
EXPECT_CALL(mock_manifest_controller, loadAfterSelfUpdate()).WillOnce(Return(false));
|
||||
EXPECT_CALL(mock_orchestration_tools, calculateChecksum(Package::ChecksumTypes::SHA256, manifest_file_path))
|
||||
.WillOnce(Return(manifest_checksum));
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, calculateChecksum(Package::ChecksumTypes::SHA256, setting_file_path))
|
||||
.WillOnce(Return(settings_checksum));
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, calculateChecksum(Package::ChecksumTypes::SHA256, policy_file_path))
|
||||
.WillOnce(Return(policy_checksum));
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, calculateChecksum(Package::ChecksumTypes::SHA256, data_file_path))
|
||||
.WillOnce(Return(data_checksum));
|
||||
|
||||
EXPECT_CALL(mock_service_controller, getPolicyVersion())
|
||||
.Times(2).WillRepeatedly(ReturnRef(first_policy_version));
|
||||
EXPECT_CALL(mock_update_communication, getUpdate(_)).WillOnce(
|
||||
Invoke(
|
||||
[&](CheckUpdateRequest &req)
|
||||
{
|
||||
EXPECT_THAT(req.getPolicy(), IsValue(policy_checksum));
|
||||
EXPECT_THAT(req.getSettings(), IsValue(settings_checksum));
|
||||
EXPECT_THAT(req.getManifest(), IsValue(manifest_checksum));
|
||||
EXPECT_THAT(req.getData(), IsValue(data_checksum));
|
||||
req = CheckUpdateRequest("", "", "", "", "", "");
|
||||
return Maybe<void>();
|
||||
}
|
||||
)
|
||||
);
|
||||
|
||||
EXPECT_CALL(mock_status, setLastUpdateAttempt());
|
||||
EXPECT_CALL(
|
||||
mock_status,
|
||||
setFieldStatus(OrchestrationStatusFieldType::LAST_UPDATE, OrchestrationStatusResult::SUCCESS, "")
|
||||
);
|
||||
EXPECT_CALL(mock_status, setIsConfigurationUpdated(A<EnumArray<OrchestrationStatusConfigType, bool>>())
|
||||
).WillOnce(
|
||||
Invoke(
|
||||
[](EnumArray<OrchestrationStatusConfigType, bool> arr)
|
||||
{
|
||||
EXPECT_EQ(arr[OrchestrationStatusConfigType::MANIFEST], false);
|
||||
EXPECT_EQ(arr[OrchestrationStatusConfigType::POLICY], false);
|
||||
EXPECT_EQ(arr[OrchestrationStatusConfigType::SETTINGS], false);
|
||||
}
|
||||
)
|
||||
);
|
||||
EXPECT_CALL(mock_ml, yield(A<chrono::microseconds>()))
|
||||
.WillOnce(
|
||||
Invoke(
|
||||
[] (chrono::microseconds microseconds)
|
||||
{
|
||||
EXPECT_EQ(1000000, microseconds.count());
|
||||
}
|
||||
)
|
||||
)
|
||||
.WillOnce(
|
||||
Invoke(
|
||||
[] (chrono::microseconds microseconds)
|
||||
{
|
||||
EXPECT_EQ(25000000, microseconds.count());
|
||||
throw invalid_argument("stop while loop");
|
||||
}
|
||||
)
|
||||
);
|
||||
EXPECT_CALL(
|
||||
mock_shell_cmd,
|
||||
getExecOutput(_, _, _)
|
||||
).WillRepeatedly(Return(string("daniel\n1\n")));
|
||||
try {
|
||||
runRoutine();
|
||||
} catch (const invalid_argument& e) {}
|
||||
orchestration_comp.init();
|
||||
}
|
||||
|
||||
TEST_F(OrchestrationTest, newServicePolicyUpdate)
|
||||
@@ -1212,7 +988,6 @@ TEST_F(OrchestrationTest, manifestUpdate)
|
||||
).WillOnce(WithArg<2>(Invoke(this, &OrchestrationTest::restHandler)));
|
||||
waitForRestCall();
|
||||
init();
|
||||
string orchestration_policy_file_path = "/etc/cp/conf/orchestration/orchestration.policy";
|
||||
string manifest_file_path = "/etc/cp/conf/manifest.json";
|
||||
string setting_file_path = "/etc/cp/conf/settings.json";
|
||||
string policy_file_path = "/etc/cp/conf/policy.json";
|
||||
@@ -1225,30 +1000,12 @@ TEST_F(OrchestrationTest, manifestUpdate)
|
||||
string settings_checksum= "settings";
|
||||
string data_checksum = "data";
|
||||
|
||||
EXPECT_CALL(mock_status, setFogAddress(host_url));
|
||||
|
||||
Maybe<string> response(
|
||||
string(
|
||||
"{\n"
|
||||
" \"fog-address\": \"" + host_url + "\",\n"
|
||||
" \"agent-type\": \"test\",\n"
|
||||
" \"pulling-interval\": 25,\n"
|
||||
" \"error-pulling-interval\": 15\n"
|
||||
"}"
|
||||
)
|
||||
);
|
||||
|
||||
vector<string> expected_data_types = {};
|
||||
EXPECT_CALL(
|
||||
mock_service_controller,
|
||||
updateServiceConfiguration(policy_file_path, setting_file_path, expected_data_types, "", "", _)
|
||||
).WillOnce(Return(Maybe<void>()));
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(orchestration_policy_file_path)).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(orchestration_policy_file_path)).WillOnce(Return(response));
|
||||
EXPECT_CALL(mock_message, setFogConnection(host_address, 443, true, MessageCategory::GENERIC))
|
||||
.WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_update_communication, setAddressExtenesion(""));
|
||||
EXPECT_CALL(mock_update_communication, authenticateAgent()).WillOnce(Return(Maybe<void>()));
|
||||
expectDetailsResolver();
|
||||
EXPECT_CALL(mock_manifest_controller, loadAfterSelfUpdate()).WillOnce(Return(false));
|
||||
@@ -1265,7 +1022,7 @@ TEST_F(OrchestrationTest, manifestUpdate)
|
||||
.WillOnce(Return(data_checksum));
|
||||
|
||||
EXPECT_CALL(mock_service_controller, getPolicyVersion())
|
||||
.Times(2).WillRepeatedly(ReturnRef(first_policy_version));
|
||||
.Times(3).WillRepeatedly(ReturnRef(first_policy_version));
|
||||
EXPECT_CALL(mock_update_communication, getUpdate(_)).WillOnce(
|
||||
Invoke(
|
||||
[&](CheckUpdateRequest &req)
|
||||
@@ -1345,7 +1102,6 @@ TEST_F(OrchestrationTest, getBadPolicyUpdate)
|
||||
).WillOnce(WithArg<2>(Invoke(this, &OrchestrationTest::restHandler)));
|
||||
waitForRestCall();
|
||||
init();
|
||||
string orchestration_policy_file_path = "/etc/cp/conf/orchestration/orchestration.policy";
|
||||
string manifest_file_path = "/etc/cp/conf/manifest.json";
|
||||
string setting_file_path = "/etc/cp/conf/settings.json";
|
||||
string policy_file_path = "/etc/cp/conf/policy.json";
|
||||
@@ -1358,18 +1114,6 @@ TEST_F(OrchestrationTest, getBadPolicyUpdate)
|
||||
string settings_checksum = "settings";
|
||||
string data_checksum = "data";
|
||||
|
||||
Maybe<string> response(
|
||||
string(
|
||||
"{\n"
|
||||
" \"fog-address\": \"" + host_url + "\",\n"
|
||||
" \"agent-type\": \"test\",\n"
|
||||
" \"pulling-interval\": 25,\n"
|
||||
" \"error-pulling-interval\": 15\n"
|
||||
"}"
|
||||
)
|
||||
);
|
||||
EXPECT_CALL(mock_status, setFogAddress(host_url));
|
||||
|
||||
vector<string> expected_data_types = {};
|
||||
|
||||
EXPECT_CALL(
|
||||
@@ -1379,13 +1123,9 @@ TEST_F(OrchestrationTest, getBadPolicyUpdate)
|
||||
|
||||
set<string> expected_changed_policies = {};
|
||||
EXPECT_CALL(mock_service_controller, mockMoveChangedPolicies()).WillOnce(Return(expected_changed_policies));
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(orchestration_policy_file_path)).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(orchestration_policy_file_path)).WillOnce(Return(response));
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, copyFile(new_policy_path, policy_file_path + ".last"))
|
||||
.WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_message, setFogConnection(host_address, 443, true, MessageCategory::GENERIC))
