[Feature] [Gateway] SNI and Authz support

CHANGELOG.md

@@ -21,6 +21,7 @@
 - (Bugfix) Fix race condition in ArangoBackup
 - (Feature) Improve Gateway Config gen
 - (Feature) Integration Service TLS
+- (Feature) (Gateway) SNI and Authz support
 
 ## [1.2.42](https://github.com/arangodb/kube-arangodb/tree/1.2.42) (2024-07-23)
 - (Maintenance) Go 1.22.4 & Kubernetes 1.29.6 libraries

Dockerfile

@@ -7,7 +7,9 @@ FROM ${ENVOY_IMAGE} AS envoy
 
 FROM ${IMAGE} AS base
 
-RUN apt-get update && apt-get upgrade -y && apt-get clean
+ARG BUILD_SKIP_UPDATE=false
+ENV BUILD_SKIP_UPDATE=${BUILD_SKIP_UPDATE}
+RUN if [ X"${BUILD_SKIP_UPDATE}" = X"true" ]; then echo "Update skipped!"; else apt-get update && apt-get upgrade -y && apt-get clean; fi
 
 FROM base
 

Makefile

@@ -121,6 +121,8 @@ ifndef LOCALONLY
 	PUSHIMAGES := 1
 endif
 
+BUILD_SKIP_UPDATE ?= false
+
 ifdef IMAGETAG
 	IMAGESUFFIX := :$(IMAGETAG)
 else
@@ -272,7 +274,7 @@ NON_EE_SOURCES := $(shell $(NON_EE_SOURCES_QUERY))
 
 YAML_EXCLUDE_DIRS := vendor .gobuild deps tools pkg/generated/clientset pkg/generated/informers pkg/generated/listers \
                      chart/kube-arangodb/templates chart/kube-arangodb-arm64/templates chart/kube-arangodb-enterprise/templates chart/kube-arangodb-enterprise-arm64/templates  \
-                     chart/kube-arangodb-crd/templates chart/arangodb-ingress-proxy/templates
+                     chart/kube-arangodb-crd/templates
 YAML_EXCLUDE_FILES :=
 YAML_QUERY := find ./ -type f -name '*.yaml' $(foreach EXCLUDE_DIR,$(YAML_EXCLUDE_DIRS), ! -path "*/$(EXCLUDE_DIR)/*") $(foreach EXCLUDE_FILE,$(YAML_EXCLUDE_FILES), ! -path "*/$(EXCLUDE_FILE)")
 YAMLS := $(shell $(YAML_QUERY))
@@ -478,11 +480,11 @@ $(BIN): $(VBIN_LINUX_AMD64) $(VBIN_OPS_LINUX_AMD64) $(VBIN_INT_LINUX_AMD64)
 docker: clean check-vars $(VBIN_LINUX_AMD64) $(VBIN_LINUX_ARM64)
 ifdef PUSHIMAGES
 	docker buildx build --no-cache -f $(DOCKERFILE) --build-arg GOVERSION=$(GOVERSION) --build-arg DISTRIBUTION=$(DISTRIBUTION) \
-		--build-arg "VERSION=${VERSION_MAJOR_MINOR_PATCH}" --build-arg "RELEASE_MODE=$(RELEASE_MODE)" \
+		--build-arg "VERSION=${VERSION_MAJOR_MINOR_PATCH}" --build-arg "RELEASE_MODE=$(RELEASE_MODE)" --build-arg "BUILD_SKIP_UPDATE=${BUILD_SKIP_UPDATE}" \
 		--platform linux/amd64,linux/arm64 --push -t $(OPERATORIMAGE) .
 else
 	docker buildx build --no-cache -f $(DOCKERFILE) --build-arg GOVERSION=$(GOVERSION) --build-arg DISTRIBUTION=$(DISTRIBUTION) \
-		--build-arg "VERSION=${VERSION_MAJOR_MINOR_PATCH}" --build-arg "RELEASE_MODE=$(RELEASE_MODE)" \
+		--build-arg "VERSION=${VERSION_MAJOR_MINOR_PATCH}" --build-arg "RELEASE_MODE=$(RELEASE_MODE)" --build-arg "BUILD_SKIP_UPDATE=${BUILD_SKIP_UPDATE}" \
 		--platform linux/amd64,linux/arm64 -t $(OPERATORIMAGE) .
 endif
 
