mirror of
https://github.com/openappsec/openappsec.git
synced 2025-11-16 09:21:54 +03:00
Compare commits
48 Commits
Mar_21_202
...
Jun_26_202
| Author | SHA1 | Date | |
|---|---|---|---|
|
78b114a274 | ||
|
81b1aec487 | ||
|
be6591a670 | ||
|
|
663782009c | ||
|
|
9392bbb26c | ||
|
|
46682bcdce | ||
|
|
057bc42375 | ||
|
|
88e0ccd308 | ||
|
|
4241b9c574 | ||
|
|
4af9f18ada | ||
|
|
3b533608b1 | ||
|
|
74bb3086ec | ||
|
|
504d1415a5 | ||
|
|
18b1b63c42 | ||
|
|
ded2a5ffc2 | ||
|
|
1254bb37b2 | ||
|
|
cf16343caa | ||
|
|
78c4209406 | ||
|
|
3c8672c565 | ||
|
|
48d6baed3b | ||
|
|
8770257a60 | ||
|
|
fd5d093b24 | ||
|
|
d6debf8d8d | ||
|
|
395b754575 | ||
|
|
dc000372c4 | ||
|
|
941c641174 | ||
|
|
fdc148aa9b | ||
|
|
307fd8897d | ||
|
|
afd2b4930b | ||
|
|
1fb9a29223 | ||
|
|
253ca70de6 | ||
|
938f625535 | ||
|
|
183d14fc55 | ||
|
|
1f3d4ed5e1 | ||
|
|
fdbd6d3786 | ||
|
|
4504138a4a | ||
|
|
66ed4a8d81 | ||
|
|
189c9209c9 | ||
|
|
1a1580081c | ||
|
|
942b2ef8b4 | ||
|
|
7a7f65a77a | ||
|
|
98639d9cb6 | ||
|
b3de81d9d9 | ||
|
|
a77fd9a6d0 | ||
|
|
8454b2dd9b | ||
|
|
3913e1e8b3 | ||
|
|
262b2e59ff | ||
|
|
ecbb34bc17 |
@@ -1,7 +1,7 @@
|
||||
cmake_minimum_required (VERSION 2.8.4)
|
||||
project (ngen)
|
||||
|
||||
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fPIC -Wall -Wno-terminate")
|
||||
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -O2 -fPIC -Wall -Wno-terminate")
|
||||
|
||||
execute_process(COMMAND grep -c "Alpine Linux" /etc/os-release OUTPUT_VARIABLE IS_ALPINE)
|
||||
if(NOT IS_ALPINE EQUAL "0")
|
||||
|
||||
@@ -1,15 +1,15 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
# Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
version: "3"
|
||||
|
||||
|
||||
@@ -3,4 +3,4 @@ dependencies:
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 12.2.8
|
||||
digest: sha256:0d13b8b0c66b8e18781eac510ce58b069518ff14a6a15ad90375e7f0ffad71fe
|
||||
generated: "2024-02-18T16:45:15.395307713Z"
|
||||
generated: "2024-03-26T14:53:49.928153508Z"
|
||||
|
||||
@@ -1,7 +1,5 @@
|
||||
annotations:
|
||||
artifacthub.io/changes: |-
|
||||
- "update web hook cert gen to latest release v20231226-1a7112e06"
|
||||
- "Update Ingress-Nginx version controller-v1.9.6"
|
||||
artifacthub.io/changes: '- "Update Ingress-Nginx version controller-v1.10.0"'
|
||||
artifacthub.io/prerelease: "false"
|
||||
apiVersion: v2
|
||||
appVersion: latest
|
||||
@@ -17,4 +15,4 @@ kubeVersion: '>=1.20.0-0'
|
||||
name: open-appsec-k8s-nginx-ingress
|
||||
sources:
|
||||
- https://github.com/kubernetes/ingress-nginx
|
||||
version: 4.9.1
|
||||
version: 4.10.0
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
[ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer
|
||||
|
||||
 
|
||||
 
|
||||
|
||||
To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources.
|
||||
|
||||
@@ -253,11 +253,11 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.admissionWebhooks.namespaceSelector | object | `{}` | |
|
||||
| controller.admissionWebhooks.objectSelector | object | `{}` | |
|
||||
| controller.admissionWebhooks.patch.enabled | bool | `true` | |
|
||||
| controller.admissionWebhooks.patch.image.digest | string | `"sha256:25d6a5f11211cc5c3f9f2bf552b585374af287b4debf693cacbe2da47daa5084"` | |
|
||||
| controller.admissionWebhooks.patch.image.digest | string | `"sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334"` | |
|
||||
| controller.admissionWebhooks.patch.image.image | string | `"ingress-nginx/kube-webhook-certgen"` | |
|
||||
| controller.admissionWebhooks.patch.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| controller.admissionWebhooks.patch.image.registry | string | `"registry.k8s.io"` | |
|
||||
| controller.admissionWebhooks.patch.image.tag | string | `"v20231226-1a7112e06"` | |
|
||||
| controller.admissionWebhooks.patch.image.tag | string | `"v1.4.0"` | |
|
||||
| controller.admissionWebhooks.patch.labels | object | `{}` | Labels to be added to patch job resources |
|
||||
| controller.admissionWebhooks.patch.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not |
|
||||
| controller.admissionWebhooks.patch.nodeSelector."kubernetes.io/os" | string | `"linux"` | |
|
||||
@@ -317,7 +317,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.hostname | object | `{}` | Optionally customize the pod hostname. |
|
||||
| controller.image.allowPrivilegeEscalation | bool | `false` | |
|
||||
| controller.image.chroot | bool | `false` | |
|
||||
| controller.image.digest | string | `"sha256:1405cc613bd95b2c6edd8b2a152510ae91c7e62aea4698500d23b2145960ab9c"` | |
|
||||
| controller.image.digest | string | `"sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c"` | |
|
||||
| controller.image.digestChroot | string | `"sha256:7eb46ff733429e0e46892903c7394aff149ac6d284d92b3946f3baf7ff26a096"` | |
|
||||
| controller.image.image | string | `"ingress-nginx/controller"` | |
|
||||
| controller.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
@@ -326,7 +326,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.image.runAsNonRoot | bool | `true` | |
|
||||
| controller.image.runAsUser | int | `101` | |
|
||||
| controller.image.seccompProfile.type | string | `"RuntimeDefault"` | |
|
||||
| controller.image.tag | string | `"v1.9.6"` | |
|
||||
| controller.image.tag | string | `"v1.10.0"` | |
|
||||
| controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation |
|
||||
| controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). |
|
||||
| controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass |
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
# Changelog
|
||||
|
||||
This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
|
||||
|
||||
### 4.10.0
|
||||
|
||||
* - "Update Ingress-Nginx version controller-v1.10.0"
|
||||
|
||||
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.9.1...helm-chart-4.10.0
|
||||
@@ -29,7 +29,7 @@
|
||||
- --watch-namespace={{ default "$(POD_NAMESPACE)" .Values.controller.scope.namespace }}
|
||||
{{- end }}
|
||||
{{- if and (not .Values.controller.scope.enabled) .Values.controller.scope.namespaceSelector }}
|
||||
- --watch-namespace-selector={{ default "" .Values.controller.scope.namespaceSelector }}
|
||||
- --watch-namespace-selector={{ .Values.controller.scope.namespaceSelector }}
|
||||
{{- end }}
|
||||
{{- if and .Values.controller.reportNodeInternalIp .Values.controller.hostNetwork }}
|
||||
- --report-node-internal-ip-address={{ .Values.controller.reportNodeInternalIp }}
|
||||
@@ -54,6 +54,9 @@
|
||||
{{- if .Values.controller.watchIngressWithoutClass }}
|
||||
- --watch-ingress-without-class=true
|
||||
{{- end }}
|
||||
{{- if not .Values.controller.metrics.enabled }}
|
||||
- --enable-metrics={{ .Values.controller.metrics.enabled }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.enableTopologyAwareRouting }}
|
||||
- --enable-topology-aware-routing=true
|
||||
{{- end }}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if and ( .Values.controller.metrics.enabled ) ( .Values.controller.metrics.prometheusRule.enabled ) ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) -}}
|
||||
{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.prometheusRule.enabled -}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
|
||||
@@ -34,7 +34,7 @@ spec:
|
||||
http-headers: false
|
||||
request-body: false
|
||||
log-destination:
|
||||
cloud: false
|
||||
cloud: true
|
||||
stdout:
|
||||
format: json-formatted
|
||||
---
|
||||
|
||||
@@ -15,3 +15,37 @@ tests:
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-controller
|
||||
|
||||
- it: should create a DaemonSet with argument `--enable-metrics=false` if `controller.metrics.enabled` is false
|
||||
set:
|
||||
controller.kind: DaemonSet
|
||||
kind: Vanilla
|
||||
controller.metrics.enabled: false
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].args
|
||||
content: --enable-metrics=false
|
||||
|
||||
- it: should create a DaemonSet without argument `--enable-metrics=false` if `controller.metrics.enabled` is true
|
||||
set:
|
||||
controller.kind: DaemonSet
|
||||
kind: Vanilla
|
||||
controller.metrics.enabled: true
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.containers[0].args
|
||||
content: --enable-metrics=false
|
||||
|
||||
- it: should create a DaemonSet with resource limits if `controller.resources.limits` is set
|
||||
set:
|
||||
controller.kind: DaemonSet
|
||||
kind: Vanilla
|
||||
controller.resources.limits.cpu: 500m
|
||||
controller.resources.limits.memory: 512Mi
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].resources.limits.cpu
|
||||
value: 500m
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].resources.limits.memory
|
||||
value: 512Mi
|
||||
|
||||
@@ -4,8 +4,6 @@ templates:
|
||||
|
||||
tests:
|
||||
- it: should create a Deployment
|
||||
set:
|
||||
kind: Vanilla
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
@@ -24,6 +22,22 @@ tests:
|
||||
path: spec.replicas
|
||||
value: 3
|
||||
|
||||
- it: should create a Deployment with argument `--enable-metrics=false` if `controller.metrics.enabled` is false
|
||||
set:
|
||||
controller.metrics.enabled: false
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].args
|
||||
content: --enable-metrics=false
|
||||
|
||||
- it: should create a Deployment without argument `--enable-metrics=false` if `controller.metrics.enabled` is true
|
||||
set:
|
||||
controller.metrics.enabled: true
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.containers[0].args
|
||||
content: --enable-metrics=false
|
||||
|
||||
- it: should create a Deployment with resource limits if `controller.resources.limits` is set
|
||||
set:
|
||||
controller.resources.limits.cpu: 500m
|
||||
|
||||
@@ -26,8 +26,8 @@ controller:
|
||||
## for backwards compatibility consider setting the full image url via the repository value below
|
||||
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
|
||||
## repository:
|
||||
tag: "v1.9.6"
|
||||
digest: sha256:1405cc613bd95b2c6edd8b2a152510ae91c7e62aea4698500d23b2145960ab9c
|
||||
tag: "v1.10.0"
|
||||
digest: sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c
|
||||
digestChroot: sha256:7eb46ff733429e0e46892903c7394aff149ac6d284d92b3946f3baf7ff26a096
|
||||
pullPolicy: IfNotPresent
|
||||
runAsNonRoot: true
|
||||
@@ -781,8 +781,8 @@ controller:
|
||||
## for backwards compatibility consider setting the full image url via the repository value below
|
||||
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
|
||||
## repository:
|
||||
tag: v20231226-1a7112e06
|
||||
digest: sha256:25d6a5f11211cc5c3f9f2bf552b585374af287b4debf693cacbe2da47daa5084
|
||||
tag: v1.4.0
|
||||
digest: sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334
|
||||
pullPolicy: IfNotPresent
|
||||
# -- Provide a priority class name to the webhook patching job
|
||||
##
|
||||
@@ -1198,7 +1198,7 @@ appsec:
|
||||
image:
|
||||
registry: ghcr.io/openappsec
|
||||
image: smartsync-tuning
|
||||
tag: 1.1.3
|
||||
tag: latest
|
||||
enabled: false
|
||||
replicaCount: 1
|
||||
securityContext:
|
||||
|
||||
@@ -1,5 +1,27 @@
|
||||
# Changelog
|
||||
|
||||
## 2.38.0
|
||||
|
||||
### Changes
|
||||
|
||||
* Added support for setting `SVC.tls.appProtocol` and `SVC.http.appProtocol` values to configure the appProtocol fields
|
||||
for Kubernetes Service HTTP and TLS ports. It might be useful for integration with external load balancers like GCP.
|
||||
[#1018](https://github.com/Kong/charts/pull/1018)
|
||||
|
||||
## 2.37.1
|
||||
|
||||
* Rename the controller status port. This fixes a collision with the proxy status port in the Prometheus ServiceMonitor.
|
||||
[#1008](https://github.com/Kong/charts/pull/1008)
|
||||
|
||||
## 2.37.0
|
||||
|
||||
### Changes
|
||||
|
||||
* Bumped default `kong/kubernetes-ingress-controller` image tag and updated CRDs to 3.1.
|
||||
[#1011](https://github.com/Kong/charts/pull/1011)
|
||||
* Bumped default `kong` image tag to 3.6.
|
||||
[#1011](https://github.com/Kong/charts/pull/1011)
|
||||
|
||||
## 2.36.0
|
||||
|
||||
### Fixed
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
apiVersion: v2
|
||||
appVersion: 1.1.6
|
||||
appVersion: 1.1.8
|
||||
dependencies:
|
||||
- condition: postgresql.enabled
|
||||
name: postgresql
|
||||
@@ -14,4 +14,4 @@ maintainers:
|
||||
name: open-appsec-kong
|
||||
sources:
|
||||
- https://github.com/Kong/charts/tree/main/charts/kong
|
||||
version: 2.36.0
|
||||
version: 2.38.0
|
||||
|
||||
@@ -666,40 +666,42 @@ nodes.
|
||||
mixed TCP/UDP LoadBalancer Services). It _does not_ support the `http`, `tls`,
|
||||
or `ingress` sections, as it is used only for stream listens.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|------------------------------------|---------------------------------------------------------------------------------------|--------------------------|
|
||||
| SVC.enabled | Create Service resource for SVC (admin, proxy, manager, etc.) | |
|
||||
| SVC.http.enabled | Enables http on the service | |
|
||||
| SVC.http.servicePort | Service port to use for http | |
|
||||
| SVC.http.containerPort | Container port to use for http | |
|
||||
| SVC.http.nodePort | Node port to use for http | |
|
||||
| SVC.http.hostPort | Host port to use for http | |
|
||||
| SVC.http.parameters | Array of additional listen parameters | `[]` |
|
||||
| SVC.tls.enabled | Enables TLS on the service | |
|
||||
| SVC.tls.containerPort | Container port to use for TLS | |
|
||||
| SVC.tls.servicePort | Service port to use for TLS | |
|
||||
| SVC.tls.nodePort | Node port to use for TLS | |
|
||||
| SVC.tls.hostPort | Host port to use for TLS | |
|
||||
| SVC.tls.overrideServiceTargetPort | Override service port to use for TLS without touching Kong containerPort | |
|
||||
| SVC.tls.parameters | Array of additional listen parameters | `["http2"]` |
|
||||
| SVC.type | k8s service type. Options: NodePort, ClusterIP, LoadBalancer | |
|
||||
| SVC.clusterIP | k8s service clusterIP | |
|
||||
| SVC.loadBalancerClass | loadBalancerClass to use for LoadBalancer provisionning | |
|
||||
| SVC.loadBalancerSourceRanges | Limit service access to CIDRs if set and service type is `LoadBalancer` | `[]` |
|
||||
| SVC.loadBalancerIP | Reuse an existing ingress static IP for the service | |
|
||||
| SVC.externalIPs | IPs for which nodes in the cluster will also accept traffic for the servic | `[]` |
|
||||
| SVC.externalTrafficPolicy | k8s service's externalTrafficPolicy. Options: Cluster, Local | |
|
||||
| SVC.ingress.enabled | Enable ingress resource creation (works with SVC.type=ClusterIP) | `false` |
|
||||
| SVC.ingress.ingressClassName | Set the ingressClassName to associate this Ingress with an IngressClass | |
|
||||
| SVC.ingress.hostname | Ingress hostname | `""` |
|
||||
| SVC.ingress.path | Ingress path. | `/` |
|
||||
| SVC.ingress.pathType | Ingress pathType. One of `ImplementationSpecific`, `Exact` or `Prefix` | `ImplementationSpecific` |
|
||||
| SVC.ingress.hosts | Slice of hosts configurations, including `hostname`, `path` and `pathType` keys | `[]` |
|
||||
| SVC.ingress.tls | Name of secret resource or slice of `secretName` and `hosts` keys | |
|
||||
| SVC.ingress.annotations | Ingress annotations. See documentation for your ingress controller for details | `{}` |
|
||||
| SVC.ingress.labels | Ingress labels. Additional custom labels to add to the ingress. | `{}` |
|
||||
| SVC.annotations | Service annotations | `{}` |
|
||||
| SVC.labels | Service labels | `{}` |
|
||||
| Parameter | Description | Default |
|
||||
|-----------------------------------|-------------------------------------------------------------------------------------------|--------------------------|
|
||||
| SVC.enabled | Create Service resource for SVC (admin, proxy, manager, etc.) | |
|
||||
| SVC.http.enabled | Enables http on the service | |
|
||||
| SVC.http.servicePort | Service port to use for http | |
|
||||
| SVC.http.containerPort | Container port to use for http | |
|
||||
| SVC.http.nodePort | Node port to use for http | |
|
||||
| SVC.http.hostPort | Host port to use for http | |
|
||||
| SVC.http.parameters | Array of additional listen parameters | `[]` |
|
||||
| SVC.http.appProtocol | `appProtocol` to be set in a Service's port. If left empty, no `appProtocol` will be set. | |
|
||||
| SVC.tls.enabled | Enables TLS on the service | |
|
||||
| SVC.tls.containerPort | Container port to use for TLS | |
|
||||
| SVC.tls.servicePort | Service port to use for TLS | |
|
||||
| SVC.tls.nodePort | Node port to use for TLS | |
|
||||
| SVC.tls.hostPort | Host port to use for TLS | |
|
||||
| SVC.tls.overrideServiceTargetPort | Override service port to use for TLS without touching Kong containerPort | |
|
||||
| SVC.tls.parameters | Array of additional listen parameters | `["http2"]` |
|
||||
| SVC.tls.appProtocol | `appProtocol` to be set in a Service's port. If left empty, no `appProtocol` will be set. | |
|
||||
| SVC.type | k8s service type. Options: NodePort, ClusterIP, LoadBalancer | |
|
||||
| SVC.clusterIP | k8s service clusterIP | |
|
||||
| SVC.loadBalancerClass | loadBalancerClass to use for LoadBalancer provisionning | |
|
||||
| SVC.loadBalancerSourceRanges | Limit service access to CIDRs if set and service type is `LoadBalancer` | `[]` |
|
||||
| SVC.loadBalancerIP | Reuse an existing ingress static IP for the service | |
|
||||
| SVC.externalIPs | IPs for which nodes in the cluster will also accept traffic for the servic | `[]` |
|
||||
| SVC.externalTrafficPolicy | k8s service's externalTrafficPolicy. Options: Cluster, Local | |
|
||||
| SVC.ingress.enabled | Enable ingress resource creation (works with SVC.type=ClusterIP) | `false` |
|
||||
| SVC.ingress.ingressClassName | Set the ingressClassName to associate this Ingress with an IngressClass | |
|
||||
| SVC.ingress.hostname | Ingress hostname | `""` |
|
||||
| SVC.ingress.path | Ingress path. | `/` |
|
||||
| SVC.ingress.pathType | Ingress pathType. One of `ImplementationSpecific`, `Exact` or `Prefix` | `ImplementationSpecific` |
|
||||
| SVC.ingress.hosts | Slice of hosts configurations, including `hostname`, `path` and `pathType` keys | `[]` |
|
||||
| SVC.ingress.tls | Name of secret resource or slice of `secretName` and `hosts` keys | |
|
||||
| SVC.ingress.annotations | Ingress annotations. See documentation for your ingress controller for details | `{}` |
|
||||
| SVC.ingress.labels | Ingress labels. Additional custom labels to add to the ingress. | `{}` |
|
||||
| SVC.annotations | Service annotations | `{}` |
|
||||
| SVC.labels | Service labels | `{}` |
|
||||
|
||||
#### Admin Service mTLS
|
||||
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -33,9 +33,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -90,7 +90,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -205,7 +205,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -274,8 +274,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-custom-dbless-config
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -286,8 +286,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-admin
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -309,8 +309,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -336,9 +336,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -364,8 +364,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -84,8 +84,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -108,9 +108,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -138,7 +138,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -159,7 +159,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -240,7 +240,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -350,7 +350,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -408,8 +408,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -617,6 +617,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -657,8 +689,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -677,8 +709,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -742,8 +774,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -766,8 +798,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -783,8 +815,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -797,8 +829,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -825,9 +857,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -854,8 +886,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -870,8 +902,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -881,8 +913,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -137,7 +137,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -158,7 +158,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -241,7 +241,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -353,7 +353,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -410,8 +410,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -619,6 +619,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -658,8 +690,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -677,8 +709,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -741,8 +773,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -764,8 +796,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -780,8 +812,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -793,8 +825,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -820,9 +852,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -848,8 +880,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -863,8 +895,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -873,8 +905,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -430,8 +430,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -639,6 +639,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -678,8 +710,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -697,8 +729,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -761,8 +793,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -784,8 +816,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -800,8 +832,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -822,8 +854,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -849,9 +881,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -877,8 +909,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -892,8 +924,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -902,8 +934,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -432,8 +432,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -641,6 +641,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -680,8 +712,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -699,8 +731,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -763,8 +795,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -786,8 +818,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -802,8 +834,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -824,8 +856,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -851,9 +883,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -879,8 +911,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -894,8 +926,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -904,8 +936,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -428,8 +428,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -637,6 +637,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -676,8 +708,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -695,8 +727,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -759,8 +791,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -782,8 +814,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -798,8 +830,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -811,8 +843,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -838,9 +870,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -866,8 +898,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -881,8 +913,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -891,8 +923,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -463,8 +463,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -672,6 +672,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -711,8 +743,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -730,8 +762,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -794,8 +826,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -817,8 +849,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -833,8 +865,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -864,8 +896,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -891,9 +923,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -919,8 +951,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -934,8 +966,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -944,8 +976,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -158,7 +158,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -241,7 +241,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -353,7 +353,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -410,8 +410,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -690,8 +690,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -709,8 +709,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -773,8 +773,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -796,8 +796,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -812,8 +812,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -825,8 +825,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -852,9 +852,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -880,8 +880,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -895,8 +895,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -905,8 +905,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -0,0 +1,908 @@
|
||||
[proxy-appprotocol-values]
|
||||
SnapShot = """
|
||||
- object:
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1beta1
|
||||
clientConfig:
|
||||
caBundle: '###DYNAMIC_FIELD###'
|
||||
service:
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
failurePolicy: Ignore
|
||||
name: validations.kong.konghq.com
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: owner
|
||||
operator: NotIn
|
||||
values:
|
||||
- helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
apiVersions:
|
||||
- '*'
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- kongconsumers
|
||||
- kongplugins
|
||||
- kongclusterplugins
|
||||
- kongingresses
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- secrets
|
||||
- services
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- ingresses
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
apiVersions:
|
||||
- v1alpha2
|
||||
- v1beta1
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- gateways
|
||||
- httproutes
|
||||
sideEffects: None
|
||||
- object:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/name: kong
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kuma.io/gateway: enabled
|
||||
kuma.io/service-account-token-volume: chartsnap-kong-token
|
||||
traffic.sidecar.istio.io/includeInboundPorts: \"\"
|
||||
labels:
|
||||
app: chartsnap-kong
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args: null
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: CONTROLLER_ADMISSION_WEBHOOK_LISTEN
