Skip to content

Commit 57b52d1

Browse files
AnadrisAnadris
committed
add external API component
1 parent b99b31c commit 57b52d1

6 files changed

Lines changed: 424 additions & 4 deletions

File tree

‎charts/bunkerweb/templates/api-deployment.yaml‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
{{- if .Values.api.enabled -}}
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: api-{{ include "bunkerweb.fullname" . }}
6+
namespace: {{ include "bunkerweb.namespace" . }}
7+
labels:
8+
{{- include "bunkerweb.labels" . | nindent 4 }}
9+
spec:
10+
replicas: 1
11+
strategy:
12+
type: Recreate
13+
selector:
14+
matchLabels:
15+
{{- include "bunkerweb.selectorLabels" . | nindent 6 }}
16+
template:
17+
metadata:
18+
labels:
19+
{{- include "bunkerweb.labels" . | nindent 8 }}
20+
{{- with .Values.api.podLabels }}
21+
{{- toYaml . | nindent 8 }}
22+
{{- end }}
23+
bunkerweb.io/component: "api"
24+
spec:
25+
containers:
26+
- name: bunkerweb-api
27+
image: {{ .Values.api.repository }}:{{ .Values.api.tag }}
28+
imagePullPolicy: {{ .Values.api.pullPolicy }}
29+
{{- with .Values.api.resources }}
30+
resources:
31+
{{- toYaml . | nindent 12}}
32+
{{- end }}
33+
{{- with .Values.api.securityContext }}
34+
securityContext:
35+
{{- toYaml . | nindent 12}}
36+
{{- end }}
37+
{{- with .Values.api.livenessProbe }}
38+
livenessProbe:
39+
{{- toYaml . | nindent 12}}
40+
{{- end }}
41+
env:
42+
- name: DATABASE_URI
43+
{{- if not (empty .Values.settings.existingSecret) }}
44+
valueFrom:
45+
secretKeyRef:
46+
name: {{ .Values.settings.existingSecret }}
47+
key: database-uri
48+
{{- else }}
49+
value: "{{ include "bunkerweb.databaseUri" . }}"
50+
{{- end }}
51+
- name: API_TOKEN
52+
{{- if not (empty .Values.settings.existingSecret) }}
53+
valueFrom:
54+
secretKeyRef:
55+
name: "{{ .Values.settings.existingSecret }}"
56+
key: api-token
57+
{{- else }}
58+
value: "{{ .Values.settings.api.apiToken }}"
59+
{{- end }}
60+
- name: API_USERNAME
61+
{{- if not (empty .Values.settings.existingSecret) }}
62+
valueFrom:
63+
secretKeyRef:
64+
name: "{{ .Values.settings.existingSecret }}"
65+
key: api-username
66+
{{- else }}
67+
value: "{{ .Values.settings.api.apiUsername }}"
68+
{{- end }}
69+
- name: API_PASSWORD
70+
{{- if not (empty .Values.settings.existingSecret) }}
71+
valueFrom:
72+
secretKeyRef:
73+
name: "{{ .Values.settings.existingSecret }}"
74+
key: api-password
75+
{{- else }}
76+
value: "{{ .Values.settings.api.apiPassword }}"
77+
{{- end }}
78+
- name: API_ACL_BOOTSTRAP_FILE
79+
{{- if not (empty .Values.settings.existingSecret) }}
80+
valueFrom:
81+
secretKeyRef:
82+
name: "{{ .Values.settings.existingSecret }}"
83+
key: api-acl-json-file-path
84+
{{- else }}
85+
value: "{{ .Values.settings.api.apiAclBootstrapFile }}"
86+
{{- end }}
87+
- name: API_WHITELIST_ENABLED
88+
value: "{{ .Values.settings.api.whitelist.enabled }}"
89+
- name: API_WHITELIST_IPS
90+
value: "{{ .Values.settings.api.whitelist.whitelistIps }}"
91+
- name: FORWARDED_ALLOW_IPS
92+
value: "{{ .Values.settings.api.forwardedAllowIps }}"
93+
- name: API_ROOT_PATH
94+
value: "{{ .Values.settings.api.rootPath }}"
95+
- name: API_DOCS_URL
96+
value: "{{ .Values.settings.api.docsUrl }}"
97+
- name: API_REDOC_URL
98+
value: "{{ .Values.settings.api.redocUrl }}"
99+
- name: API_OPENAPI_URL
100+
value: "{{ .Values.settings.api.openApiUrl }}"
101+
- name: API_RATE_LIMIT_ENABLED
102+
value: "{{ .Values.settings.api.rateLimit.enabled }}"
103+
- name: API_RATE_LIMIT_STRATEGY
104+
value: "{{ .Values.settings.api.rateLimit.strategy }}"
105+
- name: API_RATE_LIMIT_DEFAULTS
106+
value: "{{ .Values.settings.api.rateLimit.defaults }}"
107+
{{- if .Values.ui.logs.enabled }}
108+
- name: LOG_TYPES
109+
value: "stderr syslog"
110+
- name: LOG_SYSLOG_ADDRESS
111+
value: "{{ include "bunkerweb.syslogAddress" . }}"
112+
{{- end }}
113+
{{- if .Values.api.extraEnvs }}
114+
{{- toYaml .Values.api.extraEnvs | nindent 12 }}
115+
{{- end }}
116+
{{- if .Values.settings.api.apiAclBootstrapFile }}
117+
volumeMounts:
118+
- name: api-acl-bootstrap
119+
mountPath: /var/lib/bunkerweb/api_acl_bootstrap.json
120+
{{- end }}
121+
{{- if .Values.settings.api.apiAclBootstrapFile }}
122+
volumes:
123+
- name: api-acl-bootstrap
124+
configMap:
125+
name: "{{ .Values.settings.api.apiAclBootstrapFile }}"
126+
{{- end }}
127+
{{- if .Values.api.nodeSelector }}
128+
{{- with .Values.api.nodeSelector }}
129+
nodeSelector:
130+
{{- toYaml . | nindent 8 }}
131+
{{- end }}
132+
{{- else if .Values.nodeSelector }}
133+
{{- with .Values.nodeSelector }}
134+
nodeSelector:
135+
{{- toYaml . | nindent 8 }}
136+
{{- end }}
137+
{{- end }}
138+
{{- if or (.Values.api.tolerations) (.Values.tolerations) }}
139+
tolerations:
140+
{{- if .Values.api.tolerations }}
141+
{{- toYaml .Values.api.tolerations | nindent 6 }}
142+
{{- else }}
143+
{{- toYaml .Values.tolerations | nindent 6 }}
144+
{{- end }}
145+
{{- end }}
146+
{{- if or (.Values.api.imagePullSecrets) (.Values.imagePullSecrets) }}
147+
imagePullSecrets:
148+
{{- if .Values.api.imagePullSecrets }}
149+
{{- toYaml .Values.api.imagePullSecrets | nindent 6 }}
150+
{{- else }}
151+
{{- toYaml .Values.imagePullSecrets | nindent 6 }}
152+
{{- end }}
153+
{{- end }}
154+
{{- with .Values.topologySpreadConstraints }}
155+
topologySpreadConstraints:
156+
{{- toYaml . | nindent 8 }}
157+
{{- end }}
158+
{{- end }}

