-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
* implement local nginx cache strategy in docker compose with system roles purge example * EASI-4129: dockerfile improvements * nil deref and merge main * EASI-4129: init cedarproxy k8s manifests * EASI-4129: lint oops * clean up caching helpers, remove old cache code, purge my systems cache * add config var to allow using okta API locally * add build action for cedarproxy * fix build image workflow filter * fix build image workflow context * increase cache valid time to 24h * add deploy pipeline for cedarproxy dev * update step name * EASI-4129: call correct script * cache size is not cache time * mention proxy within CEDAR docs * remove memcache code, add proxy URL env var * go.mod change for go-cache * add once protection for client * add comments --------- Co-authored-by: Justin Woodson <jdwoodson@gmail.com>
- Loading branch information
Showing
23 changed files
with
409 additions
and
178 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| FROM nginx:mainline as builder | ||
|
|
||
| ARG ENABLED_MODULES=cachepurge | ||
|
|
||
| SHELL ["/bin/bash", "-exo", "pipefail", "-c"] | ||
|
|
||
| RUN if [ "$ENABLED_MODULES" = "" ]; then \ | ||
| echo "No additional modules enabled, exiting"; \ | ||
| exit 1; \ | ||
| fi | ||
|
|
||
| COPY ./modules/ /modules/ | ||
|
|
||
| RUN apt-get update \ | ||
| && apt-get install -y --no-install-suggests --no-install-recommends \ | ||
| patch make wget mercurial devscripts debhelper dpkg-dev \ | ||
| quilt lsb-release build-essential \ | ||
| && hg clone -r ${NGINX_VERSION}-${PKG_RELEASE%%~*} https://hg.nginx.org/pkg-oss/ \ | ||
| && cd pkg-oss \ | ||
| && mkdir /tmp/packages \ | ||
| && for module in $ENABLED_MODULES; do \ | ||
| echo "Building $module for nginx-$NGINX_VERSION"; \ | ||
| if [ -d /modules/$module ]; then \ | ||
| echo "Building $module from user-supplied sources"; \ | ||
| # check if module sources file is there and not empty | ||
| if [ ! -s /modules/$module/source ]; then \ | ||
| echo "No source file for $module in modules/$module/source, exiting"; \ | ||
| exit 1; \ | ||
| fi; \ | ||
| # some modules require build dependencies | ||
| if [ -f /modules/$module/build-deps ]; then \ | ||
| echo "Installing $module build dependencies"; \ | ||
| apt-get update && apt-get install -y --no-install-suggests --no-install-recommends $(cat /modules/$module/build-deps | xargs); \ | ||
| fi; \ | ||
| # if a module has a build dependency that is not in a distro, provide a | ||
| # shell script to fetch/build/install those | ||
| # note that shared libraries produced as a result of this script will | ||
| # not be copied from the builder image to the main one so build static | ||
| if [ -x /modules/$module/prebuild ]; then \ | ||
| echo "Running prebuild script for $module"; \ | ||
| /modules/$module/prebuild; \ | ||
| fi; \ | ||
| /pkg-oss/build_module.sh -v $NGINX_VERSION -f -y -o /tmp/packages -n $module $(cat /modules/$module/source); \ | ||
| BUILT_MODULES="$BUILT_MODULES $(echo $module | tr '[A-Z]' '[a-z]' | tr -d '[/_\-\.\t ]')"; \ | ||
| elif make -C /pkg-oss/debian list | grep -P "^$module\s+\d" > /dev/null; then \ | ||
| echo "Building $module from pkg-oss sources"; \ | ||
| cd /pkg-oss/debian; \ | ||
| make rules-module-$module BASE_VERSION=$NGINX_VERSION NGINX_VERSION=$NGINX_VERSION; \ | ||
| mk-build-deps --install --tool="apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends --yes" debuild-module-$module/nginx-$NGINX_VERSION/debian/control; \ | ||
| make module-$module BASE_VERSION=$NGINX_VERSION NGINX_VERSION=$NGINX_VERSION; \ | ||