|
||||
value: 0.0.0.0:8080
|
||||
- name: CONTROLLER_ELECTION_ID
|
||||
value: kong-ingress-controller-leader-kong
|
||||
- name: CONTROLLER_INGRESS_CLASS
|
||||
value: kong
|
||||
- name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY
|
||||
value: \"true\"
|
||||
- name: CONTROLLER_KONG_ADMIN_URL
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
name: ingress-controller
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: webhook
|
||||
protocol: TCP
|
||||
- containerPort: 10255
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /admission-webhook
|
||||
name: webhook-cert
|
||||
readOnly: true
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: chartsnap-kong-token
|
||||
readOnly: true
|
||||
- env:
|
||||
- name: KONG_ADMIN_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_GUI_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_GUI_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_LISTEN
|
||||
value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
|
||||
- name: KONG_CLUSTER_LISTEN
|
||||
value: \"off\"
|
||||
- name: KONG_DATABASE
|
||||
value: \"off\"
|
||||
- name: KONG_KIC
|
||||
value: \"on\"
|
||||
- name: KONG_LUA_PACKAGE_PATH
|
||||
value: /opt/?.lua;/opt/?/init.lua;;
|
||||
- name: KONG_NGINX_WORKER_PROCESSES
|
||||
value: \"2\"
|
||||
- name: KONG_PORTAL_API_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PORTAL_API_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PORT_MAPS
|
||||
value: 80:8000, 443:8443
|
||||
- name: KONG_PREFIX
|
||||
value: /kong_prefix/
|
||||
- name: KONG_PROXY_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PROXY_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PROXY_LISTEN
|
||||
value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl
|
||||
- name: KONG_PROXY_STREAM_ACCESS_LOG
|
||||
value: /dev/stdout basic
|
||||
- name: KONG_PROXY_STREAM_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ROUTER_FLAVOR
|
||||
value: traditional
|
||||
- name: KONG_STATUS_ACCESS_LOG
|
||||
value: \"off\"
|
||||
- name: KONG_STATUS_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_STATUS_LISTEN
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- kong
|
||||
- quit
|
||||
- --wait=15
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /status
|
||||
port: status
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
name: proxy
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
name: proxy
|
||||
protocol: TCP
|
||||
- containerPort: 8443
|
||||
name: proxy-tls
|
||||
protocol: TCP
|
||||
- containerPort: 8100
|
||||
name: status
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /status/ready
|
||||
port: status
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /kong_prefix/
|
||||
name: chartsnap-kong-prefix-dir
|
||||
- mountPath: /tmp
|
||||
name: chartsnap-kong-tmp
|
||||
initContainers:
|
||||
- command:
|
||||
- rm
|
||||
- -vrf
|
||||
- $KONG_PREFIX/pids
|
||||
env:
|
||||
- name: KONG_ADMIN_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_GUI_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_ADMIN_GUI_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ADMIN_LISTEN
|
||||
value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
|
||||
- name: KONG_CLUSTER_LISTEN
|
||||
value: \"off\"
|
||||
- name: KONG_DATABASE
|
||||
value: \"off\"
|
||||
- name: KONG_KIC
|
||||
value: \"on\"
|
||||
- name: KONG_LUA_PACKAGE_PATH
|
||||
value: /opt/?.lua;/opt/?/init.lua;;
|
||||
- name: KONG_NGINX_WORKER_PROCESSES
|
||||
value: \"2\"
|
||||
- name: KONG_PORTAL_API_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PORTAL_API_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PORT_MAPS
|
||||
value: 80:8000, 443:8443
|
||||
- name: KONG_PREFIX
|
||||
value: /kong_prefix/
|
||||
- name: KONG_PROXY_ACCESS_LOG
|
||||
value: /dev/stdout
|
||||
- name: KONG_PROXY_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_PROXY_LISTEN
|
||||
value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl
|
||||
- name: KONG_PROXY_STREAM_ACCESS_LOG
|
||||
value: /dev/stdout basic
|
||||
- name: KONG_PROXY_STREAM_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_ROUTER_FLAVOR
|
||||
value: traditional
|
||||
- name: KONG_STATUS_ACCESS_LOG
|
||||
value: \"off\"
|
||||
- name: KONG_STATUS_ERROR_LOG
|
||||
value: /dev/stderr
|
||||
- name: KONG_STATUS_LISTEN
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /kong_prefix/
|
||||
name: chartsnap-kong-prefix-dir
|
||||
- mountPath: /tmp
|
||||
name: chartsnap-kong-tmp
|
||||
securityContext: {}
|
||||
serviceAccountName: chartsnap-kong
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- emptyDir:
|
||||
sizeLimit: 256Mi
|
||||
name: chartsnap-kong-prefix-dir
|
||||
- emptyDir:
|
||||
sizeLimit: 1Gi
|
||||
name: chartsnap-kong-tmp
|
||||
- name: chartsnap-kong-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
- name: webhook-cert
|
||||
secret:
|
||||
secretName: chartsnap-kong-validation-webhook-keypair
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongupstreampolicies
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongupstreampolicies/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumergroups
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumergroups/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- services/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- ingressclassparameterses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongconsumers/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongplugins
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongplugins/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- tcpingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- tcpingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- udpingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- udpingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongclusterplugins
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongclusterplugins/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: chartsnap-kong
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- configmaps
|
||||
- pods
|
||||
- secrets
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resourceNames:
|
||||
- kong-ingress-controller-leader-kong-kong
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- configmaps
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- \"\"
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: chartsnap-kong
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
- object:
|
||||
apiVersion: v1
|
||||
data:
|
||||
tls.crt: '###DYNAMIC_FIELD###'
|
||||
tls.key: '###DYNAMIC_FIELD###'
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
- object:
|
||||
apiVersion: v1
|
||||
data:
|
||||
tls.crt: '###DYNAMIC_FIELD###'
|
||||
tls.key: '###DYNAMIC_FIELD###'
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
ports:
|
||||
- name: kong-manager
|
||||
port: 8002
|
||||
protocol: TCP
|
||||
targetPort: 8002
|
||||
- name: kong-manager-tls
|
||||
port: 8445
|
||||
protocol: TCP
|
||||
targetPort: 8445
|
||||
selector:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/name: kong
|
||||
type: NodePort
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
ports:
|
||||
- appProtocol: http
|
||||
name: kong-proxy
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 8000
|
||||
- appProtocol: https
|
||||
name: kong-proxy-tls
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 8443
|
||||
selector:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/name: kong
|
||||
type: LoadBalancer
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
ports:
|
||||
- name: webhook
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: webhook
|
||||
selector:
|
||||
app.kubernetes.io/component: app
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -135,7 +135,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -156,7 +156,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -237,7 +237,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -347,7 +347,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -404,8 +404,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -613,6 +613,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -652,8 +684,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -671,8 +703,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -735,8 +767,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -758,8 +790,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -774,8 +806,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -787,8 +819,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -814,9 +846,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -842,8 +874,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -857,8 +889,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -867,8 +899,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: my-kong-sa
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -105,9 +105,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -158,7 +158,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -410,8 +410,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -619,6 +619,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -658,8 +690,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -677,8 +709,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -741,8 +773,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -764,8 +796,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -780,8 +812,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -793,8 +825,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -820,9 +852,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -848,8 +880,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -863,8 +895,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -873,8 +905,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -32,9 +32,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -249,8 +249,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -276,9 +276,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -304,8 +304,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -104,10 +104,10 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
environment: test
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -139,7 +139,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -160,7 +160,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -252,7 +252,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -370,7 +370,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -447,8 +447,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -473,8 +473,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -497,8 +497,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -706,6 +706,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -745,8 +777,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -764,8 +796,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -828,8 +860,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -851,8 +883,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -867,8 +899,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -880,8 +912,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -907,9 +939,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -935,8 +967,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -950,8 +982,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -960,8 +992,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -83,8 +83,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -111,9 +111,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -150,7 +150,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -171,7 +171,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -270,7 +270,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -404,7 +404,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -507,7 +507,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-db
|
||||
resources: {}
|
||||
@@ -724,8 +724,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-init-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -740,8 +740,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-init-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -819,7 +819,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-migrations
|
||||
resources: {}
|
||||
@@ -924,7 +924,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -977,8 +977,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-post-upgrade-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -993,8 +993,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-post-upgrade-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -1072,7 +1072,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-post-upgrade-migrations
|
||||
resources: {}
|
||||
@@ -1177,7 +1177,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -1232,8 +1232,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-pre-upgrade-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1248,8 +1248,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-pre-upgrade-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -1327,7 +1327,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-upgrade-migrations
|
||||
resources: {}
|
||||
@@ -1432,7 +1432,7 @@ SnapShot = """
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: env-config
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -1481,8 +1481,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1505,10 +1505,26 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -1548,8 +1564,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -1567,8 +1583,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -1631,8 +1647,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-default
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -1841,6 +1857,22 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- object:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
@@ -1849,8 +1881,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -1869,8 +1901,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-default
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -1895,8 +1927,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-bash-wait-for-postgres
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -1917,8 +1949,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -1933,8 +1965,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -1961,8 +1993,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1988,9 +2020,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -2024,8 +2056,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -2039,8 +2071,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -2099,8 +2131,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -33,9 +33,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -92,7 +92,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -208,7 +208,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -295,8 +295,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-custom-dbless-config
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -307,8 +307,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -334,9 +334,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -362,8 +362,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -9,8 +9,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -33,9 +33,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -92,7 +92,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:9000, [::]:9000, 0.0.0.0:9001 ssl, [::]:9001 ssl
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -212,7 +212,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: 0.0.0.0:9000, [::]:9000, 0.0.0.0:9001 ssl, [::]:9001 ssl
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -271,8 +271,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -304,8 +304,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-custom-dbless-config
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -316,8 +316,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -343,9 +343,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -379,8 +379,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -8,8 +8,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validations
|
||||
namespace: default
|
||||
webhooks:
|
||||
@@ -82,8 +82,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -110,9 +110,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
version: \"3.6\"
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
@@ -142,7 +142,7 @@ SnapShot = """
|
||||
value: https://localhost:8444
|
||||
- name: CONTROLLER_PUBLISH_SERVICE
|
||||
value: default/chartsnap-kong-proxy
|
||||
image: kong/kubernetes-ingress-controller:3.0
|
||||
image: kong/kubernetes-ingress-controller:3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -163,7 +163,7 @@ SnapShot = """
|
||||
name: cmetrics
|
||||
protocol: TCP
|
||||
- containerPort: 10254
|
||||
name: status
|
||||
name: cstatus
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
@@ -261,7 +261,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
@@ -388,7 +388,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: clear-stale-pid
|
||||
resources: {}
|
||||
@@ -477,7 +477,7 @@ SnapShot = """
|
||||
value: 0.0.0.0:8100, [::]:8100
|
||||
- name: KONG_STREAM_LISTEN
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-db
|
||||
resources: {}
|
||||
@@ -694,8 +694,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-init-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -710,8 +710,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-init-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -788,7 +788,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-migrations
|
||||
resources: {}
|
||||
@@ -879,7 +879,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -932,8 +932,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-post-upgrade-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -948,8 +948,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-post-upgrade-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -1026,7 +1026,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-post-upgrade-migrations
|
||||
resources: {}
|
||||
@@ -1117,7 +1117,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -1172,8 +1172,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-pre-upgrade-migrations
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1188,8 +1188,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: kong-pre-upgrade-migrations
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
@@ -1266,7 +1266,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kong-upgrade-migrations
|
||||
resources: {}
|
||||
@@ -1357,7 +1357,7 @@ SnapShot = """
|
||||
value: \"off\"
|
||||
- name: KONG_NGINX_DAEMON
|
||||
value: \"off\"
|
||||
image: kong:3.5
|
||||
image: kong:3.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-for-postgres
|
||||
resources: {}
|
||||
@@ -1406,8 +1406,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1430,8 +1430,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
rules:
|
||||
- apiGroups:
|
||||
@@ -1639,6 +1639,38 @@ SnapShot = """
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- konglicenses/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
- kongvaults/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- configuration.konghq.com
|
||||
resources:
|
||||
@@ -1678,8 +1710,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -1697,8 +1729,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
rules:
|
||||
@@ -1761,8 +1793,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
roleRef:
|
||||
@@ -1787,8 +1819,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-bash-wait-for-postgres
|
||||
namespace: default
|
||||
- object:
|
||||
@@ -1802,8 +1834,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-ca-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -1818,8 +1850,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook-keypair
|
||||
namespace: default
|
||||
type: kubernetes.io/tls
|
||||
@@ -1846,8 +1878,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-manager
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1873,9 +1905,9 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
enable-metrics: \"true\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-proxy
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1901,8 +1933,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong-validation-webhook
|
||||
namespace: default
|
||||
spec:
|
||||
@@ -1916,8 +1948,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
- object:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -1976,8 +2008,8 @@ SnapShot = """
|
||||
app.kubernetes.io/instance: chartsnap
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: kong
|
||||
app.kubernetes.io/version: \"3.5\"
|
||||
helm.sh/chart: kong-2.36.0
|
||||
app.kubernetes.io/version: \"3.6\"
|
||||
helm.sh/chart: kong-2.38.0
|
||||
name: chartsnap-kong
|
||||
namespace: default
|
||||
"""
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
# This values test that the `proxy.*.appProtocol` can be set to a custom value.
|
||||
|
||||
proxy:
|
||||
http:
|
||||
appProtocol: "http"
|
||||
tls:
|
||||
appProtocol: "https"
|
||||
File diff suppressed because it is too large
Load Diff
@@ -213,6 +213,9 @@ spec:
|
||||
- name: kong-{{ .serviceName }}
|
||||
port: {{ .http.servicePort }}
|
||||
targetPort: {{ .http.containerPort }}
|
||||
{{- if .http.appProtocol }}
|
||||
appProtocol: {{ .http.appProtocol }}
|
||||
{{- end }}
|
||||
{{- if (and (or (eq .type "LoadBalancer") (eq .type "NodePort")) (not (empty .http.nodePort))) }}
|
||||
nodePort: {{ .http.nodePort }}
|
||||
{{- end }}
|
||||
@@ -223,6 +226,9 @@ spec:
|
||||
- name: kong-{{ .serviceName }}-tls
|
||||
port: {{ .tls.servicePort }}
|
||||
targetPort: {{ .tls.overrideServiceTargetPort | default .tls.containerPort }}
|
||||
{{- if .tls.appProtocol }}
|
||||
appProtocol: {{ .tls.appProtocol }}
|
||||
{{- end }}
|
||||
{{- if (and (or (eq .type "LoadBalancer") (eq .type "NodePort")) (not (empty .tls.nodePort))) }}
|
||||
nodePort: {{ .tls.nodePort }}
|
||||
{{- end }}
|
||||
@@ -890,7 +896,7 @@ The name of the Service which will be used by the controller to update the Ingre
|
||||
containerPort: 10255
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
- name: status
|
||||
- name: cstatus
|
||||
containerPort: 10254
|
||||
protocol: TCP
|
||||
env:
|
||||
|
||||
@@ -34,7 +34,7 @@ spec:
|
||||
http-headers: false
|
||||
request-body: false
|
||||
log-destination:
|
||||
cloud: false
|
||||
cloud: true
|
||||
stdout:
|
||||
format: json-formatted
|
||||
---
|
||||
|
||||
@@ -130,7 +130,7 @@ extraLabels: {}
|
||||
# Specify Kong's Docker image and repository details here
|
||||
image:
|
||||
repository: kong
|
||||
tag: "3.5"
|
||||
tag: "3.6"
|
||||
# Kong Enterprise
|
||||
# repository: kong/kong-gateway
|
||||
# tag: "3.5"
|
||||
@@ -317,6 +317,10 @@ proxy:
|
||||
parameters:
|
||||
- http2
|
||||
|
||||
# Specify the Service's TLS port's appProtocol. This can be useful when integrating with
|
||||
# external load balancers that require the `appProtocol` field to be set (e.g. GCP).
|
||||
appProtocol: ""
|
||||
|
||||
# Define stream (TCP) listen
|
||||
# To enable, remove "[]", uncomment the section below, and select your desired
|
||||
# ports and parameters. Listens are dynamically named after their containerPort,
|
||||
@@ -525,7 +529,7 @@ ingressController:
|
||||
enabled: true
|
||||
image:
|
||||
repository: kong/kubernetes-ingress-controller
|
||||
tag: "3.0"
|
||||
tag: "3.1"
|
||||
# Optionally set a semantic version for version-gated features. This can normally
|
||||
# be left unset. You only need to set this if your tag is not a semver string,
|
||||
# such as when you are using a "next" tag. Set this to the effective semantic
|
||||
@@ -1255,7 +1259,7 @@ appsec:
|
||||
#registry:
|
||||
repository: ghcr.io/openappsec
|
||||
image: "agent"
|
||||
tag: "1.1.6"
|
||||
tag: "1.1.8"
|
||||
pullPolicy: Always
|
||||
|
||||
securityContext:
|
||||
@@ -1269,7 +1273,7 @@ appsec:
|
||||
kong:
|
||||
image:
|
||||
repository: "ghcr.io/openappsec/kong-attachment"
|
||||
tag: "1.1.6"
|
||||
tag: "1.1.8"
|
||||
configMapName: appsec-settings-configmap
|
||||
configMapContent:
|
||||
crowdsec:
|
||||
|
||||
@@ -11,6 +11,7 @@ var_fog_address=
|
||||
var_proxy=
|
||||
var_mode=
|
||||
var_token=
|
||||
var_ignore=
|
||||
init=
|
||||
|
||||
if [ ! -f /nano-service-installers/$ORCHESTRATION_INSTALLATION_SCRIPT ]; then
|
||||
@@ -18,6 +19,10 @@ if [ ! -f /nano-service-installers/$ORCHESTRATION_INSTALLATION_SCRIPT ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z $1 ]; then
|
||||
var_mode="--hybrid_mode"
|
||||
fi
|
||||
|
||||
while true; do
|
||||
if [ -z "$1" ]; then
|
||||
break
|
||||
@@ -27,24 +32,27 @@ while true; do
|
||||
elif [ "$1" == "--proxy" ]; then
|
||||
shift
|
||||
var_proxy="$1"
|
||||
elif [ "$1" == "--hybrid-mode" ]; then
|
||||
elif [ "$1" == "--hybrid-mode" ] || [ "$1" == "--standalone" ]; then
|
||||
var_mode="--hybrid_mode"
|
||||
elif [ "$1" == "--no-upgrade" ]; then
|
||||
var_ignore="--ignore all"
|
||||
elif [ "$1" == "--token" ]; then
|
||||
shift
|
||||
var_token="$1"
|
||||
elif [ "$1" == "--standalone" ]; then
|
||||
var_mode="--hybrid_mode"
|
||||
var_token="cp-3fb5c718-5e39-47e6-8d5e-99b4bc5660b74b4b7fc8-5312-451d-a763-aaf7872703c0"
|
||||
fi
|
||||
shift
|
||||
done
|
||||
|
||||
if [ -z $var_token ]; then
|
||||
if [ -z $var_token ] && [ $var_mode != "--hybrid_mode" ]; then
|
||||
echo "Error: Token was not provided as input argument."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
orchestration_service_installation_flags="--token $var_token --container_mode --skip_registration"
|
||||
orchestration_service_installation_flags="--container_mode --skip_registration"
|
||||
if [ ! -z $var_token ]; then
|
||||
export AGENT_TOKEN="$var_token"
|
||||
orchestration_service_installation_flags="$orchestration_service_installation_flags --token $var_token"
|
||||
fi
|
||||
if [ ! -z $var_fog_address ]; then
|
||||
orchestration_service_installation_flags="$orchestration_service_installation_flags --fog $var_fog_address"
|
||||
fi
|
||||
@@ -55,6 +63,9 @@ fi
|
||||
if [ ! -z $var_mode ]; then
|
||||
orchestration_service_installation_flags="$orchestration_service_installation_flags $var_mode"
|
||||
fi
|
||||
if [ ! -z "$var_ignore" ]; then
|
||||
orchestration_service_installation_flags="$orchestration_service_installation_flags $var_ignore"
|
||||
fi
|
||||
|
||||
|
||||
/nano-service-installers/$ORCHESTRATION_INSTALLATION_SCRIPT --install $orchestration_service_installation_flags
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -4,7 +4,6 @@ add_subdirectory(signal_handler)
|
||||
add_subdirectory(gradual_deployment)
|
||||
add_subdirectory(packet)
|
||||
add_subdirectory(pending_key)
|
||||
add_subdirectory(health_check_manager)
|
||||
|
||||
add_subdirectory(utils)
|
||||
add_subdirectory(attachment-intakers)
|
||||
|
||||
@@ -1698,7 +1698,7 @@ private:
|
||||
}
|
||||
};
|
||||
mainloop->addFileRoutine(
|
||||
I_MainLoop::RoutineType::RealTime,
|
||||
I_MainLoop::RoutineType::System,
|
||||
server_sock,
