mirror of https://github.com/status-im/consul.git
345 lines
14 KiB
Go
345 lines
14 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
||
// SPDX-License-Identifier: MPL-2.0
|
||
|
||
package api
|
||
|
||
// IngressGatewayConfigEntry manages the configuration for an ingress service
|
||
// with the given name.
|
||
type IngressGatewayConfigEntry struct {
|
||
// Kind of the config entry. This should be set to api.IngressGateway.
|
||
Kind string
|
||
|
||
// Name is used to match the config entry with its associated ingress gateway
|
||
// service. This should match the name provided in the service definition.
|
||
Name string
|
||
|
||
// Partition is the partition the IngressGateway is associated with.
|
||
// Partitioning is a Consul Enterprise feature.
|
||
Partition string `json:",omitempty"`
|
||
|
||
// Namespace is the namespace the IngressGateway is associated with.
|
||
// Namespacing is a Consul Enterprise feature.
|
||
Namespace string `json:",omitempty"`
|
||
|
||
// TLS holds the TLS configuration for this gateway.
|
||
TLS GatewayTLSConfig
|
||
|
||
// Listeners declares what ports the ingress gateway should listen on, and
|
||
// what services to associated to those ports.
|
||
Listeners []IngressListener
|
||
|
||
Meta map[string]string `json:",omitempty"`
|
||
|
||
// Defaults is default configuration for all upstream services
|
||
Defaults *IngressServiceConfig `json:",omitempty"`
|
||
|
||
// CreateIndex is the Raft index this entry was created at. This is a
|
||
// read-only field.
|
||
CreateIndex uint64
|
||
|
||
// ModifyIndex is used for the Check-And-Set operations and can also be fed
|
||
// back into the WaitIndex of the QueryOptions in order to perform blocking
|
||
// queries.
|
||
ModifyIndex uint64
|
||
}
|
||
|
||
type IngressServiceConfig struct {
|
||
MaxConnections *uint32
|
||
MaxPendingRequests *uint32
|
||
MaxConcurrentRequests *uint32
|
||
|
||
// PassiveHealthCheck configuration determines how upstream proxy instances will
|
||
// be monitored for removal from the load balancing pool.
|
||
PassiveHealthCheck *PassiveHealthCheck `json:",omitempty" alias:"passive_health_check"`
|
||
}
|
||
|
||
type GatewayTLSConfig struct {
|
||
// Indicates that TLS should be enabled for this gateway service.
|
||
Enabled bool
|
||
|
||
// SDS allows configuring TLS certificate from an SDS service.
|
||
SDS *GatewayTLSSDSConfig `json:",omitempty"`
|
||
|
||
TLSMinVersion string `json:",omitempty" alias:"tls_min_version"`
|
||
TLSMaxVersion string `json:",omitempty" alias:"tls_max_version"`
|
||
|
||
// Define a subset of cipher suites to restrict
|
||
// Only applicable to connections negotiated via TLS 1.2 or earlier
|
||
CipherSuites []string `json:",omitempty" alias:"cipher_suites"`
|
||
}
|
||
|
||
type GatewayServiceTLSConfig struct {
|
||
// SDS allows configuring TLS certificate from an SDS service.
|
||
SDS *GatewayTLSSDSConfig `json:",omitempty"`
|
||
}
|
||
|
||
type GatewayTLSSDSConfig struct {
|
||
ClusterName string `json:",omitempty" alias:"cluster_name"`
|
||
CertResource string `json:",omitempty" alias:"cert_resource"`
|
||
}
|
||
|
||
// IngressListener manages the configuration for a listener on a specific port.
|
||
type IngressListener struct {
|
||
// Port declares the port on which the ingress gateway should listen for traffic.
|
||
Port int
|
||
|
||
// Protocol declares what type of traffic this listener is expected to
|
||
// receive. Depending on the protocol, a listener might support multiplexing
|
||
// services over a single port, or additional discovery chain features. The
|
||
// current supported values are: (tcp | http | http2 | grpc).
|
||
Protocol string
|
||
|
||
// Services declares the set of services to which the listener forwards
|
||
// traffic.
|
||
//
|
||
// For "tcp" protocol listeners, only a single service is allowed.
