Skip to content

Commit 091abf4

Browse files
vlktnavlktna
committed
enabled missing configuration for custom filters
- OAuth2 Tokeninfo Filters - OAuth2 Grant Flow - Open Policy Agent - Rate Limiter - Compression
1 parent 248b521 commit 091abf4

File tree

1 file changed

+119
-0
lines changed

1 file changed

+119
-0
lines changed

‎cluster/manifests/02-skipper-validation-webhook/deployment.yaml‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,45 @@ spec:
5353
containers:
5454
- name: skipper-admission-webhook
5555
image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/skipper:v0.22.142
56+
env:
57+
{{ if or (eq .Cluster.ConfigItems.skipper_local_tokeninfo "production") (eq .Cluster.ConfigItems.skipper_local_tokeninfo "bridge") }}
58+
- name: LOCAL_TOKENINFO
59+
value: "true"
60+
- name: ENABLE_OPENTRACING
61+
value: "true"
62+
- name: OPENTRACING_LIGHTSTEP_COMPONENT_NAME
63+
value: "tokeninfo-skipper-ingress"
64+
- name: OPENTRACING_LIGHTSTEP_ACCESS_TOKEN
65+
valueFrom:
66+
secretKeyRef:
67+
name: skipper-ingress
68+
key: lightstep-token
69+
{{ end }}
70+
{{ if eq .Cluster.ConfigItems.skipper_local_tokeninfo "bridge" }}
71+
- name: LOCAL_TOKENINFO_SANDBOX
72+
value: "true"
73+
{{ end }}
74+
{{ if eq .Cluster.ConfigItems.skipper_lua_scripts_enabled "true" }}
75+
- name: LUA_PATH
76+
value: /etc/skipper/lua/?.lua
77+
- name: DATADOME_API_KEY
78+
valueFrom:
79+
secretKeyRef:
80+
name: skipper-ingress
81+
key: datadome-api-key
82+
- name: KASADA_API_KEY
83+
valueFrom:
84+
secretKeyRef:
85+
name: skipper-ingress
86+
key: kasada-api-key
87+
{{ end }}
88+
{{ if eq .Cluster.ConfigItems.skipper_open_policy_agent_enabled "true" }}
89+
- name: STYRA_TOKEN
90+
valueFrom:
91+
secretKeyRef:
92+
name: skipper-ingress
93+
key: styra-token
94+
{{ end }}
5695
args:
5796
- skipper
5897
- -support-listener=:9981
@@ -73,6 +112,20 @@ spec:
73112
- "-disable-metrics-compat"
74113
- "-histogram-metric-buckets=.0001,.00025,.0005,.00075,.001,.0025,.005,.0075,.01,.025,.05,.075,.1,.2,.3,.4,.5,.75,1,2,3,4,5,7,10,15,20,30,60,120,300,600"
75114
- "-disabled-filters={{ .Cluster.ConfigItems.skipper_disabled_filters }}"
115+
- "-compress-encodings={{ .Cluster.ConfigItems.skipper_compress_encodings }}"
116+
- "-enable-ratelimits"
117+
{{ if eq .Cluster.ConfigItems.skipper_ingress_redis_swarm_enabled "true" }}
118+
- "-enable-swarm"
119+
- "-swarm-redis-dial-timeout={{ .Cluster.ConfigItems.skipper_redis_dial_timeout }}"
120+
- "-swarm-redis-pool-timeout={{ .Cluster.ConfigItems.skipper_redis_pool_timeout }}"
121+
- "-swarm-redis-read-timeout={{ .Cluster.ConfigItems.skipper_redis_read_timeout }}"
122+
- "-swarm-redis-write-timeout={{ .Cluster.ConfigItems.skipper_redis_write_timeout }}"
123+
- "-cluster-ratelimit-max-group-shards={{ .Cluster.ConfigItems.skipper_cluster_ratelimit_max_group_shards }}"
124+
- "-swarm-redis-min-conns={{ .Cluster.ConfigItems.skipper_redis_min_conns }}"
125+
- "-swarm-redis-max-conns={{ .Cluster.ConfigItems.skipper_redis_max_conns }}"
126+
- "-cluster-ratelimit-max-group-shards={{ .Cluster.ConfigItems.skipper_cluster_ratelimit_max_group_shards }}"
127+
{{ end }}
128+
- "-lua-sources={{ .Cluster.ConfigItems.skipper_lua_sources }}"
76129
- "-default-filters-dir=/etc/config/default-filters"
77130
- '-default-filters-prepend={{ .Cluster.ConfigItems.skipper_default_filters }}'
78131
- '-default-filters-append={{ .Cluster.ConfigItems.skipper_default_filters_authentication }}'
@@ -81,6 +134,35 @@ spec:
81134
- '-kubernetes-annotation-filters-append={{ .Cluster.ConfigItems.skipper_kubernetes_annotation_filters_append }}'
82135
- '-kubernetes-east-west-range-annotation-predicates={{ .Cluster.ConfigItems.skipper_kubernetes_east_west_range_annotation_predicates }}'
83136
- '-kubernetes-east-west-range-annotation-filters-append={{ .Cluster.ConfigItems.skipper_kubernetes_east_west_range_annotation_filters_append }}'