|
||||
accept_attachment_routine,
|
||||
"Nginx Attachment registration listener",
|
||||
|
||||
@@ -306,17 +306,20 @@ UsersAllIdentifiersConfig::parseXForwardedFor(const string &str) const
|
||||
void
|
||||
UsersAllIdentifiersConfig::setXFFValuesToOpaqueCtx(const HttpHeader &header, ExtractType type) const
|
||||
{
|
||||
auto i_transaction_table = Singleton::Consume<I_TableSpecific<SessionID>>::by<NginxAttachment>();
|
||||
if (!i_transaction_table || !i_transaction_table->hasState<NginxAttachmentOpaque>()) {
|
||||
dbgTrace(D_NGINX_ATTACHMENT_PARSER) << "Can't get the transaction table";
|
||||
return;
|
||||
}
|
||||
NginxAttachmentOpaque &opaque = i_transaction_table->getState<NginxAttachmentOpaque>();
|
||||
opaque.setSavedData(HttpTransactionData::xff_vals_ctx, header.getValue());
|
||||
dbgTrace(D_NGINX_ATTACHMENT_PARSER) << "xff found, value from header: " << static_cast<string>(header.getValue());
|
||||
auto value = parseXForwardedFor(header.getValue());
|
||||
if (!value.ok()) {
|
||||
dbgTrace(D_NGINX_ATTACHMENT_PARSER) << "Could not extract source identifier from X-Forwarded-For header";
|
||||
return;
|
||||
};
|
||||
auto i_transaction_table = Singleton::Consume<I_TableSpecific<SessionID>>::by<NginxAttachment>();
|
||||
if (!i_transaction_table || !i_transaction_table->hasState<NginxAttachmentOpaque>()) {
|
||||
dbgDebug(D_NGINX_ATTACHMENT_PARSER) << "Can't get the transaction table";
|
||||
return;
|
||||
}
|
||||
NginxAttachmentOpaque &opaque = i_transaction_table->getState<NginxAttachmentOpaque>();
|
||||
|
||||
if (type == ExtractType::SOURCEIDENTIFIER) {
|
||||
opaque.setSourceIdentifier(header.getKey(), value.unpack());
|
||||
dbgDebug(D_NGINX_ATTACHMENT_PARSER)
|
||||
|
||||
@@ -1,137 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/assets_config.h"
|
||||
|
||||
#include <string>
|
||||
#include <algorithm>
|
||||
#include <unordered_map>
|
||||
|
||||
#include "generic_rulebase/generic_rulebase_utils.h"
|
||||
#include "config.h"
|
||||
#include "debug.h"
|
||||
#include "ip_utilities.h"
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
using namespace std;
|
||||
|
||||
void
|
||||
RuleAsset::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
archive_in(cereal::make_nvp("assetId", asset_id));
|
||||
archive_in(cereal::make_nvp("assetName", asset_name));
|
||||
archive_in(cereal::make_nvp("assetUrls", asset_urls));
|
||||
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Adding asset with UID: " << asset_id;
|
||||
}
|
||||
|
||||
void
|
||||
RuleAsset::AssetUrl::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
archive_in(cereal::make_nvp("protocol", protocol));
|
||||
transform(protocol.begin(), protocol.end(), protocol.begin(), [](unsigned char c) { return tolower(c); });
|
||||
|
||||
archive_in(cereal::make_nvp("ip", ip));
|
||||
archive_in(cereal::make_nvp("port", port));
|
||||
|
||||
int value;
|
||||
if (protocol == "*") {
|
||||
is_any_proto = true;
|
||||
} else {
|
||||
is_any_proto = false;
|
||||
try {
|
||||
value = 0;
|
||||
if(protocol == "udp") value = IPPROTO_UDP;
|
||||
if(protocol == "tcp") value = IPPROTO_TCP;
|
||||
if(protocol == "dccp") value = IPPROTO_DCCP;
|
||||
if(protocol == "sctp") value = IPPROTO_SCTP;
|
||||
if(protocol == "icmp") value = IPPROTO_ICMP;
|
||||
if(protocol == "icmpv6") value = IPPROTO_ICMP;
|
||||
|
||||
if (value > static_cast<int>(UINT8_MAX) || value < 0) {
|
||||
dbgWarning(D_RULEBASE_CONFIG)
|
||||
<< "provided value is not a legal IP protocol number. Value: "
|
||||
<< protocol;
|
||||
} else {
|
||||
parsed_proto = value;
|
||||
}
|
||||
} catch (...) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal IP protocol. Value: " << protocol;
|
||||
}
|
||||
}
|
||||
|
||||
if (port == "*") {
|
||||
is_any_port = true;
|
||||
} else {
|
||||
is_any_port = false;
|
||||
try {
|
||||
value = stoi(port);
|
||||
if (value > static_cast<int>(UINT16_MAX) || value < 0) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal port number. Value: " << port;
|
||||
} else {
|
||||
parsed_port = value;
|
||||
}
|
||||
} catch (...) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal port. Value: " << port;
|
||||
}
|
||||
}
|
||||
|
||||
if (ip == "*") {
|
||||
is_any_ip = true;
|
||||
} else {
|
||||
is_any_ip = false;
|
||||
auto ip_addr = IPAddr::createIPAddr(ip);
|
||||
if (!ip_addr.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Could not create IP address. Error: " << ip_addr.getErr();
|
||||
} else {
|
||||
parsed_ip = ConvertToIpAddress(ip_addr.unpackMove());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
IpAddress
|
||||
RuleAsset::AssetUrl::ConvertToIpAddress(const IPAddr &addr)
|
||||
{
|
||||
IpAddress address;
|
||||
switch (addr.getType()) {
|
||||
case IPType::UNINITIALIZED: {
|
||||
address.addr4_t = {0};
|
||||
address.ip_type = IP_VERSION_ANY;
|
||||
break;
|
||||
}
|
||||
case IPType::V4: {
|
||||
address.addr4_t = addr.getIPv4();
|
||||
address.ip_type = IP_VERSION_4;
|
||||
break;
|
||||
}
|
||||
case IPType::V6: {
|
||||
address.addr6_t = addr.getIPv6();
|
||||
address.ip_type = IP_VERSION_6;
|
||||
break;
|
||||
}
|
||||
default:
|
||||
address.addr4_t = {0};
|
||||
address.ip_type = IP_VERSION_ANY;
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Unsupported IP type: " << static_cast<int>(addr.getType());
|
||||
}
|
||||
return address;
|
||||
}
|
||||
|
||||
const Assets Assets::empty_assets_config = Assets();
|
||||
|
||||
void
|
||||
Assets::preload()
|
||||
{
|
||||
registerExpectedSetting<Assets>("rulebase", "usedAssets");
|
||||
}
|
||||
@@ -1,52 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/evaluators/asset_eval.h"
|
||||
|
||||
#include <vector>
|
||||
#include <string>
|
||||
|
||||
#include "generic_rulebase/assets_config.h"
|
||||
#include "config.h"
|
||||
#include "debug.h"
|
||||
|
||||
using namespace std;
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
string AssetMatcher::ctx_key = "asset_id";
|
||||
|
||||
AssetMatcher::AssetMatcher(const vector<string> ¶ms)
|
||||
{
|
||||
if (params.size() != 1) reportWrongNumberOfParams(AssetMatcher::getName(), params.size(), 1, 1);
|
||||
asset_id = params[0];
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
AssetMatcher::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<AssetMatcher>();
|
||||
auto bc_asset_id_ctx = env->get<GenericConfigId>(AssetMatcher::ctx_key);
|
||||
|
||||
if (bc_asset_id_ctx.ok()) {
|
||||
dbgTrace(D_RULEBASE_CONFIG)
|
||||
<< "Asset ID: "
|
||||
<< asset_id
|
||||
<< "; Current set assetId context: "
|
||||
<< *bc_asset_id_ctx;
|
||||
} else {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Asset ID: " << asset_id << ". Empty context";
|
||||
}
|
||||
|
||||
return bc_asset_id_ctx.ok() && *bc_asset_id_ctx == asset_id;
|
||||
}
|
||||
@@ -1,299 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/evaluators/connection_eval.h"
|
||||
|
||||
#include <vector>
|
||||
#include <string>
|
||||
|
||||
#include "generic_rulebase/rulebase_config.h"
|
||||
#include "config.h"
|
||||
#include "debug.h"
|
||||
#include "ip_utilities.h"
|
||||
|
||||
using namespace std;
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
string IpAddressMatcher::ctx_key = "ipAddress";
|
||||
string SourceIpMatcher::ctx_key = "sourceIP";
|
||||
string DestinationIpMatcher::ctx_key = "destinationIP";
|
||||
string SourcePortMatcher::ctx_key = "sourcePort";
|
||||
string ListeningPortMatcher::ctx_key = "listeningPort";
|
||||
string IpProtocolMatcher::ctx_key = "ipProtocol";
|
||||
string UrlMatcher::ctx_key = "url";
|
||||
|
||||
Maybe<IPAddr>
|
||||
getIpAddrFromEnviroment(I_Environment *env, Context::MetaDataType enum_data_type, const string &str_data_type)
|
||||
{
|
||||
auto ip_str = env->get<string>(enum_data_type);
|
||||
if (!ip_str.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to get " << str_data_type << " from the enviroment.";
|
||||
return genError("Failed to get " + str_data_type + " from the enviroment.");
|
||||
}
|
||||
return IPAddr::createIPAddr(ip_str.unpack());
|
||||
}
|
||||
|
||||
bool
|
||||
checkIfIpInRangesVec(const vector<CustomRange<IPAddr>> &values, const IPAddr &ip_to_check)
|
||||
{
|
||||
if (values.size() == 0) {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Ip addersses vector empty. Match is true.";
|
||||
return true;
|
||||
}
|
||||
for (const CustomRange<IPAddr> &range : values) {
|
||||
if (range.contains(ip_to_check)) {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss matched: " << ip_to_check;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss not match: " << ip_to_check;
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
IpAddressMatcher::IpAddressMatcher(const vector<string> ¶ms)
|
||||
{
|
||||
for (const string ¶m : params) {
|
||||
Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
|
||||
if (!ip_range.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to create ip. Error: " + ip_range.getErr();
|
||||
continue;
|
||||
}
|
||||
values.push_back(ip_range.unpack());
|
||||
}
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
IpAddressMatcher::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<IpAddressMatcher>();
|
||||
Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
|
||||
env,
|
||||
Context::MetaDataType::SubjectIpAddr,
|
||||
"subject ip address"
|
||||
);
|
||||
if (subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack())) return true;
|
||||
|
||||
Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
|
||||
env,
|
||||
Context::MetaDataType::OtherIpAddr,
|
||||
"other ip address"
|
||||
);
|
||||
if (other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack())) return true;
|
||||
if (!subject_ip.ok() && !other_ip.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Error in getting subject ip and other ip from the enviroment";
|
||||
return false;
|
||||
}
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss didn't match";
|
||||
return false;
|
||||
}
|
||||
|
||||
SourceIpMatcher::SourceIpMatcher(const vector<string> ¶ms)
|
||||
{
|
||||
for (const string ¶m : params) {
|
||||
Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
|
||||
if (!ip_range.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to create source ip. Error: " + ip_range.getErr();
|
||||
continue;
|
||||
}
|
||||
values.push_back(ip_range.unpack());
|
||||
}
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
SourceIpMatcher::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<SourceIpMatcher>();
|
||||
auto direction_maybe = env->get<string>(Context::MetaDataType::Direction);
|
||||
if (!direction_maybe.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to get direction from the enviroment.";
|
||||
return false;
|
||||
}
|
||||
string direction = direction_maybe.unpack();
|
||||
if (direction == "incoming") {
|
||||
Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
|
||||
env,
|
||||
Context::MetaDataType::OtherIpAddr,
|
||||
"other ip address"
|
||||
);
|
||||
return other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack());
|
||||
} else if (direction == "outgoing") {
|
||||
Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
|
||||
env,
|
||||
Context::MetaDataType::SubjectIpAddr,
|
||||
"subject ip address"
|
||||
);
|
||||
return subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack());
|
||||
}
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Source ip adderss didn't match";
|
||||
return false;
|
||||
}
|
||||
|
||||
DestinationIpMatcher::DestinationIpMatcher(const vector<string> ¶ms)
|
||||
{
|
||||
for (const string ¶m : params) {
|
||||
Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
|
||||
if (!ip_range.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to create destination ip. Error: " + ip_range.getErr();
|
||||
continue;
|
||||
}
|
||||
values.push_back(ip_range.unpack());
|
||||
}
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
DestinationIpMatcher::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<DestinationIpMatcher>();
|
||||
auto direction_maybe = env->get<string>(Context::MetaDataType::Direction);
|
||||
if (!direction_maybe.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to get direction.";
|
||||
return false;
|
||||
}
|
||||
string direction = direction_maybe.unpack();
|
||||
if (direction == "outgoing") {
|
||||
Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
|
||||
env,
|
||||
Context::MetaDataType::OtherIpAddr,
|
||||
"other ip address"
|
||||
);
|
||||
return other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack());
|
||||
} else if (direction == "incoming") {
|
||||
Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
|
||||
env,
|
||||
Context::MetaDataType::SubjectIpAddr,
|
||||
"subject ip address"
|
||||
);
|
||||
return subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack());
|
||||
}
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Destination ip adderss didn't match";
|
||||
return false;
|
||||
}
|
||||
|
||||
SourcePortMatcher::SourcePortMatcher(const vector<string> ¶ms)
|
||||
{
|
||||
for (const string ¶m : params) {
|
||||
Maybe<CustomRange<PortNumber>> port_range = CustomRange<PortNumber>::createRange(param);
|
||||
if (!port_range.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to create source port.";
|
||||
continue;
|
||||
}
|
||||
values.push_back(port_range.unpack());
|
||||
}
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
SourcePortMatcher::evalVariable() const
|
||||
{
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Source is not a match";
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
ListeningPortMatcher::ListeningPortMatcher(const vector<string> ¶ms)
|
||||
{
|
||||
for (const string ¶m : params) {
|
||||
Maybe<CustomRange<PortNumber>> port_range = CustomRange<PortNumber>::createRange(param);
|
||||
if (!port_range.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to create listening port range.";
|
||||
continue;
|
||||
}
|
||||
values.push_back(port_range.unpack());
|
||||
}
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
ListeningPortMatcher::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<ListeningPortMatcher>();
|
||||
auto port_str = env->get<string>(Context::MetaDataType::Port);
|
||||
if (!port_str.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to get port from the enviroment.";
|
||||
return false;
|
||||
}
|
||||
PortNumber port;
|
||||
if (ConnKeyUtil::fromString(port_str.unpack(), port)) {
|
||||
if (values.size() == 0) return true;
|
||||
for (const CustomRange<PortNumber> &port_range : values) {
|
||||
if (port_range.contains(port)) {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Listening port is a match. Value: " << port_str.unpack();
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Listening port is not a match. Value: " << port_str.unpack();
|
||||
return false;
|
||||
}
|
||||
|
||||
IpProtocolMatcher::IpProtocolMatcher(const vector<string> ¶ms)
|
||||
{
|
||||
for (const string ¶m : params) {
|
||||
Maybe<CustomRange<IPProto>> proto_range = CustomRange<IPProto>::createRange(param);
|
||||
if (!proto_range.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to create ip protocol.";
|
||||
continue;
|
||||
}
|
||||
values.push_back(proto_range.unpack());
|
||||
}
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
IpProtocolMatcher::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<IpProtocolMatcher>();
|
||||
auto proto_str = env->get<string>(Context::MetaDataType::Protocol);
|
||||
if (!proto_str.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to get ip protocol from the enviroment.";
|
||||
return false;
|
||||
}
|
||||
IPProto protocol;
|
||||
if (ConnKeyUtil::fromString(proto_str.unpack(), protocol)) {
|
||||
if (values.size() == 0) return true;
|
||||
for (const CustomRange<IPProto> &proto_range : values) {
|
||||
if (proto_range.contains(protocol)) {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Ip protocol is a match. Value: " << proto_str.unpack();
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Source port is not a match. Value: " << proto_str.unpack();
|
||||
return false;
|
||||
}
|
||||
|
||||
UrlMatcher::UrlMatcher(const vector<string> ¶ms) : values(params) {}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
UrlMatcher::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<UrlMatcher>();
|
||||
auto curr_url_ctx = env->get<string>(Context::MetaDataType::Url);
|
||||
if (!curr_url_ctx.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to get URL from the enviroment.";
|
||||
return false;
|
||||
}
|
||||
|
||||
if (values.size() == 0) {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Matched URL on \"any\". Url: " << *curr_url_ctx;
|
||||
return true;
|
||||
}
|
||||
|
||||
for (const string &url : values) {
|
||||
if (*curr_url_ctx == url) {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Matched URL. Value: " << *curr_url_ctx;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "URL is not a match. Value: " << *curr_url_ctx;
|
||||
return false;
|
||||
}
|
||||
@@ -1,168 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/evaluators/http_transaction_data_eval.h"
|
||||
|
||||
#include <boost/lexical_cast.hpp>
|
||||
#include <algorithm>
|
||||
|
||||
#include "http_transaction_data.h"
|
||||
#include "environment/evaluator_templates.h"
|
||||
#include "i_environment.h"
|
||||
#include "singleton.h"
|
||||
#include "debug.h"
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
using namespace std;
|
||||
using namespace EnvironmentHelper;
|
||||
|
||||
EqualHost::EqualHost(const vector<string> ¶ms)
|
||||
{
|
||||
if (params.size() != 1) reportWrongNumberOfParams("EqualHost", params.size(), 1, 1);
|
||||
host = params[0];
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
EqualHost::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<EqualHost>();
|
||||
auto host_ctx = env->get<string>(HttpTransactionData::host_name_ctx);
|
||||
|
||||
if (!host_ctx.ok())
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
std::string lower_host_ctx = host_ctx.unpack();
|
||||
std::transform(lower_host_ctx.begin(), lower_host_ctx.end(), lower_host_ctx.begin(), ::tolower);
|
||||
|
||||
std::string lower_host = host;
|
||||
std::transform(lower_host.begin(), lower_host.end(), lower_host.begin(), ::tolower);
|
||||
|
||||
|
||||
if (lower_host_ctx == lower_host) return true;
|
||||
size_t pos = lower_host_ctx.find_last_of(':');
|
||||
if (pos == string::npos) return false;
|
||||
lower_host_ctx = string(lower_host_ctx.data(), pos);
|
||||
return lower_host_ctx == lower_host;
|
||||
}
|
||||
|
||||
WildcardHost::WildcardHost(const vector<string> ¶ms)
|
||||
{
|
||||
if (params.size() != 1) reportWrongNumberOfParams("WildcardHost", params.size(), 1, 1);
|
||||
host = params[0];
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
WildcardHost::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<WildcardHost>();
|
||||
auto host_ctx = env->get<string>(HttpTransactionData::host_name_ctx);
|
||||
|
||||
if (!host_ctx.ok())
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
string lower_host_ctx = host_ctx.unpack();
|
||||
transform(lower_host_ctx.begin(), lower_host_ctx.end(), lower_host_ctx.begin(), ::tolower);
|
||||
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "found host in current context: " << lower_host_ctx;
|
||||
|
||||
size_t pos = lower_host_ctx.find_first_of(".");
|
||||
if (pos == string::npos) {
|
||||
return false;
|
||||
}
|
||||
|
||||
lower_host_ctx = "*" + lower_host_ctx.substr(pos, lower_host_ctx.length());
|
||||
|
||||
string lower_host = host;
|
||||
transform(lower_host.begin(), lower_host.end(), lower_host.begin(), ::tolower);
|
||||
|
||||
dbgTrace(D_RULEBASE_CONFIG)
|
||||
<< "trying to match host context with its corresponding wildcard address: "
|
||||
<< lower_host_ctx
|
||||
<< ". Matcher host: "
|
||||
<< lower_host;
|
||||
|
||||
if (lower_host_ctx == lower_host) return true;
|
||||
pos = lower_host_ctx.find_last_of(':');
|
||||
if (pos == string::npos) return false;
|
||||
lower_host_ctx = string(lower_host_ctx.data(), pos);
|
||||
return lower_host_ctx == lower_host;
|
||||
}
|
||||
|
||||
EqualListeningIP::EqualListeningIP(const vector<string> ¶ms)
|
||||
{
|
||||
if (params.size() != 1) reportWrongNumberOfParams("EqualListeningIP", params.size(), 1, 1);
|
||||
|
||||
auto maybe_ip = IPAddr::createIPAddr(params[0]);
|
||||
if (!maybe_ip.ok()) reportWrongParamType(getName(), params[0], "Not a valid IP Address");
|
||||
|
||||
listening_ip = maybe_ip.unpack();
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
EqualListeningIP::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<EqualListeningIP>();
|
||||
auto listening_ip_ctx = env->get<IPAddr>(HttpTransactionData::listening_ip_ctx);
|
||||
return listening_ip_ctx.ok() && listening_ip_ctx.unpack() == listening_ip;
|
||||
}
|
||||
|
||||
EqualListeningPort::EqualListeningPort(const vector<string> ¶ms)
|
||||
{
|
||||
if (params.size() != 1) reportWrongNumberOfParams("EqualListeningPort", params.size(), 1, 1);
|
||||
|
||||
try {
|
||||
listening_port = boost::lexical_cast<PortNumber>(params[0]);
|
||||
} catch (boost::bad_lexical_cast const&) {
|
||||
reportWrongParamType(getName(), params[0], "Not a valid port number");
|
||||
}
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
EqualListeningPort::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<EqualListeningPort>();
|
||||
auto port_ctx = env->get<PortNumber>(HttpTransactionData::listening_port_ctx);
|
||||
|
||||
return port_ctx.ok() && port_ctx.unpack() == listening_port;
|
||||
}
|
||||
|
||||
BeginWithUri::BeginWithUri(const vector<string> ¶ms)
|
||||
{
|
||||
if (params.size() != 1) reportWrongNumberOfParams("BeginWithUri", params.size(), 1, 1);
|
||||
uri_prefix = params[0];
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
BeginWithUri::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<BeginWithUri>();
|
||||
auto uri_ctx = env->get<string>(HttpTransactionData::uri_ctx);
|
||||
|
||||
if (!uri_ctx.ok())
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
std::string lower_uri_ctx = uri_ctx.unpack();
|
||||
std::transform(lower_uri_ctx.begin(), lower_uri_ctx.end(), lower_uri_ctx.begin(), ::tolower);
|
||||
|
||||
std::string lower_uri_prefix = uri_prefix;
|
||||
std::transform(lower_uri_prefix.begin(), lower_uri_prefix.end(), lower_uri_prefix.begin(), ::tolower);
|
||||
|
||||
return lower_uri_ctx.find(lower_uri_prefix) == 0;
|
||||
}
|
||||
@@ -1,50 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/evaluators/practice_eval.h"
|
||||
|
||||
#include <vector>
|
||||
#include <string>
|
||||
|
||||
#include "generic_rulebase/rulebase_config.h"
|
||||
#include "config.h"
|
||||
#include "debug.h"
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
using namespace std;
|
||||
|
||||
string PracticeMatcher::ctx_key = "practices";
|
||||
|
||||
PracticeMatcher::PracticeMatcher(const vector<string> ¶ms)
|
||||
{
|
||||
if (params.size() != 1) reportWrongNumberOfParams(PracticeMatcher::getName(), params.size(), 1, 1);
|
||||
practice_id = params[0];
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
PracticeMatcher::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<PracticeMatcher>();
|
||||
auto bc_practice_id_ctx = env->get<set<GenericConfigId>>(PracticeMatcher::ctx_key);
|
||||
dbgTrace(D_RULEBASE_CONFIG)
|
||||
<< "Trying to match practice. ID: "
|
||||
<< practice_id << ", Current set IDs: "
|
||||
<< makeSeparatedStr(bc_practice_id_ctx.ok() ? *bc_practice_id_ctx : set<GenericConfigId>(), ", ");
|
||||
if (bc_practice_id_ctx.ok()) {
|
||||
return bc_practice_id_ctx.unpack().count(practice_id) > 0;
|
||||
}
|
||||
|
||||
auto rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
|
||||
return rule.ok() && rule.unpack().isPracticeActive(practice_id);
|
||||
}
|
||||
@@ -1,136 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/evaluators/query_eval.h"
|
||||
|
||||
#include <vector>
|
||||
#include <string>
|
||||
#include <map>
|
||||
|
||||
#include "generic_rulebase/rulebase_config.h"
|
||||
#include "generic_rulebase/zones_config.h"
|
||||
#include "i_environment.h"
|
||||
#include "singleton.h"
|
||||
#include "config.h"
|
||||
#include "debug.h"
|
||||
#include "enum_range.h"
|
||||
|
||||
using namespace std;
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
QueryMatcher::QueryMatcher(const vector<string> ¶ms)
|
||||
{
|
||||
if (params.size() < 1) reportWrongNumberOfParams(QueryMatcher::getName(), params.size(), 1);
|
||||
|
||||
key = params.front();
|
||||
if (key == "any") {
|
||||
is_any = true;
|
||||
} else {
|
||||
values.reserve(params.size() - 1);
|
||||
for (uint i = 1; i < params.size() ; i++) {
|
||||
if (params[i] == "any") {
|
||||
values.clear();
|
||||
break;
|
||||
}
|
||||
values.insert(params[i]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const string
|
||||
QueryMatcher::contextKeyToString(Context::MetaDataType type)
|
||||
{
|
||||
if (type == Context::MetaDataType::SubjectIpAddr || type == Context::MetaDataType::OtherIpAddr) return "ip";
|
||||
return Context::convertToString(type);
|
||||
}
|
||||
|
||||
class QueryMatchSerializer
|
||||
{
|
||||
public:
|
||||
static const string req_attr_ctx_key;
|
||||
|
||||
template <typename Archive>
|
||||
void
|
||||
serialize(Archive &ar)
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<QueryMatcher>();
|
||||
auto req_attr = env->get<string>(req_attr_ctx_key);
|
||||
if (!req_attr.ok()) return;
|
||||
|
||||
try {
|
||||
ar(cereal::make_nvp(*req_attr, value));
|
||||
dbgDebug(D_RULEBASE_CONFIG)
|
||||
<< "Found value for requested attribute. Tag: "
|
||||
<< *req_attr
|
||||
<< ", Value: "
|
||||
<< value;
|
||||
} catch (exception &e) {
|
||||
dbgDebug(D_RULEBASE_CONFIG) << "Could not find values for requested attribute. Tag: " << *req_attr;
|
||||
ar.finishNode();
|
||||
}
|
||||
}
|
||||
|
||||
template <typename Values>
|
||||
bool
|
||||
matchValues(const Values &requested_vals) const
|
||||
{
|
||||
return value != "" && (requested_vals.empty() || requested_vals.count(value) > 0);
|
||||
}
|
||||
|
||||
private:
|
||||
string value;
|
||||
};
|
||||
|
||||
const string QueryMatchSerializer::req_attr_ctx_key = "requested attribute key";
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
QueryMatcher::evalVariable() const
|
||||
{
|
||||
if (is_any) return true;
|
||||
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<QueryMatcher>();
|
||||
auto local_asset_ctx = env->get<bool>("is local asset");
|
||||
bool is_remote_asset = local_asset_ctx.ok() && !(*local_asset_ctx);
|
||||
|
||||
QueryRequest request;
|
||||
for (Context::MetaDataType name : makeRange<Context::MetaDataType>()) {
|
||||
auto val = env->get<string>(name);
|
||||
if (val.ok()) {
|
||||
if ((name == Context::MetaDataType::SubjectIpAddr && is_remote_asset) ||
|
||||
(name == Context::MetaDataType::OtherIpAddr && !is_remote_asset)) {
|
||||
continue;
|
||||
}
|
||||
|
||||
request.addCondition(Condition::EQUALS, contextKeyToString(name), *val);
|
