Skip to content
This repository was archived by the owner on Feb 5, 2026. It is now read-only.

Commit e6840d1

Browse files
korenlevkorenlev
committed
[NE-27439] public facing api-service with nginx ingress protected by fastly
1 parent 3e14b1f commit e6840d1

10 files changed

Lines changed: 530 additions & 3 deletions

‎cloudify-manager-worker/sops.sh‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/usr/bin/env bash
2+
3+
set -eu -o pipefail
4+
5+
command=$1
6+
7+
aws_profile="cloudify-automation"
8+
aws_region="eu-west-1"
9+
key_alias="terraform"
10+
file_path="templates/k8s_secrets.yml"
11+
12+
if [[ $command = "encrypt" ]]; then
13+
key_info=$(aws --profile $aws_profile --region $aws_region kms list-aliases | jq -r ".Aliases[] | select(.AliasName | contains (\"$key_alias\"))")
14+
echo "Using key:" 1>&2
15+
echo "$key_info" | jq 1>&2
16+
key_id=$(echo "$key_info" | jq -r .TargetKeyId)
17+
arn_prefix=$(echo "$key_info" | jq -r .AliasArn | sed 's|:alias/.*$||')
18+
key_arn="$arn_prefix:key/$key_id"
19+
sops --aws-profile "$aws_profile" --kms "$key_arn" --in-place --encrypt "$file_path"
20+
exit 0
21+
elif [[ $command = "decrypt" ]]; then
22+
sops --decrypt --in-place "$file_path"
23+
exit 0
24+
else
25+
echo "Unknown command: $command"
26+
exit 1
27+
fi

‎cloudify-manager-worker/templates/_helpers.tpl‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,4 +118,34 @@ Return values or placeholders for replace in script
118118
{{- else -}}
119119
{{- .Values.config.security.adminPassword -}}
120120
{{- end -}}
121-
{{- end -}}
121+
{{- end -}}
122+
123+
{{/*
124+
Function to generate Fastly image name
125+
*/}}
126+
{{- define "helper.fastly.image" -}}
127+
{{- printf "%s/%s:%s" .fastly.repo .fastly.image_name .fastly.tag }}
128+
{{- end }}
129+
130+
{{/*
131+
{{ include "helper.fastly.revproxy.port" (dict "fastly" $.Values.nginx.fastly) }}
132+
*/}}
133+
134+
{{/*
135+
Determine Fastly Service Port
136+
*/}}
137+
{{- define "helper.fastly.revproxy.port" -}}
138+
{{- if .fastly.enabled }}
139+
{{- .fastly.nginx.proxy_port }}
140+
{{- else }}
141+
80
142+
{{- end }}
143+
{{- end }}
144+
145+
{{/*
146+
Generate String with Proxy Port
147+
*/}}
148+
{{- define "helper.fastly.revproxy.listener" -}}
149+
{{- $proxyPort := .fastly.nginx.proxy_port }}
150+
{{- print "http:{listener='http://0.0.0.0:" $proxyPort "',upstreams='http://0.0.0.0:80',access-log='/dev/stdout'}" }}
151+
{{- end }}

‎cloudify-manager-worker/templates/claim.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ apiVersion: v1
55
metadata:
66
name: cfy-worker-pvc
77
annotations:
8-
volume.beta.kubernetes.io/storage-class: {{ .Values.volume.storageClass }}
98
helm.sh/resource-policy: keep
109
spec:
10+
storageClassName: {{ .Values.volume.storageClass }}
1111
accessModes:
1212
- {{ .Values.volume.accessMode }}
1313
resources:

‎cloudify-manager-worker/templates/fastly-secret.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{{- if $.Values.nginx.fastly.enabled }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: sigsci.fusion
6+
stringData:
7+
accesskeyid: {{ $.Values.nginx.fastly.accesskeyid }}
8+
secretaccesskey: {{ $.Values.nginx.fastly.secretaccesskey }}
9+
{{- end }}

‎cloudify-manager-worker/templates/k8s_secrets.yml‎

Lines changed: 109 additions & 0 deletions
Large diffs are not rendered by default.