|
||||
.WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_update_communication, setAddressExtenesion(""));
|
||||
|
||||
EXPECT_CALL(mock_update_communication, authenticateAgent()).WillOnce(Return(Maybe<void>()));
|
||||
expectDetailsResolver();
|
||||
@@ -1420,7 +1160,8 @@ TEST_F(OrchestrationTest, getBadPolicyUpdate)
|
||||
string second_val = "12";
|
||||
string third_val = "13";
|
||||
EXPECT_CALL(mock_service_controller, getPolicyVersion())
|
||||
.Times(3)
|
||||
.Times(4)
|
||||
.WillOnce(ReturnRef(first_policy_version))
|
||||
.WillOnce(ReturnRef(first_policy_version))
|
||||
.WillOnce(ReturnRef(first_policy_version))
|
||||
.WillOnce(ReturnRef(second_val)
|
||||
@@ -1455,7 +1196,7 @@ TEST_F(OrchestrationTest, getBadPolicyUpdate)
|
||||
)
|
||||
);
|
||||
|
||||
EXPECT_CALL(mock_service_controller, getUpdatePolicyVersion()).Times(1).WillOnce(ReturnRef(third_val));
|
||||
EXPECT_CALL(mock_service_controller, getUpdatePolicyVersion()).WillRepeatedly(ReturnRef(third_val));
|
||||
|
||||
EXPECT_CALL(
|
||||
mock_service_controller,
|
||||
@@ -1497,7 +1238,6 @@ TEST_F(OrchestrationTest, failedDownloadSettings)
|
||||
).WillOnce(WithArg<2>(Invoke(this, &OrchestrationTest::restHandler)));
|
||||
waitForRestCall();
|
||||
init();
|
||||
string orchestration_policy_file_path = "/etc/cp/conf/orchestration/orchestration.policy";
|
||||
string manifest_file_path = "/etc/cp/conf/manifest.json";
|
||||
string setting_file_path = "/etc/cp/conf/settings.json";
|
||||
string policy_file_path = "/etc/cp/conf/policy.json";
|
||||
@@ -1510,30 +1250,12 @@ TEST_F(OrchestrationTest, failedDownloadSettings)
|
||||
string settings_checksum = "settings-checksum";
|
||||
string data_checksum = "data";
|
||||
|
||||
Maybe<string> response(
|
||||
string(
|
||||
"{\n"
|
||||
" \"fog-address\": \"" + host_url + "\",\n"
|
||||
" \"agent-type\": \"test\",\n"
|
||||
" \"pulling-interval\": 25,\n"
|
||||
" \"error-pulling-interval\": 15\n"
|
||||
"}"
|
||||
)
|
||||
);
|
||||
EXPECT_CALL(mock_status, setFogAddress(host_url));
|
||||
|
||||
vector<string> expected_data_types = {};
|
||||
EXPECT_CALL(
|
||||
mock_service_controller,
|
||||
updateServiceConfiguration(policy_file_path, setting_file_path, expected_data_types, "", "", _)
|
||||
).WillOnce(Return(Maybe<void>()));
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(orchestration_policy_file_path)).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(orchestration_policy_file_path)).WillOnce(Return(response));
|
||||
EXPECT_CALL(mock_message, setFogConnection(host_address, 443, true, MessageCategory::GENERIC))
|
||||
.WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_update_communication, setAddressExtenesion(""));
|
||||
|
||||
EXPECT_CALL(mock_update_communication, authenticateAgent()).WillOnce(Return(Maybe<void>()));
|
||||
expectDetailsResolver();
|
||||
EXPECT_CALL(mock_manifest_controller, loadAfterSelfUpdate()).WillOnce(Return(false));
|
||||
@@ -1552,7 +1274,7 @@ TEST_F(OrchestrationTest, failedDownloadSettings)
|
||||
Maybe<string> new_policy_checksum(string("111111"));
|
||||
|
||||
EXPECT_CALL(mock_service_controller, getPolicyVersion())
|
||||
.Times(2).WillRepeatedly(ReturnRef(first_policy_version));
|
||||
.Times(3).WillRepeatedly(ReturnRef(first_policy_version));
|
||||
EXPECT_CALL(mock_update_communication, getUpdate(_)).WillOnce(
|
||||
Invoke(
|
||||
[&](CheckUpdateRequest &req)
|
||||
@@ -1651,7 +1373,6 @@ TEST_P(OrchestrationTest, orchestrationFirstRun)
|
||||
).WillOnce(WithArg<2>(Invoke(this, &OrchestrationTest::restHandler)));
|
||||
waitForRestCall();
|
||||
init();
|
||||
string orchestration_policy_file_path = "/etc/cp/conf/orchestration/orchestration.policy";
|
||||
string manifest_file_path = "/etc/cp/conf/manifest.json";
|
||||
string setting_file_path = "/etc/cp/conf/settings.json";
|
||||
string policy_file_path = "/etc/cp/conf/policy.json";
|
||||
@@ -1668,26 +1389,6 @@ TEST_P(OrchestrationTest, orchestrationFirstRun)
|
||||
string policy = "";
|
||||
string setting = "";
|
||||
|
||||
Maybe<string> response(
|
||||
string(
|
||||
"{\n"
|
||||
" \"fog-address\": \"" + host_url + "\",\n"
|
||||
" \"agent-type\": \"test\",\n"
|
||||
" \"pulling-interval\": 25,\n"
|
||||
" \"error-pulling-interval\": 15\n"
|
||||
"}"
|
||||
)
|
||||
);
|
||||
|
||||
EXPECT_CALL(mock_status, setFogAddress(host_url));
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(orchestration_policy_file_path)).WillOnce(Return(false));
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(orchestration_policy_file_path))
|
||||
.WillOnce(Return(response));
|
||||
EXPECT_CALL(mock_message, setFogConnection(host_address, 443, true, MessageCategory::GENERIC)).
|
||||
Times(1).
|
||||
WillRepeatedly(Return(true));
|
||||
EXPECT_CALL(mock_update_communication, setAddressExtenesion(""));
|
||||
|
||||
EXPECT_CALL(mock_update_communication, authenticateAgent()).WillOnce(Return(Maybe<void>()));
|
||||
expectDetailsResolver();
|
||||
EXPECT_CALL(mock_manifest_controller, loadAfterSelfUpdate()).WillOnce(Return(true));
|
||||
@@ -1720,7 +1421,7 @@ TEST_P(OrchestrationTest, orchestrationFirstRun)
|
||||
}
|
||||
)
|
||||
);
|
||||
EXPECT_CALL(mock_service_controller, getPolicyVersion()).WillOnce(ReturnRef(first_policy_version));
|
||||
EXPECT_CALL(mock_service_controller, getPolicyVersion()).WillRepeatedly(ReturnRef(first_policy_version));
|
||||
EXPECT_CALL(mock_update_communication, getUpdate(_)).WillOnce(
|
||||
Invoke(
|
||||
[&](CheckUpdateRequest &req)
|
||||
@@ -1853,7 +1554,6 @@ TEST_F(OrchestrationTest, set_proxy)
|
||||
mockRestCall(RestAction::ADD, "proxy", _)
|
||||
).WillOnce(WithArg<2>(Invoke(this, &OrchestrationTest::restHandler)));
|
||||
waitForRestCall();
|
||||
|
||||
init();
|
||||
stringstream is;
|
||||
string proxy_url = "http://some-proxy.com:8080";
|
||||
@@ -1872,7 +1572,7 @@ TEST_F(OrchestrationTest, dataUpdate)
|
||||
).WillOnce(WithArg<2>(Invoke(this, &OrchestrationTest::restHandler)));
|
||||
waitForRestCall();
|
||||
init();
|
||||
string orchestration_policy_file_path = "/etc/cp/conf/orchestration/orchestration.policy";
|
||||
|
||||
string manifest_file_path = "/etc/cp/conf/manifest.json";
|
||||
string setting_file_path = "/etc/cp/conf/settings.json";
|
||||
string policy_file_path = "/etc/cp/conf/policy.json";
|
||||
@@ -1889,19 +1589,6 @@ TEST_F(OrchestrationTest, dataUpdate)
|
||||
string data_checksum_type = "sha1sum";
|
||||
string data_instance_checksum = "8d4a5709673a05b380ba7d6567e28910019118f5";
|
||||
|
||||
EXPECT_CALL(mock_status, setFogAddress(host_url));
|
||||
|
||||
Maybe<string> policy_response(
|
||||
string(
|
||||
"{\n"
|
||||
" \"fog-address\": \"" + host_url + "\",\n"
|
||||
" \"agent-type\": \"test\",\n"
|
||||
" \"pulling-interval\": 25,\n"
|