||||
}
|
||||
}
|
||||
if (request.empty()) return false;
|
||||
|
||||
request.setRequestedAttr(key);
|
||||
ScopedContext req_attr_key;
|
||||
req_attr_key.registerValue<string>(QueryMatchSerializer::req_attr_ctx_key, key);
|
||||
|
||||
I_Intelligence_IS_V2 *intelligence = Singleton::Consume<I_Intelligence_IS_V2>::by<Zone>();
|
||||
auto query_res = intelligence->queryIntelligence<QueryMatchSerializer>(request);
|
||||
if (!query_res.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to perform intelligence query. Error: " << query_res.getErr();
|
||||
return false;
|
||||
}
|
||||
|
||||
for (const AssetReply<QueryMatchSerializer> &asset : query_res.unpack()) {
|
||||
if (asset.matchValues<unordered_set<string>>(values)) return true;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
@@ -1,57 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/evaluators/trigger_eval.h"
|
||||
|
||||
#include <vector>
|
||||
#include <string>
|
||||
|
||||
#include "generic_rulebase/rulebase_config.h"
|
||||
#include "config.h"
|
||||
#include "debug.h"
|
||||
|
||||
using namespace std;
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
string TriggerMatcher::ctx_key = "triggers";
|
||||
|
||||
TriggerMatcher::TriggerMatcher(const vector<string> ¶ms)
|
||||
{
|
||||
if (params.size() != 1) reportWrongNumberOfParams(TriggerMatcher::getName(), params.size(), 1, 1);
|
||||
trigger_id = params[0];
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
TriggerMatcher::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<TriggerMatcher>();
|
||||
auto ac_bc_trigger_id_ctx = env->get<set<GenericConfigId>>("ac_trigger_id");
|
||||
dbgTrace(D_RULEBASE_CONFIG)
|
||||
<< "Trying to match trigger for access control rule. ID: "
|
||||
<< trigger_id << ", Current set IDs: "
|
||||
<< makeSeparatedStr(ac_bc_trigger_id_ctx.ok() ? *ac_bc_trigger_id_ctx : set<GenericConfigId>(), ", ");
|
||||
if (ac_bc_trigger_id_ctx.ok()) {
|
||||
return ac_bc_trigger_id_ctx.unpack().count(trigger_id) > 0;
|
||||
}
|
||||
|
||||
auto bc_trigger_id_ctx = env->get<set<GenericConfigId>>(TriggerMatcher::ctx_key);
|
||||
dbgTrace(D_RULEBASE_CONFIG)
|
||||
<< "Trying to match trigger. ID: "
|
||||
<< trigger_id << ", Current set IDs: "
|
||||
<< makeSeparatedStr(bc_trigger_id_ctx.ok() ? *bc_trigger_id_ctx : set<GenericConfigId>(), ", ");
|
||||
if (bc_trigger_id_ctx.ok() && bc_trigger_id_ctx.unpack().count(trigger_id) > 0 ) return true;
|
||||
|
||||
auto rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
|
||||
return rule.ok() && rule.unpack().isTriggerActive(trigger_id);
|
||||
}
|
||||
@@ -1,44 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/evaluators/zone_eval.h"
|
||||
|
||||
#include <vector>
|
||||
#include <string>
|
||||
|
||||
#include "generic_rulebase/zone.h"
|
||||
#include "generic_rulebase/rulebase_config.h"
|
||||
#include "config.h"
|
||||
|
||||
using namespace std;
|
||||
|
||||
string ZoneMatcher::ctx_key = "zone_id";
|
||||
|
||||
ZoneMatcher::ZoneMatcher(const vector<string> ¶ms)
|
||||
{
|
||||
if (params.size() != 1) reportWrongNumberOfParams(ZoneMatcher::getName(), params.size(), 1, 1);
|
||||
zone_id = params[0];
|
||||
}
|
||||
|
||||
Maybe<bool, Context::Error>
|
||||
ZoneMatcher::evalVariable() const
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<ZoneMatcher>();
|
||||
auto bc_zone_id_ctx = env->get<GenericConfigId>(ZoneMatcher::ctx_key);
|
||||
if (bc_zone_id_ctx.ok() && *bc_zone_id_ctx == zone_id) return true;
|
||||
|
||||
if (!getProfileAgentSettingWithDefault<bool>(false, "rulebase.enableQueryBasedMatch")) return false;
|
||||
|
||||
auto zone = getConfiguration<Zone>("rulebase", "zones");
|
||||
return zone.ok() && zone.unpack().getId() == zone_id;
|
||||
}
|
||||
@@ -1,126 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/generic_rulebase.h"
|
||||
|
||||
#include <unordered_set>
|
||||
|
||||
#include "generic_rulebase/evaluators/trigger_eval.h"
|
||||
#include "generic_rulebase/evaluators/practice_eval.h"
|
||||
#include "generic_rulebase/evaluators/parameter_eval.h"
|
||||
#include "generic_rulebase/evaluators/zone_eval.h"
|
||||
#include "generic_rulebase/evaluators/asset_eval.h"
|
||||
#include "generic_rulebase/evaluators/query_eval.h"
|
||||
#include "generic_rulebase/evaluators/connection_eval.h"
|
||||
#include "generic_rulebase/evaluators/http_transaction_data_eval.h"
|
||||
#include "generic_rulebase/zone.h"
|
||||
#include "generic_rulebase/triggers_config.h"
|
||||
#include "singleton.h"
|
||||
#include "common.h"
|
||||
#include "debug.h"
|
||||
#include "cache.h"
|
||||
#include "config.h"
|
||||
|
||||
using namespace std;
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
class GenericRulebase::Impl : Singleton::Provide<I_GenericRulebase>::From<GenericRulebase>
|
||||
{
|
||||
public:
|
||||
void init() {}
|
||||
void fini() {}
|
||||
|
||||
void preload();
|
||||
|
||||
Maybe<Zone, Config::Errors> getLocalZone() const override { return getZoneConfig(true); }
|
||||
Maybe<Zone, Config::Errors> getOtherZone() const override { return getZoneConfig(false); }
|
||||
|
||||
set<ParameterBehavior> getBehavior(const ParameterKeyValues &key_value_pairs) const override;
|
||||
|
||||
private:
|
||||
Maybe<Zone, Config::Errors>
|
||||
getZoneConfig(bool is_local_zone) const
|
||||
{
|
||||
ScopedContext asset_location_ctx;
|
||||
asset_location_ctx.registerValue<bool>("is local asset", is_local_zone);
|
||||
return getConfiguration<Zone>("rulebase", "zones");
|
||||
}
|
||||
};
|
||||
|
||||
void
|
||||
GenericRulebase::Impl::preload()
|
||||
{
|
||||
addMatcher<TriggerMatcher>();
|
||||
addMatcher<PracticeMatcher>();
|
||||
addMatcher<ParameterMatcher>();
|
||||
addMatcher<ZoneMatcher>();
|
||||
addMatcher<AssetMatcher>();
|
||||
addMatcher<QueryMatcher>();
|
||||
addMatcher<IpAddressMatcher>();
|
||||
addMatcher<SourceIpMatcher>();
|
||||
addMatcher<DestinationIpMatcher>();
|
||||
addMatcher<SourcePortMatcher>();
|
||||
addMatcher<ListeningPortMatcher>();
|
||||
addMatcher<IpProtocolMatcher>();
|
||||
addMatcher<UrlMatcher>();
|
||||
addMatcher<EqualHost>();
|
||||
addMatcher<WildcardHost>();
|
||||
addMatcher<EqualListeningIP>();
|
||||
addMatcher<EqualListeningPort>();
|
||||
addMatcher<BeginWithUri>();
|
||||
BasicRuleConfig::preload();
|
||||
LogTriggerConf::preload();
|
||||
ParameterException::preload();
|
||||
registerExpectedConfiguration<Zone>("rulebase", "zones");
|
||||
registerExpectedConfigFile("zones", Config::ConfigFileType::Policy);
|
||||
registerExpectedConfigFile("triggers", Config::ConfigFileType::Policy);
|
||||
registerExpectedConfigFile("rules", Config::ConfigFileType::Policy);
|
||||
registerExpectedConfigFile("parameters", Config::ConfigFileType::Policy);
|
||||
registerExpectedConfigFile("exceptions", Config::ConfigFileType::Policy);
|
||||
|
||||
}
|
||||
|
||||
set<ParameterBehavior>
|
||||
GenericRulebase::Impl::getBehavior(const ParameterKeyValues &key_value_pairs) const
|
||||
{
|
||||
auto &exceptions = getConfiguration<ParameterException>("rulebase", "exception");
|
||||
|
||||
if (!exceptions.ok()) {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Could not find any exception with the current rule's context";
|
||||
return {};
|
||||
}
|
||||
return (*exceptions).getBehavior(key_value_pairs);
|
||||
}
|
||||
|
||||
GenericRulebase::GenericRulebase() : Component("GenericRulebase"), pimpl(make_unique<Impl>()) {}
|
||||
|
||||
GenericRulebase::~GenericRulebase() {}
|
||||
|
||||
void
|
||||
GenericRulebase::init()
|
||||
{
|
||||
pimpl->init();
|
||||
}
|
||||
|
||||
void
|
||||
GenericRulebase::fini()
|
||||
{
|
||||
pimpl->fini();
|
||||
}
|
||||
|
||||
void
|
||||
GenericRulebase::preload()
|
||||
{
|
||||
pimpl->preload();
|
||||
}
|
||||
@@ -1,109 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/generic_rulebase_context.h"
|
||||
|
||||
#include <vector>
|
||||
|
||||
#include "context.h"
|
||||
#include "config.h"
|
||||
#include "generic_rulebase/evaluators/trigger_eval.h"
|
||||
#include "generic_rulebase/evaluators/parameter_eval.h"
|
||||
#include "generic_rulebase/evaluators/practice_eval.h"
|
||||
#include "generic_rulebase/evaluators/zone_eval.h"
|
||||
#include "generic_rulebase/evaluators/asset_eval.h"
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
using namespace std;
|
||||
|
||||
template<typename Configs>
|
||||
set<GenericConfigId>
|
||||
extractIds(const vector<Configs> &configurations)
|
||||
{
|
||||
set<GenericConfigId> ids;
|
||||
for (const Configs &conf : configurations) {
|
||||
ids.insert(conf.getId());
|
||||
}
|
||||
return ids;
|
||||
}
|
||||
|
||||
void
|
||||
GenericRulebaseContext::activate(const BasicRuleConfig &rule)
|
||||
{
|
||||
switch(registration_state) {
|
||||
case RuleRegistrationState::UNINITIALIZED: {
|
||||
registration_state = RuleRegistrationState::REGISTERED;
|
||||
ctx.registerValue<set<GenericConfigId>>(
|
||||
TriggerMatcher::ctx_key,
|
||||
extractIds<RuleTrigger>(rule.getTriggers())
|
||||
);
|
||||
ctx.registerValue<set<GenericConfigId>>(
|
||||
PracticeMatcher::ctx_key,
|
||||
extractIds<RulePractice>(rule.getPractices())
|
||||
);
|
||||
dbgTrace(D_RULEBASE_CONFIG)
|
||||
<< "Activating current practices. Current practice IDs: "
|
||||
<< makeSeparatedStr(extractIds<RulePractice>(rule.getPractices()), ", ");
|
||||
|
||||
ctx.registerValue<set<GenericConfigId>>(
|
||||
ParameterMatcher::ctx_key,
|
||||
extractIds<RuleParameter>(rule.getParameters())
|
||||
);
|
||||
ctx.registerValue<GenericConfigId>(
|
||||
ZoneMatcher::ctx_key,
|
||||
rule.getZoneId()
|
||||
);
|
||||
ctx.registerValue<GenericConfigId>(
|
||||
AssetMatcher::ctx_key,
|
||||
rule.getAssetId()
|
||||
);
|
||||
ctx.activate();
|
||||
break;
|
||||
}
|
||||
case RuleRegistrationState::REGISTERED: {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Activating registered rule values";
|
||||
ctx.activate();
|
||||
break;
|
||||
}
|
||||
case RuleRegistrationState::UNREGISTERED: {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Failed to register rule values";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
GenericRulebaseContext::activate()
|
||||
{
|
||||
switch(registration_state) {
|
||||
case RuleRegistrationState::UNINITIALIZED: {
|
||||
auto maybe_rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
|
||||
if (!maybe_rule.ok()) {
|
||||
registration_state = RuleRegistrationState::UNREGISTERED;
|
||||
return;
|
||||
}
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Registering new rule values";
|
||||
activate(maybe_rule.unpack());
|
||||
registration_state = RuleRegistrationState::REGISTERED;
|
||||
break;
|
||||
}
|
||||
case RuleRegistrationState::REGISTERED: {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Activating registered rule values";
|
||||
ctx.activate();
|
||||
break;
|
||||
}
|
||||
case RuleRegistrationState::UNREGISTERED: {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Failed to register rule values";
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,347 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/match_query.h"
|
||||
|
||||
#include "cereal/types/set.hpp"
|
||||
|
||||
#include "generic_rulebase/generic_rulebase_utils.h"
|
||||
#include "config.h"
|
||||
#include "ip_utilities.h"
|
||||
#include "agent_core_utilities.h"
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
using namespace std;
|
||||
|
||||
static const unordered_map<string, MatchQuery::MatchType> string_to_match_type = {
|
||||
{ "condition", MatchQuery::MatchType::Condition },
|
||||
{ "operator", MatchQuery::MatchType::Operator }
|
||||
};
|
||||
|
||||
static const unordered_map<string, MatchQuery::Operators> string_to_operator = {
|
||||
{ "and", MatchQuery::Operators::And },
|
||||
{ "or", MatchQuery::Operators::Or }
|
||||
};
|
||||
|
||||
static const unordered_map<string, MatchQuery::Conditions> string_to_condition = {
|
||||
{ "equals", MatchQuery::Conditions::Equals },
|
||||
{ "not-equals", MatchQuery::Conditions::NotEquals },
|
||||
{ "not equals", MatchQuery::Conditions::NotEquals },
|
||||
{ "in", MatchQuery::Conditions::In },
|
||||
{ "not-in", MatchQuery::Conditions::NotIn },
|
||||
{ "not in", MatchQuery::Conditions::NotIn },
|
||||
{ "exist", MatchQuery::Conditions::Exist }
|
||||
};
|
||||
|
||||
static const string ip_addr_type_name = "IP address";
|
||||
static const string port_type_name = "port";
|
||||
static const string ip_proto_type_name = "IP protocol";
|
||||
|
||||
static const unordered_map<string, MatchQuery::StaticKeys> string_to_key = {
|
||||
{ "sourceIP", MatchQuery::StaticKeys::SrcIpAddress },
|
||||
{ "sourceIpAddr", MatchQuery::StaticKeys::SrcIpAddress },
|
||||
{ "destinationIP", MatchQuery::StaticKeys::DstIpAddress },
|
||||
{ "destinationIpAddr", MatchQuery::StaticKeys::DstIpAddress },
|
||||
{ "ipAddress", MatchQuery::StaticKeys::IpAddress },
|
||||
{ "sourcePort", MatchQuery::StaticKeys::SrcPort },
|
||||
{ "listeningPort", MatchQuery::StaticKeys::ListeningPort },
|
||||
{ "ipProtocol", MatchQuery::StaticKeys::IpProtocol },
|
||||
{ "domain", MatchQuery::StaticKeys::Domain }
|
||||
};
|
||||
|
||||
MatchQuery::MatchQuery(const string &match) : is_specific_label(false), is_ignore_keyword(false)
|
||||
{
|
||||
try {
|
||||
stringstream ss;
|
||||
ss.str(match);
|
||||
cereal::JSONInputArchive archive_in(ss);
|
||||
load(archive_in);
|
||||
} catch (const exception &e) {
|
||||
dbgWarning(D_RULEBASE_CONFIG)
|
||||
<< "Unable to load match query JSON. JSON content: "
|
||||
<< match
|
||||
<< ", Error: "
|
||||
<< e.what();
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
MatchQuery::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
string type_as_string;
|
||||
archive_in(cereal::make_nvp("type", type_as_string));
|
||||
|
||||
string op_as_string;
|
||||
archive_in(cereal::make_nvp("op", op_as_string));
|
||||
|
||||
auto maybe_type = string_to_match_type.find(type_as_string);
|
||||
if (maybe_type == string_to_match_type.end()) {
|
||||
reportConfigurationError("Illegal Zone match query type. Provided type in configuration: " + type_as_string);
|
||||
}
|
||||
|
||||
type = maybe_type->second;
|
||||
switch (type) {
|
||||
case (MatchType::Condition): {
|
||||
auto maybe_condition = string_to_condition.find(op_as_string);
|
||||
if (maybe_condition == string_to_condition.end()) {
|
||||
reportConfigurationError(
|
||||
"Illegal op provided for condition. Provided op in configuration: " +
|
||||
op_as_string
|
||||
);
|
||||
}
|
||||
condition_type = maybe_condition->second;
|
||||
operator_type = Operators::None;
|
||||
archive_in(cereal::make_nvp("key", key));
|
||||
key_type = getKeyByName(key);
|
||||
if (key_type == StaticKeys::NotStatic) {
|
||||
if (key.rfind("containerLabels.", 0) == 0) {
|
||||
is_specific_label = true;
|
||||
} else {
|
||||
is_specific_label = false;
|
||||
}
|
||||
}
|
||||
is_ignore_keyword = (key == "indicator");
|
||||
|
||||
if (condition_type != Conditions::Exist) {
|
||||
archive_in(cereal::make_nvp("value", value));
|
||||
for(const auto &val: value) {
|
||||
if (isKeyTypeIp()) {
|
||||
auto ip_range = IPUtilities::createRangeFromString<IPRange, IpAddress>(val, ip_addr_type_name);
|
||||
if (ip_range.ok()) {
|
||||
ip_addr_value.push_back(ip_range.unpack());
|
||||
} else {
|
||||
dbgWarning(D_RULEBASE_CONFIG)
|
||||
<< "Failed to parse IP address range. Error: "
|
||||
<< ip_range.getErr();
|
||||
}
|
||||
} else if (isKeyTypePort()) {
|
||||
auto port_range = IPUtilities::createRangeFromString<PortsRange, uint16_t>(
|
||||
val,
|
||||
port_type_name
|
||||
);
|
||||
if (port_range.ok()) {
|
||||
port_value.push_back(port_range.unpack());
|
||||
} else {
|
||||
dbgWarning(D_RULEBASE_CONFIG)
|
||||
<< "Failed to parse port range. Error: "
|
||||
<< port_range.getErr();
|
||||
}
|
||||
} else if (isKeyTypeProtocol()) {
|
||||
auto proto_range = IPUtilities::createRangeFromString<IpProtoRange, uint8_t>(
|
||||
val,
|
||||
ip_proto_type_name
|
||||
);
|
||||
if (proto_range.ok()) {
|
||||
ip_proto_value.push_back(proto_range.unpack());
|
||||
} else {
|
||||
dbgWarning(D_RULEBASE_CONFIG)
|
||||
<< "Failed to parse IP protocol range. Error: "
|
||||
<< proto_range.getErr();
|
||||
}
|
||||
}
|
||||
|
||||
try {
|
||||
regex_values.insert(boost::regex(val));
|
||||
} catch (const exception &e) {
|
||||
dbgDebug(D_RULEBASE_CONFIG) << "Failed to compile regex. Error: " << e.what();
|
||||
}
|
||||
}
|
||||
first_value = *(value.begin());
|
||||
}
|
||||
break;
|
||||
}
|
||||
case (MatchType::Operator): {
|
||||
auto maybe_operator = string_to_operator.find(op_as_string);
|
||||
if (maybe_operator == string_to_operator.end()) {
|
||||
reportConfigurationError(
|
||||
"Illegal op provided for operator. Provided op in configuration: " +
|
||||
op_as_string
|
||||
);
|
||||
}
|
||||
operator_type = maybe_operator->second;
|
||||
condition_type = Conditions::None;
|
||||
archive_in(cereal::make_nvp("items", items));
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
MatchQuery::StaticKeys
|
||||
MatchQuery::getKeyByName(const string &key_type_name)
|
||||
{
|
||||
auto key = string_to_key.find(key_type_name);
|
||||
if (key == string_to_key.end()) return StaticKeys::NotStatic;
|
||||
return key->second;
|
||||
}
|
||||
|
||||
bool
|
||||
MatchQuery::isKeyTypeIp() const
|
||||
{
|
||||
return (key_type >= StaticKeys::IpAddress && key_type <= StaticKeys::DstIpAddress);
|
||||
}
|
||||
|
||||
bool
|
||||
MatchQuery::isKeyTypePort() const
|
||||
{
|
||||
return (key_type == StaticKeys::SrcPort || key_type == StaticKeys::ListeningPort);
|
||||
}
|
||||
|
||||
bool
|
||||
MatchQuery::isKeyTypeProtocol() const
|
||||
{
|
||||
return (key_type == StaticKeys::IpProtocol);
|
||||
}
|
||||
|
||||
bool
|
||||
MatchQuery::isKeyTypeDomain() const
|
||||
{
|
||||
return (key_type == StaticKeys::Domain);
|
||||
}
|
||||
|
||||
bool
|
||||
MatchQuery::isKeyTypeSpecificLabel() const
|
||||
{
|
||||
return is_specific_label;
|
||||
}
|
||||
|
||||
bool
|
||||
MatchQuery::isKeyTypeStatic() const
|
||||
{
|
||||
return (key_type != StaticKeys::NotStatic);
|
||||
}
|
||||
|
||||
set<string>
|
||||
MatchQuery::getAllKeys() const
|
||||
{
|
||||
set<string> keys;
|
||||
if (type == MatchType::Condition) {
|
||||
if (!key.empty()) keys.insert(key);
|
||||
return keys;
|
||||
}
|
||||
|
||||
for (const MatchQuery &inner_match: items) {
|
||||
set<string> iner_keys = inner_match.getAllKeys();
|
||||
keys.insert(iner_keys.begin(), iner_keys.end());
|
||||
}
|
||||
|
||||
return keys;
|
||||
}
|
||||
|
||||
bool
|
||||
MatchQuery::matchAttributes(
|
||||
const unordered_map<string, set<string>> &key_value_pairs,
|
||||
set<string> &matched_override_keywords ) const
|
||||
{
|
||||
|
||||
if (type == MatchType::Condition) {
|
||||
auto key_value_pair = key_value_pairs.find(key);
|
||||
if (key_value_pair == key_value_pairs.end()) {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Ignoring irrelevant key: " << key;
|
||||
return false;
|
||||
}
|
||||
return matchAttributes(key_value_pair->second, matched_override_keywords);
|
||||
} else if (type == MatchType::Operator && operator_type == Operators::And) {
|
||||
for (const MatchQuery &inner_match: items) {
|
||||
if (!inner_match.matchAttributes(key_value_pairs, matched_override_keywords)) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return true;
|
||||
} else if (type == MatchType::Operator && operator_type == Operators::Or) {
|
||||
// With 'or' condition, evaluate matched override keywords first and add the ones that were fully matched
|
||||
set<string> inner_override_keywords;
|
||||
bool res = false;
|
||||
for (const MatchQuery &inner_match: items) {
|
||||
inner_override_keywords.clear();
|
||||
if (inner_match.matchAttributes(key_value_pairs, inner_override_keywords)) {
|
||||
matched_override_keywords.insert(inner_override_keywords.begin(), inner_override_keywords.end());
|
||||
res = true;
|
||||
}
|
||||
}
|
||||
return res;
|
||||
} else {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Unsupported match query type";
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
MatchQuery::MatchResult
|
||||
MatchQuery::getMatch( const unordered_map<string, set<string>> &key_value_pairs) const
|
||||
{
|
||||
MatchQuery::MatchResult matches;
|
||||
matches.matched_keywords = make_shared<set<string>>();
|
||||
matches.is_match = matchAttributes(key_value_pairs, *matches.matched_keywords);
|
||||
return matches;
|
||||
}
|
||||
|
||||
bool
|
||||
MatchQuery::matchAttributes(
|
||||
const unordered_map<string, set<string>> &key_value_pairs) const
|
||||
{
|
||||
return getMatch(key_value_pairs).is_match;
|
||||
}
|
||||
|
||||
bool
|
||||
MatchQuery::matchAttributes(
|
||||
const set<string> &values,
|
||||
set<string> &matched_override_keywords) const
|
||||
{
|
||||
auto &type = condition_type;
|
||||
bool negate = type == MatchQuery::Conditions::NotEquals || type == MatchQuery::Conditions::NotIn;
|
||||
bool match = isRegEx() ? matchAttributesRegEx(values, matched_override_keywords) : matchAttributesString(values);
|
||||
return negate ? !match : match;
|
||||
}
|
||||
|
||||
bool
|
||||
MatchQuery::matchAttributesRegEx(
|
||||
const set<string> &values,
|
||||
set<string> &matched_override_keywords) const
|
||||
{
|
||||
bool res = false;
|
||||
boost::cmatch value_matcher;
|
||||
for (const boost::regex &val_regex : regex_values) {
|
||||
for (const string &requested_match_value : values) {
|
||||
if (NGEN::Regex::regexMatch(
|
||||
__FILE__,
|
||||
__LINE__,
|
||||
requested_match_value.c_str(),
|
||||
value_matcher,
|
||||
val_regex))
|
||||
{
|
||||
res = true;
|
||||
if (is_ignore_keyword) {
|
||||
matched_override_keywords.insert(requested_match_value);
|
||||
} else {
|
||||
return res;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return res;
|
||||
}
|
||||
|
||||
bool
|
||||
MatchQuery::matchAttributesString(const set<string> &values) const
|
||||
{
|
||||
for (const string &requested_value : values) {
|
||||
if (value.find(requested_value) != value.end()) return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
bool
|
||||
MatchQuery::isRegEx() const
|
||||
{
|
||||
return key != "protectionName";
|
||||
}
|
||||
@@ -1,157 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/parameters_config.h"
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
using namespace std;
|
||||
|
||||
bool ParameterException::is_geo_location_exception_exists(false);
|
||||
bool ParameterException::is_geo_location_exception_being_loaded(false);
|
||||
|
||||
void
|
||||
ParameterOverrides::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
parseJSONKey<vector<ParsedBehavior>>("parsedBehavior", parsed_behaviors, archive_in);
|
||||
}
|
||||
|
||||
void
|
||||
ParameterTrustedSources::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
parseJSONKey<uint>("numOfSources", num_of_sources, archive_in);
|
||||
parseJSONKey<vector<SourcesIdentifier>>("sourcesIdentifiers", sources_identidiers, archive_in);
|
||||
}
|
||||
|
||||
void
|
||||
ParameterBehavior::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
string key_string;
|
||||
string val_string;
|
||||
parseJSONKey<string>("id", id, archive_in);
|
||||
parseJSONKey<string>("key", key_string, archive_in);
|
||||
parseJSONKey<string>("value", val_string, archive_in);
|
||||
if (string_to_behavior_key.find(key_string) == string_to_behavior_key.end()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Unsupported behavior key: " << key_string;
|
||||
return;
|
||||
}
|
||||
key = string_to_behavior_key.at(key_string);
|
||||
|
||||
if (string_to_behavior_val.find(val_string) == string_to_behavior_val.end()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Unsupported behavior value: " << val_string;
|
||||
return;
|
||||
}
|
||||
value = string_to_behavior_val.at(val_string);
|
||||
}
|
||||
|
||||
void
|
||||
ParameterAntiBot::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
parseJSONKey<vector<string>>("injected", injected, archive_in);
|
||||
parseJSONKey<vector<string>>("validated", validated, archive_in);
|
||||
}
|
||||
|
||||
void
|
||||
ParameterOAS::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
parseJSONKey<string>("value", value, archive_in);
|
||||
}
|
||||
|
||||
void
|
||||
ParameterException::MatchBehaviorPair::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
parseJSONKey<MatchQuery>("match", match, archive_in);
|
||||
parseJSONKey<ParameterBehavior>("behavior", behavior, archive_in);
|
||||
}
|
||||
|
||||
void
|
||||
ParameterException::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
try {
|
||||
archive_in(
|
||||
cereal::make_nvp("match", match),
|
||||
cereal::make_nvp("behavior", behavior)
|
||||
);
|
||||
} catch (...) {
|
||||
parseJSONKey<vector<MatchBehaviorPair>>("exceptions", match_queries, archive_in);
|
||||
}
|
||||
|
||||
function<bool(const MatchQuery &)> isGeoLocationExists =
|
||||
[&](const MatchQuery &query)
|
||||
{
|
||||
if (query.getKey() == "countryCode" || query.getKey() == "countryName") {
|
||||
is_geo_location_exception_being_loaded = true;
|
||||
return true;
|
||||
}
|
||||
|
||||
for (const MatchQuery &query_item : query.getItems()) {
|
||||
if (isGeoLocationExists(query_item)) return true;
|
||||
}
|
||||
|
||||
return false;
|
||||
};
|
||||
|
||||
if (isGeoLocationExists(match)) return;
|
||||
for (const MatchBehaviorPair &match_query : match_queries) {
|
||||
if (isGeoLocationExists(match_query.match)) return;
|
||||
}
|
||||
}
|
||||
|
||||
set<ParameterBehavior>
|
||||
ParameterException::getBehavior(
|
||||
const unordered_map<string, set<string>> &key_value_pairs,
|
||||
set<string> &matched_override_keywords) const
|
||||
{
|
||||
set<ParameterBehavior> matched_behaviors;
|
||||
|
||||
matched_override_keywords.clear();
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Matching exception";
|
||||
for (const MatchBehaviorPair &match_behavior_pair: match_queries) {
|
||||
MatchQuery::MatchResult match_res = match_behavior_pair.match.getMatch(key_value_pairs);
|
||||
if (match_res.is_match) {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Successfully matched an exception from a list of matches.";
|
||||
// When matching indicators with action=ignore, we expect no behavior override.
|
||||
// Instead, a matched keywords list should be returned which will be later removed from score calculation
|
||||
if (match_res.matched_keywords->size() > 0 && match_behavior_pair.behavior == action_ignore) {
|
||||
matched_override_keywords.insert(match_res.matched_keywords->begin(),
|
||||
match_res.matched_keywords->end());
|
||||
} else {
|
||||
matched_behaviors.insert(match_behavior_pair.behavior);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (match_queries.empty()) {
|
||||
MatchQuery::MatchResult match_res = match.getMatch(key_value_pairs);
|
||||
if (match_res.is_match) {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Successfully matched an exception.";
|
||||
// When matching indicators with action=ignore, we expect no behavior override.
