@ -735,109 +735,10 @@ type configSnapshotAPIGateway struct {
// Listeners is the original listener config from the api-gateway config
// Listeners is the original listener config from the api-gateway config
// entry to save us trying to pass fields through Upstreams
// entry to save us trying to pass fields through Upstreams
Listeners map [ string ] structs . APIGatewayListener Listeners map [ string ] structs . APIGatewayListener
// this acts as an intermediary for inlining certificates
// FUTURE(nathancoleman) Remove when ToIngress is removed
ListenerCertificates map [ IngressListenerKey ] [ ] structs . InlineCertificateConfigEntry
BoundListeners map [ string ] structs . BoundAPIGatewayListener BoundListeners map [ string ] structs . BoundAPIGatewayListener
} }
// ToIngress converts a configSnapshotAPIGateway to a configSnapshotIngressGateway.
// This is temporary, for the sake of re-using existing codepaths when integrating
// Consul API Gateway into Consul core.
//
// FUTURE(nathancoleman): Remove when API gateways have custom snapshot generation
func ( c * configSnapshotAPIGateway ) ToIngress ( datacenter string ) ( configSnapshotIngressGateway , error ) {
// Convert API Gateway Listeners to Ingress Listeners.
ingressListeners := make ( map [ IngressListenerKey ] structs . IngressListener , len ( c . Listeners ) )
ingressUpstreams := make ( map [ IngressListenerKey ] structs . Upstreams , len ( c . Listeners ) )
synthesizedChains := map [ UpstreamID ] * structs . CompiledDiscoveryChain { }
watchedUpstreamEndpoints := make ( map [ UpstreamID ] map [ string ] structs . CheckServiceNodes )
watchedGatewayEndpoints := make ( map [ UpstreamID ] map [ string ] structs . CheckServiceNodes )
// reset the cached certificates
c . ListenerCertificates = make ( map [ IngressListenerKey ] [ ] structs . InlineCertificateConfigEntry )
for name , listener := range c . Listeners {
boundListener , ok := c . BoundListeners [ name ]
if ! ok {
// Skip any listeners that don't have a bound listener. Once the bound listener is created, this will be run again.
continue
}
if ! c . GatewayConfig . ListenerIsReady ( name ) {
// skip any listeners that might be in an invalid state
continue
}
ingressListener := structs . IngressListener {
Port : listener . Port ,
Protocol : string ( listener . Protocol ) ,
}
// Create a synthesized discovery chain for each service.
services , upstreams , compiled , err := c . synthesizeChains ( datacenter , listener , boundListener )
if err != nil {
return configSnapshotIngressGateway { } , err
}
if len ( upstreams ) == 0 {
// skip if we can't construct any upstreams
continue
}
ingressListener . Services = services
for i , service := range services {
id := NewUpstreamIDFromServiceName ( structs . NewServiceName ( service . Name , & service . EnterpriseMeta ) )
upstreamEndpoints := make ( map [ string ] structs . CheckServiceNodes )
gatewayEndpoints := make ( map [ string ] structs . CheckServiceNodes )
// add the watched endpoints and gateway endpoints under the new upstream
for _ , endpoints := range c . WatchedUpstreamEndpoints {
for targetID , endpoint := range endpoints {
upstreamEndpoints [ targetID ] = endpoint
}
}
for _ , endpoints := range c . WatchedGatewayEndpoints {
for targetID , endpoint := range endpoints {
gatewayEndpoints [ targetID ] = endpoint
}
}
synthesizedChains [ id ] = compiled [ i ]
watchedUpstreamEndpoints [ id ] = upstreamEndpoints
watchedGatewayEndpoints [ id ] = gatewayEndpoints
}
key := IngressListenerKey {
Port : listener . Port ,
Protocol : string ( listener . Protocol ) ,
}
// Configure TLS for the ingress listener
tls , err := c . toIngressTLS ( key , listener , boundListener )
if err != nil {
return configSnapshotIngressGateway { } , err
}
ingressListener . TLS = tls
ingressListeners [ key ] = ingressListener
ingressUpstreams [ key ] = upstreams
}
snapshotUpstreams := c . DeepCopy ( ) . ConfigSnapshotUpstreams
snapshotUpstreams . DiscoveryChain = synthesizedChains
snapshotUpstreams . WatchedUpstreamEndpoints = watchedUpstreamEndpoints
snapshotUpstreams . WatchedGatewayEndpoints = watchedGatewayEndpoints
return configSnapshotIngressGateway {
Upstreams : ingressUpstreams ,
ConfigSnapshotUpstreams : snapshotUpstreams ,
GatewayConfigLoaded : true ,
Listeners : ingressListeners ,
} , nil
}
func ( c * configSnapshotAPIGateway ) synthesizeChains ( datacenter string , listener structs . APIGatewayListener , boundListener structs . BoundAPIGatewayListener ) ( [ ] structs . IngressService , structs . Upstreams , [ ] * structs . CompiledDiscoveryChain , error ) { func ( c * configSnapshotAPIGateway ) synthesizeChains ( datacenter string , listener structs . APIGatewayListener , boundListener structs . BoundAPIGatewayListener ) ( [ ] structs . IngressService , structs . Upstreams , [ ] * structs . CompiledDiscoveryChain , error ) {
chains := [ ] * structs . CompiledDiscoveryChain { } chains := [ ] * structs . CompiledDiscoveryChain { }
trustDomain := "" trustDomain := ""
@ -914,27 +815,6 @@ DOMAIN_LOOP:
return services , upstreams , compiled , err return services , upstreams , compiled , err
} }
func ( c * configSnapshotAPIGateway ) toIngressTLS ( key IngressListenerKey , listener structs . APIGatewayListener , bound structs . BoundAPIGatewayListener ) ( * structs . GatewayTLSConfig , error ) {
if len ( listener . TLS . Certificates ) == 0 {
return nil , nil
}
for _ , certRef := range bound . Certificates {
cert , ok := c . Certificates . Get ( certRef )
if ! ok {
continue
}
c . ListenerCertificates [ key ] = append ( c . ListenerCertificates [ key ] , * cert )
}
return & structs . GatewayTLSConfig {
Enabled : true ,
TLSMinVersion : listener . TLS . MinVersion ,
TLSMaxVersion : listener . TLS . MaxVersion ,
CipherSuites : listener . TLS . CipherSuites ,
} , nil
}
type configSnapshotIngressGateway struct { type configSnapshotIngressGateway struct {
ConfigSnapshotUpstreams ConfigSnapshotUpstreams
sarahalsmiller
2 years ago
committed by