Skip to content
This repository was archived by the owner on Feb 5, 2026. It is now read-only.

Commit b0087f2

Browse files
korenlevkorenlev
committed
[NE-27439] public facing api-service with nginx ingress protected by fastly
1 parent 3e14b1f commit b0087f2

9 files changed

Lines changed: 349 additions & 1 deletion

File tree

‎cloudify-manager-worker/sops.sh‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/usr/bin/env bash
2+
3+
set -eu -o pipefail
4+
5+
command=$1
6+
7+
aws_profile="cloudify-automation"
8+
aws_region="eu-west-1"
9+
key_alias="terraform"
10+
file_path="templates/k8s_secrets.yml"
11+
12+
if [[ $command = "encrypt" ]]; then
13+
key_info=$(aws --profile $aws_profile --region $aws_region kms list-aliases | jq -r ".Aliases[] | select(.AliasName | contains (\"$key_alias\"))")
14+
echo "Using key:" 1>&2
15+
echo "$key_info" | jq 1>&2
16+
key_id=$(echo "$key_info" | jq -r .TargetKeyId)
17+
arn_prefix=$(echo "$key_info" | jq -r .AliasArn | sed 's|:alias/.*$||')
18+
key_arn="$arn_prefix:key/$key_id"
19+
sops --aws-profile "$aws_profile" --kms "$key_arn" --in-place --encrypt "$file_path"
20+
exit 0
21+
elif [[ $command = "decrypt" ]]; then
22+
sops --decrypt --in-place "$file_path"
23+
exit 0
24+
else
25+
echo "Unknown command: $command"
26+
exit 1
27+
fi

‎cloudify-manager-worker/templates/_helpers.tpl‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,4 +118,34 @@ Return values or placeholders for replace in script
118118
{{- else -}}
119119
{{- .Values.config.security.adminPassword -}}
120120
{{- end -}}
121-
{{- end -}}
121+
{{- end -}}
122+
123+
{{/*
124+
Function to generate Fastly image name
125+
*/}}
126+
{{- define "helper.fastly.image" -}}
127+
{{- printf "%s/%s:%s" .fastly.repo .fastly.image_name .fastly.tag }}
128+
{{- end }}
129+
130+
{{/*
131+
{{ include "helper.fastly.revproxy.port" (dict "fastly" $.Values.nginx.fastly) }}
132+
*/}}
133+
134+
{{/*
135+
Determine Fastly Service Port
136+
*/}}
137+
{{- define "helper.fastly.revproxy.port" -}}
138+
{{- if .fastly.enabled }}
139+
{{- .fastly.nginx.proxy_port }}
140+
{{- else }}
141+
80
142+
{{- end }}
143+
{{- end }}
144+
145+
{{/*
146+
Generate String with Proxy Port
147+
*/}}
148+
{{- define "helper.fastly.revproxy.listener" -}}
149+
{{- $proxyPort := .fastly.nginx.proxy_port }}
150+
{{- print "http:{listener='http://0.0.0.0:" $proxyPort "',upstreams='http://0.0.0.0:80',access-log='/dev/stdout'}" }}
151+
{{- end }}

‎cloudify-manager-worker/templates/fastly-secret.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{{- if $.Values.nginx.fastly.enabled }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: sigsci.fusion
6+
stringData:
7+
accesskeyid: {{ $.Values.nginx.fastly.accesskeyid }}
8+
secretaccesskey: {{ $.Values.nginx.fastly.secretaccesskey }}
9+
{{- end }}

‎cloudify-manager-worker/templates/k8s_secrets.yml‎

Lines changed: 25 additions & 0 deletions
Large diffs are not rendered by default.