‎charts/bunkerweb/templates/api-ingress.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{{- if .Values.settings.api.ingress.enabled -}}
2+
apiVersion: networking.k8s.io/v1
3+
kind: Ingress
4+
metadata:
5+
name: api-{{ include "bunkerweb.fullname" . }}
6+
namespace: {{ include "bunkerweb.namespace" . }}
7+
labels:
8+
{{- include "bunkerweb.labels" . | nindent 4 }}
9+
annotations:
10+
bunkerweb.io/USE_TEMPLATE: "api"
11+
{{- with .Values.settings.api.ingress.extraAnnotations }}
12+
{{- toYaml . | nindent 4 }}
13+
{{- end }}
14+
spec:
15+
{{- if .Values.settings.api.ingress.ingressClassName }}
16+
ingressClassName: {{ .Values.settings.api.ingress.ingressClassName }}
17+
{{- end}}
18+
{{- if .Values.settings.api.ingress.tlsSecretName }}
19+
tls:
20+
- hosts:
21+
- {{ .Values.settings.api.ingress.serverName }}
22+
secretName: {{ .Values.settings.api.ingress.tlsSecretName }}
23+
{{- end }}
24+
rules:
25+
- host: {{ .Values.settings.api.ingress.serverName }}
26+
http:
27+
paths:
28+
- path: {{ .Values.settings.api.ingress.serverPath }}
29+
pathType: Prefix
30+
backend:
31+
service:
32+
name: api-{{ include "bunkerweb.fullname" . }}
33+
port:
34+
number: 8888
35+
{{- end }}