‎cloudify-manager-worker/templates/statefulset.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,40 @@ spec:
125125
'
126126
{{- end }}
127127
containers:
128+
{{- if .Values.nginx.fastly.enabled }}
129+
- name: sigsci-agent
130+
env:
131+
- name: SIGSCI_ACCESSKEYID
132+
valueFrom:
133+
secretKeyRef:
134+
key: accesskeyid
135+
name: sigsci.fusion
136+
- name: SIGSCI_SECRETACCESSKEY
137+
valueFrom:
138+
secretKeyRef:
139+
key: secretaccesskey
140+
name: sigsci.fusion
141+
# - name: SIGSCI_DEBUG_LOG_ALL_THE_THINGS
142+
# value: "true"
143+
- name: SIGSCI_LOG_OUT
144+
value: stdout
145+
image: {{ include "helper.fastly.image" (dict "fastly" .Values.nginx.fastly) }}
146+
imagePullPolicy: IfNotPresent
147+
ports:
148+
- containerPort: 9999
149+
protocol: TCP
150+
resources: {}
151+
securityContext:
152+
readOnlyRootFilesystem: true
153+
runAsGroup: 101
154+
runAsNonRoot: true
155+
runAsUser: 100
156+
terminationMessagePath: /dev/termination-log
157+
terminationMessagePolicy: File
158+
volumeMounts:
159+
- mountPath: /sigsci/tmp
160+
name: sigsci-tmp
161+
{{- end }}
128162
- name: {{ template "cloudify-manager-worker.name" . }}
129163
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
130164
imagePullPolicy: {{ .Values.image.pullPolicy }}
@@ -256,6 +290,12 @@ spec:
256290
{{- end }}
257291
{{- end }}
258292
volumes:
293+
{{- if .Values.nginx.fastly.enabled }}
294+
- name: sigsci-tmp
295+
emptyDir:
296+
medium: Memory
297+
sizeLimit: "2Gi"
298+
{{- end }}
259299
- name: run
260300
emptyDir:
261301
medium: Memory

‎cloudify-manager-worker/values.saas_manager.dev.yaml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
config:
2+
labels:
3+
compute-type: fargate
4+
public_ip: ${manager_host}
5+
replicas: 2
6+
security:
7+
existingAdminPassword:
8+
secret: cfy-admin-password
9+
containerSecurityContext:
10+
capabilities:
11+
add: null
12+
drop: null
13+
14+
image:
15+
tag: 7.0.2
16+
17+
license:
18+
secretName: cfy-license
19+
useSecret: true
20+
21+
resources:
22+
limits:
23+
cpu: 2
24+
memory: 6Gi
25+
requests:
26+
cpu: 2
27+
memory: 6Gi
28+
29+
rabbitmq:
30+
deploy: true
31+
podAnnotations:
32+
backup.velero.io/backup-volumes: cloudify-data
33+
extraVolumeMounts:
34+
- name: cloudify-data
35+
mountPath: /mnt/cloudify-data
36+
readOnly: true
37+
extraVolumes:
38+
- name: cloudify-data
39+
persistentVolumeClaim:
40+
claimName: cfy-worker-pvc
41+
42+
postgresql:
43+
deploy: true
44+
45+
tls:
46+
certManager:
47+
generate: true
48+
pgsqlSslCaName: global-bundle.pem
49+
pgsqlSslSecretName: postgres-external-cert
50+
51+
volume:
52+
accessMode: ReadWriteMany
53+
size: 30Gi
54+
storageClass: efs
55+
56+
nginx:
57+
# -- Fastly WAF option
58+
# --set nginx.fastly.enabled to true if used as "saas_manager" with public access
59+
# --set nginx.fastly.accesskeyid and --set nginx.fastly.secretaccesskey with values during deploy ..
60+
fastly:
61+
enabled: true
62+
repo: docker.io/signalsciences
63+
image_name: sigsci-agent
64+
tag: latest
65+
accesskeyid: override
66+
secretaccesskey: override
67+
nginx:
68+
proxy_port: 8002
69+
70+
ingress:
71+
enabled: true
72+
host: saas-manager.dev.nativeedge.dell.com
73+
ingressClassName: alb
74+
annotations:
75+
alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
76+
alb.ingress.kubernetes.io/healthcheck-interval-seconds: '60'
77+
alb.ingress.kubernetes.io/healthcheck-path: /
78+
alb.ingress.kubernetes.io/healthcheck-port: traffic-port
79+
alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
80+
alb.ingress.kubernetes.io/healthcheck-timeout-seconds: '20'
81+
alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
82+
alb.ingress.kubernetes.io/scheme: internal
83+
alb.ingress.kubernetes.io/success-codes: '200'
84+
alb.ingress.kubernetes.io/target-type: ip
85+
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:eu-west-1:702886132326:certificate/87a36f47-14d2-44b3-9551-665ef7a84688
86+
alb.ingress.kubernetes.io/group.name: eoaas-development
87+
tls:
88+
enabled: false

