Skip to content

Commit 4dbfc2e

Browse files
pdabelf5pdabelf5
authored
refactor policy config structs (#7232)
1 parent bce0a1c commit 4dbfc2e

File tree

2 files changed

+236
-200
lines changed

2 files changed

+236
-200
lines changed

‎internal/configs/virtualserver.go‎

Lines changed: 94 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -423,16 +423,16 @@ func (vsc *virtualServerConfigurator) GenerateVirtualServerConfig(
423423
}
424424
policiesCfg := vsc.generatePolicies(ownerDetails, vsEx.VirtualServer.Spec.Policies, vsEx.Policies, specContext, policyOpts)
425425

426-
if policiesCfg.JWKSAuthEnabled {
427-
jwtAuthKey := policiesCfg.JWTAuth.Key
428-
policiesCfg.JWTAuthList = make(map[string]*version2.JWTAuth)
429-
policiesCfg.JWTAuthList[jwtAuthKey] = policiesCfg.JWTAuth
426+
if policiesCfg.JWTAuth.JWKSEnabled {
427+
jwtAuthKey := policiesCfg.JWTAuth.Auth.Key
428+
policiesCfg.JWTAuth.List = make(map[string]*version2.JWTAuth)
429+
policiesCfg.JWTAuth.List[jwtAuthKey] = policiesCfg.JWTAuth.Auth
430430
}
431431

432-
if policiesCfg.APIKeyEnabled {
433-
apiMapName := policiesCfg.APIKey.MapName
434-
policiesCfg.APIKeyClientMap = make(map[string][]apiKeyClient)
435-
policiesCfg.APIKeyClientMap[apiMapName] = policiesCfg.APIKeyClients
432+
if policiesCfg.APIKey.Enabled {
433+
apiMapName := policiesCfg.APIKey.Key.MapName
434+
policiesCfg.APIKey.ClientMap = make(map[string][]apiKeyClient)
435+
policiesCfg.APIKey.ClientMap[apiMapName] = policiesCfg.APIKey.Clients
436436
}
437437

438438
dosCfg := generateDosCfg(dosResources[""])
@@ -454,7 +454,7 @@ func (vsc *virtualServerConfigurator) GenerateVirtualServerConfig(
454454
var healthChecks []version2.HealthCheck
455455
var limitReqZones []version2.LimitReqZone
456456

457-
limitReqZones = append(limitReqZones, policiesCfg.LimitReqZones...)
457+
limitReqZones = append(limitReqZones, policiesCfg.RateLimit.Zones...)
458458

459459
// generate upstreams for VirtualServer
460460
for _, u := range vsEx.VirtualServer.Spec.Upstreams {
@@ -582,29 +582,29 @@ func (vsc *virtualServerConfigurator) GenerateVirtualServerConfig(
582582
if policiesCfg.OIDC {
583583
routePoliciesCfg.OIDC = policiesCfg.OIDC
584584
}
585-
if routePoliciesCfg.JWKSAuthEnabled {
586-
policiesCfg.JWKSAuthEnabled = routePoliciesCfg.JWKSAuthEnabled
585+
if routePoliciesCfg.JWTAuth.JWKSEnabled {
586+
policiesCfg.JWTAuth.JWKSEnabled = routePoliciesCfg.JWTAuth.JWKSEnabled
587587

588-
if policiesCfg.JWTAuthList == nil {
589-
policiesCfg.JWTAuthList = make(map[string]*version2.JWTAuth)
588+
if policiesCfg.JWTAuth.List == nil {
589+
policiesCfg.JWTAuth.List = make(map[string]*version2.JWTAuth)
590590
}
591591