‎charts/bunkerweb/templates/api-service.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{{- if .Values.api.enabled -}}
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: api-{{ include "bunkerweb.fullname" . }}
6+
namespace: {{ include "bunkerweb.namespace" . }}
7+
labels:
8+
{{- include "bunkerweb.labels" . | nindent 4 }}
9+
spec:
10+
type: ClusterIP
11+
selector:
12+
bunkerweb.io/component: "api"
13+
ports:
14+
- name: api-external
15+
protocol: TCP
16+
port: 8888
17+
targetPort: 8888
18+
{{- end }}

‎charts/bunkerweb/templates/ui-ingress.yaml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,7 @@ metadata:
77
labels:
88
{{- include "bunkerweb.labels" . | nindent 4 }}
99
annotations:
10-
bunkerweb.io/SERVE_FILES: "no"
11-
bunkerweb.io/USE_UI: "yes"
12-
bunkerweb.io/INTERCEPTED_ERROR_CODES: '400 404 405 413 429 500 501 502 503 504'
13-
bunkerweb.io/MAX_CLIENT_SIZE: '50m'
10+
bunkerweb.io/USE_TEMPLATE: "ui"
1411
{{- with .Values.settings.ui.ingress.extraAnnotations }}
1512
{{- toYaml . | nindent 4 }}
1613
{{- end }}

‎charts/bunkerweb/values.yaml‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,9 @@ settings:
5353
# - totp-secrets : TOTP secrets for 2FA
5454
# - mariadb-user : MariaDB username
5555
# - mariadb-password : MariaDB password
56+
# - api-token : API Bearer token
57+
# - api-username : API username, also require api-password
58+
# - api-password : API password, also require api-username
5659
existingSecret: ""
5760

5861
# ----- KUBERNETES INTEGRATION -----
@@ -141,6 +144,75 @@ settings:
141144
# TOTP secrets for two-factor authentication
142145
totpSecrets: ""
143146