137+
{{ if eq .Cluster.ConfigItems.skipper_local_tokeninfo "bridge" }}
138+
- "-oauth2-tokeninfo-url=http://127.0.0.1:9000/oauth2/tokeninfo"
139+
- "-status-checks=http://127.0.0.1:9021/health,http://127.0.0.1:9121/health,http://127.0.0.1:9000/healthz"
140+
{{ else if eq .Cluster.ConfigItems.skipper_local_tokeninfo "production" }}
141+
- "-oauth2-tokeninfo-url=http://127.0.0.1:9021/oauth2/tokeninfo"
142+
- "-status-checks=http://127.0.0.1:9021/health"
143+
{{ end }}
144+
- "-oauth2-tokeninfo-cache-size={{ .Cluster.ConfigItems.skipper_tokeninfo_cache_size }}"
145+
- "-oauth2-tokeninfo-cache-ttl={{ .Cluster.ConfigItems.skipper_tokeninfo_cache_ttl }}"
146+
{{ if eq .Cluster.ConfigItems.skipper_oauth2_ui_login "true" }}
147+
- "-enable-oauth2-grant-flow"
148+
- "-oauth2-auth-url={{ .Cluster.ConfigItems.skipper_oauth2_auth_url }}"
149+
- "-oauth2-token-url={{ .Cluster.ConfigItems.skipper_oauth2_token_url }}"
150+
- "-oauth2-secret-file=/etc/skipper/secret/encryption-key"
151+
- "-oauth2-client-id-file=/etc/skipper/hostname-credentials/{host}-grant-credentials-employee-client-id"
152+
- "-oauth2-client-secret-file=/etc/skipper/hostname-credentials/{host}-grant-credentials-employee-client-secret"
153+
- "-credentials-update-interval=1m"
154+
- "-oauth2-token-cookie-name={{ .Cluster.ConfigItems.skipper_oauth2_cookie_name }}"
155+
- "-oauth2-token-cookie-remove-subdomains=0"
156+
- "-oauth2-callback-path={{ .Cluster.ConfigItems.skipper_oauth2_redirect_uri_path }}"
157+
- "-oauth2-grant-tokeninfo-keys={{ .Cluster.ConfigItems.skipper_oauth2_ui_login_tokeninfo_keys }}"
158+
{{ end }}
159+
{{ if eq .Cluster.ConfigItems.skipper_open_policy_agent_enabled "true" }}
160+
- "-enable-open-policy-agent"
161+
- "-open-policy-agent-config-template=/etc/skipper/open-policy-agent/opaconfig.yaml"
162+
- "-open-policy-agent-envoy-metadata=/etc/skipper/open-policy-agent/envoymetadata.json"
163+
- "-enable-open-policy-agent-data-preprocessing-optimization={{ .Cluster.ConfigItems.skipper_open_policy_agent_data_preprocessing_optimization_enabled }}"
164+
- "-enable-open-policy-agent-preloading={{ .Cluster.ConfigItems.skipper_open_policy_agent_preloading_enabled }}"
165+
{{ end }}
84166
lifecycle:
85167
preStop:
86168
sleep:
@@ -110,6 +192,24 @@ spec:
110192
readOnly: true
111193
- name: filters
112194
mountPath: /etc/config/default-filters
195+
{{ if eq .Cluster.ConfigItems.skipper_lua_scripts_enabled "true" }}
196+
- name: lua
197+
mountPath: /etc/skipper/lua
198+
readOnly: true
199+
{{ end }}
200+
{{ if eq .Cluster.ConfigItems.skipper_oauth2_ui_login "true"}}
201+
- name: hostname-credentials
202+
mountPath: /etc/skipper/hostname-credentials
203+
readOnly: true
204+
- name: encryption-key
205+
mountPath: /etc/skipper/secret
206+
readOnly: true
207+
{{ end }}
208+
{{ if eq .Cluster.ConfigItems.skipper_open_policy_agent_enabled "true" }}
209+
- name: open-policy-agent-config
210+
mountPath: /etc/skipper/open-policy-agent
211+
readOnly: true
212+
{{ end }}
113213
volumes:
114214
- name: tls-certs
115215
secret:
@@ -118,3 +218,22 @@ spec:
118218
configMap:
119219
name: skipper-default-filters
120220
optional: true
221+
{{ if eq .Cluster.ConfigItems.skipper_lua_scripts_enabled "true" }}
222+
- name: lua
223+
configMap:
224+
name: skipper-ingress-lua
225+
optional: true
226+
{{ end }}
227+
{{ if eq .Cluster.ConfigItems.skipper_oauth2_ui_login "true"}}
228+
- name: hostname-credentials
229+
secret:
230+
secretName: hostname-credentials
231+
- name: encryption-key
232+
secret:
233+
secretName: skipper-ingress
234+
{{ end }}
235+
{{ if eq .Cluster.ConfigItems.skipper_open_policy_agent_enabled "true" }}
236+
- name: open-policy-agent-config
237+
configMap:
238+
name: open-policy-agent-config
239+
{{ end }}

0 commit comments

Comments
 (0)