||||
" \"error-pulling-interval\": 15\n"
|
||||
"}"
|
||||
)
|
||||
);
|
||||
|
||||
Maybe<string> data_response(
|
||||
string(
|
||||
"{\n"
|
||||
@@ -1928,14 +1615,8 @@ TEST_F(OrchestrationTest, dataUpdate)
|
||||
).After(expectation_set).WillOnce(Return(Maybe<void>()));
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, doesDirectoryExist("/etc/cp/conf/data")).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(orchestration_policy_file_path)).WillOnce(Return(policy_response));
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(data_file_path + ".download")).WillOnce(Return(data_response));
|
||||
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(orchestration_policy_file_path)).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_message, setFogConnection(host_address, 443, true, MessageCategory::GENERIC))
|
||||
.WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_update_communication, setAddressExtenesion(""));
|
||||
EXPECT_CALL(mock_update_communication, authenticateAgent()).WillOnce(Return(Maybe<void>()));
|
||||
EXPECT_CALL(mock_manifest_controller, loadAfterSelfUpdate()).WillOnce(Return(false));
|
||||
expectDetailsResolver();
|
||||
@@ -1954,8 +1635,7 @@ TEST_F(OrchestrationTest, dataUpdate)
|
||||
EXPECT_CALL(mock_orchestration_tools, calculateChecksum(Package::ChecksumTypes::SHA256, "/path/ips"))
|
||||
.WillOnce(Return(data_instance_checksum));
|
||||
|
||||
EXPECT_CALL(mock_service_controller, getPolicyVersion())
|
||||
.Times(2).WillRepeatedly(ReturnRef(first_policy_version));
|
||||
EXPECT_CALL(mock_service_controller, getPolicyVersion()).WillRepeatedly(ReturnRef(first_policy_version));
|
||||
EXPECT_CALL(mock_update_communication, getUpdate(_)).WillOnce(
|
||||
Invoke(
|
||||
[&](CheckUpdateRequest &req)
|
||||
|
||||
@@ -109,6 +109,10 @@ packageHandlerActionsToString(PackageHandlerActions action)
|
||||
installation_mode += " --certs-dir ";
|
||||
installation_mode += trusted_ca_directory.unpack();
|
||||
}
|
||||
|
||||
auto maybe_vs_id = Singleton::Consume<I_Environment>::by<PackageHandler>()->get<string>("VS ID");
|
||||
if (maybe_vs_id.ok()) installation_mode += " --vs_id " + *maybe_vs_id;
|
||||
|
||||
AdditionalFlagsConfiguration additional_flags = getConfigurationWithDefault<AdditionalFlagsConfiguration>(
|
||||
AdditionalFlagsConfiguration(),
|
||||
"orchestration",
|
||||
|
||||
@@ -33,7 +33,7 @@
|
||||
using namespace std;
|
||||
using namespace ReportIS;
|
||||
|
||||
USE_DEBUG_FLAG(D_ORCHESTRATOR);
|
||||
USE_DEBUG_FLAG(D_SERVICE_CONTROLLER);
|
||||
|
||||
class SendConfigurations : public ClientRest
|
||||
{
|
||||
@@ -56,7 +56,7 @@ public:
|
||||
auto service_controller = Singleton::Consume<I_ServiceController>::by<ServiceReconfStatusMonitor>();
|
||||
if (!finished.get()) {
|
||||
service_controller->updateReconfStatus(id.get(), service_name.get(), ReconfStatus::IN_PROGRESS);
|
||||
dbgTrace(D_ORCHESTRATOR)
|
||||
dbgTrace(D_SERVICE_CONTROLLER)
|
||||
<< "Request for service reconfiguration is still in progress. ID: "
|
||||
<< id.get()
|
||||
<< ", Service Name: "
|
||||
@@ -65,7 +65,7 @@ public:
|
||||
}
|
||||
if (error.get()) {
|
||||
service_controller->updateReconfStatus(id.get(), service_name.get(), ReconfStatus::FAILED);
|
||||
dbgError(D_ORCHESTRATOR)
|
||||
dbgError(D_SERVICE_CONTROLLER)
|
||||
<< "Request for service reconfiguration failed to complete. ID: "
|
||||
<< id.get()
|
||||
<< ", Service Name: "
|
||||
@@ -75,7 +75,7 @@ public:
|
||||
return;
|
||||
}
|
||||
service_controller->updateReconfStatus(id.get(), service_name.get(), ReconfStatus::SUCCEEDED);
|
||||
dbgInfo(D_ORCHESTRATOR)
|
||||
dbgInfo(D_SERVICE_CONTROLLER)
|
||||
<< "Request for service reconfiguration successfully accomplished. Reconf ID: "
|
||||
<< id.get()
|
||||
<< ", Service Name: "
|
||||
@@ -112,7 +112,7 @@ ServiceDetails::isServiceActive() const
|
||||
}
|
||||
}
|
||||
|
||||
dbgDebug(D_ORCHESTRATOR)
|
||||
dbgDebug(D_SERVICE_CONTROLLER)
|
||||
<< "Executing service status check via watchdog api. Service name: "
|
||||
<< service_name
|
||||
<< ", Watchdog command: "
|
||||
@@ -133,7 +133,7 @@ ServiceDetails::isServiceActive() const
|
||||
for (int current_attempt = 0; current_attempt < max_retry_attempts; ++current_attempt) {
|
||||
if (service_status.ok() || service_status.getErr().find("Reached timeout") == string::npos) break;
|
||||
|
||||
dbgWarning(D_ORCHESTRATOR)
|
||||
dbgWarning(D_SERVICE_CONTROLLER)
|
||||
<< "Retrying to execute service status check via watchdog API after getting timeout. Service name: "
|
||||
<< service_name
|
||||
<< ", Watchdog command: "
|
||||
@@ -146,7 +146,7 @@ ServiceDetails::isServiceActive() const
|
||||
}
|
||||
|
||||
if (!service_status.ok()) {
|
||||
dbgWarning(D_ORCHESTRATOR)
|
||||
dbgWarning(D_SERVICE_CONTROLLER)
|
||||
<< "Changing service status to inactive after failure to its status from watchdog. Service name: "
|
||||
<< service_name
|
||||
<< ", Watchdog output: "
|
||||
@@ -154,7 +154,7 @@ ServiceDetails::isServiceActive() const
|
||||
return false;
|
||||
}
|
||||
|
||||
dbgDebug(D_ORCHESTRATOR)
|
||||
dbgDebug(D_SERVICE_CONTROLLER)
|
||||
<< "Successfully retrieved service status from watchdog. Service name: "
|
||||
<< service_name
|
||||
<< ", Watchdog output: "
|
||||
@@ -166,7 +166,7 @@ ServiceDetails::isServiceActive() const
|
||||
bool is_registered = status.find("not-registered") == string::npos && status.find("registered") != string::npos;
|
||||
bool is_running = status.find("not-running") == string::npos && status.find("running") != string::npos;
|
||||
|
||||
dbgTrace(D_ORCHESTRATOR)
|
||||
dbgTrace(D_SERVICE_CONTROLLER)
|
||||
<< "Successfully set service status. Service name: "
|
||||
<< service_name
|
||||
<< ", Status: "
|
||||
@@ -189,7 +189,7 @@ ReconfStatus
|
||||
ServiceDetails::sendNewConfigurations(int configuration_id, const string &policy_version)
|
||||
{
|
||||
if(!isServiceActive()) {
|
||||
dbgDebug(D_ORCHESTRATOR) << "Service " << service_name << " is inactive";
|
||||
dbgDebug(D_SERVICE_CONTROLLER) << "Service " << service_name << " is inactive";
|
||||
return ReconfStatus::INACTIVE;
|
||||
}
|
||||
|
||||
@@ -210,7 +210,7 @@ ServiceDetails::sendNewConfigurations(int configuration_id, const string &policy
|
||||
|
||||
if (!res.ok()) {
|
||||
auto err = res.getErr();
|
||||
dbgDebug(D_ORCHESTRATOR)
|
||||
dbgDebug(D_SERVICE_CONTROLLER)
|
||||
<< "Service: "
|
||||
<< service_name
|
||||
<< " didn't get new configuration. Error: "
|
||||
@@ -223,7 +223,7 @@ ServiceDetails::sendNewConfigurations(int configuration_id, const string &policy
|
||||
if (new_config.finished.get()) {
|
||||
if (!new_config.error.get()) {
|
||||
service_details->startReconfStatus(new_config.id.get(), ReconfStatus::SUCCEEDED, service_name, service_id);
|
||||