@@ -802,6 +804,7 @@ set-typed-api-version/%:
 	@grep -rHn "github.com/arangodb/kube-arangodb/pkg/generated/clientset/versioned/typed/$*/v[A-Za-z0-9]\+" \
 	      "$(ROOT)/pkg/deployment/" \
 	      "$(ROOT)/pkg/replication/" \
+	      "$(ROOT)/pkg/integrations/" \
 	      "$(ROOT)/pkg/operator/" \
 	      "$(ROOT)/pkg/operatorV2/" \
 	      "$(ROOT)/pkg/server/" \
@@ -818,6 +821,7 @@ set-api-version/%:
 	@grep -rHn "github.com/arangodb/kube-arangodb/pkg/apis/$*/v[A-Za-z0-9]\+" \
 	      "$(ROOT)/pkg/deployment/" \
 	      "$(ROOT)/pkg/replication/" \
+	      "$(ROOT)/pkg/integrations/" \
 	      "$(ROOT)/pkg/operator/" \
 	      "$(ROOT)/pkg/operatorV2/" \
 	      "$(ROOT)/pkg/server/" \
@@ -831,6 +835,7 @@ set-api-version/%:
 	@grep -rHn "DatabaseV[A-Za-z0-9]\+()" \
 		  "$(ROOT)/pkg/deployment/" \
 	      "$(ROOT)/pkg/replication/" \
+	      "$(ROOT)/pkg/integrations/" \
 	      "$(ROOT)/pkg/operator/" \
 	      "$(ROOT)/pkg/operatorV2/" \
 	      "$(ROOT)/pkg/server/" \
@@ -844,6 +849,7 @@ set-api-version/%:
 	@grep -rHn "ReplicationV[A-Za-z0-9]\+()" \
 		  "$(ROOT)/pkg/deployment/" \
 		  "$(ROOT)/pkg/replication/" \
+	      "$(ROOT)/pkg/integrations/" \
 		  "$(ROOT)/pkg/operator/" \
 	      "$(ROOT)/pkg/operatorV2/" \
 		  "$(ROOT)/pkg/server/" \

README.md

@@ -182,7 +182,7 @@ Flags:
       --kubernetes.max-batch-size int                          Size of batch during objects read (default 256)
       --kubernetes.qps float32                                 Number of queries per second for k8s API (default 15)
       --log.format string                                      Set log format. Allowed values: 'pretty', 'JSON'. If empty, default format is used (default "pretty")
-      --log.level stringArray                                  Set log levels in format <level> or <logger>=<level>. Possible loggers: action, agency, api-server, assertion, backup-operator, chaos-monkey, crd, deployment, deployment-ci, deployment-reconcile, deployment-replication, deployment-resilience, deployment-resources, deployment-storage, deployment-storage-pc, deployment-storage-service, http, inspector, integration-config-v1, integrations, k8s-client, kubernetes-informer, monitor, networking-route-operator, operator, operator-arangojob-handler, operator-v2, operator-v2-event, operator-v2-worker, panics, pod_compare, root, root-event-recorder, server, server-authentication (default [info])
+      --log.level stringArray                                  Set log levels in format <level> or <logger>=<level>. Possible loggers: action, agency, api-server, assertion, backup-operator, chaos-monkey, crd, deployment, deployment-ci, deployment-reconcile, deployment-replication, deployment-resilience, deployment-resources, deployment-storage, deployment-storage-pc, deployment-storage-service, http, inspector, integration-config-v1, integration-envoy-auth-v3, integrations, k8s-client, kubernetes-informer, monitor, networking-route-operator, operator, operator-arangojob-handler, operator-v2, operator-v2-event, operator-v2-worker, panics, pod_compare, root, root-event-recorder, server, server-authentication (default [info])
       --log.sampling                                           If true, operator will try to minimize duplication of logging events (default true)
       --memory-limit uint                                      Define memory limit for hard shutdown and the dump of goroutines. Used for testing
       --metrics.excluded-prefixes stringArray                  List of the excluded metrics prefixes