|
||||
// Instead, a matched keywords list should be returned which will be later removed from score calculation
|
||||
if (match_res.matched_keywords->size() > 0 && behavior == action_ignore) {
|
||||
matched_override_keywords.insert(match_res.matched_keywords->begin(),
|
||||
match_res.matched_keywords->end());
|
||||
} else {
|
||||
matched_behaviors.insert(behavior);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return matched_behaviors;
|
||||
}
|
||||
|
||||
set<ParameterBehavior>
|
||||
ParameterException::getBehavior(const unordered_map<string, set<string>> &key_value_pairs) const
|
||||
{
|
||||
set<string> keywords;
|
||||
return getBehavior(key_value_pairs, keywords);
|
||||
}
|
||||
@@ -1,79 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/rulebase_config.h"
|
||||
|
||||
#include "telemetry.h"
|
||||
#include "config.h"
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
using namespace std;
|
||||
|
||||
set<string> BasicRuleConfig::assets_ids{};
|
||||
set<string> BasicRuleConfig::assets_ids_aggregation{};
|
||||
|
||||
void
|
||||
BasicRuleConfig::load(cereal::JSONInputArchive &ar)
|
||||
{
|
||||
parseJSONKey<vector<RulePractice>>("practices", practices, ar);
|
||||
parseJSONKey<vector<RuleTrigger>>("triggers", triggers, ar);
|
||||
parseJSONKey<vector<RuleParameter>>("parameters", parameters, ar);
|
||||
parseJSONKey<uint8_t>("priority", priority, ar);
|
||||
parseJSONKey<string>("ruleId", rule_id, ar);
|
||||
parseJSONKey<string>("ruleName", rule_name, ar);
|
||||
parseJSONKey<string>("assetId", asset_id, ar);
|
||||
parseJSONKey<string>("assetName", asset_name, ar);
|
||||
parseJSONKey<string>("zoneId", zone_id, ar);
|
||||
parseJSONKey<string>("zoneName", zone_name, ar);
|
||||
|
||||
assets_ids_aggregation.insert(asset_id);
|
||||
}
|
||||
|
||||
void
|
||||
BasicRuleConfig::updateCountMetric()
|
||||
{
|
||||
BasicRuleConfig::assets_ids = BasicRuleConfig::assets_ids_aggregation;
|
||||
AssetCountEvent(AssetType::ALL, BasicRuleConfig::assets_ids.size()).notify();
|
||||
}
|
||||
|
||||
bool
|
||||
BasicRuleConfig::isPracticeActive(const string &practice_id) const
|
||||
{
|
||||
for (auto practice: practices) {
|
||||
if (practice.getId() == practice_id) return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
bool
|
||||
BasicRuleConfig::isTriggerActive(const string &trigger_id) const
|
||||
{
|
||||
for (auto trigger: triggers) {
|
||||
if (trigger.getId() == trigger_id) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
bool
|
||||
BasicRuleConfig::isParameterActive(const string ¶meter_id) const
|
||||
{
|
||||
for (auto param: parameters) {
|
||||
if (param.getId() == parameter_id) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
@@ -1,243 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include <string>
|
||||
#include <map>
|
||||
|
||||
#include "generic_rulebase/triggers_config.h"
|
||||
#include "generic_rulebase/generic_rulebase_utils.h"
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
using namespace std;
|
||||
|
||||
WebTriggerConf::WebTriggerConf() : response_title(""), response_body(""), response_code(0) {}
|
||||
WebTriggerConf::WebTriggerConf(const string &title, const string &body, uint code)
|
||||
:
|
||||
response_title(title),
|
||||
response_body(body),
|
||||
response_code(code)
|
||||
{}
|
||||
|
||||
WebTriggerConf WebTriggerConf::default_trigger_conf = WebTriggerConf(
|
||||
"Attack blocked by web application protection", // title
|
||||
"Check Point's <b>Application Security</b> has detected an attack and blocked it.", // body
|
||||
403
|
||||
);
|
||||
|
||||
void
|
||||
WebTriggerConf::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
try {
|
||||
parseJSONKey<string>("details level", details_level, archive_in);
|
||||
if (details_level == "Redirect") {
|
||||
parseJSONKey<string>("redirect URL", redirect_url, archive_in);
|
||||
parseJSONKey<bool>("xEventId", add_event_id_to_header, archive_in);
|
||||
parseJSONKey<bool>("eventIdInHeader", add_event_id_to_header, archive_in);
|
||||
return;
|
||||
}
|
||||
parseJSONKey<uint>("response code", response_code, archive_in);
|
||||
if (response_code < 100 || response_code > 599) {
|
||||
throw cereal::Exception(
|
||||
"illegal web trigger response code: " +
|
||||
to_string(response_code) +
|
||||
" is out of range (100-599)"
|
||||
);
|
||||
}
|
||||
|
||||
if (details_level == "Response Code") return;
|
||||
|
||||
parseJSONKey<string>("response body", response_body, archive_in);
|
||||
parseJSONKey<string>("response title", response_title, archive_in);
|
||||
} catch (const exception &e) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to parse the web trigger configuration: '" << e.what() << "'";
|
||||
archive_in.setNextName(nullptr);
|
||||
}
|
||||
}
|
||||
|
||||
bool
|
||||
WebTriggerConf::operator==(const WebTriggerConf &other) const
|
||||
{
|
||||
return
|
||||
response_code == other.response_code &&
|
||||
response_title == other.response_title &&
|
||||
response_body == other.response_body;
|
||||
}
|
||||
|
||||
LogTriggerConf::LogTriggerConf(string trigger_name, bool log_detect, bool log_prevent) : name(trigger_name)
|
||||
{
|
||||
if (log_detect) should_log_on_detect.setAll();
|
||||
if (log_prevent) should_log_on_prevent.setAll();
|
||||
active_streams.setFlag(ReportIS::StreamType::JSON_FOG);
|
||||
active_streams.setFlag(ReportIS::StreamType::JSON_LOG_FILE);
|
||||
}
|
||||
|
||||
ReportIS::Severity
|
||||
LogTriggerConf::getSeverity(bool is_action_drop_or_prevent) const
|
||||
{
|
||||
return is_action_drop_or_prevent ? ReportIS::Severity::MEDIUM : ReportIS::Severity::LOW;
|
||||
}
|
||||
|
||||
ReportIS::Priority
|
||||
LogTriggerConf::getPriority(bool is_action_drop_or_prevent) const
|
||||
{
|
||||
return is_action_drop_or_prevent ? ReportIS::Priority::HIGH : ReportIS::Priority::MEDIUM;
|
||||
}
|
||||
|
||||
Flags<ReportIS::StreamType>
|
||||
LogTriggerConf::getStreams(SecurityType security_type, bool is_action_drop_or_prevent) const
|
||||
{
|
||||
if (is_action_drop_or_prevent && should_log_on_prevent.isSet(security_type)) return active_streams;
|
||||
if (!is_action_drop_or_prevent && should_log_on_detect.isSet(security_type)) return active_streams;
|
||||
|
||||
return Flags<ReportIS::StreamType>();
|
||||
}
|
||||
|
||||
Flags<ReportIS::Enreachments>
|
||||
LogTriggerConf::getEnrechments(SecurityType security_type) const
|
||||
{
|
||||
Flags<ReportIS::Enreachments> enreachments;
|
||||
|
||||
if (log_geo_location.isSet(security_type)) enreachments.setFlag(ReportIS::Enreachments::GEOLOCATION);
|
||||
if (should_format_output) enreachments.setFlag(ReportIS::Enreachments::BEAUTIFY_OUTPUT);
|
||||
|
||||
return enreachments;
|
||||
}
|
||||
|
||||
template <typename EnumClass>
|
||||
static void
|
||||
setTriggersFlag(const string &key, cereal::JSONInputArchive &ar, EnumClass flag, Flags<EnumClass> &flags)
|
||||
{
|
||||
bool value = false;
|
||||
parseJSONKey<bool>(key, value, ar);
|
||||
if (value) flags.setFlag(flag);
|
||||
}
|
||||
|
||||
static void
|
||||
setLogConfiguration(
|
||||
const ReportIS::StreamType &log_type,
|
||||
const string &log_server_url = "",
|
||||
const string &protocol = ""
|
||||
)
|
||||
{
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "log server url:" << log_server_url;
|
||||
if (log_server_url != "" && protocol != "") {
|
||||
Singleton::Consume<I_Logging>::by<LogTriggerConf>()->addStream(log_type, log_server_url, protocol);
|
||||
} else {
|
||||
Singleton::Consume<I_Logging>::by<LogTriggerConf>()->addStream(log_type);
|
||||
}
|
||||
}
|
||||
|
||||
static string
|
||||
parseProtocolWithDefault(
|
||||
const std::string &default_value,
|
||||
const std::string &key_name,
|
||||
cereal::JSONInputArchive &archive_in
|
||||
)
|
||||
{
|
||||
string value;
|
||||
try {
|
||||
archive_in(cereal::make_nvp(key_name, value));
|
||||
} catch (const cereal::Exception &e) {
|
||||
return default_value;
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
void
|
||||
LogTriggerConf::load(cereal::JSONInputArchive& archive_in)
|
||||
{
|
||||
try {
|
||||
parseJSONKey<string>("triggerName", name, archive_in);
|
||||
parseJSONKey<string>("verbosity", verbosity, archive_in);
|
||||
parseJSONKey<string>("urlForSyslog", url_for_syslog, archive_in);
|
||||
parseJSONKey<string>("urlForCef", url_for_cef, archive_in);
|
||||
parseJSONKey<string>("syslogProtocol", syslog_protocol, archive_in);
|
||||
syslog_protocol = parseProtocolWithDefault("UDP", "syslogProtocol", archive_in);
|
||||
cef_protocol = parseProtocolWithDefault("UDP", "cefProtocol", archive_in);
|
||||
|
||||
setTriggersFlag("webBody", archive_in, WebLogFields::webBody, log_web_fields);
|
||||
setTriggersFlag("webHeaders", archive_in, WebLogFields::webHeaders, log_web_fields);
|
||||
setTriggersFlag("webRequests", archive_in, WebLogFields::webRequests, log_web_fields);
|
||||
setTriggersFlag("webUrlPath", archive_in, WebLogFields::webUrlPath, log_web_fields);
|
||||
setTriggersFlag("webUrlQuery", archive_in, WebLogFields::webUrlQuery, log_web_fields);
|
||||
setTriggersFlag("logToAgent", archive_in, ReportIS::StreamType::JSON_LOG_FILE, active_streams);
|
||||
setTriggersFlag("logToCloud", archive_in, ReportIS::StreamType::JSON_FOG, active_streams);
|
||||
setTriggersFlag("logToK8sService", archive_in, ReportIS::StreamType::JSON_K8S_SVC, active_streams);
|
||||
setTriggersFlag("logToSyslog", archive_in, ReportIS::StreamType::SYSLOG, active_streams);
|
||||
setTriggersFlag("logToCef", archive_in, ReportIS::StreamType::CEF, active_streams);
|
||||
setTriggersFlag("acAllow", archive_in, SecurityType::AccessControl, should_log_on_detect);
|
||||
setTriggersFlag("acDrop", archive_in, SecurityType::AccessControl, should_log_on_prevent);
|
||||
setTriggersFlag("tpDetect", archive_in, SecurityType::ThreatPrevention, should_log_on_detect);
|
||||
setTriggersFlag("tpPrevent", archive_in, SecurityType::ThreatPrevention, should_log_on_prevent);
|
||||
setTriggersFlag("complianceWarnings", archive_in, SecurityType::Compliance, should_log_on_detect);
|
||||
setTriggersFlag("complianceViolations", archive_in, SecurityType::Compliance, should_log_on_prevent);
|
||||
setTriggersFlag("acLogGeoLocation", archive_in, SecurityType::AccessControl, log_geo_location);
|
||||
setTriggersFlag("tpLogGeoLocation", archive_in, SecurityType::ThreatPrevention, log_geo_location);
|
||||
setTriggersFlag("complianceLogGeoLocation", archive_in, SecurityType::Compliance, log_geo_location);
|
||||
|
||||
bool extend_logging = false;
|
||||
parseJSONKey<bool>("extendLogging", extend_logging, archive_in);
|
||||
if (extend_logging) {
|
||||
setTriggersFlag("responseCode", archive_in, WebLogFields::responseCode, log_web_fields);
|
||||
setTriggersFlag("responseBody", archive_in, WebLogFields::responseBody, log_web_fields);
|
||||
|
||||
string severity;
|
||||
static const map<string, extendLoggingSeverity> extend_logging_severity_strings = {
|
||||
{"High", extendLoggingSeverity::High},
|
||||
{"Critical", extendLoggingSeverity::Critical}
|
||||
};
|
||||
parseJSONKey<string>("extendLoggingMinSeverity", severity, archive_in);
|
||||
auto extended_severity = extend_logging_severity_strings.find(severity);
|
||||
if (extended_severity != extend_logging_severity_strings.end()) {
|
||||
extend_logging_severity = extended_severity->second;
|
||||
} else {
|
||||
dbgWarning(D_RULEBASE_CONFIG)
|
||||
<< "Failed to parse the extendLoggingMinSeverityfield: '"
|
||||
<< severity
|
||||
<< "'";
|
||||
}
|
||||
}
|
||||
|
||||
for (ReportIS::StreamType log_stream : makeRange<ReportIS::StreamType>()) {
|
||||
if (!active_streams.isSet(log_stream)) continue;
|
||||
switch (log_stream) {
|
||||
case ReportIS::StreamType::JSON_DEBUG:
|
||||
setLogConfiguration(ReportIS::StreamType::JSON_DEBUG);
|
||||
break;
|
||||
case ReportIS::StreamType::JSON_FOG:
|
||||
setLogConfiguration(ReportIS::StreamType::JSON_FOG);
|
||||
break;
|
||||
case ReportIS::StreamType::JSON_LOG_FILE:
|
||||
setLogConfiguration(ReportIS::StreamType::JSON_LOG_FILE);
|
||||
break;
|
||||
case ReportIS::StreamType::JSON_K8S_SVC:
|
||||
setLogConfiguration(ReportIS::StreamType::JSON_K8S_SVC);
|
||||
break;
|
||||
case ReportIS::StreamType::SYSLOG:
|
||||
setLogConfiguration(ReportIS::StreamType::SYSLOG, getUrlForSyslog(), syslog_protocol);
|
||||
break;
|
||||
case ReportIS::StreamType::CEF:
|
||||
setLogConfiguration(ReportIS::StreamType::CEF, getUrlForCef(), cef_protocol);
|
||||
break;
|
||||
case ReportIS::StreamType::NONE: break;
|
||||
case ReportIS::StreamType::COUNT: break;
|
||||
}
|
||||
}
|
||||
|
||||
parseJSONKey<bool>("formatLoggingOutput", should_format_output, archive_in);
|
||||
} catch (const exception &e) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to parse the log trigger configuration: '" << e.what() << "'";
|
||||
archive_in.setNextName(nullptr);
|
||||
}
|
||||
}
|
||||
@@ -1,179 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/zone.h"
|
||||
|
||||
#include <set>
|
||||
#include <vector>
|
||||
#include <string>
|
||||
|
||||
using namespace std;
|
||||
|
||||
static const unordered_map<string, Zone::Direction> string_to_direction = {
|
||||
{ "to", Zone::Direction::To },
|
||||
{ "from", Zone::Direction::From },
|
||||
{ "bidirectional", Zone::Direction::Bidirectional }
|
||||
};
|
||||
|
||||
class AdjacentZone
|
||||
{
|
||||
public:
|
||||
void
|
||||
load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
string direction_as_string;
|
||||
archive_in(cereal::make_nvp("direction", direction_as_string));
|
||||
archive_in(cereal::make_nvp("zoneId", id));
|
||||
auto maybe_direction = string_to_direction.find(direction_as_string);
|
||||
if (maybe_direction == string_to_direction.end()) {
|
||||
reportConfigurationError(
|
||||
"Illegal direction provided for adjacency. Provided direction in configuration: " +
|
||||
direction_as_string
|
||||
);
|
||||
}
|
||||
dir = maybe_direction->second;
|
||||
}
|
||||
|
||||
pair<Zone::Direction, GenericConfigId> getValue() const { return make_pair(dir, id); }
|
||||
|
||||
private:
|
||||
Zone::Direction dir;
|
||||
GenericConfigId id;
|
||||
};
|
||||
|
||||
class TagsValues
|
||||
{
|
||||
public:
|
||||
static const string req_attrs_ctx_key;
|
||||
|
||||
TagsValues() {}
|
||||
|
||||
template <typename Archive>
|
||||
void
|
||||
serialize(Archive &ar)
|
||||
{
|
||||
I_Environment *env = Singleton::Consume<I_Environment>::by<Zone>();
|
||||
auto req_attrs = env->get<set<string>>(req_attrs_ctx_key);
|
||||
if (!req_attrs.ok()) return;
|
||||
|
||||
for (const string &req_attr : *req_attrs) {
|
||||
try {
|
||||
string data;
|
||||
ar(cereal::make_nvp(req_attr, data));
|
||||
dbgDebug(D_RULEBASE_CONFIG)
|
||||
<< "Found value for requested attribute. Tag: "
|
||||
<< req_attr
|
||||
<< ", Value: "
|
||||
<< data;
|
||||
|
||||
tags_set[req_attr].insert(data);
|
||||
} catch (const exception &e) {
|
||||
dbgDebug(D_RULEBASE_CONFIG) << "Could not find values for requested attribute. Tag: " << req_attr;
|
||||
ar.setNextName(nullptr);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
bool
|
||||
matchValueByKey(const string &requested_key, const unordered_set<string> &possible_values) const
|
||||
{
|
||||
auto values = tags_set.find(requested_key);
|
||||
if (values == tags_set.end()) return false;
|
||||
|
||||
for (const string &val : possible_values) {
|
||||
if (values->second.count(val)) return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
void
|
||||
insert(const TagsValues &other)
|
||||
{
|
||||
for (auto &single_tags_value : other.getData()) {
|
||||
tags_set[single_tags_value.first].insert(single_tags_value.second.begin(), single_tags_value.second.end());
|
||||
}
|
||||
}
|
||||
|
||||
const unordered_map<string, set<string>> & getData() const { return tags_set; }
|
||||
|
||||
private:
|
||||
unordered_map<string, set<string>> tags_set;
|
||||
};
|
||||
|
||||
const string TagsValues::req_attrs_ctx_key = "requested attributes key";
|
||||
|
||||
void
|
||||
Zone::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
archive_in(cereal::make_nvp("id", zone_id));
|
||||
archive_in(cereal::make_nvp("name", zone_name));
|
||||
vector<AdjacentZone> adjacency;
|
||||
try {
|
||||
archive_in(cereal::make_nvp("adjacentZones", adjacency));
|
||||
} catch (const cereal::Exception &) {
|
||||
dbgTrace(D_RULEBASE_CONFIG)
|
||||
<< "List of adjacentZones does not exist for current object. Zone id: "
|
||||
<< zone_id
|
||||
<< ", Zone name: "
|
||||
<< zone_name;
|
||||
|
||||
archive_in.setNextName(nullptr);
|
||||
}
|
||||
|
||||
for (const AdjacentZone &zone : adjacency) {
|
||||
adjacent_zones.push_back(zone.getValue());
|
||||
}
|
||||
|
||||
archive_in(cereal::make_nvp("match", match_query));
|
||||
|
||||
is_any =
|
||||
match_query.getType() == MatchQuery::MatchType::Condition &&
|
||||
match_query.getKey() == "any" &&
|
||||
match_query.getValue().count("any") > 0;
|
||||
|
||||
set<string> keys = match_query.getAllKeys();
|
||||
}
|
||||
|
||||
const string
|
||||
contextKeyToString(Context::MetaDataType type)
|
||||
{
|
||||
if (type == Context::MetaDataType::SubjectIpAddr || type == Context::MetaDataType::OtherIpAddr) return "ip";
|
||||
return Context::convertToString(type);
|
||||
}
|
||||
|
||||
bool
|
||||
Zone::contains(const Asset &asset)
|
||||
{
|
||||
QueryRequest request;
|
||||
|
||||
for (const auto &main_attr : asset.getAttrs()) {
|
||||
request.addCondition(Condition::EQUALS, contextKeyToString(main_attr.first), main_attr.second);
|
||||
}
|
||||
|
||||
ScopedContext req_attrs_key;
|
||||
req_attrs_key.registerValue<set<string>>(TagsValues::req_attrs_ctx_key, match_query.getAllKeys());
|
||||
|
||||
I_Intelligence_IS_V2 *intelligence = Singleton::Consume<I_Intelligence_IS_V2>::by<Zone>();
|
||||
auto query_res = intelligence->queryIntelligence<TagsValues>(request);
|
||||
if (!query_res.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to perform intelligence query. Error: " << query_res.getErr();
|
||||
return false;
|
||||
}
|
||||
|
||||
for (const AssetReply<TagsValues> &asset : query_res.unpack()) {
|
||||
TagsValues tag_values = asset.mergeReplyData();
|
||||
|
||||
if (match_query.matchAttributes(tag_values.getData())) return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
@@ -1,114 +0,0 @@
|
||||
// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
|
||||
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "generic_rulebase/zones_config.h"
|
||||
|
||||
#include <string>
|
||||
#include <unordered_map>
|
||||
|
||||
#include "generic_rulebase/generic_rulebase_utils.h"
|
||||
#include "config.h"
|
||||
#include "ip_utilities.h"
|
||||
#include "connkey.h"
|
||||
#include "i_generic_rulebase.h"
|
||||
|
||||
USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
|
||||
|
||||
using namespace std;
|
||||
|
||||
void
|
||||
ZonesConfig::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgFlow(D_RULEBASE_CONFIG) << "Saving active zones";
|
||||
set<string> used_zones;
|
||||
cereal::load(archive_in, used_zones);
|
||||
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Loading all zones";
|
||||
auto all_zones_maybe = getSetting<Zones>("rulebase", "zones");
|
||||
if (!all_zones_maybe.ok()) {
|
||||
dbgWarning(D_RULEBASE_CONFIG) << "Failed to load zones";
|
||||
return;
|
||||
}
|
||||
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Creating cache of all zones by ID";
|
||||
map<GenericConfigId, Zone> all_zones;
|
||||
for (const auto &single_zone : all_zones_maybe.unpack().zones) {
|
||||
if (used_zones.count(single_zone.getId()) > 0 && single_zone.isAnyZone()) {
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Found used zone of type \"Any\": saving all zones as active zones";
|
||||
zones = all_zones_maybe.unpack().zones;
|
||||
return;
|
||||
}
|
||||
|
||||
dbgDebug(D_RULEBASE_CONFIG)
|
||||
<< "Adding specific zone to cache. Zone ID: "
|
||||
<< single_zone.getId()
|
||||
<< ", name: "
|
||||
<< single_zone.getName();
|
||||
all_zones.emplace(single_zone.getId(), single_zone);
|
||||
}
|
||||
|
||||
dbgTrace(D_RULEBASE_CONFIG) << "Creating list of active zones";
|
||||
map<GenericConfigId, Zone> active_zones_set;
|
||||
for (const auto &single_used_zone_id : used_zones) {
|
||||
const auto &found_zone = all_zones[single_used_zone_id];
|
||||
dbgTrace(D_RULEBASE_CONFIG)
|
||||
<< "Adding zone to list of active zones. Zone ID: "
|
||||
<< single_used_zone_id
|
||||
<< ", zone name: "
|
||||
<< found_zone.getName();
|
||||
active_zones_set.emplace(found_zone.getId(), found_zone);
|
||||
|
||||
for (const auto &adjacent_zone : found_zone.getAdjacentZones()) {
|
||||
const auto &adjacent_zone_obj = all_zones[adjacent_zone.second];
|
||||
dbgTrace(D_RULEBASE_CONFIG)
|
||||
<< "Adding adjacent zone to list of active zones. Zone ID: "
|
||||
<< adjacent_zone_obj.getId()
|
||||
<< ", zone name: "
|
||||
<< adjacent_zone_obj.getName();
|
||||
active_zones_set.emplace(adjacent_zone_obj.getId(), adjacent_zone_obj);
|
||||
}
|
||||
}
|
||||
|
||||
vector<GenericConfigId> implied_zones = {
|
||||
"impliedAzure",
|
||||
"impliedDNS",
|
||||
"impliedSSH",
|
||||
"impliedProxy",
|
||||
"impliedFog"
|
||||
};
|
||||
|
||||
GenericConfigId any_zone_id = "";
|
||||
for (const auto &single_zone : all_zones_maybe.unpack().zones) {
|
||||
if (single_zone.isAnyZone()) any_zone_id = single_zone.getId();
|
||||
}
|
||||
for (GenericConfigId &implied_id: implied_zones) {
|
||||
if (all_zones.find(implied_id) != all_zones.end()) {
|
||||
dbgDebug(D_RULEBASE_CONFIG) << "Adding implied zone to cache. Zone ID: " << implied_id;
|
||||
active_zones_set.emplace(implied_id, all_zones[implied_id]);
|
||||
if (any_zone_id != "" && active_zones_set.count(any_zone_id) == 0) {
|
||||
active_zones_set.emplace(any_zone_id, all_zones[any_zone_id]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for (const auto &single_id_zone_pair : active_zones_set) {
|
||||
zones.push_back(single_id_zone_pair.second);
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
ZonesConfig::preload()
|
||||
{
|
||||
registerExpectedSetting<Zones>("rulebase", "zones");
|
||||
registerExpectedSetting<ZonesConfig>("rulebase", "usedZones");
|
||||
}
|
||||
@@ -1,8 +0,0 @@
|
||||
include_directories(${CMAKE_SOURCE_DIR}/components/include)
|
||||
link_directories(${BOOST_ROOT}/lib)
|
||||
|
||||
add_unit_test(
|
||||
health_check_manager_ut
|
||||
"health_check_manager_ut.cc"
|
||||
"singleton;messaging;mainloop;health_check_manager;event_is;metric;-lboost_regex"
|
||||
)
|
||||
@@ -34,6 +34,7 @@ public:
|
||||
~DetailsResolver();
|
||||
|
||||
void preload() override;
|
||||
void init() override;
|
||||
|
||||
private:
|
||||
class Impl;
|
||||
|
||||
@@ -21,6 +21,7 @@
|
||||
#include "url_parser.h"
|
||||
#include "i_agent_details.h"
|
||||
#include "i_mainloop.h"
|
||||
#include "i_environment.h"
|
||||
#include "singleton.h"
|
||||
#include "component.h"
|
||||
|
||||
@@ -32,6 +33,7 @@ class Downloader
|
||||
Singleton::Consume<I_Encryptor>,
|
||||
Singleton::Consume<I_MainLoop>,
|
||||
Singleton::Consume<I_OrchestrationTools>,
|
||||
Singleton::Consume<I_Environment>,
|
||||
Singleton::Consume<I_UpdateCommunication>
|
||||
{
|
||||
public:
|
||||
|
||||
@@ -15,7 +15,8 @@ class HttpGeoFilter
|
||||
public Component,
|
||||
Singleton::Consume<I_MainLoop>,
|
||||
Singleton::Consume<I_GeoLocation>,
|
||||
Singleton::Consume<I_GenericRulebase>
|
||||
Singleton::Consume<I_GenericRulebase>,
|
||||
Singleton::Consume<I_Environment>
|
||||
{
|
||||
public:
|
||||
HttpGeoFilter();
|
||||
|
||||
@@ -136,6 +136,7 @@ public:
|
||||
static const std::string req_body;
|
||||
static const std::string source_identifier;
|
||||
static const std::string proxy_ip_ctx;
|
||||
static const std::string xff_vals_ctx;
|
||||
|
||||
static const CompressionType default_response_content_encoding;
|
||||
|
||||
|
||||
@@ -29,7 +29,9 @@ public:
|
||||
virtual bool isGwNotVsx() = 0;
|
||||
virtual bool isVersionAboveR8110() = 0;
|
||||
virtual bool isReverseProxy() = 0;
|
||||
virtual bool isCloudStorageEnabled() = 0;
|
||||
virtual Maybe<std::tuple<std::string, std::string, std::string>> parseNginxMetadata() = 0;
|
||||
virtual Maybe<std::tuple<std::string, std::string, std::string, std::string, std::string>> readCloudMetadata() = 0;
|
||||
virtual std::map<std::string, std::string> getResolvedDetails() = 0;
|
||||
#if defined(gaia) || defined(smb)
|
||||
virtual bool compareCheckpointVersion(int cp_version, std::function<bool(int, int)> compare_operator) const = 0;
|
||||
|
||||
@@ -22,7 +22,7 @@
|
||||
class I_Downloader
|
||||
{
|
||||
public:
|
||||
virtual Maybe<std::string> downloadFileFromFog(
|
||||
virtual Maybe<std::string> downloadFile(
|
||||
const std::string &checksum,
|
||||
Package::ChecksumTypes,
|
||||
const GetResourceFile &resourse_file
|
||||
|
||||
@@ -117,7 +117,7 @@ public:
|
||||
const std::string &conf_path) const = 0;
|
||||
virtual bool copyFile(const std::string &src_path, const std::string &dst_path) const = 0;
|
||||
virtual bool doesFileExist(const std::string &file_path) const = 0;
|
||||
virtual void getClusterId() const = 0;
|
||||
virtual void setClusterId() const = 0;
|
||||
virtual void fillKeyInJson(
|
||||
const std::string &filename,
|
||||
const std::string &_key,
|
||||
|
||||
@@ -64,7 +64,7 @@ public:
|
||||
const std::string &service_id
|
||||
) = 0;
|
||||
|
||||
virtual std::map<std::string, PortNumber> getServiceToPortMap() = 0;
|
||||
virtual std::map<std::string, std::vector<PortNumber>> getServiceToPortMap() = 0;
|
||||
|
||||
protected:
|
||||
virtual ~I_ServiceController() {}
|
||||
|
||||
@@ -32,6 +32,7 @@ public:
|
||||
const std::string &policy_versions
|
||||
) const = 0;
|
||||
virtual Maybe<void> authenticateAgent() = 0;
|
||||
virtual void registerLocalAgentToFog() = 0;
|
||||
virtual Maybe<void> getUpdate(CheckUpdateRequest &request) = 0;
|
||||
virtual Maybe<std::string> downloadAttributeFile(
|
||||
const GetResourceFile &resourse_file,
|
||||
|
||||
@@ -31,6 +31,7 @@
|
||||
#include "i_environment.h"
|
||||
#include "i_tenant_manager.h"
|
||||
#include "i_package_handler.h"
|
||||
#include "i_proxy_configuration.h"
|
||||
#include "i_env_details.h"
|
||||
#include "component.h"
|
||||
|
||||
@@ -54,7 +55,8 @@ class OrchestrationComp
|
||||
Singleton::Consume<I_UpdateCommunication>,
|
||||
Singleton::Consume<I_Downloader>,
|
||||
Singleton::Consume<I_ManifestController>,
|
||||
Singleton::Consume<I_EnvDetails>
|
||||
Singleton::Consume<I_EnvDetails>,
|
||||
Singleton::Consume<I_ProxyConfiguration>
|
||||
{
|
||||
public:
|
||||
OrchestrationComp();
|
||||
|
||||
@@ -40,7 +40,7 @@ public:
|
||||
~OrchestrationStatus();
|
||||
|
||||
void init() override;
|
||||
|
||||
|
||||
private:
|
||||
class Impl;
|
||||
std::unique_ptr<Impl> pimpl;
|
||||
|
||||
@@ -17,6 +17,7 @@
|
||||
#include "i_package_handler.h"
|
||||
#include "i_orchestration_tools.h"
|
||||
#include "i_shell_cmd.h"
|
||||
#include "i_environment.h"
|
||||
#include "component.h"
|
||||
|
||||
class PackageHandler
|
||||
@@ -24,7 +25,8 @@ class PackageHandler
|
||||
public Component,
|
||||
Singleton::Provide<I_PackageHandler>,
|
||||
Singleton::Consume<I_ShellCmd>,
|
||||
Singleton::Consume<I_OrchestrationTools>
|
||||
Singleton::Consume<I_OrchestrationTools>,
|
||||
Singleton::Consume<I_Environment>
|
||||
{
|
||||
public:
|
||||
PackageHandler();
|
||||
|
||||
@@ -36,7 +36,6 @@ public:
|
||||
title,
|
||||
audience_team,
|
||||
obj,
|
||||
false,
|
||||
MessageCategory::GENERIC,
|
||||
std::forward<Args>(args)...
|
||||
)
|
||||
@@ -48,26 +47,6 @@ public:
|
||||
const std::string &title,
|
||||
const ReportIS::AudienceTeam &audience_team,
|
||||
const T &obj,
|
||||
bool is_async_message,
|
||||
Args ...args)
|
||||
:
|
||||
ReportMessaging(
|
||||
title,
|
||||
audience_team,
|
||||
obj,
|
||||
is_async_message,
|
||||
MessageCategory::GENERIC,
|
||||
std::forward<Args>(args)...
|
||||
)
|
||||
{
|
||||
}
|
||||
|
||||
template <typename ...Args, typename T>
|
||||
ReportMessaging(
|
||||
const std::string &title,
|
||||
const ReportIS::AudienceTeam &audience_team,
|
||||
const T &obj,
|
||||
bool is_async_message,
|
||||
const MessageCategory &message_type,
|
||||
Args ...args)
|
||||
:
|
||||
@@ -77,7 +56,6 @@ public:
|
||||
ReportIS::Severity::INFO,
|
||||
ReportIS::Priority::LOW,
|
||||
obj,
|
||||
is_async_message,
|
||||
message_type,
|
||||
std::forward<Args>(args)...
|
||||
)
|
||||
@@ -99,7 +77,6 @@ public:
|
||||
severity,
|
||||
priority,
|
||||
obj,
|
||||
false,
|
||||
MessageCategory::GENERIC,
|
||||
std::forward<Args>(args)...
|
||||
)
|
||||
@@ -114,7 +91,6 @@ public:
|
||||
const ReportIS::Severity &severity,
|
||||
const ReportIS::Priority &priority,
|
||||
const T &obj,
|
||||
bool _is_async_message,
|
||||
const MessageCategory &message_type,
|
||||
Args ...args)
|
||||
:
|
||||
@@ -131,7 +107,6 @@ public:
|
||||
std::chrono::seconds(0),
|
||||
std::forward<Args>(args)...