dbgDebug(D_ORCHESTRATOR) << "Loading service configuration succeeded for service " << service_name;
|
||||
dbgDebug(D_SERVICE_CONTROLLER) << "Loading service configuration succeeded for service " << service_name;
|
||||
return ReconfStatus::SUCCEEDED;
|
||||
} else {
|
||||
string log_name = "Agent could not update policy to version " +
|
||||
@@ -241,7 +241,7 @@ ServiceDetails::sendNewConfigurations(int configuration_id, const string &policy
|
||||
<< LogField("policyVersion", service_details->getPolicyVersion());
|
||||
|
||||
service_details->startReconfStatus(new_config.id.get(), ReconfStatus::FAILED, service_name, service_id);
|
||||
dbgDebug(D_ORCHESTRATOR)
|
||||
dbgDebug(D_SERVICE_CONTROLLER)
|
||||
<< "Loading service configuration failed for service "
|
||||
<< service_name
|
||||
<< " with error: "
|
||||
@@ -249,7 +249,7 @@ ServiceDetails::sendNewConfigurations(int configuration_id, const string &policy
|
||||
return ReconfStatus::FAILED;
|
||||
}
|
||||
}
|
||||
dbgDebug(D_ORCHESTRATOR) << "Loading service configuration is in progress for service: " << service_name;
|
||||
dbgDebug(D_SERVICE_CONTROLLER) << "Loading service configuration is in progress for service: " << service_name;
|
||||
service_details->startReconfStatus(new_config.id.get(), ReconfStatus::IN_PROGRESS, service_name, service_id);
|
||||
return ReconfStatus::IN_PROGRESS;
|
||||
}
|
||||
@@ -257,7 +257,7 @@ ServiceDetails::sendNewConfigurations(int configuration_id, const string &policy
|
||||
void
|
||||
SetNanoServiceConfig::doCall()
|
||||
{
|
||||
dbgFlow(D_ORCHESTRATOR)
|
||||
dbgFlow(D_SERVICE_CONTROLLER)
|
||||
<< "Received registration request from service. Service name: "
|
||||
<< service_name.get()
|
||||
<< ", service listening port: "
|
||||
@@ -402,12 +402,12 @@ ServiceController::Impl::getUpdatedReconfStatus()
|
||||
auto maybe_service = getServiceDetails(service_id);
|
||||
|
||||
if (!maybe_service.ok()) {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Unable to get service details. Error: " << maybe_service.getErr();
|
||||
dbgWarning(D_SERVICE_CONTROLLER) << "Unable to get service details. Error: " << maybe_service.getErr();
|
||||
continue;
|
||||
}
|
||||
|
||||
if (!maybe_service.unpack().isServiceActive()) {
|
||||
dbgInfo(D_ORCHESTRATOR)
|
||||
dbgInfo(D_SERVICE_CONTROLLER)
|
||||
<< "Service is not active, removing from registered services list. Service: "
|
||||
<< services_reconf_names[service_and_reconf_status.first]
|
||||
<< "ID: "
|
||||
@@ -490,7 +490,7 @@ ServiceController::Impl::loadRegisteredServicesFromFile()
|
||||
auto maybe_registered_services_str = Singleton::Consume<I_OrchestrationTools>::by<ServiceController::Impl>()->
|
||||
readFile(registered_services_file);
|
||||
if (!maybe_registered_services_str.ok()) {
|
||||
dbgTrace(D_ORCHESTRATOR)
|
||||
dbgTrace(D_SERVICE_CONTROLLER)
|
||||
<< "could not read file. File: "
|
||||
<< registered_services_file
|
||||
<< " Error: " << maybe_registered_services_str.getErr();
|
||||
@@ -501,7 +501,7 @@ ServiceController::Impl::loadRegisteredServicesFromFile()
|
||||
cereal::JSONInputArchive ar(ss);
|
||||
ar(cereal::make_nvp("Registered Services", pending_services));
|
||||
|
||||
dbgInfo(D_ORCHESTRATOR)
|
||||
dbgInfo(D_SERVICE_CONTROLLER)
|
||||
<< "Orchestration pending services loaded from file."
|
||||
<< " File: "
|
||||
<< registered_services_file
|
||||
@@ -509,7 +509,7 @@ ServiceController::Impl::loadRegisteredServicesFromFile()
|
||||
|
||||
for (const auto &id_service_pair : pending_services) {
|
||||
const auto &service = id_service_pair.second;
|
||||
dbgInfo(D_ORCHESTRATOR)
|
||||
dbgInfo(D_SERVICE_CONTROLLER)
|
||||
<< "Service name: "
|
||||
<< service.getServiceName()
|
||||
<< ", Service ID: "
|
||||
@@ -522,7 +522,7 @@ ServiceController::Impl::loadRegisteredServicesFromFile()
|
||||
void
|
||||
ServiceController::Impl::writeRegisteredServicesToFile()
|
||||
{
|
||||
dbgFlow(D_ORCHESTRATOR);
|
||||
dbgFlow(D_SERVICE_CONTROLLER);
|
||||
auto registered_services_file = getConfigurationWithDefault<string>(
|
||||
filesystem_prefix + "/conf/orchestrations_registered_services.json",
|
||||
"orchestration",
|
||||
@@ -533,14 +533,14 @@ ServiceController::Impl::writeRegisteredServicesToFile()
|
||||
cereal::JSONOutputArchive ar(ss);
|
||||
ar(cereal::make_nvp("Registered Services", registered_services));
|
||||
|
||||
dbgInfo(D_ORCHESTRATOR)
|
||||
dbgInfo(D_SERVICE_CONTROLLER)
|
||||
<< "Orchestration registered services file has been updated. File: "
|
||||
<< registered_services_file
|
||||
<< ". Registered Services:";
|
||||
|
||||
for (const auto &id_service_pair : registered_services) {
|
||||
const auto &service = id_service_pair.second;
|
||||
dbgInfo(D_ORCHESTRATOR)
|
||||
dbgInfo(D_SERVICE_CONTROLLER)
|
||||
<< "Service name: "
|
||||
<< service.getServiceName()
|
||||
<< ", Service ID: "
|
||||
@@ -626,6 +626,7 @@ ServiceController::Impl::registerServiceConfig(
|
||||
|
||||
pending_services.erase(service_config.getServiceID());
|
||||
pending_services.insert({service_config.getServiceID(), service_config});
|
||||
refreshPendingServices();
|
||||
}
|
||||
|
||||
bool
|
||||
@@ -639,12 +640,12 @@ ServiceController::Impl::isServiceInstalled(const string &service_name)
|
||||
void
|
||||
ServiceController::Impl::refreshPendingServices()
|
||||
{
|
||||
dbgFlow(D_ORCHESTRATOR);
|
||||
dbgFlow(D_SERVICE_CONTROLLER);
|
||||
if (pending_services.empty()) return;
|
||||
for (const auto &service : pending_services) {
|
||||
registered_services.erase(service.first);
|
||||
registered_services.insert({service.first, service.second});
|
||||
dbgDebug(D_ORCHESTRATOR) << "Successfully registered service. Name: " << service.first;
|
||||
dbgDebug(D_SERVICE_CONTROLLER) << "Successfully registered service. Name: " << service.first;
|
||||
}
|
||||
pending_services.clear();
|
||||
|
||||
@@ -659,7 +660,7 @@ ServiceController::Impl::backupConfigurationFile(const string &config_file_path)
|
||||
string backup_file = config_file_path + backup_ext;
|
||||
|
||||
if (!orchestration_tools->doesFileExist(config_file_path)) {
|
||||
dbgTrace(D_ORCHESTRATOR) << "File does not exist. File: " << config_file_path;
|
||||
dbgTrace(D_SERVICE_CONTROLLER) << "File does not exist. File: " << config_file_path;
|
||||
return true;
|
||||
}
|
||||
|
||||
@@ -670,7 +671,7 @@ ServiceController::Impl::backupConfigurationFile(const string &config_file_path)
|
||||
mainloop->yield(false);
|
||||
}
|
||||
|
||||
dbgWarning(D_ORCHESTRATOR) << "Failed to back up the file. File: " << config_file_path;
|
||||
dbgWarning(D_SERVICE_CONTROLLER) << "Failed to back up the file. File: " << config_file_path;
|
||||
return false;
|
||||
}
|
||||
|
||||
@@ -692,12 +693,12 @@ ServiceController::Impl::createDirectoryForChildTenant(
|
||||
if (orchestration_tools->doesDirectoryExist(dir)) return true;
