Read about our upcoming Code of Conduct on this issue

This instance will be upgraded to Heptapod 0.28.1 on 2022-01-26 at 16:00 UTC+1 (a few minutes of down time)

ingress.rb 4.66 KB
Newer Older
1
2
# frozen_string_literal: true

Kamil Trzcinski's avatar
Kamil Trzcinski committed
3
4
module Clusters
  module Applications
5
    class Ingress < ApplicationRecord
6
      VERSION = '1.22.1'
7

Kamil Trzcinski's avatar
Kamil Trzcinski committed
8
9
      self.table_name = 'clusters_applications_ingress'

10
      include ::Clusters::Concerns::ApplicationCore
Kamil Trzcinski's avatar
Kamil Trzcinski committed
11
      include ::Clusters::Concerns::ApplicationStatus
12
      include ::Clusters::Concerns::ApplicationVersion
13
      include ::Clusters::Concerns::ApplicationData
14
      include AfterCommitQueue
Kamil Trzcinski's avatar
Kamil Trzcinski committed
15
16

      default_value_for :ingress_type, :nginx
17
      default_value_for :version, VERSION
Kamil Trzcinski's avatar
Kamil Trzcinski committed
18
19
20
21
22

      enum ingress_type: {
        nginx: 1
      }

23
      FETCH_IP_ADDRESS_DELAY = 30.seconds
24
      MODSEC_SIDECAR_INITIAL_DELAY_SECONDS = 10
25

26
      state_machine :status do
27
        after_transition any => [:installed] do |application|
28
29
          application.run_after_commit do
            ClusterWaitForIngressIpAddressWorker.perform_in(
30
              FETCH_IP_ADDRESS_DELAY, application.name, application.id)
31
32
33
34
          end
        end
      end

Kamil Trzcinski's avatar
Kamil Trzcinski committed
35
36
37
      def chart
        'stable/nginx-ingress'
      end
38

39
40
41
42
      def values
        content_values.to_yaml
      end

43
      def allowed_to_uninstall?
44
        external_ip_or_hostname? && application_jupyter_nil_or_installable? && application_elastic_stack_nil_or_installable?
45
46
      end

47
      def install_command
48
        Gitlab::Kubernetes::Helm::InstallCommand.new(
49
          name: name,
50
          version: VERSION,
51
          rbac: cluster.platform_kubernetes_rbac?,
52
          chart: chart,
53
          files: files
54
        )
55
      end
56

57
58
59
60
      def external_ip_or_hostname?
        external_ip.present? || external_hostname.present?
      end

61
      def schedule_status_update
62
63
        return unless installed?
        return if external_ip
64
        return if external_hostname
65

66
        ClusterWaitForIngressIpAddressWorker.perform_async(name, id)
67
      end
68
69
70
71

      def ingress_service
        cluster.kubeclient.get_service('ingress-nginx-ingress-controller', Gitlab::Kubernetes::Helm::NAMESPACE)
      end
72
73
74

      private

75
76
77
78
79
80
81
      def specification
        return {} unless Feature.enabled?(:ingress_modsecurity)

        {
          "controller" => {
            "config" => {
              "enable-modsecurity" => "true",
82
83
84
              "enable-owasp-modsecurity-crs" => "true",
              "modsecurity.conf" => modsecurity_config_content
            },
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
            "extraContainers" => [
              {
                "name" => "modsecurity-log",
                "image" => "busybox",
                "args" => [
                  "/bin/sh",
                  "-c",
                  "tail -f /var/log/modsec/audit.log"
                ],
                "volumeMounts" => [
                  {
                    "name" => "modsecurity-log-volume",
                    "mountPath" => "/var/log/modsec",
                    "readOnly" => true
                  }
                ],
                "startupProbe" => {
                  "exec" => {
                    "command" => ["ls", "/var/log/modsec"]
                  },
                  "initialDelaySeconds" => MODSEC_SIDECAR_INITIAL_DELAY_SECONDS
                }
              }
            ],
109
110
111
112
113
            "extraVolumeMounts" => [
              {
                "name" => "modsecurity-template-volume",
                "mountPath" => "/etc/nginx/modsecurity/modsecurity.conf",
                "subPath" => "modsecurity.conf"
114
115
116
117
              },
              {
                "name" => "modsecurity-log-volume",
                "mountPath" => "/var/log/modsec"
118
119
120
121
122
123
124
125
126
127
128
129
130
131
              }
            ],
            "extraVolumes" => [
              {
                "name" => "modsecurity-template-volume",
                "configMap" => {
                  "name" => "ingress-nginx-ingress-controller",
                  "items" => [
                    {
                      "key" => "modsecurity.conf",
                      "path" => "modsecurity.conf"
                    }
                  ]
                }
132
133
134
135
              },
              {
                "name" => "modsecurity-log-volume",
                "emptyDir" => {}
136
137
              }
            ]
138
139
140
141
          }
        }
      end

142
143
144
145
146
147
148
149
      def modsecurity_config_content
        File.read(modsecurity_config_file_path)
      end

      def modsecurity_config_file_path
        Rails.root.join('vendor', 'ingress', 'modsecurity.conf')
      end

150
151
152
153
      def content_values
        YAML.load_file(chart_values_file).deep_merge!(specification)
      end

154
155
156
      def application_jupyter_nil_or_installable?
        cluster.application_jupyter.nil? || cluster.application_jupyter&.installable?
      end
157
158
159
160

      def application_elastic_stack_nil_or_installable?
        cluster.application_elastic_stack.nil? || cluster.application_elastic_stack&.installable?
      end
Kamil Trzcinski's avatar
Kamil Trzcinski committed
161
162
163
    end
  end
end