147+
api:
148+
# Authentication settings
149+
# https://docs.bunkerweb.io/latest/api/#authentication
150+
# API Bearer Token
151+
# Leave Empty if using settings.existingSecret
152+
apiToken: ""
153+
# OR/AND API Username and Password
154+
# Leave Empty if using settings.existingSecret
155+
apiUsername: ""
156+
apiPassword: ""
157+
# OR/AND ConfigMap name that includes ACL based JSON File
158+
# https://docs.bunkerweb.io/latest/api/#permissions-acl
159+
apiAclBootstrapFile: ""
160+
161+
# API Configuration
162+
# https://docs.bunkerweb.io/latest/api/#configuration
163+
# Root path for the API
164+
rootPath: ""
165+
# URL for API documentation, set to an empty value to disable
166+
docsUrl: "/docs"
167+
# URL for ReDoc API documentation, set to an empty value to disable
168+
redocUrl: "/redoc"
169+
# URL for OpenAPI specification, set to an empty value to disable
170+
openApiUrl: "/openapi.json"
171+
# Forwarded allow IPs for correct client IP detection
172+
forwardedAllowIps: "*"
173+
# Whitelist configuration for API access
174+
whitelist:
175+
# Enable API whitelist functionality
176+
enabled: true
177+
# space-separated list of IPs/CIDR allowed to access the API
178+
whitelistIps: "10.0.0.0/8"
179+
180+
# Rate limiting configuration for API access
181+
# https://docs.bunkerweb.io/latest/api/#rate-limiting
182+
rateLimit:
183+
# Enable request rate limiting
184+
enabled: true
185+
# Strategy: "fixed-window" or "moving-window" or "sliding-window"
186+
# https://limits.readthedocs.io/en/stable/strategies.html
187+
strategy: "fixed-window"
188+
# Rate limit per period,
189+
# Supported formats: "[10/seconde]", "[100/minute]", "[1000/day]"
190+
# https://limits.readthedocs.io/en/stable/quickstart.html#rate-limit-string-notation
191+
defaults: ["100/minute"]
192+
193+
# Ingress configuration for API access
194+
ingress:
195+
# Set to true to create an Ingress resource for the API
196+
enabled: false
197+
198+
# IngressClass name to use
199+
ingressClassName: ""
200+
201+
# Domain name for API access
202+
# Example: "bunkerweb-api.example.com"
203+
serverName: ""
204+
205+
# Path for API access (usually "/")
206+
serverPath: "/"
207+
208+
# Additional annotations for the Ingress resource
209+
# Example: {"cert-manager.io/cluster-issuer": "letsencrypt-prod"}
210+
extraAnnotations: {}
211+
212+
# Secret name containing TLS certificate
213+
# Leave empty to disable HTTPS
214+
tlsSecretName: ""
215+
144216
# =============================================================================
145217
# SERVICE CONFIGURATION
146218
# =============================================================================
@@ -1023,6 +1095,67 @@ ui:
10231095
timeoutSeconds: 1
10241096
failureThreshold: 3
10251097

1098+
# =============================================================================
1099+
# EXTERNAL API COMPONENT
1100+
# =============================================================================
1101+
# External API for BunkerWeb that exposes REST interface for automation tools
1102+
1103+
api:
1104+
# Enable the external API
1105+
enabled: true
1106+
1107+
# Container image configuration
1108+
repository: bunkerity/bunkerweb-api
1109+
tag: 1.6.6
1110+
pullPolicy: Always
1111+
1112+
# Image pull secrets (overrides global setting)
1113+
imagePullSecrets: []
1114+
1115+
# Node selector (overrides global setting)
1116+
nodeSelector: {}
1117+
1118+
# Tolerations (overrides global setting)
1119+
tolerations: []
1120+
1121+
# Resource requests and limits
1122+
# RECOMMENDED: Uncomment and adjust for production
1123+
# resources:
1124+
# requests:
1125+
# cpu: "100m"
1126+
# memory: "256Mi"
1127+
# limits:
1128+
# cpu: "250m"
1129+
# memory: "512Mi"
1130+
1131+
# Additional pod annotations
1132+
podAnnotations: {}
1133+
1134+
# Additional pod labels
1135+
podLabels: {}
1136+
1137+
# Security context for API container
1138+
securityContext:
1139+
runAsUser: 101
1140+
runAsGroup: 101
1141+
allowPrivilegeEscalation: false
1142+
capabilities:
1143+
drop:
1144+
- ALL
1145+
1146+
# Additional environment variables
1147+
extraEnvs: []
1148+
1149+
# Liveness probe configuration
1150+
livenessProbe:
1151+
exec:
1152+
command:
1153+
- /usr/share/bunkerweb/helpers/healthcheck-api.sh
1154+
initialDelaySeconds: 30
1155+
periodSeconds: 5
1156+
timeoutSeconds: 1
1157+
failureThreshold: 3
1158+
10261159
# =============================================================================
10271160
# DATABASE (MARIADB) COMPONENT
10281161
# =============================================================================

0 commit comments

Comments
 (0)