|
||||
|
||||
if (!orchestration_tools->createDirectory(dir)) {
|
||||
dbgError(D_ORCHESTRATOR)
|
||||
dbgError(D_SERVICE_CONTROLLER)
|
||||
<< "Failed to create configuration directory for tenant "
|
||||
<< child_tenant_id;
|
||||
return false;
|
||||
}
|
||||
dbgTrace(D_ORCHESTRATOR) << "Created new configuration directory for tenant " << child_tenant_id;
|
||||
dbgTrace(D_SERVICE_CONTROLLER) << "Created new configuration directory for tenant " << child_tenant_id;
|
||||
return true;
|
||||
}
|
||||
|
||||
@@ -716,7 +717,7 @@ getChecksum(const string &file_path)
|
||||
try {
|
||||
checksum = to_string(boost::uuids::random_generator()());
|
||||
} catch (const boost::uuids::entropy_error &e) {
|
||||
dbgDebug(D_ORCHESTRATOR) << "Couldn't generate random checksum";
|
||||
dbgDebug(D_SERVICE_CONTROLLER) << "Couldn't generate random checksum";
|
||||
}
|
||||
return checksum;
|
||||
}
|
||||
@@ -734,7 +735,7 @@ ServiceController::Impl::updateServiceConfiguration(
|
||||
if (!child_tenant_id.empty()) {
|
||||
tenant_and_profile_ids = " Child tenant id: " + child_tenant_id + ", Child profile id: " + child_profile_id;
|
||||
}
|
||||
dbgFlow(D_ORCHESTRATOR)
|
||||
dbgFlow(D_SERVICE_CONTROLLER)
|
||||
<< "new_policy_path: "
|
||||
<< new_policy_path
|
||||
<< ", new_settings_path: "
|
||||
@@ -758,9 +759,9 @@ ServiceController::Impl::updateServiceConfiguration(
|
||||
}
|
||||
|
||||
for (const string &data : new_data_files) {
|
||||
dbgTrace(D_ORCHESTRATOR) << "data: " << data;
|
||||
dbgTrace(D_SERVICE_CONTROLLER) << "data: " << data;
|
||||
if (service.second.isConfigurationRelevant(data)) {
|
||||
dbgTrace(D_ORCHESTRATOR)
|
||||
dbgTrace(D_SERVICE_CONTROLLER)
|
||||
<< "data has relevant configuration, will update the service: "
|
||||
<< service.first;
|
||||
nano_services_to_update.insert(service.first);
|
||||
@@ -770,7 +771,8 @@ ServiceController::Impl::updateServiceConfiguration(
|
||||
}
|
||||
|
||||
if (new_policy_path == "") {
|
||||
dbgDebug(D_ORCHESTRATOR) << "Policy file was not updated. Sending reload command regarding settings and data";
|
||||
dbgDebug(D_SERVICE_CONTROLLER)
|
||||
<< "Policy file was not updated. Sending reload command regarding settings and data";
|
||||
auto signal_services = sendSignalForServices(nano_services_to_update, "");
|
||||
if (!signal_services.ok()) return signal_services.passErr();
|
||||
Singleton::Consume<I_DeclarativePolicy>::from<DeclarativePolicyUtils>()->turnOffApplyPolicyFlag();
|
||||
@@ -779,7 +781,7 @@ ServiceController::Impl::updateServiceConfiguration(
|
||||
|
||||
Maybe<string> loaded_policy_json = orchestration_tools->readFile(new_policy_path);
|
||||
if (!loaded_policy_json.ok()) {
|
||||
dbgWarning(D_ORCHESTRATOR)
|
||||
dbgWarning(D_SERVICE_CONTROLLER)
|
||||
<< "Failed to load new file: "
|
||||
<< new_policy_path
|
||||
<< ". Error: "
|
||||
@@ -795,7 +797,7 @@ ServiceController::Impl::updateServiceConfiguration(
|
||||
);
|
||||
|
||||
if (!all_security_policies.ok()) {
|
||||
dbgWarning(D_ORCHESTRATOR)
|
||||
dbgWarning(D_SERVICE_CONTROLLER)
|
||||
<< "Failed to parse json file: "
|
||||
<< new_policy_path
|
||||
<< ". Error: "
|
||||
@@ -825,13 +827,13 @@ ServiceController::Impl::updateServiceConfiguration(
|
||||
if (child_tenant_id.empty() && single_policy.first == versions_param) {
|
||||
//In a multi-tenant env, only the parent should handle the versions parameter
|
||||
policy_versions = single_policy.second;
|
||||
dbgWarning(D_ORCHESTRATOR) << "Found versions parameter in policy file:" << policy_versions;
|
||||
dbgWarning(D_SERVICE_CONTROLLER) << "Found versions parameter in policy file:" << policy_versions;
|
||||
}
|
||||
|
||||
dbgDebug(D_ORCHESTRATOR) << "Starting to update policy file. Policy type: " << single_policy.first;
|
||||
dbgDebug(D_SERVICE_CONTROLLER) << "Starting to update policy file. Policy type: " << single_policy.first;
|
||||
|
||||
if (!createDirectoryForChildTenant(child_tenant_id, child_profile_id)) {
|
||||
dbgWarning(D_ORCHESTRATOR)
|
||||
dbgWarning(D_SERVICE_CONTROLLER)
|
||||
<< "Failed to create directory for child. Tenant id: " << child_tenant_id
|
||||
<< ", Profile id: " << child_profile_id;
|
||||
return genError("Failed to create directory for child tenant");
|
||||
@@ -861,7 +863,7 @@ ServiceController::Impl::updateServiceConfiguration(
|
||||
}
|
||||
changed_policy_files.insert(policy_file_path);
|
||||
|
||||
dbgInfo(D_ORCHESTRATOR) << "Successfully updated policy file. Policy name: " << single_policy.first;
|
||||
dbgInfo(D_SERVICE_CONTROLLER) << "Successfully updated policy file. Policy name: " << single_policy.first;
|
||||
|
||||
auto orc_status = Singleton::Consume<I_OrchestrationStatus>::by<ServiceController>();
|
||||
orc_status->setServiceConfiguration(
|
||||
@@ -878,7 +880,9 @@ ServiceController::Impl::updateServiceConfiguration(
|
||||
for (const auto &instance_id: instances) {
|
||||
auto relevant_service = registered_services.find(instance_id);
|
||||
if (relevant_service == registered_services.end()) {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Could not find registered service. Service Id: " << instance_id;
|
||||
dbgWarning(D_SERVICE_CONTROLLER)
|
||||
<< "Could not find registered service. Service Id: "
|
||||
<< instance_id;
|
||||
continue;
|
||||
}
|
||||
if (relevant_service->second.isConfigurationRelevant(single_policy.first)) {
|
||||
@@ -902,7 +906,7 @@ ServiceController::Impl::updateServiceConfiguration(
|
||||
if (!is_send_signal_for_services.ok()) send_signal_for_services_err = is_send_signal_for_services.getErr();
|
||||
}
|
||||
|
||||
dbgTrace(D_ORCHESTRATOR) << "was policy updated: " << (was_policy_updated ? "true" : "false");
|
||||
dbgTrace(D_SERVICE_CONTROLLER) << "was policy updated: " << (was_policy_updated ? "true" : "false");
|
||||
|
||||
if (was_policy_updated) {
|
||||
string base_path =
|
||||
@@ -916,14 +920,14 @@ ServiceController::Impl::updateServiceConfiguration(
|
||||
);
|
||||
|
||||
if (new_policy_path.compare(config_file_path) == 0) {
|
||||
dbgDebug(D_ORCHESTRATOR) << "Enforcing the default policy file";
|
||||
dbgDebug(D_SERVICE_CONTROLLER) << "Enforcing the default policy file";
|
||||
policy_version = version_value;
|
||||
Singleton::Consume<I_DeclarativePolicy>::from<DeclarativePolicyUtils>()->turnOffApplyPolicyFlag();
|
||||
return Maybe<void>();
|
||||
}
|
||||
|
||||
if (!backupConfigurationFile(config_file_path)) {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Failed to backup the policy file.";
|
||||
dbgWarning(D_SERVICE_CONTROLLER) << "Failed to backup the policy file.";
|
||||
return genError("Failed to backup the policy file.");
|
||||
}
|
||||
|
||||
@@ -931,7 +935,7 @@ ServiceController::Impl::updateServiceConfiguration(
|
||||
|
||||
// Save the new configuration file.