|
||
// For "http" listeners, multiple services can be declared.
|
||
Services []IngressService
|
||
|
||
// TLS allows specifying some TLS configuration per listener.
|
||
TLS *GatewayTLSConfig `json:",omitempty"`
|
||
}
|
||
|
||
// IngressService manages configuration for services that are exposed to
|
||
// ingress traffic.
|
||
type IngressService struct {
|
||
// Name declares the service to which traffic should be forwarded.
|
||
//
|
||
// This can either be a specific service, or the wildcard specifier,
|
||
// "*". If the wildcard specifier is provided, the listener must be of "http"
|
||
// protocol and means that the listener will forward traffic to all services.
|
||
//
|
||
// A name can be specified on multiple listeners, and will be exposed on both
|
||
// of the listeners.
|
||
Name string
|
||
|
||
// Hosts is a list of hostnames which should be associated to this service on
|
||
// the defined listener. Only allowed on layer 7 protocols, this will be used
|
||
// to route traffic to the service by matching the Host header of the HTTP
|
||
// request.
|
||
//
|
||
// If a host is provided for a service that also has a wildcard specifier
|
||
// defined, the host will override the wildcard-specifier-provided
|
||
// "<service-name>.*" domain for that listener.
|
||
//
|
||
// This cannot be specified when using the wildcard specifier, "*", or when
|
||
// using a "tcp" listener.
|
||
Hosts []string
|
||
|
||
// Namespace is the namespace where the service is located.
|
||
// Namespacing is a Consul Enterprise feature.
|
||
Namespace string `json:",omitempty"`
|
||
|
||
// Partition is the partition where the service is located.
|
||
// Partitioning is a Consul Enterprise feature.
|
||
Partition string `json:",omitempty"`
|
||
|
||
// TLS allows specifying some TLS configuration per listener.
|
||
TLS *GatewayServiceTLSConfig `json:",omitempty"`
|
||
|
||
// Allow HTTP header manipulation to be configured.
|
||
RequestHeaders *HTTPHeaderModifiers `json:",omitempty" alias:"request_headers"`
|
||
ResponseHeaders *HTTPHeaderModifiers `json:",omitempty" alias:"response_headers"`
|
||
|
||
MaxConnections *uint32 `json:",omitempty" alias:"max_connections"`
|
||
MaxPendingRequests *uint32 `json:",omitempty" alias:"max_pending_requests"`
|
||
MaxConcurrentRequests *uint32 `json:",omitempty" alias:"max_concurrent_requests"`
|
||
|
||
// PassiveHealthCheck configuration determines how upstream proxy instances will
|
||
// be monitored for removal from the load balancing pool.
|
||
PassiveHealthCheck *PassiveHealthCheck `json:",omitempty" alias:"passive_health_check"`
|
||
}
|
||
|
||
func (i *IngressGatewayConfigEntry) GetKind() string { return i.Kind }
|
||
func (i *IngressGatewayConfigEntry) GetName() string { return i.Name }
|
||
func (i *IngressGatewayConfigEntry) GetPartition() string { return i.Partition }
|
||
func (i *IngressGatewayConfigEntry) GetNamespace() string { return i.Namespace }
|
||
func (i *IngressGatewayConfigEntry) GetMeta() map[string]string { return i.Meta }
|
||
func (i *IngressGatewayConfigEntry) GetCreateIndex() uint64 { return i.CreateIndex }
|
||
func (i *IngressGatewayConfigEntry) GetModifyIndex() uint64 { return i.ModifyIndex }
|
||
|
||
// TerminatingGatewayConfigEntry manages the configuration for a terminating gateway
|
||
// with the given name.
|
||
type TerminatingGatewayConfigEntry struct {
|
||
// Kind of the config entry. This should be set to api.TerminatingGateway.
|
||
Kind string
|
||
|
||
// Name is used to match the config entry with its associated terminating gateway
|
||
// service. This should match the name provided in the service definition.
|
||
Name string
|
||
|
||
// Services is a list of service names represented by the terminating gateway.
|
||
Services []LinkedService `json:",omitempty"`
|
||
|
||
Meta map[string]string `json:",omitempty"`
|
||
|
||
// CreateIndex is the Raft index this entry was created at. This is a
|
||
// read-only field.