‎cloudify-manager-worker/templates/statefulset.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,38 @@ spec:
125125
'
126126
{{- end }}
127127
containers:
128+
{{- if .Values.nginx.fastly.enabled }}
129+
- name: sigsci-agent
130+
image: {{ include "helper.fastly.image" (dict "fastly" .Values.nginx.fastly) }}
131+
imagePullPolicy: Always
132+
env:
133+
- name: SIGSCI_ACCESSKEYID
134+
valueFrom:
135+
secretKeyRef:
136+
name: sigsci.fusion
137+
key: accesskeyid
138+
- name: SIGSCI_SECRETACCESSKEY
139+
valueFrom:
140+
secretKeyRef:
141+
name: sigsci.fusion
142+
key: secretaccesskey
143+
# Configure the revproxy listener to listen on a new port 8001
144+
# forwarding to the app on the original port 8000 as the upstream
145+
- name: SIGSCI_REVPROXY_LISTENER
146+
value: {{ include "helper.fastly.revproxy.listener" (dict "fastly" .Values.nginx.fastly) }}
147+
ports:
148+
- containerPort: {{ include "helper.fastly.revproxy.port" (dict "fastly" .Values.nginx.fastly) | int }}
149+
protocol: TCP
150+
securityContext:
151+
# The sigsci-agent container should run with its root filesystem read only
152+
readOnlyRootFilesystem: true
153+
volumeMounts:
154+
# Default volume mount location for sigsci-agent writeable data
155+
# NOTE: Also change `SIGSCI_SHARED_CACHE_DIR` (default `/sigsci/tmp/cache`)
156+
# if mountPath is changed, but best not to change.
157+
- name: sigsci-tmp
158+
mountPath: /sigsci/tmp
159+
{{- end }}
128160
- name: {{ template "cloudify-manager-worker.name" . }}
129161
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
130162
imagePullPolicy: {{ .Values.image.pullPolicy }}

‎cloudify-manager-worker/values.saas_manager.dev.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
config:
2+
labels:
3+
compute-type: fargate
4+
public_ip: ${manager_host}
5+
replicas: 2
6+
security:
7+
existingAdminPassword:
8+
secret: cfy-admin-password
9+
containerSecurityContext:
10+
capabilities:
11+
add: null
12+
drop: null
13+
14+
image:
15+
tag: 7.0.2
16+
17+
license:
18+
secretName: cfy-license
19+
useSecret: true
20+
21+
resources:
22+
limits:
23+
cpu: 2
24+
memory: 6Gi
25+
requests:
26+
cpu: 2
27+
memory: 6Gi
28+
29+
nginx:
30+
# -- Fastly WAF option
31+
# --set nginx.fastly.enabled to true if used as "saas_manager" with public access
32+
# --set nginx.fastly.accesskeyid and --set nginx.fastly.secretaccesskey with values during deploy ..
33+
fastly:
34+
enabled: true
35+
repo: docker.io/signalsciences
36+
image_name: sigsci-agent
37+
tag: latest
38+
accesskeyid: override
39+
secretaccesskey: override
40+
nginx:
41+
proxy_port: 8002
42+
43+
ingress:
44+
enabled: true
45+
host: saas-manager.dev.nativeedge.dell.com
46+
ingressClassName: alb
47+
annotations:
48+
alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
49+
alb.ingress.kubernetes.io/healthcheck-interval-seconds: '60'
50+
alb.ingress.kubernetes.io/healthcheck-path: /
51+
alb.ingress.kubernetes.io/healthcheck-port: traffic-port
52+
alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
53+
alb.ingress.kubernetes.io/healthcheck-timeout-seconds: '20'
54+
alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
55+
alb.ingress.kubernetes.io/scheme: internal
56+
alb.ingress.kubernetes.io/success-codes: '200'
57+
alb.ingress.kubernetes.io/target-type: ip
58+
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:eu-west-1:702886132326:certificate/87a36f47-14d2-44b3-9551-665ef7a84688
59+
alb.ingress.kubernetes.io/group.name: eoaas-development
60+
tls:
61+
enabled: false