‎cloudify-manager-worker/values.saas_manager.prod.yaml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
config:
2+
labels:
3+
compute-type: fargate
4+
public_ip: ${manager_host}
5+
replicas: 2
6+
security:
7+
existingAdminPassword:
8+
secret: cfy-admin-password
9+
containerSecurityContext:
10+
capabilities:
11+
add: null
12+
drop: null
13+
14+
image:
15+
tag: 7.0.2
16+
17+
license:
18+
secretName: cfy-license
19+
useSecret: true
20+
21+
resources:
22+
limits:
23+
cpu: 2
24+
memory: 6Gi
25+
requests:
26+
cpu: 2
27+
memory: 6Gi
28+
29+
rabbitmq:
30+
deploy: true
31+
podAnnotations:
32+
backup.velero.io/backup-volumes: cloudify-data
33+
extraVolumeMounts:
34+
- name: cloudify-data
35+
mountPath: /mnt/cloudify-data
36+
readOnly: true
37+
extraVolumes:
38+
- name: cloudify-data
39+
persistentVolumeClaim:
40+
claimName: cfy-worker-pvc
41+
42+
postgresql:
43+
deploy: true
44+
45+
config:
46+
labels:
47+
compute-type: fargate
48+
public_ip: ${manager_host}
49+
replicas: 2
50+
security:
51+
existingAdminPassword:
52+
secret: cfy-admin-password
53+
containerSecurityContext:
54+
capabilities:
55+
add: null
56+
drop: null
57+
58+
image:
59+
tag: 7.0.2
60+
61+
license:
62+
secretName: cfy-license
63+
useSecret: true
64+
65+
resources:
66+
limits:
67+
cpu: 2
68+
memory: 6Gi
69+
requests:
70+
cpu: 2
71+
memory: 6Gi
72+
73+
rabbitmq:
74+
deploy: true
75+
76+
postgresql:
77+
deploy: true
78+
79+
tls:
80+
certManager:
81+
generate: true
82+
pgsqlSslCaName: global-bundle.pem
83+
pgsqlSslSecretName: postgres-external-cert
84+
85+
volume:
86+
accessMode: ReadWriteMany
87+
size: 30Gi
88+
storageClass: efs
89+
90+
nginx:
91+
# -- Fastly WAF option
92+
# --set nginx.fastly.enabled to true if used as "saas_manager" with public access
93+
# --set nginx.fastly.accesskeyid and --set nginx.fastly.secretaccesskey with values during deploy ..
94+
fastly:
95+
enabled: true
96+
repo: docker.io/signalsciences
97+
image_name: sigsci-agent
98+
tag: latest
99+
accesskeyid: override
100+
secretaccesskey: override
101+
nginx:
102+
proxy_port: 8002
103+
104+
ingress:
105+
enabled: true
106+
host: saas-manager.pub.nativeedge.dell.com
107+
ingressClassName: alb
108+
annotations:
109+
alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
110+
alb.ingress.kubernetes.io/healthcheck-interval-seconds: '60'
111+
alb.ingress.kubernetes.io/healthcheck-path: /
112+
alb.ingress.kubernetes.io/healthcheck-port: traffic-port
113+
alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
114+
alb.ingress.kubernetes.io/healthcheck-timeout-seconds: '20'
115+
alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
116+
alb.ingress.kubernetes.io/scheme: internet-facing
117+
alb.ingress.kubernetes.io/success-codes: '200'
118+
alb.ingress.kubernetes.io/target-type: ip
119+
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:eu-west-1:008791006138:certificate/92a2092c-bd84-48e3-bd32-b5c62136b723
120+
alb.ingress.kubernetes.io/group.name: eoaas-production-pub
121+
tls:
122+
enabled: false

0 commit comments

Comments
 (0)