| find ../../ -maxdepth 1 -mindepth 1 -type f -name "*.deb" -exec mv -v {} /tmp/packages/ \;; \ | ||
| BUILT_MODULES="$BUILT_MODULES $module"; \ | ||
| else \ | ||
| echo "Don't know how to build $module module, exiting"; \ | ||
| exit 1; \ | ||
| fi; \ | ||
| done \ | ||
| && echo "BUILT_MODULES=\"$BUILT_MODULES\"" > /tmp/packages/modules.env \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| FROM nginx:mainline | ||
| ENV NGINX_ENVSUBST_OUTPUT_DIR=/etc/nginx | ||
| COPY ./nginx.conf /etc/nginx/templates/nginx.conf.template | ||
| RUN --mount=type=bind,target=/tmp/packages/,source=/tmp/packages/,from=builder \ | ||
| apt-get update \ | ||
| && . /tmp/packages/modules.env \ | ||
| && for module in $BUILT_MODULES; do \ | ||
| apt-get install --no-install-suggests --no-install-recommends -y /tmp/packages/nginx-module-${module}_${NGINX_VERSION}*.deb; \ | ||
| done \ | ||
| && rm -rf /var/lib/apt/lists/* |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| https://github.com/FRiCKLE/ngx_cache_purge/archive/2.3.tar.gz |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| # load_module modules/ngx_cache_purge_module.so; | ||
| load_module modules/ngx_http_cache_purge_module.so; | ||
|
|
||
| user nginx; | ||
| worker_processes auto; | ||
|
|
||
| error_log /var/log/nginx/error.log notice; | ||
| pid /var/run/nginx.pid; | ||
|
|
||
|
|
||
| events { | ||
| worker_connections 1024; | ||
| } | ||
|
|
||
|
|
||
| http { | ||
| include /etc/nginx/mime.types; | ||
| default_type application/octet-stream; | ||
|
|
||
| log_format main '$remote_addr - $remote_user [$time_local] "$request" ' | ||
| '$status $body_bytes_sent "$http_referer" ' | ||
| '"$http_user_agent" "$http_x_forwarded_for"'; | ||
|
|
||
| access_log /var/log/nginx/access.log main; | ||
|
|
||
| sendfile on; | ||
| #tcp_nopush on; | ||
|
|
||
| keepalive_timeout 65; | ||
|
|
||
| #gzip on; | ||
|
|
||
| # include /etc/nginx/conf.d/*.conf; | ||
|
|
||
| proxy_cache_path /nginxcache keys_zone=cedarcorecache:10m; | ||
| proxy_cache_valid 200 302 24h; | ||
|
|
||
| server { | ||
| listen 8001; | ||
|
|
||
| server_name cedarproxy; | ||
|
|
||
| location / { | ||
| proxy_pass https://${CEDAR_API_URL}/; | ||
| proxy_pass_request_headers on; | ||
| proxy_set_header Host $proxy_host; | ||
| proxy_set_header X-Real-IP $remote_addr; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_set_header X-Forwarded-Proto $scheme; | ||
|
|
||
| proxy_cache cedarcorecache; | ||
| proxy_cache_key $uri$is_args$args; | ||
| proxy_cache_purge PURGE from all; | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: cedarproxy-configmap | ||
| namespace: easi | ||
| data: | ||
| CEDAR_API_URL: webmethods-apigw.cedarimpl.cms.gov | ||
|
|
||
| --- | ||
|
|
||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: cedarproxy | ||
| namespace: easi | ||
| spec: | ||
| selector: | ||
| matchLabels: | ||
| app: cedarproxy | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app: cedarproxy | ||
| spec: | ||
| containers: | ||
| - name: cedarproxy | ||
| image: cedarproxy:latest | ||
| imagePullPolicy: Never | ||
| envFrom: | ||
| - configMapRef: | ||
| name: cedarproxy-configmap | ||
| resources: {} | ||
| ports: | ||
| - containerPort: 8001 | ||
|
|
||
| --- | ||
|
|
||
| apiVersion: v1 | ||
| kind: Service | ||
| metadata: | ||
| name: cedarproxy | ||
| namespace: easi | ||
| spec: | ||
| selector: | ||
| app: cedarproxy | ||
| ports: | ||
| - port: 8001 | ||
| targetPort: 8001 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -7,3 +7,4 @@ resources: | |
| - minio.yaml | ||
| - easi-client.yaml | ||
| - easi.yaml | ||
| - cedarproxy.yaml | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.