|
||||
if (!orchestration_tools->copyFile(new_policy_path, config_file_path)) {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Failed to save the policy file.";
|
||||
dbgWarning(D_SERVICE_CONTROLLER) << "Failed to save the policy file.";
|
||||
return genError("Failed to save the policy file.");
|
||||
}
|
||||
}
|
||||
@@ -946,11 +950,11 @@ ServiceController::Impl::sendSignalForServices(
|
||||
const set<string> &nano_services_to_update,
|
||||
const string &policy_version_to_update)
|
||||
{
|
||||
dbgFlow(D_ORCHESTRATOR);
|
||||
dbgFlow(D_SERVICE_CONTROLLER);
|
||||
for (auto &service_id : nano_services_to_update) {
|
||||
auto nano_service = registered_services.find(service_id);
|
||||
if (nano_service == registered_services.end()) {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Could not find registered service. Service Id: " << service_id;
|
||||
dbgWarning(D_SERVICE_CONTROLLER) << "Could not find registered service. Service Id: " << service_id;
|
||||
continue;
|
||||
}
|
||||
|
||||
@@ -958,13 +962,13 @@ ServiceController::Impl::sendSignalForServices(
|
||||
auto reconf_status = nano_service->second.sendNewConfigurations(configuration_id, policy_version_to_update);
|
||||
|
||||
if (reconf_status == ReconfStatus::INACTIVE) {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Erasing details regarding inactive service " << service_id;
|
||||
dbgWarning(D_SERVICE_CONTROLLER) << "Erasing details regarding inactive service " << service_id;
|
||||
registered_services.erase(service_id);
|
||||
writeRegisteredServicesToFile();
|
||||
}
|
||||
|
||||
if (reconf_status == ReconfStatus::FAILED) {
|
||||
dbgDebug(D_ORCHESTRATOR) << "The reconfiguration failed for serivce: " << service_id;
|
||||
dbgDebug(D_SERVICE_CONTROLLER) << "The reconfiguration failed for serivce: " << service_id;
|
||||
services_reconf_status.clear();
|
||||
services_reconf_names.clear();
|
||||
return genError("The reconfiguration failed for serivce: " + service_id);
|
||||
@@ -985,13 +989,14 @@ ServiceController::Impl::sendSignalForServices(
|
||||
while(timer->getMonotonicTime() < current_timeout) {
|
||||
switch (getUpdatedReconfStatus()) {
|
||||
case ReconfStatus::SUCCEEDED: {
|
||||
dbgDebug(D_ORCHESTRATOR) << "The reconfiguration was successfully completed for all the services";
|
||||
dbgDebug(D_SERVICE_CONTROLLER)
|
||||
<< "The reconfiguration was successfully completed for all the services";
|
||||
services_reconf_status.clear();
|
||||
services_reconf_names.clear();
|
||||
return Maybe<void>();
|
||||
}
|
||||
case ReconfStatus::IN_PROGRESS: {
|
||||
dbgTrace(D_ORCHESTRATOR) << "Reconfiguration in progress...";
|
||||
dbgTrace(D_SERVICE_CONTROLLER) << "Reconfiguration in progress...";
|
||||
Singleton::Consume<I_MainLoop>::by<ServiceController>()->yield(chrono::seconds(2));
|
||||
break;
|
||||
}
|
||||
@@ -1000,7 +1005,7 @@ ServiceController::Impl::sendSignalForServices(
|
||||
for(auto &status : services_reconf_status) {
|
||||
if (status.second == ReconfStatus::FAILED) {
|
||||
failed_services_vec.push_back(services_reconf_names[status.first]);
|
||||
dbgDebug(D_ORCHESTRATOR)
|
||||
dbgDebug(D_SERVICE_CONTROLLER)
|
||||
<< "The reconfiguration failed for serivce "
|
||||
<< services_reconf_names[status.first];
|
||||
}
|
||||
@@ -1013,7 +1018,7 @@ ServiceController::Impl::sendSignalForServices(
|
||||
return genError("The reconfiguration failed for serivces: " + failed_services);
|
||||
}
|
||||
case ReconfStatus::INACTIVE: {
|
||||
dbgError(D_ORCHESTRATOR) << "Reached inactive state in the middle of reconfiguration!";
|
||||
dbgError(D_SERVICE_CONTROLLER) << "Reached inactive state in the middle of reconfiguration!";
|
||||
services_reconf_status.clear();
|
||||
services_reconf_names.clear();
|
||||
return genError("Reached inactive state in the middle of reconfiguration!");
|
||||
@@ -1021,7 +1026,7 @@ ServiceController::Impl::sendSignalForServices(
|
||||
}
|
||||
}
|
||||
|
||||
dbgDebug(D_ORCHESTRATOR) << "The reconfiguration has reached a timeout";
|
||||
dbgDebug(D_SERVICE_CONTROLLER) << "The reconfiguration has reached a timeout";
|
||||
services_reconf_status.clear();
|
||||
services_reconf_names.clear();
|
||||
return genError("The reconfiguration has reached a timeout");
|
||||
@@ -1033,17 +1038,17 @@ ServiceController::Impl::updateServiceConfigurationFile(
|
||||
const string &configuration_file_path,
|
||||
const string &new_configuration)
|
||||
{
|
||||
dbgFlow(D_ORCHESTRATOR) << "Updating configuration. Config Name: " << configuration_name;
|
||||
dbgFlow(D_SERVICE_CONTROLLER) << "Updating configuration. Config Name: " << configuration_name;
|
||||
|
||||
if (orchestration_tools->doesFileExist(configuration_file_path)) {
|
||||
Maybe<string> old_configuration = orchestration_tools->readFile(configuration_file_path);
|
||||
if (old_configuration.ok()) {
|
||||
bool service_changed = old_configuration.unpack().compare(new_configuration) != 0;
|
||||
if (service_changed == false) {
|
||||
dbgDebug(D_ORCHESTRATOR) << "There is no update for policy file: " << configuration_file_path;
|
||||
dbgDebug(D_SERVICE_CONTROLLER) << "There is no update for policy file: " << configuration_file_path;
|
||||
return Maybe<void>();
|
||||
}
|
||||
dbgDebug(D_ORCHESTRATOR)
|
||||
dbgDebug(D_SERVICE_CONTROLLER)
|
||||
<< "Starting to update " << configuration_file_path << " to " << new_configuration;
|
||||
string old_configuration_backup_path = configuration_file_path + getConfigurationWithDefault<string>(
|
||||
".bk",
|
||||
@@ -1051,13 +1056,15 @@ ServiceController::Impl::updateServiceConfigurationFile(
|
||||
"Backup file extension"
|
||||
);
|
||||
if (orchestration_tools->copyFile(configuration_file_path, old_configuration_backup_path)) {
|
||||
dbgDebug(D_ORCHESTRATOR) << "Backup of policy file has been created in: " << configuration_file_path;
|
||||
dbgDebug(D_SERVICE_CONTROLLER)
|
||||
<< "Backup of policy file has been created in: "
|
||||
<< configuration_file_path;
|
||||
} else {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Failed to backup policy file";
|
||||
dbgWarning(D_SERVICE_CONTROLLER) << "Failed to backup policy file";
|
||||
return genError("Failed to backup policy file");
|
||||
}
|
||||
} else {
|
||||
dbgWarning(D_ORCHESTRATOR)
|
||||
dbgWarning(D_SERVICE_CONTROLLER)
|
||||
<< "Failed to read current policy file "
|
||||
<< configuration_file_path
|
||||
<< ". Error: "
|
||||
@@ -1073,13 +1080,13 @@ ServiceController::Impl::updateServiceConfigurationFile(
|
||||
}
|
||||
|
||||
if (orchestration_tools->writeFile(new_configuration, configuration_file_path)) {
|
||||
dbgDebug(D_ORCHESTRATOR) << "New policy file has been saved in: " << configuration_file_path;
|
||||
dbgDebug(D_SERVICE_CONTROLLER) << "New policy file has been saved in: " << configuration_file_path;
|
||||
} else {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Failed to save new policy file";
|
||||
dbgWarning(D_SERVICE_CONTROLLER) << "Failed to save new policy file";
|
||||