592-
jwtAuthKey := routePoliciesCfg.JWTAuth.Key
593-
if _, exists := policiesCfg.JWTAuthList[jwtAuthKey]; !exists {
594-
policiesCfg.JWTAuthList[jwtAuthKey] = routePoliciesCfg.JWTAuth
592+
jwtAuthKey := routePoliciesCfg.JWTAuth.Auth.Key
593+
if _, exists := policiesCfg.JWTAuth.List[jwtAuthKey]; !exists {
594+
policiesCfg.JWTAuth.List[jwtAuthKey] = routePoliciesCfg.JWTAuth.Auth
595595
}
596596
}
597-
if routePoliciesCfg.APIKeyEnabled {
598-
policiesCfg.APIKeyEnabled = routePoliciesCfg.APIKeyEnabled
599-
apiMapName := routePoliciesCfg.APIKey.MapName
600-
if policiesCfg.APIKeyClientMap == nil {
601-
policiesCfg.APIKeyClientMap = make(map[string][]apiKeyClient)
597+
if routePoliciesCfg.APIKey.Enabled {
598+
policiesCfg.APIKey.Enabled = routePoliciesCfg.APIKey.Enabled
599+
apiMapName := routePoliciesCfg.APIKey.Key.MapName
600+
if policiesCfg.APIKey.ClientMap == nil {
601+
policiesCfg.APIKey.ClientMap = make(map[string][]apiKeyClient)
602602
}
603-
if _, exists := policiesCfg.APIKeyClientMap[apiMapName]; !exists {
604-
policiesCfg.APIKeyClientMap[apiMapName] = routePoliciesCfg.APIKeyClients
603+
if _, exists := policiesCfg.APIKey.ClientMap[apiMapName]; !exists {
604+
policiesCfg.APIKey.ClientMap[apiMapName] = routePoliciesCfg.APIKey.Clients
605605
}
606606
}
607-
limitReqZones = append(limitReqZones, routePoliciesCfg.LimitReqZones...)
607+
limitReqZones = append(limitReqZones, routePoliciesCfg.RateLimit.Zones...)
608608

609609
dosRouteCfg := generateDosCfg(dosResources[r.Path])
610610

@@ -722,30 +722,30 @@ func (vsc *virtualServerConfigurator) GenerateVirtualServerConfig(
722722
if policiesCfg.OIDC {
723723
routePoliciesCfg.OIDC = policiesCfg.OIDC
724724
}
725-
if routePoliciesCfg.JWKSAuthEnabled {
726-
policiesCfg.JWKSAuthEnabled = routePoliciesCfg.JWKSAuthEnabled
725+
if routePoliciesCfg.JWTAuth.JWKSEnabled {
726+
policiesCfg.JWTAuth.JWKSEnabled = routePoliciesCfg.JWTAuth.JWKSEnabled
727727

728-
if policiesCfg.JWTAuthList == nil {
729-
policiesCfg.JWTAuthList = make(map[string]*version2.JWTAuth)
728+
if policiesCfg.JWTAuth.List == nil {
729+
policiesCfg.JWTAuth.List = make(map[string]*version2.JWTAuth)
730730
}
731731

732-
jwtAuthKey := routePoliciesCfg.JWTAuth.Key
733-
if _, exists := policiesCfg.JWTAuthList[jwtAuthKey]; !exists {
734-
policiesCfg.JWTAuthList[jwtAuthKey] = routePoliciesCfg.JWTAuth
732+
jwtAuthKey := routePoliciesCfg.JWTAuth.Auth.Key
733+
if _, exists := policiesCfg.JWTAuth.List[jwtAuthKey]; !exists {
734+
policiesCfg.JWTAuth.List[jwtAuthKey] = routePoliciesCfg.JWTAuth.Auth
735735
}
736736
}
737-
if routePoliciesCfg.APIKeyEnabled {
738-
policiesCfg.APIKeyEnabled = routePoliciesCfg.APIKeyEnabled
739-
apiMapName := routePoliciesCfg.APIKey.MapName
740-
if policiesCfg.APIKeyClientMap == nil {
741-
policiesCfg.APIKeyClientMap = make(map[string][]apiKeyClient)
737+
if routePoliciesCfg.APIKey.Enabled {
738+
policiesCfg.APIKey.Enabled = routePoliciesCfg.APIKey.Enabled
739+
apiMapName := routePoliciesCfg.APIKey.Key.MapName
740+
if policiesCfg.APIKey.ClientMap == nil {
741+
policiesCfg.APIKey.ClientMap = make(map[string][]apiKeyClient)
742742
}
743-
if _, exists := policiesCfg.APIKeyClientMap[apiMapName]; !exists {
744-
policiesCfg.APIKeyClientMap[apiMapName] = routePoliciesCfg.APIKeyClients
743+
if _, exists := policiesCfg.APIKey.ClientMap[apiMapName]; !exists {
744+
policiesCfg.APIKey.ClientMap[apiMapName] = routePoliciesCfg.APIKey.Clients
745745
}
746746
}
747747

