Skip to content

Commit

Permalink
settings: add codec_type (#1085)
Browse files Browse the repository at this point in the history 
* settings: add codec_type

* use ports 443, 80
  • Loading branch information
@calebdoxsey
calebdoxsey authored Jan 8, 2025
1 parent 8c71989 commit fef68c1
Show file tree
Hide file tree
Showing 11 changed files with 217 additions and 144 deletions.
6 changes: 6 additions & 0 deletions apis/ingress/v1/pomerium_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -283,6 +283,12 @@ type PomeriumSpec struct {

// UseProxyProtocol enables <a href="https://www.pomerium.com/docs/reference/use-proxy-protocol">Proxy Protocol</a> support.
UseProxyProtocol *bool `json:"useProxyProtocol,omitempty"`

// CodecType sets the <a href="https://www.pomerium.com/docs/reference/codec-type">Codec Type</a>.
//
// +kubebuilder:validation:Optional
// +kubebuilder:validation:Enum=auto;http1;http2;http3
CodecType *string `json:"codec_type,omitempty"`
}

// Timeouts allows to configure global timeouts for all routes.
Expand Down
5 changes: 5 additions & 0 deletions apis/ingress/v1/zz_generated.deepcopy.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 4 additions & 3 deletions cmd/all_in_one.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,8 @@ func AllInOneCommand() (*cobra.Command, error) {
Command: cobra.Command{
Use: "all-in-one",
Short: "run ingress controller together with pomerium in all-in-one mode",
}}
},
}
cmd.RunE = cmd.exec
if err := cmd.setupFlags(); err != nil {
return nil, err
Expand Down Expand Up @@ -113,8 +114,8 @@ func (s *allCmd) setupFlags() error {
flags.BoolVar(&s.debugEnvoy, debugEnvoy, false, "enable debug logging for envoy")
flags.StringVar(&s.metricsBindAddress, metricsBindAddress, "", "host:port for aggregate metrics. host is mandatory")
flags.StringVar(&s.adminBindAddr, debugAdminBindAddr, "", "host:port for admin server")
flags.StringVar(&s.serverAddr, "server-addr", ":8443", "the address the HTTPS server would bind to")
flags.StringVar(&s.httpRedirectAddr, "http-redirect-addr", ":8080", "the address HTTP redirect would bind to")
flags.StringVar(&s.serverAddr, "server-addr", ":443", "the address the HTTPS server would bind to")
flags.StringVar(&s.httpRedirectAddr, "http-redirect-addr", ":80", "the address HTTP redirect would bind to")
flags.StringVar(&s.deriveTLS, "databroker-auto-tls", "", "enable auto TLS and generate server certificate for the domain")
flags.DurationVar(&s.configControllerShutdownTimeout, configControllerShutdown, time.Second*30, "timeout waiting for graceful config controller shutdown")