return genError("Failed to save new policy file");
|
||||
}
|
||||
|
||||
dbgInfo(D_ORCHESTRATOR) << "Successfully updated policy file: " << configuration_file_path;
|
||||
dbgInfo(D_SERVICE_CONTROLLER) << "Successfully updated policy file: " << configuration_file_path;
|
||||
|
||||
return Maybe<void>();
|
||||
}
|
||||
@@ -1120,14 +1127,14 @@ ServiceController::Impl::updateReconfStatus(int id, const string &service_name,
|
||||
}
|
||||
|
||||
if (services_reconf_status.find(id) == services_reconf_status.end()) {
|
||||
dbgError(D_ORCHESTRATOR)
|
||||
dbgError(D_SERVICE_CONTROLLER)
|
||||
<< "Unable to find a mapping for reconfiguration ID:"
|
||||
<< id
|
||||
<< ". Service name: "
|
||||
<< service_name;
|
||||
return;
|
||||
}
|
||||
dbgTrace(D_ORCHESTRATOR)
|
||||
dbgTrace(D_SERVICE_CONTROLLER)
|
||||
<< "Updating reconf status for reconfiguration ID "
|
||||
<< id
|
||||
<< ", Service name: "
|
||||
@@ -1144,7 +1151,7 @@ ServiceController::Impl::startReconfStatus(
|
||||
const string &service_name,
|
||||
const string &service_id)
|
||||
{
|
||||
dbgTrace(D_ORCHESTRATOR)
|
||||
dbgTrace(D_SERVICE_CONTROLLER)
|
||||
<< "Starting reconf status. Configuration ID: "
|
||||
<< id
|
||||
<< ", service name: "
|
||||
|
||||
@@ -21,15 +21,13 @@
|
||||
using namespace testing;
|
||||
using namespace std;
|
||||
|
||||
USE_DEBUG_FLAG(D_SERVICE_CONTROLLER);
|
||||
|
||||
class ServiceControllerTest : public Test
|
||||
{
|
||||
public:
|
||||
ServiceControllerTest()
|
||||
{
|
||||
Debug::setUnitTestFlag(D_ORCHESTRATOR, Debug::DebugLevel::NOISE);
|
||||
Debug::setNewDefaultStdout(&capture_debug);
|
||||
|
||||
CPTestTempfile status_file;
|
||||
registered_services_file_path = status_file.fname;
|
||||
setConfiguration(registered_services_file_path, "orchestration", "Orchestration registered services");
|
||||
|
||||
@@ -116,28 +114,6 @@ public:
|
||||
Debug::setNewDefaultStdout(&cout);
|
||||
}
|
||||
|
||||
void
|
||||
registerNewService()
|
||||
{
|
||||
stringstream new_service_registration;
|
||||
new_service_registration
|
||||
<< "{"
|
||||
<< " \"service_name\": \"mock access control\","
|
||||
<< " \"service_listening_port\":" + to_string(l4_firewall_service_port) + ","
|
||||
<< " \"expected_configurations\": [\"l4_firewall\", \"non updated capability\"],"
|
||||
<< " \"service_id\": \"family1_id2\","
|
||||
<< " \"general_settings\": \"path_to_settings\","
|
||||
<< " \"debug_settings\": \"path_to_debug\""
|
||||
<< "}";
|
||||
|
||||
auto registration_res = set_nano_service_config->performRestCall(new_service_registration);
|
||||
ASSERT_TRUE(registration_res.ok());
|
||||
|
||||
i_service_controller = Singleton::Consume<I_ServiceController>::from(service_controller);
|
||||
EXPECT_TRUE(i_service_controller->isServiceInstalled("family1_id2"));
|
||||
EXPECT_FALSE(i_service_controller->isServiceInstalled("I am not installed"));
|
||||
}
|
||||
|
||||
string
|
||||
orchestrationRegisteredServicesFileToString(const string &file_name)
|
||||
{
|
||||
@@ -159,6 +135,43 @@ public:
|
||||
return string_stream.str();
|
||||
}
|
||||
|
||||
void
|
||||
registerNewService()
|
||||
{
|
||||
stringstream new_service_registration;
|
||||
new_service_registration
|
||||
<< "{"
|
||||
<< " \"service_name\": \"mock access control\","
|
||||
<< " \"service_listening_port\":" + to_string(l4_firewall_service_port) + ","
|
||||
<< " \"expected_configurations\": [\"l4_firewall\", \"non updated capability\"],"
|
||||
<< " \"service_id\": \"family1_id2\","
|
||||
<< " \"general_settings\": \"path_to_settings\","
|
||||
<< " \"debug_settings\": \"path_to_debug\""
|
||||
<< "}";
|
||||
|
||||
auto registration_res = set_nano_service_config->performRestCall(new_service_registration);
|
||||
ASSERT_TRUE(registration_res.ok());
|
||||
|
||||
i_service_controller = Singleton::Consume<I_ServiceController>::from(service_controller);
|
||||
EXPECT_TRUE(i_service_controller->isServiceInstalled("family1_id2"));
|
||||
EXPECT_FALSE(i_service_controller->isServiceInstalled("I am not installed"));
|
||||
|
||||
string expected_json = "{\n"
|
||||
" \"Registered Services\": {\n"
|
||||
" \"family1_id2\": {\n"
|
||||
" \"Service name\": \"mock access control\",\n"
|
||||
" \"Service ID\": \"family1_id2\",\n"
|
||||
" \"Service port\": " + to_string(l4_firewall_service_port) + ",\n"
|
||||
" \"Relevant configs\": [\n"
|
||||
" \"non updated capability\",\n"
|
||||
" \"l4_firewall\"\n"
|
||||
" ]\n"
|
||||
" }\n"
|
||||
" }\n"
|
||||
"}";
|
||||
EXPECT_EQ(orchestrationRegisteredServicesFileToString(registered_services_file_path), expected_json);
|
||||
}
|
||||
|
||||
void
|
||||
expectNewConfigRequest(const string &req_body, const string &response)
|
||||
{
|
||||
@@ -174,6 +187,7 @@ public:
|
||||
).WillOnce(Return(HTTPResponse(HTTPStatusCode::HTTP_OK, response)));
|
||||
}
|
||||
|
||||
CPTestTempfile status_file;
|
||||
const uint16_t l4_firewall_service_port = 8888;
|
||||
const uint16_t waap_service_port = 7777;
|
||||
::Environment env;
|
||||
@@ -193,7 +207,7 @@ public:
|
||||
string services_port;
|
||||
StrictMock<MockTimeGet> time;
|
||||
StrictMock<MockRestApi> mock_rest_api;
|
||||
StrictMock<MockMessaging> mock_message;
|
||||
StrictMock<MockMessaging> mock_message;
|
||||
StrictMock<MockMainLoop> mock_ml;
|
||||
StrictMock<MockShellCmd> mock_shell_cmd;
|
||||
StrictMock<MockOrchestrationStatus> mock_orchestration_status;
|
||||
@@ -206,11 +220,10 @@ public:
|
||||
unique_ptr<ServerRest> get_services_ports;
|
||||
unique_ptr<ServerRest> set_reconf_status;
|
||||
unique_ptr<ServerRest> set_new_configuration;
|
||||
|
||||
I_MainLoop::Routine v_tenants_cleanup;
|
||||
I_MainLoop::Routine v_tenants_cleanup;
|
||||
ostringstream capture_debug;
|
||||
string version_value = "1.0.2";
|
||||
string old_version = "1.0.1";
|
||||
string version_value = "1.0.2";
|
||||
string old_version = "1.0.1";
|
||||
};
|
||||
|
||||
TEST_F(ServiceControllerTest, doNothing)
|
||||
@@ -494,103 +507,6 @@ TEST_F(ServiceControllerTest, TimeOutUpdateConfiguration)
|
||||
EXPECT_EQ(i_service_controller->getUpdatePolicyVersion(), version_value);
|
||||
}
|
||||
|
||||
TEST_F(ServiceControllerTest, writeRegisteredServicesFromFile)
|
||||
{
|
||||
EXPECT_EQ(orchestrationRegisteredServicesFileToString(registered_services_file_path), string(""));
|
||||
|
||||
string new_configuration = "{"
|
||||
" \"version\": \"" + version_value + "\""
|
||||
" \"l4_firewall\":"
|
||||
" {"
|
||||
" \"app\": \"netfilter\","
|
||||
" \"l4_firewall_rules\": ["
|
||||
" {"
|
||||
" \"name\": \"allow_statefull_conns\","
|
||||
" \"flags\": [\"established\"],"
|
||||
" \"action\": \"accept\""
|
||||
" },"
|
||||
" {"
|
||||
" \"name\": \"icmp drop\","
|
||||
" \"flags\": [\"log\"],"
|
||||
" \"services\": [{\"name\":\"icmp\"}],"
|
||||
" \"action\": \"drop\""
|
||||
" }"
|
||||
" ]"
|
||||
" }"
|
||||
"}";
|
||||
|
||||
string l4_firewall = "{"
|
||||
" \"app\": \"netfilter\","
|
||||
" \"l4_firewall_rules\": ["
|
||||
" {"
|
||||
" \"name\": \"allow_statefull_conns\","