|
||||
),
|
||||
is_async_message(_is_async_message),
|
||||
message_type_tag(message_type)
|
||||
{
|
||||
report << LogField("eventObject", obj);
|
||||
@@ -141,11 +116,13 @@ public:
|
||||
|
||||
ReportMessaging & operator<<(const LogField &field);
|
||||
|
||||
Maybe<void, HTTPResponse> sendReportSynchronously();
|
||||
|
||||
void setForceBuffering(bool _force_buffering);
|
||||
|
||||
private:
|
||||
Report report;
|
||||
bool is_async_message;
|
||||
bool is_async_message = true;
|
||||
bool force_buffering = false;
|
||||
MessageCategory message_type_tag;
|
||||
};
|
||||
|
||||
@@ -35,8 +35,10 @@ public:
|
||||
bool isOverSSL() const { return over_ssl; }
|
||||
std::string getPort() const { return port; }
|
||||
std::string getQuery() const { return query; }
|
||||
std::string getHost() const;
|
||||
URLProtocol getProtocol() const { return protocol; }
|
||||
std::string toString() const;
|
||||
void setHost(const std::string &new_host);
|
||||
void setQuery(const std::string &new_query);
|
||||
|
||||
private:
|
||||
@@ -47,6 +49,7 @@ private:
|
||||
std::string base_url;
|
||||
std::string port;
|
||||
std::string query;
|
||||
std::string host;
|
||||
URLProtocol protocol;
|
||||
};
|
||||
|
||||
|
||||
@@ -24,6 +24,7 @@ static const string url = "/api/v1/agents/events";
|
||||
ReportMessaging::~ReportMessaging()
|
||||
{
|
||||
if (!Singleton::exists<I_Messaging>()) return;
|
||||
if (!is_async_message) return;
|
||||
|
||||
LogRest log_rest(report);
|
||||
|
||||
@@ -47,6 +48,25 @@ ReportMessaging::operator<<(const LogField &field)
|
||||
return *this;
|
||||
}
|
||||
|
||||
class LogRestWithReply : public LogRest
|
||||
{
|
||||
public:
|
||||
LogRestWithReply(const Report &report) : LogRest(report) {}
|
||||
|
||||
bool loadJson(const string &) const { return true; }
|
||||
};
|
||||
|
||||
Maybe<void, HTTPResponse>
|
||||
ReportMessaging::sendReportSynchronously()
|
||||
{
|
||||
is_async_message = false;
|
||||
|
||||
LogRestWithReply log_rest(report);
|
||||
|
||||
auto messaging = Singleton::Consume<I_Messaging>::by<ReportMessaging>();
|
||||
return messaging->sendSyncMessage(HTTPMethod::POST, url, log_rest, message_type_tag);
|
||||
}
|
||||
|
||||
void
|
||||
ReportMessaging::setForceBuffering(bool _force_buffering)
|
||||
{
|
||||
|
||||
@@ -103,7 +103,48 @@ TEST_F(ReportMessagingTest, title_only)
|
||||
_
|
||||
)
|
||||
).Times(1);
|
||||
ReportMessaging("test", ReportIS::AudienceTeam::AGENT_CORE, 1, true, ReportIS::Tags::ACCESS_CONTROL);
|
||||
ReportMessaging("test", ReportIS::AudienceTeam::AGENT_CORE, 1, ReportIS::Tags::ACCESS_CONTROL);
|
||||
}
|
||||
|
||||
TEST_F(ReportMessagingTest, sync_sending)
|
||||
{
|
||||
EXPECT_CALL(
|
||||
mock_messaging,
|
||||
sendSyncMessage(
|
||||
_,
|
||||
_,
|
||||
"{\n"
|
||||
" \"log\": {\n"
|
||||
" \"eventTime\": \"Best Time ever\",\n"
|
||||
" \"eventName\": \"test\",\n"
|
||||
" \"eventSeverity\": \"Info\",\n"
|
||||
" \"eventPriority\": \"Low\",\n"
|
||||
" \"eventType\": \"Event Driven\",\n"
|
||||
" \"eventLevel\": \"Log\",\n"
|
||||
" \"eventLogLevel\": \"info\",\n"
|
||||
" \"eventAudience\": \"Internal\",\n"
|
||||
" \"eventAudienceTeam\": \"Agent Core\",\n"
|
||||
" \"eventFrequency\": 0,\n"
|
||||
" \"eventTags\": [\n"
|
||||
" \"Access Control\"\n"
|
||||
" ],\n"
|
||||
" \"eventSource\": {\n"
|
||||
" \"eventTraceId\": \"\",\n"
|
||||
" \"eventSpanId\": \"\",\n"
|
||||
" \"issuingEngineVersion\": \"\",\n"
|
||||
" \"serviceName\": \"Unnamed Nano Service\"\n"
|
||||
" },\n"
|
||||
" \"eventData\": {\n"
|
||||
" \"eventObject\": 1\n"
|
||||
" }\n"
|
||||
" }\n"
|
||||
"}",
|
||||
_,
|
||||
_
|
||||
)
|
||||
).WillOnce(Return(HTTPResponse(HTTPStatusCode::HTTP_OK, "response!!")));
|
||||
ReportMessaging report("test", ReportIS::AudienceTeam::AGENT_CORE, 1, ReportIS::Tags::ACCESS_CONTROL);
|
||||
EXPECT_TRUE(report.sendReportSynchronously().ok());
|
||||
}
|
||||
|
||||
TEST_F(ReportMessagingTest, with_buffering)
|
||||
@@ -144,7 +185,7 @@ TEST_F(ReportMessagingTest, with_buffering)
|
||||
true
|
||||
)
|
||||
).Times(1);
|
||||
ReportMessaging report("test", ReportIS::AudienceTeam::AGENT_CORE, 1, true, ReportIS::Tags::ACCESS_CONTROL);
|
||||
ReportMessaging report("test", ReportIS::AudienceTeam::AGENT_CORE, 1, ReportIS::Tags::ACCESS_CONTROL);
|
||||
report.setForceBuffering(true);
|
||||
}
|
||||
|
||||
|
||||
@@ -1 +1,5 @@
|
||||
include_directories(../waap/include)
|
||||
include_directories(../waap/waap_clib)
|
||||
include_directories(../../attachment-intakers/nginx_attachment)
|
||||
|
||||
add_library(http_geo_filter http_geo_filter.cc)
|
||||
|
||||
@@ -4,10 +4,16 @@
|
||||
#include <unistd.h>
|
||||
#include <stddef.h>
|
||||
#include <algorithm>
|
||||
#include <sstream>
|
||||
#include <string>
|
||||
#include <vector>
|
||||
#include <boost/algorithm/string.hpp>
|
||||
|
||||
#include "cidrs_data.h"
|
||||
#include "generic_rulebase/generic_rulebase.h"
|
||||
#include "generic_rulebase/parameters_config.h"
|
||||
#include "generic_rulebase/triggers_config.h"
|
||||
#include "user_identifiers_config.h"
|
||||
#include "debug.h"
|
||||
#include "config.h"
|
||||
#include "rest.h"
|
||||
@@ -21,9 +27,10 @@ USE_DEBUG_FLAG(D_GEO_FILTER);
|
||||
|
||||
static const LogTriggerConf default_triger;
|
||||
|
||||
class HttpGeoFilter::Impl : public Listener<NewHttpTransactionEvent>
|
||||
class HttpGeoFilter::Impl : public Listener<HttpRequestHeaderEvent>
|
||||
{
|
||||
public:
|
||||
|
||||
void
|
||||
init()
|
||||
{
|
||||
@@ -55,32 +62,42 @@ public:
|
||||
}
|
||||
|
||||
EventVerdict
|
||||
respond(const NewHttpTransactionEvent &event) override
|
||||
respond(const HttpRequestHeaderEvent &event) override
|
||||
{
|
||||
dbgTrace(D_GEO_FILTER) << getListenerName() << " new transaction event";
|
||||
|
||||
if (!ParameterException::isGeoLocationExceptionExists() &&
|
||||
!getConfiguration<GeoConfig>("rulebase", "httpGeoFilter").ok()
|
||||
) {
|
||||
dbgTrace(D_GEO_FILTER) << "No geo location practice nor exception was found. Returning default verdict";
|
||||
if (!event.isLastHeader()) return EventVerdict(ngx_http_cp_verdict_e::TRAFFIC_VERDICT_INSPECT);
|
||||
std::set<std::string> xff_set;
|
||||
auto env = Singleton::Consume<I_Environment>::by<HttpGeoFilter>();
|
||||
auto maybe_xff = env->get<std::string>(HttpTransactionData::xff_vals_ctx);
|
||||
if (!maybe_xff.ok()) {
|
||||
dbgTrace(D_GEO_FILTER) << "failed to get xff vals from env";
|
||||
} else {
|
||||
xff_set = split(maybe_xff.unpack(), ',');
|
||||
}
|
||||
dbgDebug(D_GEO_FILTER) << getListenerName() << " last header, start lookup";
|
||||
|
||||
if (xff_set.size() > 0) {
|
||||
removeTrustedIpsFromXff(xff_set);
|
||||
} else {
|
||||
dbgDebug(D_GEO_FILTER) << "xff not found in headers";
|
||||
}
|
||||
|
||||
auto maybe_source_ip = env->get<IPAddr>(HttpTransactionData::client_ip_ctx);
|
||||
if (!maybe_source_ip.ok()) {
|
||||
dbgWarning(D_GEO_FILTER) << "failed to get source ip from env";
|
||||
return EventVerdict(default_action);
|
||||
}
|
||||
|
||||
I_GeoLocation *i_geo_location = Singleton::Consume<I_GeoLocation>::by<HttpGeoFilter>();
|
||||
auto asset_location = i_geo_location->lookupLocation(event.getSourceIP());
|
||||
if (!asset_location.ok()) {
|
||||
dbgTrace(D_GEO_FILTER) << "Lookup location failed, Error: " << asset_location.getErr();
|
||||
return EventVerdict(default_action);
|
||||
}
|
||||
auto source_ip = convertIpAddrToString(maybe_source_ip.unpack());
|
||||
xff_set.insert(source_ip);
|
||||
|
||||
EnumArray<I_GeoLocation::GeoLocationField, std::string> geo_location_data = asset_location.unpack();
|
||||
|
||||
ngx_http_cp_verdict_e exception_verdict = getExceptionVerdict(event, geo_location_data);
|
||||
ngx_http_cp_verdict_e exception_verdict = getExceptionVerdict(xff_set);
|
||||
if (exception_verdict != ngx_http_cp_verdict_e::TRAFFIC_VERDICT_IRRELEVANT) {
|
||||
return EventVerdict(exception_verdict);
|
||||
}
|
||||
|
||||
ngx_http_cp_verdict_e geo_lookup_verdict = getGeoLookupVerdict(event, geo_location_data);
|
||||
ngx_http_cp_verdict_e geo_lookup_verdict = getGeoLookupVerdict(xff_set);
|
||||
if (geo_lookup_verdict != ngx_http_cp_verdict_e::TRAFFIC_VERDICT_IRRELEVANT) {
|
||||
return EventVerdict(geo_lookup_verdict);
|
||||
}
|
||||
@@ -88,6 +105,73 @@ public:
|
||||
}
|
||||
|
||||
private:
|
||||
std::set<std::string>
|
||||
split(const std::string& s, char delim) {
|
||||
std::set<std::string> elems;
|
||||
std::stringstream ss(s);
|
||||
std::string value;
|
||||
while (std::getline(ss, value, delim)) {
|
||||
elems.insert(trim(value));
|
||||
}
|
||||
return elems;
|
||||
}
|
||||
|
||||
static inline std::string <rim(std::string &s) {
|
||||
s.erase(s.begin(), std::find_if(s.begin(), s.end(),
|
||||
[] (char c) { return !std::isspace(c); }));
|
||||
return s;
|
||||
}
|
||||
|
||||
// trim from end
|
||||
static inline std::string &rtrim(std::string &s) {
|
||||
s.erase(std::find_if(s.rbegin(), s.rend(),
|
||||
[] (char c) { return !std::isspace(c); }).base(), s.end());
|
||||
return s;
|
||||
}
|
||||
|
||||
// trim from both ends
|
||||
static inline std::string &trim(std::string &s) {
|
||||
return ltrim(rtrim(s));
|
||||
}
|
||||
|
||||
void
|
||||
removeTrustedIpsFromXff(std::set<std::string> &xff_set)
|
||||
{
|
||||
auto identify_config = getConfiguration<UsersAllIdentifiersConfig>(
|
||||
"rulebase",
|
||||
"usersIdentifiers"
|
||||
);
|
||||
if (!identify_config.ok()) {
|
||||
dbgDebug(D_GEO_FILTER) << "did not find users identifiers definition in policy";
|
||||
} else {
|
||||
auto trusted_ips = (*identify_config).getHeaderValuesFromConfig("x-forwarded-for");
|
||||
for (auto it = xff_set.begin(); it != xff_set.end();) {
|
||||
if (isIpTrusted(*it, trusted_ips)) {
|
||||
dbgTrace(D_GEO_FILTER) << "xff value is in trusted ips: " << *it;
|
||||
it = xff_set.erase(it);
|
||||
} else {
|
||||
dbgTrace(D_GEO_FILTER) << "xff value is not in trusted ips: " << *it;
|
||||
++it;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
bool
|
||||
isIpTrusted(const string &ip, const vector<string> &trusted_ips)
|
||||
{
|
||||
for (const auto &trusted_ip : trusted_ips) {
|
||||
CIDRSData cidr_data(trusted_ip);
|
||||
if (
|
||||
ip == trusted_ip ||
|
||||
(cidr_data.contains(ip))
|
||||
) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
string
|
||||
convertIpAddrToString(const IPAddr &ip_to_convert)
|
||||
{
|
||||
@@ -117,54 +201,75 @@ private:
|
||||
}
|
||||
|
||||
ngx_http_cp_verdict_e
|
||||
getGeoLookupVerdict(
|
||||
const NewHttpTransactionEvent &event,
|
||||
const EnumArray<I_GeoLocation::GeoLocationField, std::string> &geo_location_data)
|
||||
getGeoLookupVerdict(const std::set<std::string> &sources)
|
||||
{
|
||||
auto maybe_geo_config = getConfiguration<GeoConfig>("rulebase", "httpGeoFilter");
|
||||
if (!maybe_geo_config.ok()) {
|
||||
dbgWarning(D_GEO_FILTER) << "Failed to load HTTP Geo Filter config. Error:" << maybe_geo_config.getErr();
|
||||
dbgTrace(D_GEO_FILTER) << "Failed to load HTTP Geo Filter config. Error:" << maybe_geo_config.getErr();
|
||||
return ngx_http_cp_verdict_e::TRAFFIC_VERDICT_IRRELEVANT;
|
||||
}
|
||||
GeoConfig geo_config = maybe_geo_config.unpack();
|
||||
string country_code = geo_location_data[I_GeoLocation::GeoLocationField::COUNTRY_CODE];
|
||||
EnumArray<I_GeoLocation::GeoLocationField, std::string> geo_location_data;
|
||||
I_GeoLocation *i_geo_location = Singleton::Consume<I_GeoLocation>::by<HttpGeoFilter>();
|
||||
|
||||
if (geo_config.isAllowedCountry(country_code)) {
|
||||
dbgTrace(D_GEO_FILTER)
|
||||
<< "geo verdict ACCEPT, practice id: "
|
||||
<< geo_config.getId()
|
||||
<< ", country code: "
|
||||
<< country_code;
|
||||
generateVerdictLog(
|
||||
ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT,
|
||||
event,
|
||||
geo_config.getId(),
|
||||
true,
|
||||
geo_location_data
|
||||
);
|
||||
return ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT;
|
||||
}
|
||||
if (geo_config.isBlockedCountry(country_code)) {
|
||||
dbgTrace(D_GEO_FILTER)
|
||||
<< "geo verdict DROP, practice id: "
|
||||
<< geo_config.getId()
|
||||
<< ", country code: "
|
||||
<< country_code;
|
||||
generateVerdictLog(
|
||||
ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP,
|
||||
event,
|
||||
geo_config.getId(),
|
||||
true,
|
||||
geo_location_data
|
||||
);
|
||||
return ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP;
|
||||
for (const std::string& source : sources) {
|
||||
Maybe<IPAddr> maybe_source_ip = IPAddr::createIPAddr(source);
|
||||
if (!maybe_source_ip.ok()){
|
||||
dbgWarning(D_GEO_FILTER) <<
|
||||
"create ip address failed for source: " <<
|
||||
source <<
|
||||
", Error: " <<
|
||||
maybe_source_ip.getErr();
|
||||
continue;
|
||||
}
|
||||
auto asset_location = i_geo_location->lookupLocation(maybe_source_ip.unpack());
|
||||
if (!asset_location.ok()) {
|
||||
dbgWarning(D_GEO_FILTER) <<
|
||||
"Lookup location failed for source: " <<
|
||||
source <<
|
||||
", Error: " <<
|
||||
asset_location.getErr();
|
||||
continue;
|
||||
}
|
||||
|
||||
geo_location_data = asset_location.unpack();
|
||||
|
||||
string country_code = geo_location_data[I_GeoLocation::GeoLocationField::COUNTRY_CODE];
|
||||
|
||||
if (geo_config.isAllowedCountry(country_code)) {
|
||||
dbgTrace(D_GEO_FILTER)
|
||||
<< "geo verdict ACCEPT, practice id: "
|
||||
<< geo_config.getId()
|
||||
<< ", country code: "
|
||||
<< country_code;
|
||||
generateVerdictLog(
|
||||
ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT,
|
||||
geo_config.getId(),
|
||||
true,
|
||||
geo_location_data
|
||||
);
|
||||
return ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT;
|
||||
}
|
||||
if (geo_config.isBlockedCountry(country_code)) {
|
||||
dbgTrace(D_GEO_FILTER)
|
||||
<< "geo verdict DROP, practice id: "
|
||||
<< geo_config.getId()
|
||||
<< ", country code: "
|
||||
<< country_code;
|
||||
generateVerdictLog(
|
||||
ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP,
|
||||
geo_config.getId(),
|
||||
true,
|
||||
geo_location_data
|
||||
);
|
||||
return ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP;
|
||||
}
|
||||
}
|
||||
dbgTrace(D_GEO_FILTER)
|
||||
<< "No matched practice. Returned default action: "
|
||||
<< geo_config.getDefaultAction();
|
||||
generateVerdictLog(
|
||||
convertActionToVerdict(geo_config.getDefaultAction()),
|
||||
event,
|
||||
geo_config.getId(),
|
||||
true,
|
||||
geo_location_data,
|
||||
@@ -176,7 +281,6 @@ private:
|
||||
Maybe<pair<ngx_http_cp_verdict_e, string>>
|
||||
getBehaviorsVerdict(
|
||||
const unordered_map<string, set<string>> &behaviors_map_to_search,
|
||||
const NewHttpTransactionEvent &event,
|
||||
EnumArray<I_GeoLocation::GeoLocationField, std::string> geo_location_data)
|
||||
{
|
||||
bool is_matched = false;
|
||||
@@ -193,7 +297,6 @@ private:
|
||||
dbgTrace(D_GEO_FILTER) << "behavior verdict: DROP, exception id: " << behavior.getId();
|
||||
generateVerdictLog(
|
||||
matched_verdict,
|
||||
event,
|
||||
behavior.getId(),
|
||||
false,
|
||||
geo_location_data
|
||||
@@ -218,63 +321,74 @@ private:
|
||||
}
|
||||
|
||||
ngx_http_cp_verdict_e
|
||||
getExceptionVerdict(
|
||||
const NewHttpTransactionEvent &event,
|
||||
EnumArray<I_GeoLocation::GeoLocationField, std::string> geo_location_data
|
||||
){
|
||||
string country_code = geo_location_data[I_GeoLocation::GeoLocationField::COUNTRY_CODE];
|
||||
string country_name = geo_location_data[I_GeoLocation::GeoLocationField::COUNTRY_NAME];
|
||||
string source_ip = convertIpAddrToString(event.getSourceIP());
|
||||
getExceptionVerdict(const std::set<std::string> &sources) {
|
||||
|
||||
pair<ngx_http_cp_verdict_e, string> curr_matched_behavior;
|
||||
ngx_http_cp_verdict_e verdict = ngx_http_cp_verdict_e::TRAFFIC_VERDICT_IRRELEVANT;
|
||||
I_GeoLocation *i_geo_location = Singleton::Consume<I_GeoLocation>::by<HttpGeoFilter>();
|
||||
EnumArray<I_GeoLocation::GeoLocationField, std::string> geo_location_data;
|
||||
|
||||
dbgTrace(D_GEO_FILTER)
|
||||
for (const std::string& source : sources) {
|
||||
|
||||
Maybe<IPAddr> maybe_source_ip = IPAddr::createIPAddr(source);
|
||||
if (!maybe_source_ip.ok()){
|
||||
dbgWarning(D_GEO_FILTER) <<
|
||||
"create ip address failed for source: " <<
|
||||
source <<
|
||||
", Error: " <<
|
||||
maybe_source_ip.getErr();
|
||||
continue;
|
||||
}
|
||||
|
||||
|
||||
auto asset_location = i_geo_location->lookupLocation(maybe_source_ip.unpack());
|
||||
if (!asset_location.ok()) {
|
||||
dbgWarning(D_GEO_FILTER) << "Lookup location failed for source: " <<
|
||||
source <<
|
||||
", Error: " <<
|
||||
asset_location.getErr();
|
||||
continue;
|
||||
}
|
||||
geo_location_data = asset_location.unpack();
|
||||
string country_code = geo_location_data[I_GeoLocation::GeoLocationField::COUNTRY_CODE];
|
||||
string country_name = geo_location_data[I_GeoLocation::GeoLocationField::COUNTRY_NAME];
|
||||
dbgTrace(D_GEO_FILTER)
|
||||
<< "Get exception verdict. "
|
||||
<< "country code: "
|
||||
<< country_code
|
||||
<< ", country name: "
|
||||
<< country_name
|
||||
<< ", source ip address: "
|
||||
<< source_ip;
|
||||
<< source;
|
||||
|
||||
unordered_map<string, set<string>> exception_value_source_ip = {{"sourceIP", {source_ip}}};
|
||||
auto matched_behavior_maybe = getBehaviorsVerdict(exception_value_source_ip, event, geo_location_data);
|
||||
if (matched_behavior_maybe.ok()) {
|
||||
curr_matched_behavior = matched_behavior_maybe.unpack();
|
||||
verdict = curr_matched_behavior.first;
|
||||
if (verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP) {
|
||||
return verdict;
|
||||
unordered_map<string, set<string>> exception_value_country_code = {
|
||||
{"countryCode", {country_code}}
|
||||
};
|
||||
auto matched_behavior_maybe = getBehaviorsVerdict(exception_value_country_code, geo_location_data);
|
||||
if (matched_behavior_maybe.ok()) {
|
||||
curr_matched_behavior = matched_behavior_maybe.unpack();
|
||||
verdict = curr_matched_behavior.first;
|
||||
if (verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP) {
|
||||
return verdict;
|
||||
}
|
||||
}
|
||||
|
||||
unordered_map<string, set<string>> exception_value_country_name = {
|
||||
{"countryName", {country_name}}
|
||||
};
|
||||
matched_behavior_maybe = getBehaviorsVerdict(exception_value_country_name, geo_location_data);
|
||||
if (matched_behavior_maybe.ok()) {
|
||||
curr_matched_behavior = matched_behavior_maybe.unpack();
|
||||
verdict = curr_matched_behavior.first;
|
||||
if (verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP) {
|
||||
return verdict;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
unordered_map<string, set<string>> exception_value_country_code = {
|
||||
{"countryCode", {country_code}}
|
||||
};
|
||||
matched_behavior_maybe = getBehaviorsVerdict(exception_value_country_code, event, geo_location_data);
|
||||
if (matched_behavior_maybe.ok()) {
|
||||
curr_matched_behavior = matched_behavior_maybe.unpack();
|
||||
verdict = curr_matched_behavior.first;
|
||||
if (verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP) {
|
||||
return verdict;
|
||||
}
|
||||
}
|
||||
|
||||
unordered_map<string, set<string>> exception_value_country_name = {
|
||||
{"countryName", {country_name}}
|
||||
};
|
||||
matched_behavior_maybe = getBehaviorsVerdict(exception_value_country_name, event, geo_location_data);
|
||||
if (matched_behavior_maybe.ok()) {
|
||||
curr_matched_behavior = matched_behavior_maybe.unpack();
|
||||
verdict = curr_matched_behavior.first;
|
||||
if (verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP) {
|
||||
return verdict;
|
||||
}
|
||||
}
|
||||
if (verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT) {
|
||||
generateVerdictLog(
|
||||
verdict,
|
||||
event,
|
||||
curr_matched_behavior.second,
|
||||
false,
|
||||
geo_location_data
|
||||
@@ -286,7 +400,6 @@ private:
|
||||
void
|
||||
generateVerdictLog(
|
||||
const ngx_http_cp_verdict_e &verdict,
|
||||
const NewHttpTransactionEvent &event,
|
||||
const string &matched_id,
|
||||
bool is_geo_filter,
|
||||
const EnumArray<I_GeoLocation::GeoLocationField, std::string> geo_location_data,
|
||||
@@ -307,14 +420,27 @@ private:
|
||||
LogField(matched_on, matched_id),
|
||||
ReportIS::Tags::HTTP_GEO_FILTER
|
||||
);
|
||||
log
|
||||
<< LogField("sourceIP", convertIpAddrToString(event.getSourceIP()))
|
||||
<< LogField("sourcePort", event.getSourcePort())
|
||||
<< LogField("hostName", event.getDestinationHost())
|
||||
<< LogField("httpMethod", event.getHttpMethod())
|
||||
<< LogField("securityAction", is_prevent ? "Prevent" : "Detect");
|
||||
auto env = Singleton::Consume<I_Environment>::by<HttpGeoFilter>();
|
||||
auto source_ip = env->get<IPAddr>(HttpTransactionData::client_ip_ctx);
|
||||
if (source_ip.ok()) log << LogField("sourceIP", convertIpAddrToString(source_ip.unpack()));
|
||||
|
||||
auto source_identifier = env->get<string>(HttpTransactionData::source_identifier);
|
||||
if (source_identifier.ok()) log << LogField("httpSourceId", source_identifier.unpack());
|
||||
|
||||
auto source_port = env->get<string>(HttpTransactionData::client_port_ctx);
|
||||
if (source_port.ok()) log << LogField("sourcePort", source_port.unpack());
|
||||
|
||||
auto host_name = env->get<string>(HttpTransactionData::host_name_ctx);
|
||||
if (host_name.ok()) log << LogField("hostName", host_name.unpack());
|
||||
|
||||
auto method = env->get<string>(HttpTransactionData::method_ctx);
|
||||
if (method.ok()) log << LogField("httpMethod", method.unpack());
|
||||
|
||||
log << LogField("securityAction", is_prevent ? "Prevent" : "Detect");
|
||||
|
||||
if (is_default_action) log << LogField("isDefaultSecurityAction", true);
|
||||
auto xff = env->get<string>(HttpTransactionData::xff_vals_ctx);
|
||||
if (xff.ok()) log << LogField("proxyIP", xff.unpack());
|
||||
|
||||
log
|
||||
<< LogField("sourceCountryCode", geo_location_data[I_GeoLocation::GeoLocationField::COUNTRY_CODE])
|
||||
|
||||
@@ -50,9 +50,13 @@ public:
|
||||
|
||||
private:
|
||||
void readRules(cereal::JSONInputArchive &ar);
|
||||
void readTriggerId(cereal::JSONInputArchive &ar);
|
||||
void readExceptionId(cereal::JSONInputArchive &ar);
|
||||
void readDefaultAction(cereal::JSONInputArchive &ar);
|
||||
|
||||
std::vector<Rule> rules;
|
||||
std::string trigger_id;
|
||||
std::string exception_id;
|
||||
};
|
||||
|
||||
#endif // __IPS_BASIC_POLICY_H__
|
||||
|
||||
@@ -27,6 +27,7 @@
|
||||
#include "log_generator.h"
|
||||
#include "parsed_context.h"
|
||||
#include "pm_hook.h"
|
||||
#include "i_generic_rulebase.h"
|
||||
|
||||
/// \namespace IPSSignatureSubTypes
|
||||
/// \brief Namespace containing subtypes for IPS signatures.