Expand Down
9 changes: 9 additions & 0 deletions config/crd/bases/ingress.pomerium.io_pomerium.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,15 @@ spec:
items:
type: string
type: array
codec_type:
description: CodecType sets the <a href="https://www.pomerium.com/docs/reference/codec-type">Codec
Type</a>.
enum:
- auto
- http1
- http2
- http3
type: string
cookie:
description: Cookie defines Pomerium session cookie options.
properties:
Expand Down
6 changes: 6 additions & 0 deletions config/pomerium/deployment/no-root.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,16 @@ spec:
spec:
securityContext:
runAsNonRoot: true
sysctls:
- name: net.ipv4.ip_unprivileged_port_start
value: "80"
containers:
- name: pomerium
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsGroup: 65532
runAsUser: 65532
7 changes: 5 additions & 2 deletions config/pomerium/deployment/ports.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,14 @@ spec:
containers:
- name: pomerium
ports:
- containerPort: 8443
- containerPort: 443
name: https
protocol: TCP
- containerPort: 443
name: quic
protocol: UDP
- name: http
containerPort: 8080
containerPort: 80
protocol: TCP
- name: metrics
containerPort: 9090
Expand Down
4 changes: 4 additions & 0 deletions config/pomerium/service/proxy.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,10 @@ spec:
targetPort: https
protocol: TCP
name: https
- port: 443
targetPort: quic
protocol: UDP
name: quic
- name: http
targetPort: http
protocol: TCP
Expand Down
26 changes: 24 additions & 2 deletions deployment.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -237,6 +237,15 @@ spec:
items:
type: string
type: array
codec_type:
description: CodecType sets the <a href="https://www.pomerium.com/docs/reference/codec-type">Codec
Type</a>.
enum:
- auto
- http1
- http2
- http3
type: string
cookie:
description: Cookie defines Pomerium session cookie options.
properties:
Expand Down Expand Up @@ -708,6 +717,10 @@ spec:
port: 443
protocol: TCP
targetPort: https
- name: quic
port: 443
protocol: UDP
targetPort: quic
- name: http
port: 80
protocol: TCP
Expand Down Expand Up @@ -757,10 +770,13 @@ spec:
imagePullPolicy: Always
name: pomerium
ports:
- containerPort: 8443
- containerPort: 443
name: https
protocol: TCP
- containerPort: 8080
- containerPort: 443
name: quic
protocol: UDP
- containerPort: 80
name: http
protocol: TCP
- containerPort: 9090
Expand All @@ -775,6 +791,9 @@ spec:
memory: 200Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 65532
runAsNonRoot: true
Expand All @@ -786,6 +805,9 @@ spec:
kubernetes.io/os: linux
securityContext:
runAsNonRoot: true
sysctls:
- name: net.ipv4.ip_unprivileged_port_start
value: "80"
serviceAccountName: pomerium-controller
terminationGracePeriodSeconds: 10
volumes:
Expand Down
86 changes: 43 additions & 43 deletions go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,9 @@ require (
github.com/hashicorp/go-set/v3 v3.0.0
github.com/iancoleman/strcase v0.3.0
github.com/martinlindhe/base36 v1.1.1
github.com/open-policy-agent/opa v0.70.0
github.com/pomerium/pomerium v0.28.1-0.20241219204256-7d15a5efe11b
github.com/open-policy-agent/opa v1.0.0
github.com/pomerium/csrf v1.7.0
github.com/pomerium/pomerium v0.28.1-0.20250106184142-95d4a24271fe
github.com/rs/zerolog v1.33.0
github.com/sergi/go-diff v1.3.1
github.com/spf13/cobra v1.8.1
Expand All @@ -27,7 +28,7 @@ require (
go.uber.org/mock v0.5.0
go.uber.org/zap v1.27.0
golang.org/x/sync v0.10.0
google.golang.org/grpc v1.68.0
google.golang.org/grpc v1.69.2
google.golang.org/protobuf v1.36.1
gopkg.in/yaml.v3 v3.0.1
k8s.io/api v0.32.0
Expand All @@ -44,42 +45,42 @@ require (
require (
cel.dev/expr v0.18.0 // indirect
cloud.google.com/go v0.116.0 // indirect
cloud.google.com/go/auth v0.10.2 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.5 // indirect
cloud.google.com/go/compute/metadata v0.5.2 // indirect
cloud.google.com/go/auth v0.13.0 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.6 // indirect
cloud.google.com/go/compute/metadata v0.6.0 // indirect
cloud.google.com/go/iam v1.2.2 // indirect
cloud.google.com/go/monitoring v1.21.2 // indirect
cloud.google.com/go/storage v1.47.0 // indirect
cloud.google.com/go/storage v1.49.0 // indirect
contrib.go.opencensus.io/exporter/jaeger v0.2.1 // indirect
contrib.go.opencensus.io/exporter/prometheus v0.4.2 // indirect
contrib.go.opencensus.io/exporter/zipkin v0.1.2 // indirect
github.com/CAFxX/httpcompression v0.0.9 // indirect
github.com/DataDog/datadog-go v3.5.0+incompatible // indirect
github.com/DataDog/opencensus-go-exporter-datadog v0.0.0-20200406135749-5c268882acf0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.24.1 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.25.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.48.1 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.48.1 // indirect
github.com/OneOfOne/xxhash v1.2.8 // indirect
github.com/VictoriaMetrics/fastcache v1.12.2 // indirect
github.com/agnivade/levenshtein v1.2.0 // indirect
github.com/andybalholm/brotli v1.0.5 // indirect
github.com/aws/aws-sdk-go-v2 v1.32.6 // indirect
github.com/aws/aws-sdk-go-v2 v1.32.7 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 // indirect
github.com/aws/aws-sdk-go-v2/config v1.28.6 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.17.47 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.21 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.25 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.25 // indirect