|
||||
" \"flags\": [\"established\"],"
|
||||
" \"action\": \"accept\""
|
||||
" },"
|
||||
" {"
|
||||
" \"name\": \"icmp drop\","
|
||||
" \"flags\": [\"log\"],"
|
||||
" \"services\": [{\"name\":\"icmp\"}],"
|
||||
" \"action\": \"drop\""
|
||||
" }"
|
||||
" ]"
|
||||
"}";
|
||||
string expected_json = "{\n"
|
||||
" \"Registered Services\": {\n"
|
||||
" \"family1_id2\": {\n"
|
||||
" \"Service name\": \"mock access control\",\n"
|
||||
" \"Service ID\": \"family1_id2\",\n"
|
||||
" \"Service port\": 8888,\n"
|
||||
" \"Relevant configs\": [\n"
|
||||
" \"non updated capability\",\n"
|
||||
" \"l4_firewall\"\n"
|
||||
" ]\n"
|
||||
" }\n"
|
||||
" }\n"
|
||||
"}";
|
||||
|
||||
Maybe<map<string, string>> json_parser_return =
|
||||
map<string, string>({{"l4_firewall", l4_firewall}, {"version", version_value}});
|
||||
EXPECT_CALL(mock_orchestration_tools, readFile(file_name)).WillOnce(Return(new_configuration));
|
||||
EXPECT_CALL(mock_orchestration_tools, jsonObjectSplitter(new_configuration, _, _))
|
||||
.WillOnce(Return(json_parser_return));
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(l4_firewall_policy_path)).WillOnce(Return(false));
|
||||
EXPECT_CALL(mock_orchestration_tools, writeFile(l4_firewall, l4_firewall_policy_path, false))
|
||||
.WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_status,
|
||||
setServiceConfiguration("l4_firewall", l4_firewall_policy_path, OrchestrationStatusConfigType::POLICY));
|
||||
|
||||
EXPECT_EQ(i_service_controller->getPolicyVersion(), "");
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, calculateChecksum(Package::ChecksumTypes::MD5, file_name))
|
||||
.WillOnce(Return(version_value));
|
||||
|
||||
EXPECT_CALL(mock_orchestration_tools, copyFile(policy_file_path, policy_file_path + backup_extension))
|
||||
.WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_tools, copyFile(file_name, policy_file_path)).WillOnce(Return(true));
|
||||
EXPECT_CALL(mock_orchestration_tools, doesFileExist(policy_file_path)).WillOnce(Return(true));
|
||||
|
||||
string general_settings_path = "/my/settings/path";
|
||||
string reply_msg = "{\"id\": 1, \"error\": false, \"finished\": true, \"error_message\": \"\"}";
|
||||
|
||||
expectNewConfigRequest("{\n \"id\": 1,\n \"policy_version\": \"1.0.2,1.0.2\"\n}", reply_msg);
|
||||
|
||||
EXPECT_CALL(
|
||||
mock_shell_cmd,
|
||||
getExecOutput(
|
||||
"/etc/cp/watchdog/cp-nano-watchdog --status --verbose --service mock access control"
|
||||
" --family family1 --id id2",
|
||||
_,
|
||||
_
|
||||
)
|
||||
).WillRepeatedly(Return(string("registered and running")));
|
||||
|
||||
EXPECT_TRUE(i_service_controller->updateServiceConfiguration(file_name, general_settings_path).ok());
|
||||
EXPECT_EQ(i_service_controller->getPolicyVersion(), version_value);
|
||||
EXPECT_EQ(i_service_controller->getUpdatePolicyVersion(), version_value);
|
||||
EXPECT_EQ(orchestrationRegisteredServicesFileToString(registered_services_file_path), expected_json);
|
||||
}
|
||||
|
||||
TEST_F(ServiceControllerTest, readRegisteredServicesFromFile)
|
||||
{
|
||||
int family1_id3_port = 1111;
|
||||
@@ -1409,6 +1325,8 @@ TEST_F(ServiceControllerTest, failingWhileCopyingCurrentConfiguration)
|
||||
|
||||
TEST_F(ServiceControllerTest, ErrorUpdateConfigurationRest)
|
||||
{
|
||||
Debug::setUnitTestFlag(D_SERVICE_CONTROLLER, Debug::DebugLevel::NOISE);
|
||||
Debug::setNewDefaultStdout(&capture_debug);
|
||||
string new_configuration = "{"
|
||||
" \"version\": \"" + version_value + "\""
|
||||
" \"l4_firewall\":"
|
||||
|
||||
@@ -473,10 +473,11 @@ FogAuthenticator::authenticateAgent()
|
||||
auto orc_status = Singleton::Consume<I_OrchestrationStatus>::by<FogAuthenticator>();
|
||||
credentials = getCredentials();
|
||||
if (!credentials.ok()) {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Failed to authenticate the agent: " << credentials.getErr();
|
||||
orc_status->setFieldStatus(
|
||||
OrchestrationStatusFieldType::REGISTRATION,
|
||||
OrchestrationStatusResult::FAILED,
|
||||
credentials.getErr()
|
||||
"Warning: Agent/Gateway failed the authentication. Contact Check Point support."
|
||||
);
|
||||
return genError(credentials.getErr());
|
||||
}
|
||||
@@ -516,7 +517,7 @@ FogAuthenticator::authenticateAgent()
|
||||
orc_status->setFieldStatus(
|
||||
OrchestrationStatusFieldType::REGISTRATION,
|
||||
OrchestrationStatusResult::FAILED,
|
||||
access_token.getErr()
|
||||
"Warning: Agent/Gateway failed to receive access token. Contact Check Point support."
|
||||
);
|
||||
}
|
||||
int next_session_req = max(
|
||||
|
||||
@@ -154,6 +154,7 @@ protected:
|
||||
if (agentDetails->getOrchestrationMode() == OrchestrationMode::HYBRID) {
|
||||
MessageMetadata req_md(getSharedStorageHost(), 80);
|
||||
req_md.insertHeader("X-Tenant-Id", agentDetails->getTenantId());
|
||||
req_md.setConnectioFlag(MessageConnectionConfig::UNSECURE_CONN);
|
||||
auto req_status = messaging->sendSyncMessage(
|
||||
method,
|
||||
uri,
|
||||
@@ -161,6 +162,10 @@ protected:
|
||||
MessageCategory::GENERIC,
|
||||
req_md
|
||||
);
|
||||
if (!req_status.ok()) {
|
||||
dbgWarning(D_WAAP) << "failed to send request to uri: " << uri
|
||||
<< ", error: " << req_status.getErr().toString();
|
||||
}
|
||||
return req_status.ok();
|
||||
}
|
||||
auto req_status = messaging->sendSyncMessage(
|
||||
@@ -169,6 +174,10 @@ protected:
|
||||
obj,
|
||||
MessageCategory::GENERIC
|
||||
);
|
||||
if (!req_status.ok()) {
|
||||
dbgWarning(D_WAAP) << "failed to send request to uri: " << uri
|
||||
<< ", error: " << req_status.getErr().toString();
|
||||
}
|
||||
return req_status.ok();
|
||||
}
|
||||
|
||||
@@ -204,6 +213,7 @@ protected:
|
||||
if (agentDetails->getOrchestrationMode() == OrchestrationMode::HYBRID) {
|
||||
MessageMetadata req_md(getSharedStorageHost(), 80);
|
||||
req_md.insertHeader("X-Tenant-Id", agentDetails->getTenantId());
|
||||
req_md.setConnectioFlag(MessageConnectionConfig::UNSECURE_CONN);
|
||||
return messaging->sendSyncMessageWithoutResponse(
|
||||
method,
|
||||
uri,
|
||||
|
||||
@@ -20,6 +20,7 @@
|
||||
#include "../waap_clib/WaapOpenRedirect.h"
|
||||
#include "../waap_clib/FpMitigation.h"
|
||||
#include "../waap_clib/DeepParser.h"
|
||||
#include "../waap_clib/OASchemaUpdaterConfConstant.h"
|
||||
#include "http_inspection_events.h"
|
||||
|
||||
enum HeaderType {
|
||||
@@ -29,6 +30,7 @@ enum HeaderType {
|
||||
COOKIE_HEADER,
|
||||
REFERER_HEADER,
|
||||
CONTENT_TYPE_HEADER,
|
||||
AUTHORIZATION_HEADER,
|
||||
CLEAN_HEADER,
|
||||
OTHER_KNOWN_HEADERS
|
||||
};
|
||||
@@ -135,6 +137,7 @@ public:
|
||||
virtual void add_response_body_chunk(const char* data, int data_len) = 0;
|
||||
virtual void end_response_body() = 0;
|
||||
virtual void end_response() = 0;
|
||||
virtual const std::string& getResponseBody() = 0;
|
||||
|
||||
virtual void collectFoundPatterns() = 0;
|
||||
virtual ReportIS::Severity computeEventSeverityFromDecision() const = 0;
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user