docs/cli/arangodb_operator.md

@@ -80,7 +80,7 @@ Flags:
       --kubernetes.max-batch-size int                          Size of batch during objects read (default 256)
       --kubernetes.qps float32                                 Number of queries per second for k8s API (default 15)
       --log.format string                                      Set log format. Allowed values: 'pretty', 'JSON'. If empty, default format is used (default "pretty")
-      --log.level stringArray                                  Set log levels in format <level> or <logger>=<level>. Possible loggers: action, agency, api-server, assertion, backup-operator, chaos-monkey, crd, deployment, deployment-ci, deployment-reconcile, deployment-replication, deployment-resilience, deployment-resources, deployment-storage, deployment-storage-pc, deployment-storage-service, http, inspector, integration-config-v1, integrations, k8s-client, kubernetes-informer, monitor, networking-route-operator, operator, operator-arangojob-handler, operator-v2, operator-v2-event, operator-v2-worker, panics, pod_compare, root, root-event-recorder, server, server-authentication (default [info])
+      --log.level stringArray                                  Set log levels in format <level> or <logger>=<level>. Possible loggers: action, agency, api-server, assertion, backup-operator, chaos-monkey, crd, deployment, deployment-ci, deployment-reconcile, deployment-replication, deployment-resilience, deployment-resources, deployment-storage, deployment-storage-pc, deployment-storage-service, http, inspector, integration-config-v1, integration-envoy-auth-v3, integrations, k8s-client, kubernetes-informer, monitor, networking-route-operator, operator, operator-arangojob-handler, operator-v2, operator-v2-event, operator-v2-worker, panics, pod_compare, root, root-event-recorder, server, server-authentication (default [info])
       --log.sampling                                           If true, operator will try to minimize duplication of logging events (default true)
       --memory-limit uint                                      Define memory limit for hard shutdown and the dump of goroutines. Used for testing
       --metrics.excluded-prefixes stringArray                  List of the excluded metrics prefixes

integrations/envoy/auth/v3/impl.go

@@ -53,5 +53,10 @@ func (i *impl) Register(registrar *grpc.Server) {
 }
 
 func (i *impl) Check(ctx context.Context, request *pbEnvoyAuthV3.CheckRequest) (*pbEnvoyAuthV3.CheckResponse, error) {
-	return &pbEnvoyAuthV3.CheckResponse{}, nil
+	logger.Info("Request Received")
+	return &pbEnvoyAuthV3.CheckResponse{
+		HttpResponse: &pbEnvoyAuthV3.CheckResponse_OkResponse{
+			OkResponse: &pbEnvoyAuthV3.OkHttpResponse{},
+		},
+	}, nil
 }

integrations/envoy/auth/v3/logger.go

@@ -0,0 +1,25 @@
+//
+// DISCLAIMER
+//
+// Copyright 2024 ArangoDB GmbH, Cologne, Germany
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Copyright holder is ArangoDB GmbH, Cologne, Germany
+//
+
+package v3
+
+import "github.com/arangodb/kube-arangodb/pkg/logging"
+
+var logger = logging.Global().RegisterAndGetLogger("integration-envoy-auth-v3", logging.Info)

integrations/envoy/auth/v3/service_test.go

@@ -28,6 +28,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/arangodb/kube-arangodb/pkg/util/svc"
+	"github.com/arangodb/kube-arangodb/pkg/util/tests"
 	"github.com/arangodb/kube-arangodb/pkg/util/tests/tgrpc"
 )
 
@@ -53,6 +54,7 @@ func Test_AllowAll(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, resp.Validate())
 	require.Nil(t, resp.Status)
-	require.Nil(t, resp.HttpResponse)
+	require.NotNil(t, resp.HttpResponse)
+	require.NotNil(t, tests.CastAs[*pbEnvoyAuthV3.CheckResponse_OkResponse](t, resp.GetHttpResponse()).OkResponse)
 	require.Nil(t, resp.DynamicMetadata)
 }