|
||
CreateIndex uint64
|
||
|
||
// ModifyIndex is used for the Check-And-Set operations and can also be fed
|
||
// back into the WaitIndex of the QueryOptions in order to perform blocking
|
||
// queries.
|
||
ModifyIndex uint64
|
||
|
||
// Partition is the partition the config entry is associated with.
|
||
// Partitioning is a Consul Enterprise feature.
|
||
Partition string `json:",omitempty"`
|
||
|
||
// Namespace is the namespace the config entry is associated with.
|
||
// Namespacing is a Consul Enterprise feature.
|
||
Namespace string `json:",omitempty"`
|
||
}
|
||
|
||
// A LinkedService is a service represented by a terminating gateway
|
||
type LinkedService struct {
|
||
// Referencing other partitions is not supported.
|
||
|
||
// Namespace is where the service is registered.
|
||
Namespace string `json:",omitempty"`
|
||
|
||
// Name is the name of the service, as defined in Consul's catalog.
|
||
Name string `json:",omitempty"`
|
||
|
||
// CAFile is the optional path to a CA certificate to use for TLS connections
|
||
// from the gateway to the linked service.
|
||
CAFile string `json:",omitempty" alias:"ca_file"`
|
||
|
||
// CertFile is the optional path to a client certificate to use for TLS connections
|
||
// from the gateway to the linked service.
|
||
CertFile string `json:",omitempty" alias:"cert_file"`
|
||
|
||
// KeyFile is the optional path to a private key to use for TLS connections
|
||
// from the gateway to the linked service.
|
||
KeyFile string `json:",omitempty" alias:"key_file"`
|
||
|
||
// SNI is the optional name to specify during the TLS handshake with a linked service.
|
||
SNI string `json:",omitempty"`
|
||
}
|
||
|
||
func (g *TerminatingGatewayConfigEntry) GetKind() string { return g.Kind }
|
||
func (g *TerminatingGatewayConfigEntry) GetName() string { return g.Name }
|
||
func (g *TerminatingGatewayConfigEntry) GetPartition() string { return g.Partition }
|
||
func (g *TerminatingGatewayConfigEntry) GetNamespace() string { return g.Namespace }
|
||
func (g *TerminatingGatewayConfigEntry) GetMeta() map[string]string { return g.Meta }
|
||
func (g *TerminatingGatewayConfigEntry) GetCreateIndex() uint64 { return g.CreateIndex }
|
||
func (g *TerminatingGatewayConfigEntry) GetModifyIndex() uint64 { return g.ModifyIndex }
|
||
|
||
// APIGatewayConfigEntry manages the configuration for an API gateway
|
||
// with the given name.
|
||
type APIGatewayConfigEntry struct {
|
||
// Kind of the config entry. This should be set to api.APIGateway.
|
||
Kind string
|
||
|
||
// Name is used to match the config entry with its associated api gateway
|
||
// service. This should match the name provided in the service definition.
|
||
Name string
|
||
|
||
Meta map[string]string `json:",omitempty"`
|
||
|
||
// Listeners is the set of listener configuration to which an API Gateway
|
||
// might bind.
|
||
Listeners []APIGatewayListener
|
||
// Status is the asynchronous status which an APIGateway propagates to the user.
|
||
Status ConfigEntryStatus
|
||
|
||
// CreateIndex is the Raft index this entry was created at. This is a
|
||
// read-only field.
|
||
CreateIndex uint64
|
||
|
||
// ModifyIndex is used for the Check-And-Set operations and can also be fed
|
||
// back into the WaitIndex of the QueryOptions in order to perform blocking
|
||
// queries.
|
||
ModifyIndex uint64
|
||
|
||
// Partition is the partition the config entry is associated with.
|
||
// Partitioning is a Consul Enterprise feature.
|
||
Partition string `json:",omitempty"`
|
||
|
||
// Namespace is the namespace the config entry is associated with.
|
||
// Namespacing is a Consul Enterprise feature.