748-
limitReqZones = append(limitReqZones, routePoliciesCfg.LimitReqZones...)
748+
limitReqZones = append(limitReqZones, routePoliciesCfg.RateLimit.Zones...)
749749

750750
dosRouteCfg := generateDosCfg(dosResources[r.Path])
751751

@@ -812,7 +812,7 @@ func (vsc *virtualServerConfigurator) GenerateVirtualServerConfig(
812812
}
813813
}
814814

815-
for mapName, apiKeyClients := range policiesCfg.APIKeyClientMap {
815+
for mapName, apiKeyClients := range policiesCfg.APIKey.ClientMap {
816816
maps = append(maps, *generateAPIKeyClientMap(mapName, apiKeyClients))
817817
}
818818

@@ -861,16 +861,16 @@ func (vsc *virtualServerConfigurator) GenerateVirtualServerConfig(
861861
TLSPassthrough: vsc.isTLSPassthrough,
862862
Allow: policiesCfg.Allow,
863863
Deny: policiesCfg.Deny,
864-
LimitReqOptions: policiesCfg.LimitReqOptions,
865-
LimitReqs: policiesCfg.LimitReqs,
866-
JWTAuth: policiesCfg.JWTAuth,
864+
LimitReqOptions: policiesCfg.RateLimit.Options,
865+
LimitReqs: policiesCfg.RateLimit.Reqs,
866+
JWTAuth: policiesCfg.JWTAuth.Auth,
867867
BasicAuth: policiesCfg.BasicAuth,
868-
JWTAuthList: policiesCfg.JWTAuthList,
869-
JWKSAuthEnabled: policiesCfg.JWKSAuthEnabled,
868+
JWTAuthList: policiesCfg.JWTAuth.List,
869+
JWKSAuthEnabled: policiesCfg.JWTAuth.JWKSEnabled,
870870
IngressMTLS: policiesCfg.IngressMTLS,
871871
EgressMTLS: policiesCfg.EgressMTLS,
872-
APIKey: policiesCfg.APIKey,
873-
APIKeyEnabled: policiesCfg.APIKeyEnabled,
872+
APIKey: policiesCfg.APIKey.Key,
873+
APIKeyEnabled: policiesCfg.APIKey.Enabled,
874874
OIDC: vsc.oidcPolCfg.oidc,
875875
WAF: policiesCfg.WAF,
876876
Dos: dosCfg,
@@ -891,23 +891,38 @@ func (vsc *virtualServerConfigurator) GenerateVirtualServerConfig(
891891
return vsCfg, vsc.warnings
892892
}
893893