github.com/aws/aws-sdk-go-v2/config v1.28.7 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.17.48 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.22 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.26 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.26 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.25 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.26 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.6 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.6 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.6 // indirect
github.com/aws/aws-sdk-go-v2/service/s3 v1.70.0 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.24.7 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.6 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.33.2 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.7 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.7 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.7 // indirect
github.com/aws/aws-sdk-go-v2/service/s3 v1.71.1 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.24.8 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.7 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.33.3 // indirect
github.com/aws/smithy-go v1.22.1 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver/v4 v4.0.0 // indirect
Expand All @@ -91,15 +92,15 @@ require (
github.com/coreos/go-oidc/v3 v3.11.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/emicklei/go-restful/v3 v3.12.0 // indirect
github.com/envoyproxy/go-control-plane v0.13.2 // indirect
github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 // indirect
github.com/envoyproxy/protoc-gen-validate v1.1.0 // indirect
github.com/evanphx/json-patch/v5 v5.9.0 // indirect
github.com/fatih/color v1.18.0 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/fsnotify/fsnotify v1.8.0 // indirect
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
github.com/gabriel-vasile/mimetype v1.4.3 // indirect
github.com/go-chi/chi/v5 v5.1.0 // indirect
github.com/go-chi/chi/v5 v5.2.0 // indirect
github.com/go-ini/ini v1.67.0 // indirect
github.com/go-jose/go-jose/v3 v3.0.3 // indirect
github.com/go-jose/go-jose/v4 v4.0.2 // indirect
Expand All @@ -115,7 +116,7 @@ require (
github.com/gobuffalo/flect v1.0.3 // indirect
github.com/gobwas/glob v0.2.3 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/golang/snappy v0.0.4 // indirect
github.com/google/btree v1.1.3 // indirect
Expand All @@ -135,13 +136,13 @@ require (
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
github.com/jackc/pgx/v5 v5.7.1 // indirect
github.com/jackc/pgx/v5 v5.7.2 // indirect
github.com/jackc/puddle/v2 v2.2.2 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/jxskiss/base62 v1.1.0 // indirect
github.com/klauspost/compress v1.17.11 // indirect
github.com/klauspost/cpuid/v2 v2.2.8 // indirect
github.com/klauspost/cpuid/v2 v2.2.9 // indirect
github.com/leodido/go-urn v1.4.0 // indirect
github.com/libdns/libdns v0.2.2 // indirect
github.com/lufia/plan9stats v0.0.0-20240513124658-fba389f38bae // indirect
Expand All @@ -160,21 +161,20 @@ require (
github.com/openzipkin/zipkin-go v0.4.3 // indirect
github.com/pelletier/go-toml/v2 v2.2.2 // indirect
github.com/philhofer/fwd v1.1.2 // indirect
github.com/pires/go-proxyproto v0.8.0 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/pomerium/csrf v1.7.0 // indirect
github.com/pomerium/datasource v0.18.2-0.20221108160055-c6134b5ed524 // indirect
github.com/pomerium/protoutil v0.0.0-20240813175624-47b7ac43ff46 // indirect
github.com/pomerium/webauthn v0.0.0-20240603205124-0428df511172 // indirect
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
github.com/prometheus/client_golang v1.20.5 // indirect
github.com/prometheus/client_model v0.6.1 // indirect
github.com/prometheus/common v0.60.1 // indirect
github.com/prometheus/common v0.61.0 // indirect
github.com/prometheus/procfs v0.15.1 // indirect
github.com/prometheus/statsd_exporter v0.22.7 // indirect
github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
github.com/rogpeppe/go-internal v1.13.1 // indirect
github.com/rs/cors v1.11.1 // indirect
github.com/sagikazarmark/locafero v0.4.0 // indirect
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
Expand All @@ -199,14 +199,15 @@ require (
github.com/yusufpapurcu/wmi v1.2.4 // indirect
github.com/zeebo/blake3 v0.2.4 // indirect
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/contrib/detectors/gcp v1.29.0 // indirect
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
go.opentelemetry.io/contrib/detectors/gcp v1.31.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 // indirect
go.opentelemetry.io/otel v1.32.0 // indirect
go.opentelemetry.io/otel/metric v1.32.0 // indirect
go.opentelemetry.io/otel/sdk v1.32.0 // indirect
go.opentelemetry.io/otel/sdk/metric v1.32.0 // indirect
go.opentelemetry.io/otel/trace v1.32.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
go.opentelemetry.io/otel v1.33.0 // indirect
go.opentelemetry.io/otel/metric v1.33.0 // indirect
go.opentelemetry.io/otel/sdk v1.33.0 // indirect
go.opentelemetry.io/otel/sdk/metric v1.33.0 // indirect
go.opentelemetry.io/otel/trace v1.33.0 // indirect
go.uber.org/automaxprocs v1.6.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/crypto v0.31.0 // indirect
Expand All @@ -220,11 +221,10 @@ require (
golang.org/x/time v0.8.0 // indirect
golang.org/x/tools v0.28.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/api v0.209.0 // indirect
google.golang.org/genproto v0.0.0-20241113202542-65e8d215514f // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20241113202542-65e8d215514f // indirect
google.golang.org/grpc/stats/opentelemetry v0.0.0-20240907200651-3ffb98b2c93a // indirect
google.golang.org/api v0.214.0 // indirect
google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
gopkg.in/DataDog/dd-trace-go.v1 v1.22.0 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
Expand Down
Loading

0 comments on commit fef68c1

Please sign in to comment.