|
||||
@@ -348,8 +349,16 @@ public:
|
||||
/// \brief Construct a SignatureAndAction object.
|
||||
/// \param _signature The complete signature.
|
||||
/// \param _action The signature action.
|
||||
SignatureAndAction(std::shared_ptr<CompleteSignature> _signature, SignatureAction _action) :
|
||||
signature(_signature), action(_action)
|
||||
SignatureAndAction(
|
||||
std::shared_ptr<CompleteSignature> _signature,
|
||||
SignatureAction _action,
|
||||
std::string _trigger_id,
|
||||
std::string _exception_id)
|
||||
:
|
||||
signature(_signature),
|
||||
action(_action),
|
||||
trigger_id(_trigger_id),
|
||||
exception_id(_exception_id)
|
||||
{}
|
||||
|
||||
/// \brief Check if the signature is matched for prevention.
|
||||
@@ -375,6 +384,11 @@ public:
|
||||
return signature->getContext();
|
||||
}
|
||||
|
||||
LogTriggerConf getTrigger() const;
|
||||
|
||||
std::set<ParameterBehavior>
|
||||
getBehavior(const std::unordered_map<std::string, std::set<std::string>> &exceptions_dict) const;
|
||||
|
||||
private:
|
||||
/// \brief Get the action results for the IPS state.
|
||||
/// \param ips_state The IPS entry.
|
||||
@@ -382,6 +396,8 @@ private:
|
||||
|
||||
std::shared_ptr<CompleteSignature> signature;
|
||||
SignatureAction action;
|
||||
std::string trigger_id;
|
||||
std::string exception_id;
|
||||
};
|
||||
} // namespace IPSSignatureSubTypes
|
||||
|
||||
|
||||
@@ -17,6 +17,8 @@ public:
|
||||
private:
|
||||
IPSSignatureSubTypes::SignatureAction action = IPSSignatureSubTypes::SignatureAction::IGNORE;
|
||||
std::vector<std::string> file_names;
|
||||
std::string trigger_id;
|
||||
std::string exception_id;
|
||||
};
|
||||
|
||||
#endif // __SNORT_BASIC_POLICY_H__
|
||||
|
||||
@@ -17,6 +17,8 @@ void
|
||||
RuleSelector::load(cereal::JSONInputArchive &ar)
|
||||
{
|
||||
readRules(ar);
|
||||
readTriggerId(ar);
|
||||
readExceptionId(ar);
|
||||
readDefaultAction(ar);
|
||||
}
|
||||
|
||||
@@ -36,7 +38,7 @@ RuleSelector::selectSignatures() const
|
||||
if (rule.isSignaturedMatched(*signature)) {
|
||||
if (rule.getAction() != IPSSignatureSubTypes::SignatureAction::IGNORE) {
|
||||
signature->setIndicators("Check Point", signatures_version);
|
||||
res.emplace_back(signature, rule.getAction());
|
||||
res.emplace_back(signature, rule.getAction(), trigger_id, exception_id);
|
||||
}
|
||||
break;
|
||||
}
|
||||
@@ -52,6 +54,28 @@ RuleSelector::readRules(cereal::JSONInputArchive &ar)
|
||||
ar(cereal::make_nvp("rules", rules));
|
||||
}
|
||||
|
||||
void
|
||||
RuleSelector::readTriggerId(cereal::JSONInputArchive &ar)
|
||||
{
|
||||
try {
|
||||
ar(cereal::make_nvp("triggers", trigger_id));
|
||||
} catch (const cereal::Exception &e) {
|
||||
ar.setNextName(nullptr);
|
||||
trigger_id = "";
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
RuleSelector::readExceptionId(cereal::JSONInputArchive &ar)
|
||||
{
|
||||
try {
|
||||
ar(cereal::make_nvp("exceptions", exception_id));
|
||||
} catch (const cereal::Exception &e) {
|
||||
ar.setNextName(nullptr);
|
||||
exception_id = "";
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
RuleSelector::readDefaultAction(cereal::JSONInputArchive &ar)
|
||||
{
|
||||
|
||||
@@ -280,8 +280,7 @@ SignatureAndAction::getAction(const IPSEntry &ips_state) const
|
||||
exceptions_dict["sourceIdentifier"].insert(*env_source_identifier);
|
||||
}
|
||||
|
||||
I_GenericRulebase *i_rulebase = Singleton::Consume<I_GenericRulebase>::by<IPSComp>();
|
||||
auto behaviors = i_rulebase->getBehavior(exceptions_dict);
|
||||
auto behaviors = getBehavior(exceptions_dict);
|
||||
|
||||
set<BehaviorValue> override_actions;
|
||||
vector<string> override_ids;
|
||||
@@ -315,6 +314,23 @@ static const auto url_query = LogTriggerConf::WebLogFields::webUrlQuery;
|
||||
static const auto res_body = LogTriggerConf::WebLogFields::responseBody;
|
||||
static const auto res_code = LogTriggerConf::WebLogFields::responseCode;
|
||||
|
||||
LogTriggerConf
|
||||
SignatureAndAction::getTrigger() const
|
||||
{
|
||||
if (trigger_id.empty()) return getConfigurationWithDefault(LogTriggerConf(), "rulebase", "log");
|
||||
|
||||
return Singleton::Consume<I_GenericRulebase>::by<IPSComp>()->getLogTriggerConf(trigger_id);
|
||||
}
|
||||
|
||||
set<ParameterBehavior>
|
||||
SignatureAndAction::getBehavior(const unordered_map<string, set<string>> &exceptions_dict) const
|
||||
{
|
||||
I_GenericRulebase *i_rulebase = Singleton::Consume<I_GenericRulebase>::by<IPSComp>();
|
||||
if (exception_id.empty()) return i_rulebase->getBehavior(exceptions_dict);
|
||||
|
||||
return i_rulebase->getParameterException(exception_id).getBehavior(exceptions_dict);
|
||||
}
|
||||
|
||||
bool
|
||||
SignatureAndAction::matchSilent(const Buffer &sample) const
|
||||
{
|
||||
@@ -398,7 +414,7 @@ SignatureAndAction::isMatchedPrevent(const Buffer &context_buffer, const set<PMP
|
||||
|
||||
dbgDebug(D_IPS) << "Signature matched - sending log";
|
||||
|
||||
auto &trigger = getConfigurationWithDefault(default_triger, "rulebase", "log");
|
||||
auto trigger = getTrigger();
|
||||
bool is_prevent = get<0>(override_action) == IPSSignatureSubTypes::SignatureAction::PREVENT;
|
||||
|
||||
auto severity = signature->getSeverity() < IPSLevel::HIGH ? Severity::HIGH : Severity::CRITICAL;
|
||||
|
||||
@@ -596,6 +596,8 @@ TEST_F(ComponentTest, check_filtering_by_year)
|
||||
|
||||
TEST_F(ComponentTest, log_fields)
|
||||
{
|
||||
generic_rulebase.preload();
|
||||
generic_rulebase.init();
|
||||
string config =
|
||||
"{"
|
||||
"\"IPS\": {"
|
||||
@@ -632,6 +634,8 @@ TEST_F(ComponentTest, log_fields)
|
||||
"\"assetId\": \"1-1-1\","
|
||||
"\"practiceId\": \"2-2-2\","
|
||||
"\"practiceName\": \"practice1\","
|
||||
"\"triggers\": \"5eaeefde6765c30010bae8b6\","
|
||||
"\"exceptions\": \"\","
|
||||
"\"defaultAction\": \"Detect\","
|
||||
"\"rules\": ["
|
||||
"{"
|
||||
@@ -643,10 +647,36 @@ TEST_F(ComponentTest, log_fields)
|
||||
"]"
|
||||
"}"
|
||||
"]"
|
||||
"},"
|
||||
"\"rulebase\": {"
|
||||
"\"log\": ["
|
||||
"{"
|
||||
"\"context\": \"triggerId(5eaeefde6765c30010bae8b6)\","
|
||||
"\"triggerName\": \"Logging Trigger\","
|
||||
"\"triggerType\": \"log\","
|
||||
"\"urlForSyslog\": \"\","
|
||||
"\"urlForCef\": \"128.1.1.1:333\","
|
||||
"\"acAllow\": false,"
|
||||
"\"acDrop\": true,"
|
||||
"\"complianceViolations\": true,"
|
||||
"\"complianceWarnings\": true,"
|
||||
"\"logToAgent\": true,"
|
||||
"\"logToCloud\": true,"
|
||||
"\"logToSyslog\": false,"
|
||||
"\"logToCef\": true,"
|
||||
"\"tpDetect\": true,"
|
||||
"\"tpPrevent\": true,"
|
||||
"\"verbosity\": \"Standard\","
|
||||
"\"webBody\": true,"
|
||||
"\"webHeaders\": true,"
|
||||
"\"webRequests\": true,"
|
||||
"\"webUrlPath\": true,"
|
||||
"\"webUrlQuery\": true"
|
||||
"}"
|
||||
"]"
|
||||
"}"
|
||||
"}";
|
||||
loadPolicy(config);
|
||||
setTrigger();
|
||||
|
||||
EXPECT_CALL(table, createStateRValueRemoved(_, _));
|
||||
EXPECT_CALL(table, getState(_)).WillRepeatedly(Return(&entry));
|
||||
@@ -829,6 +859,8 @@ TEST_F(ComponentTest, prxeem_exception_bug)
|
||||
" \"practiceId\": \"2-2-2\","
|
||||
" \"practiceName\": \"practice1\","
|
||||
" \"defaultAction\": \"Prevent\","
|
||||
" \"triggers\": \"\","
|
||||
" \"exceptions\": \"6c3867be-4da5-42c2-93dc-8f509a764004\","
|
||||
" \"rules\": []"
|
||||
" }"
|
||||
" ]"
|
||||
@@ -847,6 +879,11 @@ TEST_F(ComponentTest, prxeem_exception_bug)
|
||||
" \"parameterId\": \"6c3867be-4da5-42c2-93dc-8f509a764003\","
|
||||
" \"parameterType\": \"exceptions\","
|
||||
" \"parameterName\": \"exception\""
|
||||
" },"
|
||||
" {"
|
||||
" \"parameterId\": \"6c3867be-4da5-42c2-93dc-8f509a764004\","
|
||||
" \"parameterType\": \"exceptions\","
|
||||
" \"parameterName\": \"exception\""
|
||||
" }"
|
||||
" ],"
|
||||
" \"zoneId\": \"\","
|
||||
@@ -855,7 +892,7 @@ TEST_F(ComponentTest, prxeem_exception_bug)
|
||||
" ],"
|
||||
" \"exception\": ["
|
||||
" {"
|
||||
" \"context\": \"parameterId(6c3867be-4da5-42c2-93dc-8f509a764003)\","
|
||||
" \"context\": \"parameterId(6c3867be-4da5-42c2-93dc-8f509a764004)\","
|
||||
" \"match\": {"
|
||||
" \"type\": \"operator\","
|
||||
" \"op\": \"and\","
|
||||
|
||||
@@ -16,6 +16,19 @@ using namespace std;
|
||||
void
|
||||
SnortRuleSelector::load(cereal::JSONInputArchive &ar)
|
||||
{
|
||||
try {
|
||||
ar(cereal::make_nvp("triggers", trigger_id));
|
||||
} catch (const cereal::Exception &e) {
|
||||
ar.setNextName(nullptr);
|
||||
trigger_id = "";
|
||||
}
|
||||
|
||||
try {
|
||||
ar(cereal::make_nvp("exceptions", exception_id));
|
||||
} catch (const cereal::Exception &e) {
|
||||
ar.setNextName(nullptr);
|
||||
exception_id = "";
|
||||
}
|
||||
string mode;
|
||||
ar(cereal::make_nvp("mode", mode), cereal::make_nvp("files", file_names));
|
||||
|
||||
@@ -38,7 +51,7 @@ SnortRuleSelector::selectSignatures() const
|
||||
|
||||
for (auto &file : file_names) {
|
||||
for (auto &signature : (*signatures).getSignatures(file)) {
|
||||
res.emplace_back(signature, action);
|
||||
res.emplace_back(signature, action, trigger_id, exception_id);
|
||||
}
|
||||
}
|
||||
return res;
|
||||
|
||||
@@ -142,6 +142,13 @@ string disabled_settings =
|
||||
"}"
|
||||
"],\n";
|
||||
|
||||
|
||||
string local_intelligence =
|
||||
"\"intelligence\":{"
|
||||
" \"local intelligence server ip\":\"127.0.0.1\","
|
||||
" \"local intelligence server primary port\":9090"
|
||||
"}\n,";
|
||||
|
||||
string policy =
|
||||
"\"rulebase\": {"
|
||||
"\"usersIdentifiers\": ["
|
||||
@@ -259,7 +266,7 @@ Layer7AccessControlTest::verifyReport(
|
||||
|
||||
TEST_F(Layer7AccessControlTest, ReturnAcceptVerdict)
|
||||
{
|
||||
stringstream ss_conf(prevent_settings + policy);
|
||||
stringstream ss_conf(prevent_settings + local_intelligence + policy);
|
||||
Singleton::Consume<Config::I_Config>::from(config)->loadConfiguration(ss_conf);
|
||||
|
||||
string intelligence_response_ok = loadIntelligenceResponse("data/ok_intelligence_response.json");
|
||||
@@ -305,7 +312,7 @@ TEST_F(Layer7AccessControlTest, ReturnAcceptVerdict)
|
||||
|
||||
TEST_F(Layer7AccessControlTest, ReturnDropVerdictOnMaliciousReputation)
|
||||
{
|
||||
stringstream ss_conf(prevent_settings + policy);
|
||||
stringstream ss_conf(prevent_settings + local_intelligence + policy);
|
||||
Singleton::Consume<Config::I_Config>::from(config)->loadConfiguration(ss_conf);
|
||||
|
||||
string malicious_intelligence_response = loadIntelligenceResponse("data/malicious_intelligence_response.json");
|
||||
@@ -351,7 +358,7 @@ TEST_F(Layer7AccessControlTest, ReturnDropVerdictOnMaliciousReputation)
|
||||
|
||||
TEST_F(Layer7AccessControlTest, ReturnDropVerdictCacheBased)
|
||||
{
|
||||
stringstream ss_conf(prevent_settings + policy);
|
||||
stringstream ss_conf(prevent_settings + local_intelligence + policy);
|
||||
Singleton::Consume<Config::I_Config>::from(config)->loadConfiguration(ss_conf);
|
||||
|
||||
string malicious_intelligence_response = loadIntelligenceResponse("data/malicious_intelligence_response.json");
|
||||
@@ -403,7 +410,7 @@ TEST_F(Layer7AccessControlTest, ReturnDropVerdictCacheBased)
|
||||
|
||||
TEST_F(Layer7AccessControlTest, AcceptOnDetect)
|
||||
{
|
||||
stringstream ss_conf(detect_settings + policy);
|
||||
stringstream ss_conf(detect_settings + local_intelligence + policy);
|
||||
Singleton::Consume<Config::I_Config>::from(config)->loadConfiguration(ss_conf);
|
||||
|
||||
string malicious_intelligence_response = loadIntelligenceResponse("data/malicious_intelligence_response.json");
|
||||
@@ -449,7 +456,7 @@ TEST_F(Layer7AccessControlTest, AcceptOnDetect)
|
||||
|
||||
TEST_F(Layer7AccessControlTest, FallbackToSourceIPAndDrop)
|
||||
{
|
||||
stringstream ss_conf(prevent_settings + policy);
|
||||
stringstream ss_conf(prevent_settings + local_intelligence + policy);
|
||||
Singleton::Consume<Config::I_Config>::from(config)->loadConfiguration(ss_conf);
|
||||
|
||||
string malicious_intelligence_response = loadIntelligenceResponse("data/malicious_intelligence_response.json");
|
||||
|
||||
@@ -228,6 +228,7 @@ AccessControlPracticeSpec::load(cereal::JSONInputArchive &archive_in)
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec practice spec";
|
||||
|
||||
parseAppsecJSONKey<string>("name", practice_name, archive_in);
|
||||
parseAppsecJSONKey<string>("practiceMode", mode, archive_in);
|
||||
parseAppsecJSONKey<string>("appsecClassName", appsec_class_name, archive_in);
|
||||
parseMandatoryAppsecJSONKey<AccessControlRateLimit>("rateLimit", rate_limit, archive_in);
|
||||
}
|
||||
@@ -255,4 +256,10 @@ AccessControlPracticeSpec::getName() const
|
||||
{
|
||||
return practice_name;
|
||||
}
|
||||
|
||||
const string &
|
||||
AccessControlPracticeSpec::getMode(const std::string &default_mode) const
|
||||
{
|
||||
return isModeInherited(mode) ? default_mode : mode;
|
||||
}
|
||||
// LCOV_EXCL_STOP
|
||||
|
||||
@@ -181,12 +181,14 @@ public:
|
||||
const AccessControlRateLimit &getRateLimit() const;
|
||||
const std::string & getAppSecClassName() const;
|
||||
const std::string & getName() const;
|
||||
const std::string & getMode(const std::string &default_mode = "inactive") const;
|
||||
void setName(const std::string &_name);
|
||||
|
||||
private:
|
||||
AccessControlRateLimit rate_limit;
|
||||
std::string appsec_class_name;
|
||||
std::string practice_name;
|
||||
std::string mode;
|
||||
};
|
||||
|
||||
#endif // __ACCESS_CONTROL_PRACTICE_H__
|
||||
|
||||
@@ -587,6 +587,7 @@ public:
|
||||
const NewFileSecurity & getFileSecurity() const;
|
||||
const std::string & getAppSecClassName() const;
|
||||
const std::string & getName() const;
|
||||
const std::string & getMode(const std::string &default_mode = "inactive") const;
|
||||
void setName(const std::string &_name);
|
||||
|
||||
private:
|
||||
@@ -598,6 +599,7 @@ private:
|
||||
NewAppSecPracticeAntiBot anti_bot;
|
||||
std::string appsec_class_name;
|
||||
std::string practice_name;
|
||||
std::string mode;
|
||||
};
|
||||
|
||||
#endif // __NEW_PRACTICE_H__
|
||||
|
||||
@@ -27,7 +27,7 @@ NewAppsecTriggerAccessControlLogging::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec Trigger - Access Control Logging";
|
||||
parseAppsecJSONKey<bool>("allowEvents", ac_allow_events, archive_in, false);
|
||||
parseAppsecJSONKey<bool>("dropEvents", ac_drop_events, archive_in, false);
|
||||
parseAppsecJSONKey<bool>("dropEvents", ac_drop_events, archive_in, true);
|
||||
}
|
||||
|
||||
void
|
||||
@@ -36,8 +36,7 @@ NewAppsecTriggerAdditionalSuspiciousEventsLogging::load(cereal::JSONInputArchive
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec Trigger - Additional Suspicious Events Logging";
|
||||
parseAppsecJSONKey<bool>("enabled", enabled, archive_in, true);
|
||||
parseAppsecJSONKey<bool>("responseBody", response_body, archive_in, false);
|
||||
//the old code didn't parse the responsecode so ask Noam what is the currenct default value for it
|
||||
parseAppsecJSONKey<bool>("responseCode", response_code, archive_in, false);
|
||||
parseAppsecJSONKey<bool>("responseCode", response_code, archive_in, true);
|
||||
parseAppsecJSONKey<string>("minSeverity", minimum_severity, archive_in, "high");
|
||||
if (valid_severities.count(minimum_severity) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY)
|
||||
@@ -133,7 +132,7 @@ void
|
||||
NewLoggingService::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
parseAppsecJSONKey<string>("address", address, archive_in);
|
||||
parseAppsecJSONKey<string>("proto", proto, archive_in);
|
||||
parseAppsecJSONKey<string>("proto", proto, archive_in, "tcp");
|
||||
if (valid_protocols.count(proto) == 0) {
|
||||
dbgWarning(D_LOCAL_POLICY) << "AppSec Logging Service - proto invalid: " << proto;
|
||||
throw PolicyGenException("AppSec Logging Service - proto invalid: " + proto);
|
||||
@@ -175,8 +174,12 @@ void
|
||||
NewAppsecTriggerLogDestination::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec Trigger LogDestination";
|
||||
// TBD: support "file"
|
||||
parseAppsecJSONKey<bool>("cloud", cloud, archive_in, false);
|
||||
if (getConfigurationFlag("orchestration-mode") != "hybrid_mode") {
|
||||
// TBD: support "file"
|
||||
parseAppsecJSONKey<bool>("cloud", cloud, archive_in, false);
|
||||
} else {
|
||||
cloud = false;
|
||||
}
|
||||
auto mode = Singleton::Consume<I_AgentDetails>::by<NewAppsecTriggerLogDestination>()->getOrchestrationMode();
|
||||
auto env_type = Singleton::Consume<I_EnvDetails>::by<NewAppsecTriggerLogDestination>()->getEnvType();
|
||||
bool k8s_service_default = (mode == OrchestrationMode::HYBRID && env_type == EnvType::K8S);
|
||||
@@ -184,7 +187,7 @@ NewAppsecTriggerLogDestination::load(cereal::JSONInputArchive &archive_in)
|
||||
|
||||
NewStdoutLogging stdout_log;
|
||||
parseAppsecJSONKey<NewStdoutLogging>("stdout", stdout_log, archive_in);
|
||||
agent_local = !(stdout_log.getFormat().empty());
|
||||
parseAppsecJSONKey<bool>("logToAgent", agent_local, archive_in, true);
|
||||
beautify_logs = stdout_log.getFormat() == "json-formatted";
|
||||
parseAppsecJSONKey<NewLoggingService>("syslogService", syslog_service, archive_in);
|
||||
parseAppsecJSONKey<NewLoggingService>("cefService", cef_service, archive_in);
|
||||
|
||||
@@ -1025,6 +1025,7 @@ NewAppSecPracticeSpec::load(cereal::JSONInputArchive &archive_in)
|
||||
parseMandatoryAppsecJSONKey<NewAppSecPracticeWebAttacks>("webAttacks", web_attacks, archive_in);
|
||||
parseAppsecJSONKey<NewAppSecPracticeAntiBot>("antiBot", anti_bot, archive_in);
|
||||
parseAppsecJSONKey<string>("name", practice_name, archive_in);
|
||||
parseAppsecJSONKey<string>("practiceMode", mode, archive_in, "inherited");
|
||||
}
|
||||
|
||||
void
|
||||
@@ -1080,4 +1081,11 @@ NewAppSecPracticeSpec::getName() const
|
||||
{
|
||||
return practice_name;
|
||||
}
|
||||
|
||||
const string &
|
||||
NewAppSecPracticeSpec::getMode(const string &default_mode) const
|
||||
{
|
||||
return isModeInherited(mode) ? default_mode : mode;
|
||||
}
|
||||
|
||||
// LCOV_EXCL_STOP
|
||||
|
||||
@@ -147,7 +147,7 @@ string
|
||||
PolicyMakerUtils::dumpPolicyToFile(
|
||||
const PolicyWrapper &policy,
|
||||
const string &policy_path,
|
||||
const string &settings_path)
|
||||
const string &)
|
||||
{
|
||||
clearElementsMaps();
|
||||
|
||||
@@ -170,6 +170,7 @@ PolicyMakerUtils::dumpPolicyToFile(
|
||||
cereal::JSONOutputArchive ar(settings_ss);
|
||||
policy.getSettings().save(ar);
|
||||
}
|
||||
#if 0
|
||||
string settings_str = settings_ss.str();
|
||||
try {
|
||||
ofstream settings_file(settings_path);
|
||||
@@ -179,6 +180,7 @@ PolicyMakerUtils::dumpPolicyToFile(
|
||||
dbgDebug(D_NGINX_POLICY) << "Error while writing settings to " << settings_path << ", Error: " << e.what();
|
||||
}
|
||||
dbgDebug(D_LOCAL_POLICY) << settings_path << " content: " << settings_str;
|
||||
#endif
|
||||
|
||||
return policy_str;
|
||||
}
|
||||
@@ -1002,8 +1004,9 @@ PolicyMakerUtils::createIpsSections(
|
||||
auto apssec_practice = getAppsecPracticeSpec<V1beta2AppsecLinuxPolicy, NewAppSecPracticeSpec>(
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
policy);
|
||||
const string &override_mode =
|
||||
apssec_practice.getIntrusionPrevention().getMode(apssec_practice.getMode(default_mode));
|
||||
|
||||
const string &override_mode = apssec_practice.getIntrusionPrevention().getMode(default_mode);
|
||||
if (override_mode == "Inactive" || override_mode == "Disabled") return;
|
||||
|
||||
IpsProtectionsSection ips_section = IpsProtectionsSection(
|
||||
@@ -1076,8 +1079,9 @@ PolicyMakerUtils::createSnortSections(
|
||||
auto apssec_practice = getAppsecPracticeSpec<V1beta2AppsecLinuxPolicy, NewAppSecPracticeSpec>(
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
policy);
|
||||
const string &override_mode =
|
||||
apssec_practice.getSnortSignatures().getOverrideMode(apssec_practice.getMode(default_mode));
|
||||
|
||||
const string &override_mode = apssec_practice.getSnortSignatures().getOverrideMode(default_mode);
|
||||
if (override_mode == "Inactive" ||
|
||||
override_mode == "Disabled" ||
|
||||
apssec_practice.getSnortSignatures().getFiles().size() == 0) {
|
||||
@@ -1129,7 +1133,7 @@ PolicyMakerUtils::createFileSecuritySections(
|
||||
asset_id,
|
||||
practice_name,
|
||||
practice_id,
|
||||
default_mode
|
||||
apssec_practice.getMode(default_mode)
|
||||
);
|
||||
|
||||
file_security[asset_name] = file_security_section;
|
||||
@@ -1171,7 +1175,7 @@ PolicyMakerUtils::createRateLimitSection(
|
||||
asset_name,
|
||||
url,
|
||||
uri,
|
||||
access_control_practice.getRateLimit().getMode(default_mode),
|
||||
access_control_practice.getRateLimit().getMode(access_control_practice.getMode(default_mode)),
|
||||
practice_id,
|
||||
rule_annotations[AnnotationTypes::ACCESS_CONTROL_PRACTICE],
|
||||
rules
|
||||
@@ -1191,6 +1195,8 @@ PolicyMakerUtils::createWebAppSection(
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
policy
|
||||
);
|
||||
const string &practice_mode = apssec_practice.getMode(default_mode);
|
||||
|
||||
PracticeAdvancedConfig practice_advance_config(
|
||||
apssec_practice.getWebAttacks().getMaxHeaderSizeBytes(),
|
||||
apssec_practice.getWebAttacks().getMaxBodySizeKb(),
|
||||
@@ -1206,8 +1212,8 @@ PolicyMakerUtils::createWebAppSection(
|
||||
practice_id,
|
||||
rule_annotations[AnnotationTypes::PRACTICE],
|
||||
rule_config.getContext(),
|
||||
apssec_practice.getWebAttacks().getMinimumConfidence(default_mode),
|
||||
apssec_practice.getWebAttacks().getMode(default_mode),
|
||||
apssec_practice.getWebAttacks().getMinimumConfidence(practice_mode),
|
||||
apssec_practice.getWebAttacks().getMode(practice_mode),
|
||||
practice_advance_config,
|
||||
apssec_practice.getAntiBot(),
|
||||
log_triggers[rule_annotations[AnnotationTypes::TRIGGER]],
|
||||
|