|
||
Namespace string `json:",omitempty"`
|
||
}
|
||
|
||
func (g *APIGatewayConfigEntry) GetKind() string { return g.Kind }
|
||
func (g *APIGatewayConfigEntry) GetName() string { return g.Name }
|
||
func (g *APIGatewayConfigEntry) GetPartition() string { return g.Partition }
|
||
func (g *APIGatewayConfigEntry) GetNamespace() string { return g.Namespace }
|
||
func (g *APIGatewayConfigEntry) GetMeta() map[string]string { return g.Meta }
|
||
func (g *APIGatewayConfigEntry) GetCreateIndex() uint64 { return g.CreateIndex }
|
||
func (g *APIGatewayConfigEntry) GetModifyIndex() uint64 { return g.ModifyIndex }
|
||
|
||
// APIGatewayListener represents an individual listener for an APIGateway
|
||
type APIGatewayListener struct {
|
||
// Name is the name of the listener in a given gateway. This must be
|
||
// unique within a gateway.
|
||
Name string
|
||
// Hostname is the host name that a listener should be bound to, if
|
||
// unspecified, the listener accepts requests for all hostnames.
|
||
Hostname string
|
||
// Port is the port at which this listener should bind.
|
||
Port int
|
||
// Protocol is the protocol that a listener should use, it must
|
||
// either be "http" or "tcp"
|
||
Protocol string
|
||
// TLS is the TLS settings for the listener.
|
||
TLS APIGatewayTLSConfiguration
|
||
// Override is the policy that overrides all other policy and route specific configuration
|
||
Override *APIGatewayPolicy `json:",omitempty"`
|
||
// Default is the policy that is the default for the listener and route, routes can override this behavior
|
||
Default *APIGatewayPolicy `json:",omitempty"`
|
||
}
|
||
|
||
// APIGatewayTLSConfiguration specifies the configuration of a listener’s
|
||
// TLS settings.
|
||
type APIGatewayTLSConfiguration struct {
|
||
// Certificates is a set of references to certificates
|
||
// that a gateway listener uses for TLS termination.
|
||
Certificates []ResourceReference
|
||
// MaxVersion is the maximum TLS version that the listener
|
||
// should support.
|
||
MaxVersion string `json:",omitempty" alias:"tls_max_version"`
|
||
// MinVersion is the minimum TLS version that the listener
|
||
// should support.
|
||
MinVersion string `json:",omitempty" alias:"tls_min_version"`
|
||
// Define a subset of cipher suites to restrict
|
||
// Only applicable to connections negotiated via TLS 1.2 or earlier
|
||
CipherSuites []string `json:",omitempty" alias:"cipher_suites"`
|
||
}
|
||
|
||
// APIGatewayPolicy holds the policy that configures the gateway listener, this is used in the `Override` and `Default` fields of a listener
|
||
type APIGatewayPolicy struct {
|
||
// JWT holds the JWT configuration for the Listener
|
||
JWT *APIGatewayJWTRequirement `json:",omitempty"`
|
||
}
|
||
|
||
// APIGatewayJWTRequirement holds the list of JWT providers to be verified against
|
||
type APIGatewayJWTRequirement struct {
|
||
// Providers is a list of providers to consider when verifying a JWT.
|
||
Providers []*APIGatewayJWTProvider `json:",omitempty"`
|
||
}
|
||
|
||
// APIGatewayJWTProvider holds the provider and claim verification information
|
||
type APIGatewayJWTProvider struct {
|
||
// Name is the name of the JWT provider. There MUST be a corresponding
|
||
// "jwt-provider" config entry with this name.
|
||
Name string `json:",omitempty"`
|
||
|
||
// VerifyClaims is a list of additional claims to verify in a JWT's payload.
|
||
VerifyClaims []*APIGatewayJWTClaimVerification `json:",omitempty" alias:"verify_claims"`
|
||
}
|
||
|
||
// APIGatewayJWTClaimVerification holds the actual claim information to be verified
|
||
type APIGatewayJWTClaimVerification struct {
|
||
// Path is the path to the claim in the token JSON.
|
||
Path []string `json:",omitempty"`
|
||
|
||
// Value is the expected value at the given path:
|
||
// - If the type at the path is a list then we verify
|
||
// that this value is contained in the list.
|
||
//
|
||
// - If the type at the path is a string then we verify
|
||
// that this value matches.
|
||
Value string `json:",omitempty"`
|
||
}
|