‎cloudify-manager-worker/values.saas_manager.prod.yaml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
config:
2+
labels:
3+
compute-type: fargate
4+
public_ip: ${manager_host}
5+
replicas: 2
6+
security:
7+
existingAdminPassword:
8+
secret: cfy-admin-password
9+
containerSecurityContext:
10+
capabilities:
11+
add: null
12+
drop: null
13+
14+
image:
15+
tag: 7.0.2
16+
17+
license:
18+
secretName: cfy-license
19+
useSecret: true
20+
21+
resources:
22+
limits:
23+
cpu: 2
24+
memory: 6Gi
25+
requests:
26+
cpu: 2
27+
memory: 6Gi
28+
29+
config:
30+
labels:
31+
compute-type: fargate
32+
public_ip: ${manager_host}
33+
replicas: 2
34+
security:
35+
existingAdminPassword:
36+
secret: cfy-admin-password
37+
containerSecurityContext:
38+
capabilities:
39+
add: null
40+
drop: null
41+
42+
image:
43+
tag: 7.0.2
44+
45+
license:
46+
secretName: cfy-license
47+
useSecret: true
48+
49+
resources:
50+
limits:
51+
cpu: 2
52+
memory: 6Gi
53+
requests:
54+
cpu: 2
55+
memory: 6Gi
56+
57+
nginx:
58+
# -- Fastly WAF option
59+
# --set nginx.fastly.enabled to true if used as "saas_manager" with public access
60+
# --set nginx.fastly.accesskeyid and --set nginx.fastly.secretaccesskey with values during deploy ..
61+
fastly:
62+
enabled: true
63+
repo: docker.io/signalsciences
64+
image_name: sigsci-agent
65+
tag: latest
66+
accesskeyid: override
67+
secretaccesskey: override
68+
nginx:
69+
proxy_port: 8002
70+
71+
ingress:
72+
enabled: true
73+
host: saas-manager.pub.nativeedge.dell.com
74+
ingressClassName: alb
75+
annotations:
76+
alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
77+
alb.ingress.kubernetes.io/healthcheck-interval-seconds: '60'
78+
alb.ingress.kubernetes.io/healthcheck-path: /
79+
alb.ingress.kubernetes.io/healthcheck-port: traffic-port
80+
alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
81+
alb.ingress.kubernetes.io/healthcheck-timeout-seconds: '20'
82+
alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
83+
alb.ingress.kubernetes.io/scheme: internet-facing
84+
alb.ingress.kubernetes.io/success-codes: '200'
85+
alb.ingress.kubernetes.io/target-type: ip
86+
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:eu-west-1:008791006138:certificate/92a2092c-bd84-48e3-bd32-b5c62136b723
87+
alb.ingress.kubernetes.io/group.name: eoaas-production-pub
88+
tls:
89+
enabled: false

‎cloudify-manager-worker/values.saas_manager.test.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
config:
2+
labels:
3+
compute-type: fargate
4+
public_ip: ${manager_host}
5+
replicas: 2
6+
security:
7+
existingAdminPassword:
8+
secret: cfy-admin-password
9+
containerSecurityContext:
10+
capabilities:
11+
add: null
12+
drop: null
13+
14+
image:
15+
tag: 7.0.2
16+
17+
license:
18+
secretName: cfy-license
19+
useSecret: true
20+
21+
resources:
22+
limits:
23+
cpu: 2
24+
memory: 6Gi
25+
requests:
26+
cpu: 2
27+
memory: 6Gi
28+
29+
nginx:
30+
# -- Fastly WAF option
31+
# --set nginx.fastly.enabled to true if used as "saas_manager" with public access
32+
# --set nginx.fastly.accesskeyid and --set nginx.fastly.secretaccesskey with values during deploy ..
33+
fastly:
34+
enabled: true
35+
repo: docker.io/signalsciences
36+
image_name: sigsci-agent
37+
tag: latest
38+
accesskeyid: override
39+
secretaccesskey: override
40+
nginx:
41+
proxy_port: 8002
42+
43+
ingress:
44+
enabled: true
45+
host: saas-manager.test.nativeedge.dell.com
46+
ingressClassName: alb
47+
annotations:
48+
alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
49+
alb.ingress.kubernetes.io/healthcheck-interval-seconds: '60'
50+
alb.ingress.kubernetes.io/healthcheck-path: /
51+
alb.ingress.kubernetes.io/healthcheck-port: traffic-port
52+
alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
53+
alb.ingress.kubernetes.io/healthcheck-timeout-seconds: '20'
54+
alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
55+
alb.ingress.kubernetes.io/scheme: internal
56+
alb.ingress.kubernetes.io/success-codes: '200'
57+
alb.ingress.kubernetes.io/target-type: ip
58+
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:eu-west-1:702886132326:certificate/99a36f47-14d2-44b3-9551-665ef7a84699
59+
alb.ingress.kubernetes.io/group.name: eoaas-testing
60+
tls:
61+
enabled: false

‎cloudify-manager-worker/values.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -338,6 +338,20 @@ startupProbe:
338338
# -- startup probe initial delay in seconds
339339
initialDelaySeconds: 30
340340

341+
nginx:
342+
# -- Fastly WAF option
343+
# --set nginx.fastly.enabled to true if used as "saas_manager" with public access
344+
# --set nginx.fastly.accesskeyid and --set nginx.fastly.secretaccesskey with values during deploy ..
345+
fastly:
346+
enabled: false
347+
repo: docker.io/signalsciences
348+
image_name: sigsci-agent
349+
tag: latest
350+
accesskeyid:
351+
secretaccesskey:
352+
nginx:
353+
proxy_port: 8002
354+
341355
# -- Parameters group for ingress (managed external access to service)
342356
# @default -- object
343357
ingress:

0 commit comments

Comments
 (0)