||||
@@ -387,8 +387,12 @@ void
|
||||
AppsecTriggerLogDestination::load(cereal::JSONInputArchive &archive_in)
|
||||
{
|
||||
dbgTrace(D_LOCAL_POLICY) << "Loading AppSec Trigger LogDestination";
|
||||
// TBD: support "file"
|
||||
parseAppsecJSONKey<bool>("cloud", cloud, archive_in, false);
|
||||
if (getConfigurationFlag("orchestration-mode") != "hybrid_mode") {
|
||||
// TBD: support "file"
|
||||
parseAppsecJSONKey<bool>("cloud", cloud, archive_in, false);
|
||||
} else {
|
||||
cloud = false;
|
||||
}
|
||||
auto mode = Singleton::Consume<I_AgentDetails>::by<AppsecTriggerLogDestination>()->getOrchestrationMode();
|
||||
auto env_type = Singleton::Consume<I_EnvDetails>::by<AppsecTriggerLogDestination>()->getEnvType();
|
||||
bool k8s_service_default = (mode == OrchestrationMode::HYBRID && env_type == EnvType::K8S);
|
||||
|
||||
@@ -12,6 +12,8 @@ add_subdirectory(manifest_controller)
|
||||
add_subdirectory(update_communication)
|
||||
add_subdirectory(details_resolver)
|
||||
add_subdirectory(health_check)
|
||||
add_subdirectory(health_check_manager)
|
||||
add_subdirectory(updates_process_reporter)
|
||||
add_subdirectory(env_details)
|
||||
|
||||
#add_subdirectory(orchestration_ut)
|
||||
|
||||
@@ -32,6 +32,7 @@ class DetailsResolver::Impl
|
||||
Singleton::Provide<I_DetailsResolver>::From<DetailsResolver>
|
||||
{
|
||||
public:
|
||||
void init() { handler.init(); }
|
||||
Maybe<string> getHostname() override;
|
||||
Maybe<string> getPlatform() override;
|
||||
Maybe<string> getArch() override;
|
||||
@@ -43,6 +44,8 @@ public:
|
||||
bool isGwNotVsx() override;
|
||||
bool isVersionAboveR8110() override;
|
||||
bool isReverseProxy() override;
|
||||
bool isCloudStorageEnabled() override;
|
||||
Maybe<tuple<string, string, string, string, string>> readCloudMetadata() override;
|
||||
Maybe<tuple<string, string, string>> parseNginxMetadata() override;
|
||||
#if defined(gaia) || defined(smb)
|
||||
bool compareCheckpointVersion(int cp_version, std::function<bool(int, int)> compare_operator) const override;
|
||||
@@ -134,6 +137,18 @@ DetailsResolver::Impl::isReverseProxy()
|
||||
return getenv("DOCKER_RPM_ENABLED") && getenv("DOCKER_RPM_ENABLED") == string("true");
|
||||
}
|
||||
|
||||
bool
|
||||
DetailsResolver::Impl::isCloudStorageEnabled()
|
||||
{
|
||||
auto cloud_storage_mode_override = getProfileAgentSetting<bool>("agent.cloudStorage.enabled");
|
||||
if (cloud_storage_mode_override.ok()) {
|
||||
dbgInfo(D_ORCHESTRATOR) << "Received cloud-storage mode override: " << *cloud_storage_mode_override;
|
||||
return *cloud_storage_mode_override;
|
||||
}
|
||||
|
||||
return getenv("CLOUD_STORAGE_ENABLED") && getenv("CLOUD_STORAGE_ENABLED") == string("true");
|
||||
}
|
||||
|
||||
bool
|
||||
DetailsResolver::Impl::isKernelVersion3OrHigher()
|
||||
{
|
||||
@@ -174,17 +189,16 @@ DetailsResolver::Impl::getCheckpointVersion() const
|
||||
{
|
||||
#ifdef gaia
|
||||
static const string cmd =
|
||||
"echo $CPDIR | awk -F'-' '{print $NF}' | cut -c 2- |"
|
||||
" awk -F'.' '{ if( NF == 1 ) {print $1\"00\"} else {print $1$2} }'";
|
||||
"echo $CPDIR | awk '{sub(/.*-R/,\"\"); sub(/\\/.*/,\"\")}/^[0-9]*$/{$0=$0\".00\"}{sub(/\\./, \"\"); print}'";
|
||||
#else // smb
|
||||
static const string cmd = "sqlcmd 'select major,minor from cpver' |"
|
||||
"awk '{if ($1 == \"major\") v += (substr($3,2) * 100);"
|
||||
" if ($1 == \"minor\") v += $3; } END { print v}'";
|
||||
|
||||
#endif // gaia
|
||||
auto version_out = DetailsResolvingHanlder::getCommandOutput(cmd);
|
||||
int cp_version = 0;
|
||||
if (version_out.ok()) {
|
||||
dbgTrace(D_ORCHESTRATOR) << "Identified version " << version_out.unpack();
|
||||
stringstream version_stream(version_out.unpack());
|
||||
version_stream >> cp_version;
|
||||
}
|
||||
@@ -286,10 +300,77 @@ DetailsResolver::Impl::parseNginxMetadata()
|
||||
return make_tuple(config_opt, cc_opt, nginx_version);
|
||||
}
|
||||
|
||||
Maybe<tuple<string, string, string, string, string>>
|
||||
DetailsResolver::Impl::readCloudMetadata()
|
||||
{
|
||||
auto env_read_cloud_metadata = []() -> Maybe<tuple<string, string, string, string, string>> {
|
||||
string account_id = getenv("CLOUD_ACCOUNT_ID") ? getenv("CLOUD_ACCOUNT_ID") : "";
|
||||
string vpc_id = getenv("CLOUD_VPC_ID") ? getenv("CLOUD_VPC_ID") : "";
|
||||
string instance_id = getenv("CLOUD_INSTANCE_ID") ? getenv("CLOUD_INSTANCE_ID") : "";
|
||||
string instance_local_ip = getenv("CLOUD_INSTANCE_LOCAL_IP") ? getenv("CLOUD_INSTANCE_LOCAL_IP") : "";
|
||||
string region = getenv("CLOUD_REGION") ? getenv("CLOUD_REGION") : "";
|
||||
|
||||
if (
|
||||
account_id.empty() ||
|
||||
vpc_id.empty() ||
|
||||
instance_id.empty() ||
|
||||
instance_local_ip.empty() ||
|
||||
region.empty()) {
|
||||
return genError("Could not read cloud metadata");
|
||||
}
|
||||
|
||||
return make_tuple(account_id, vpc_id, instance_id, instance_local_ip, region);
|
||||
};
|
||||
|
||||
auto cloud_metadata = env_read_cloud_metadata();
|
||||
if (!cloud_metadata.ok()) {
|
||||
const string cmd = getFilesystemPathConfig() + "/scripts/get-cloud-metadata.sh";
|
||||
dbgTrace(D_ORCHESTRATOR) << cloud_metadata.getErr() << ", trying to fetch it via cmd: " << cmd;
|
||||
|
||||
auto result = DetailsResolvingHanlder::getCommandOutput(cmd);
|
||||
if (result.ok()) {
|
||||
istringstream iss(result.unpack());
|
||||
string line;
|
||||
while (getline(iss, line)) {
|
||||
size_t pos = line.find('=');
|
||||
if (pos != string::npos) {
|
||||
string key = line.substr(0, pos);
|
||||
string value = line.substr(pos + 1);
|
||||
if (!key.empty() && !value.empty()) setenv(key.c_str(), value.c_str(), 1);
|
||||
}
|
||||
}
|
||||
cloud_metadata = env_read_cloud_metadata();
|
||||
} else {
|
||||
dbgWarning(D_ORCHESTRATOR) << "Could not fetch cloud metadata from cmd: " << result.getErr();
|
||||
}
|
||||
}
|
||||
|
||||
if (!cloud_metadata.ok()) {
|
||||
dbgWarning(D_ORCHESTRATOR) << cloud_metadata.getErr();
|
||||
return genError("Failed to fetch cloud metadata");
|
||||
}
|
||||
|
||||
dbgTrace(D_ORCHESTRATOR)
|
||||
<< "Successfully fetched cloud metadata: "
|
||||
<< ::get<0>(cloud_metadata.unpack()) << ", "
|
||||
<< ::get<1>(cloud_metadata.unpack()) << ", "
|
||||
<< ::get<2>(cloud_metadata.unpack()) << ", "
|
||||
<< ::get<3>(cloud_metadata.unpack()) << ", "
|
||||
<< ::get<4>(cloud_metadata.unpack());
|
||||
|
||||
return cloud_metadata;
|
||||
}
|
||||
|
||||
DetailsResolver::DetailsResolver() : Component("DetailsResolver"), pimpl(make_unique<Impl>()) {}
|
||||
|
||||
DetailsResolver::~DetailsResolver() {}
|
||||
|
||||
void
|
||||
DetailsResolver::init()
|
||||
{
|
||||
pimpl->init();
|
||||
}
|
||||
|
||||
void
|
||||
DetailsResolver::preload()
|
||||
{
|
||||
|
||||
@@ -15,7 +15,9 @@
|
||||
#define __CHECKPOINT_PRODUCT_HANDLERS_H__
|
||||
|
||||
#include <algorithm>
|
||||
#include <regex>
|
||||
#include <boost/regex.hpp>
|
||||
#include <boost/algorithm/string.hpp>
|
||||
|
||||
#if defined(gaia)
|
||||
|
||||
@@ -32,6 +34,17 @@ checkSAMLSupportedBlade(const string &command_output)
|
||||
return genError("Current host does not have SAML capability");
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
checkIDABlade(const string &command_output)
|
||||
{
|
||||
string idaBlade = "identityServer";
|
||||
if (command_output.find(idaBlade) != string::npos) {
|
||||
return string("true");
|
||||
}
|
||||
|
||||
return genError("Current host does not have IDA installed");
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
checkSAMLPortal(const string &command_output)
|
||||
{
|
||||
@@ -43,9 +56,22 @@ checkSAMLPortal(const string &command_output)
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
getIDASSamlGaia(const string &command_output)
|
||||
checkPepIdaIdnStatus(const string &command_output)
|
||||
{
|
||||
return string("idaSaml_gaia");
|
||||
if (command_output.find("nac_pep_scaled_sharing_enabled = 1") != string::npos) {
|
||||
return string("true");
|
||||
}
|
||||
return genError("Current host does not have PEP control scaled_sharing enabled");
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
getIDAGaiaPackages(const string &command_output)
|
||||
{
|
||||
string result = "idaSaml_gaia;idaIdn_gaia;idaIdnBg_gaia;";
|
||||
if (command_output.find("nac_pep_scaled_sharing_enabled = 1") != string::npos) {
|
||||
result += "agentIntelligenceService_gaia;";
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
@@ -76,6 +102,18 @@ checkIsInstallHorizonTelemetrySucceeded(const string &command_output)
|
||||
return command_output;
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
getQUID(const string &command_output)
|
||||
{
|
||||
if (command_output == "" ) return string("false");
|
||||
// validate valid QUID - contains exactly 4 '-'
|
||||
if (std::count(command_output.begin(), command_output.end(), '-') != 4) {
|
||||
return genError("not valid QUID");
|
||||
}
|
||||
return command_output;
|
||||
}
|
||||
|
||||
|
||||
Maybe<string>
|
||||
checkHasSDWan(const string &command_output)
|
||||
{
|
||||
@@ -92,6 +130,26 @@ checkCanUpdateSDWanData(const string &command_output)
|
||||
return string("true");
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
checkLsmProfileName(const string &command_output)
|
||||
{
|
||||
if (!command_output.empty()) {
|
||||
return command_output;
|
||||
}
|
||||
|
||||
return genError("LSM profile name was not found");
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
checkLsmProfileUuid(const string &command_output)
|
||||
{
|
||||
if (!command_output.empty()) {
|
||||
return command_output;
|
||||
}
|
||||
|
||||
return genError("LSM profile uuid was not found");
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
getMgmtObjType(const string &command_output)
|
||||
{
|
||||
@@ -271,6 +329,34 @@ getSmbGWIPSecVPNBlade(const string &command_output)
|
||||
{
|
||||
return getSmbBlade(command_output, "IPSec VPN Blade was not found");
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
extractManagements(const string &command_output)
|
||||
{
|
||||
size_t start_pos = command_output.find(":masters(");
|
||||
if (start_pos == string::npos) {
|
||||
return genError("Starting pattern \":masters(\" not found.");
|
||||
}
|
||||
size_t end_pos = command_output.find("))):", start_pos);
|
||||
if (end_pos == string::npos) {
|
||||
return genError("Ending pattern \"))):\" not found.");
|
||||
}
|
||||
string input_string = command_output.substr(start_pos, end_pos - start_pos + 3);
|
||||
string json_output = "[";
|
||||
regex pattern("\\(ReferenceObject\\:Uid\\(\"\\{([\\w-]+)\\}\"\\)\\:Name\\(([^\\)]+)\\)\\:Table\\(([^\\)]+)\\)\\)");
|
||||
smatch matches;
|
||||
auto words_begin = sregex_iterator(input_string.begin(), input_string.end(), pattern);
|
||||
auto words_end = sregex_iterator();
|
||||
for (sregex_iterator i = words_begin; i != words_end; ++i) {
|
||||
const smatch& match = *i;
|
||||
string uid = boost::algorithm::to_lower_copy(match[1].str());
|
||||
string name = match[2].str();
|
||||
if (json_output.back() != '[') json_output += ",";
|
||||
json_output += "{\"Uid\":\"" + uid + "\",\"Name\":\"" + name + "\"}";
|
||||
}
|
||||
json_output += "]";
|
||||
return json_output;
|
||||
}
|
||||
#endif // gaia || smb
|
||||
|
||||
#if defined(gaia)
|
||||
|
||||
@@ -43,9 +43,15 @@ SHELL_PRE_CMD("gunzip local.cfg", "gunzip -c $FWDIR/state/local/FW1/local.cfg.gz
|
||||
#if defined(gaia) || defined(smb)
|
||||
SHELL_CMD_HANDLER("cpProductIntegrationMgmtObjectType", "cpprod_util CPPROD_IsMgmtMachine", getMgmtObjType)
|
||||
SHELL_CMD_HANDLER("prerequisitesForHorizonTelemetry",
|
||||
"[ -f /var/log/nano_agent/cp-nano-horizon-telemetry-prerequisites.log ] "
|
||||
"&& head -1 /var/log/nano_agent/cp-nano-horizon-telemetry-prerequisites.log || echo ''",
|
||||
"FS_PATH=<FILESYSTEM-PREFIX>; [ -f ${FS_PATH}/cp-nano-horizon-telemetry-prerequisites.log ] "
|
||||
"&& head -1 ${FS_PATH}/cp-nano-horizon-telemetry-prerequisites.log || echo ''",
|
||||
checkIsInstallHorizonTelemetrySucceeded)
|
||||
SHELL_CMD_HANDLER("QUID", "[ -d /opt/CPquid ] "
|
||||
"&& python3 /opt/CPquid/Quid_Api.py -i /opt/CPotelcol/quid_api/get_global_id.json | jq -r .message || echo ''",
|
||||
getQUID)
|
||||
SHELL_CMD_HANDLER("SMO_QUID", "[ -d /opt/CPquid ] "
|
||||
"&& python3 /opt/CPquid/Quid_Api.py -i /opt/CPotelcol/quid_api/get_smo_quid.json | jq -r .message || echo ''",
|
||||
getQUID)
|
||||
SHELL_CMD_HANDLER("hasSDWan", "[ -f $FWDIR/bin/sdwan_steering ] && echo '1' || echo '0'", checkHasSDWan)
|
||||
SHELL_CMD_HANDLER(
|
||||
"canUpdateSDWanData",
|
||||
@@ -56,6 +62,16 @@ SHELL_CMD_HANDLER(
|
||||
"isSdwanRunning",
|
||||
"[ -v $(pidof cp-nano-sdwan) ] && echo 'false' || echo 'true'",
|
||||
checkIfSdwanRunning)
|
||||
SHELL_CMD_HANDLER(
|
||||
"lsmProfileName",
|
||||
"jq -r .lsm_profile_name /tmp/cpsdwan_getdata_orch.json",
|
||||
checkLsmProfileName
|
||||
)
|
||||
SHELL_CMD_HANDLER(
|
||||
"lsmProfileUuid",
|
||||
"jq -r .lsm_profile_uuid /tmp/cpsdwan_getdata_orch.json",
|
||||
checkLsmProfileUuid
|
||||
)
|
||||
SHELL_CMD_HANDLER(
|
||||
"IP Address",
|
||||
"[ $(cpprod_util FWisDAG) -eq 1 ] && echo \"Dynamic Address\" "
|
||||
@@ -84,8 +100,10 @@ SHELL_CMD_HANDLER(
|
||||
|
||||
#if defined(gaia)
|
||||
SHELL_CMD_HANDLER("hasSAMLSupportedBlade", "enabled_blades", checkSAMLSupportedBlade)
|
||||
SHELL_CMD_HANDLER("hasSAMLPortal", "mpclient status saml-vpn", checkSAMLPortal)
|
||||
SHELL_CMD_HANDLER("requiredNanoServices", "ida_saml_gaia", getIDASSamlGaia)
|
||||
SHELL_CMD_HANDLER("hasIDABlade", "enabled_blades", checkIDABlade)
|
||||
SHELL_CMD_HANDLER("hasSAMLPortal", "mpclient status nac", checkSAMLPortal)
|
||||
SHELL_CMD_HANDLER("hasIdaIdnEnabled", "fw ctl get int nac_pep_scaled_sharing_enabled", checkPepIdaIdnStatus)
|
||||
SHELL_CMD_HANDLER("requiredNanoServices", "fw ctl get int nac_pep_scaled_sharing_enabled", getIDAGaiaPackages)
|
||||
SHELL_CMD_HANDLER(
|
||||
"cpProductIntegrationMgmtParentObjectName",
|
||||
"cat $FWDIR/database/myself_objects.C "
|
||||
@@ -134,6 +152,12 @@ SHELL_CMD_HANDLER(
|
||||
"| awk -F '[:()]' '/:masters/ {found=1; next} found && /:Name/ {print $3; exit}'",
|
||||
getSMCBasedMgmtName
|
||||
)
|
||||
SHELL_CMD_HANDLER(
|
||||
"managements",
|
||||
"sed -n '/:masters (/,$p' $FWDIR/database/myself_objects.C |"
|
||||
" sed -e ':a' -e 'N' -e '$!ba' -e 's/\\n//g' -e 's/\t//g' -e 's/ //g' | sed 's/))):.*/)))):/'",
|
||||
extractManagements
|
||||
)
|
||||
#endif //gaia
|
||||
|
||||
#if defined(smb)
|
||||
@@ -184,6 +208,13 @@ SHELL_CMD_HANDLER(
|
||||
"| awk -F '[:()]' '/:masters/ {found=1; next} found && /:Name/ {print $3; exit}'",
|
||||
getSMCBasedMgmtName
|
||||
)
|
||||
|
||||
SHELL_CMD_HANDLER(
|
||||
"managements",
|
||||
"sed -n '/:masters (/,$p' /tmp/local.cfg |"
|
||||
" sed -e ':a' -e 'N' -e '$!ba' -e 's/\\n//g' -e 's/\t//g' -e 's/ //g' | sed 's/))):.*/)))):/'",
|
||||
extractManagements
|
||||
)
|
||||
#endif//smb
|
||||
|
||||
SHELL_CMD_OUTPUT("kernel_version", "uname -r")
|
||||
@@ -223,7 +254,7 @@ FILE_CONTENT_HANDLER(
|
||||
FILE_CONTENT_HANDLER("os_release", "/etc/os-release", getOsRelease)
|
||||
#endif // gaia || smb
|
||||
|
||||
FILE_CONTENT_HANDLER("AppSecModelVersion", "/etc/cp/conf/waap/waap.data", getWaapModelVersion)
|
||||
FILE_CONTENT_HANDLER("AppSecModelVersion", "<FILESYSTEM-PREFIX>/conf/waap/waap.data", getWaapModelVersion)
|
||||
|
||||
#endif // FILE_CONTENT_HANDLER
|
||||
|
||||
|
||||
@@ -36,9 +36,12 @@ using FileContentHandler = function<Maybe<string>(shared_ptr<istream> file_otput
|
||||
|
||||
#include "checkpoint_product_handlers.h"
|
||||
|
||||
static const string filesystem_place_holder = "<FILESYSTEM-PREFIX>";
|
||||
|
||||
class DetailsResolvingHanlder::Impl
|
||||
{
|
||||
public:
|
||||
void init();
|
||||
map<string, string> getResolvedDetails() const;
|
||||
static Maybe<string> getCommandOutput(const string &cmd);
|
||||
|
||||
@@ -70,6 +73,28 @@ private:
|
||||
};
|
||||
#undef SHELL_POST_CMD
|
||||
|
||||
void
|
||||
DetailsResolvingHanlder::Impl::init()
|
||||
{
|
||||
string actual_filesystem_prefix = getFilesystemPathConfig();
|
||||
size_t place_holder_size = filesystem_place_holder.size();
|
||||
|
||||
for (auto &file_handler : file_content_handlers) {
|
||||
string &path = file_handler.second.first;
|
||||
if (path.substr(0, place_holder_size) == filesystem_place_holder) {
|
||||
path = actual_filesystem_prefix + path.substr(place_holder_size);
|
||||
}
|
||||
}
|
||||
|
||||
for (auto &cmd_handler_pair : shell_command_handlers) {
|
||||
string &cmd_str = cmd_handler_pair.second.first;
|
||||
size_t fs_pos = cmd_str.find(filesystem_place_holder);
|
||||
if (fs_pos != string::npos) {
|
||||
cmd_str.replace(fs_pos, place_holder_size, actual_filesystem_prefix);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
map<string, string>
|
||||
DetailsResolvingHanlder::Impl::getResolvedDetails() const
|
||||
{
|
||||
@@ -155,6 +180,12 @@ DetailsResolvingHanlder::Impl::getCommandOutput(const string &cmd)
|
||||
DetailsResolvingHanlder::DetailsResolvingHanlder() : pimpl(make_unique<Impl>()) {}
|
||||
DetailsResolvingHanlder::~DetailsResolvingHanlder() {}
|
||||
|
||||
void
|
||||
DetailsResolvingHanlder::init()
|
||||
{
|
||||
return pimpl->init();
|
||||
}
|
||||
|
||||
map<string, string>
|
||||
DetailsResolvingHanlder::getResolvedDetails() const
|
||||
{
|
||||
|
||||
@@ -31,6 +31,7 @@ public:
|
||||
DetailsResolvingHanlder();
|
||||
~DetailsResolvingHanlder();
|
||||
|
||||
void init();
|
||||
std::map<std::string, std::string> getResolvedDetails() const;
|
||||
|
||||
static Maybe<std::string> getCommandOutput(const std::string &cmd);
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
ADD_DEFINITIONS(-Wno-deprecated-declarations -Dalpine)
|
||||
|
||||
add_library(orchestration_downloader curl_client.cc downloader.cc http_client.cc https_client.cc)
|
||||
add_library(orchestration_downloader curl_client.cc downloader.cc https_client.cc https_client_helper.cc)
|
||||
|
||||
#add_subdirectory(downloader_ut)
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
|
||||
#include "i_orchestration_tools.h"
|
||||
#include "singleton.h"
|
||||
#include "http_client.h"
|
||||
#include "https_client.h"
|
||||
#include "debug.h"
|
||||
#include "config.h"
|
||||
#include "rest.h"
|
||||
@@ -63,7 +63,7 @@ class Downloader::Impl : Singleton::Provide<I_Downloader>::From<Downloader>
|
||||
public:
|
||||
void init();
|
||||
|
||||
Maybe<string> downloadFileFromFog(
|
||||
Maybe<string> downloadFile(
|
||||
const string &checksum,
|
||||
Package::ChecksumTypes checksum_type,
|
||||
const GetResourceFile &resourse_file
|
||||
@@ -87,7 +87,7 @@ public:
|
||||
string getProfileFromMap(const string &tenant_id) const override;
|
||||
|
||||
private:
|
||||
Maybe<string> downloadFileFromFogByHTTP(
|
||||
Maybe<string> downloadAttributeFile(
|
||||
const GetResourceFile &resourse_file,
|
||||
const string &file_name
|
||||
) const;
|
||||
@@ -121,16 +121,21 @@ Downloader::Impl::init()
|
||||
"Default file download path"
|
||||
);
|
||||
|
||||
auto maybe_vs_id = Singleton::Consume<I_Environment>::by<Downloader>()->get<string>("VS ID");
|
||||
if (maybe_vs_id.ok()) {
|
||||
dir_path = dir_path + "/vs" + maybe_vs_id.unpack();
|
||||
}
|
||||
|
||||
Singleton::Consume<I_OrchestrationTools>::by<Downloader>()->createDirectory(dir_path);
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
Downloader::Impl::downloadFileFromFog(
|
||||
Downloader::Impl::downloadFile(
|
||||
const string &checksum,
|
||||
Package::ChecksumTypes checksum_type,
|
||||
const GetResourceFile &resourse_file) const
|
||||
{
|
||||
auto file_path = downloadFileFromFogByHTTP(resourse_file, resourse_file.getFileName() + ".download");
|
||||
auto file_path = downloadAttributeFile(resourse_file, resourse_file.getFileName() + ".download");
|
||||
|
||||
if (!file_path.ok()) {
|
||||
return file_path;
|
||||
@@ -373,11 +378,11 @@ Downloader::Impl::validateChecksum(
|
||||
}
|
||||
|
||||
Maybe<string>
|
||||
Downloader::Impl::downloadFileFromFogByHTTP(const GetResourceFile &resourse_file, const string &file_name) const
|
||||
Downloader::Impl::downloadAttributeFile(const GetResourceFile &resourse_file, const string &file_name) const
|
||||
{
|
||||
string file_path = dir_path + "/" + file_name;
|
||||
|
||||
dbgInfo(D_ORCHESTRATOR) << "Downloading file from fog. File: " << resourse_file.getFileName();
|
||||
dbgInfo(D_ORCHESTRATOR) << "Downloading file. File: " << resourse_file.getFileName();
|
||||
|
||||
I_UpdateCommunication *update_communication = Singleton::Consume<I_UpdateCommunication>::by<Downloader>();
|
||||
auto downloaded_file = update_communication->downloadAttributeFile(resourse_file, file_path);
|
||||
@@ -403,17 +408,14 @@ Downloader::Impl::getFileFromLocal(const string &local_file_path, const string &
|
||||
Maybe<string>
|
||||
Downloader::Impl::getFileFromURL(const URLParser &url, const string &file_path, bool auth_required) const
|
||||
{
|
||||
ofstream outFile(file_path, ofstream::out | ofstream::binary);
|
||||
HTTPClient http_client;
|
||||
dbgInfo(D_ORCHESTRATOR) << "Downloading file. URL: " << url;
|
||||
auto get_file_response = http_client.getFile(url, outFile, auth_required);
|
||||
auto get_file_response = HTTPSClient().getFile(url, file_path, auth_required);
|
||||
if (!get_file_response.ok()) {
|
||||
Maybe<string> error = genError("Failed to download file from " + url.getBaseURL().unpack() +
|
||||
". Error: " + get_file_response.getErr());
|
||||
dbgWarning(D_ORCHESTRATOR) << "Download failed";
|
||||
return error;
|
||||
}
|
||||
outFile.close();
|
||||
dbgInfo(D_ORCHESTRATOR) << "Download completed. URL: " << url;
|
||||
return file_path;
|
||||
}
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user