894+
// rateLimit hold the configuration for the ratelimiting Policy
895+
type rateLimit struct {
896+
Reqs []version2.LimitReq
897+
Zones []version2.LimitReqZone
898+
Options version2.LimitReqOptions
899+
}
900+
901+
// jwtAuth hold the configuration for the JWTAuth & JWKSAuth Policies
902+
type jwtAuth struct {
903+
Auth *version2.JWTAuth
904+
List map[string]*version2.JWTAuth
905+
JWKSEnabled bool
906+
}
907+
908+
// apiKeyAuth hold the configuration for the APIKey Policy
909+
type apiKeyAuth struct {
910+
Enabled bool
911+
Key *version2.APIKey
912+
Clients []apiKeyClient
913+
ClientMap map[string][]apiKeyClient
914+
}
915+
894916
type policiesCfg struct {
895917
Allow []string
896918
Deny []string
897-
LimitReqOptions version2.LimitReqOptions
898-
LimitReqZones []version2.LimitReqZone
899-
LimitReqs []version2.LimitReq
900-
JWTAuth *version2.JWTAuth
901-
JWTAuthList map[string]*version2.JWTAuth
902-
JWKSAuthEnabled bool
919+
RateLimit rateLimit
920+
JWTAuth jwtAuth
903921
BasicAuth *version2.BasicAuth
904922
IngressMTLS *version2.IngressMTLS
905923
EgressMTLS *version2.EgressMTLS
906924
OIDC bool
907-
APIKeyEnabled bool
908-
APIKey *version2.APIKey
909-
APIKeyClients []apiKeyClient
910-
APIKeyClientMap map[string][]apiKeyClient
925+
APIKey apiKeyAuth
911926
WAF *version2.WAF
912927
ErrorReturn *version2.Return
913928
BundleValidator bundleValidator
@@ -994,20 +1009,20 @@ func (p *policiesCfg) addRateLimitConfig(
9941009
) *validationResults {
9951010
res := newValidationResults()
9961011
rlZoneName := fmt.Sprintf("pol_rl_%v_%v_%v_%v", polNamespace, polName, vsNamespace, vsName)
997-
p.LimitReqs = append(p.LimitReqs, generateLimitReq(rlZoneName, rateLimit))
998-
p.LimitReqZones = append(p.LimitReqZones, generateLimitReqZone(rlZoneName, rateLimit, podReplicas))
999-
if len(p.LimitReqs) == 1 {
1000-
p.LimitReqOptions = generateLimitReqOptions(rateLimit)
1012+
p.RateLimit.Reqs = append(p.RateLimit.Reqs, generateLimitReq(rlZoneName, rateLimit))
1013+
p.RateLimit.Zones = append(p.RateLimit.Zones, generateLimitReqZone(rlZoneName, rateLimit, podReplicas))
1014+
if len(p.RateLimit.Reqs) == 1 {
1015+
p.RateLimit.Options = generateLimitReqOptions(rateLimit)
10011016
} else {
10021017
curOptions := generateLimitReqOptions(rateLimit)
1003-
if curOptions.DryRun != p.LimitReqOptions.DryRun {
1004-
res.addWarningf("RateLimit policy %s with limit request option dryRun='%v' is overridden to dryRun='%v' by the first policy reference in this context", polKey, curOptions.DryRun, p.LimitReqOptions.DryRun)
1018+
if curOptions.DryRun != p.RateLimit.Options.DryRun {
1019+
res.addWarningf("RateLimit policy %s with limit request option dryRun='%v' is overridden to dryRun='%v' by the first policy reference in this context", polKey, curOptions.DryRun, p.RateLimit.Options.DryRun)
10051020
}
1006-
if curOptions.LogLevel != p.LimitReqOptions.LogLevel {
1007-
res.addWarningf("RateLimit policy %s with limit request option logLevel='%v' is overridden to logLevel='%v' by the first policy reference in this context", polKey, curOptions.LogLevel, p.LimitReqOptions.LogLevel)
1021+
if curOptions.LogLevel != p.RateLimit.Options.LogLevel {
1022+
res.addWarningf("RateLimit policy %s with limit request option logLevel='%v' is overridden to logLevel='%v' by the first policy reference in this context", polKey, curOptions.LogLevel, p.RateLimit.Options.LogLevel)
10081023
}
1009-
if curOptions.RejectCode != p.LimitReqOptions.RejectCode {
1010-
res.addWarningf("RateLimit policy %s with limit request option rejectCode='%v' is overridden to rejectCode='%v' by the first policy reference in this context", polKey, curOptions.RejectCode, p.LimitReqOptions.RejectCode)
1024+
if curOptions.RejectCode != p.RateLimit.Options.RejectCode {
1025+
res.addWarningf("RateLimit policy %s with limit request option rejectCode='%v' is overridden to rejectCode='%v' by the first policy reference in this context", polKey, curOptions.RejectCode, p.RateLimit.Options.RejectCode)
10111026
}
10121027
}
10131028
return res
@@ -1055,7 +1070,7 @@ func (p *policiesCfg) addJWTAuthConfig(
10551070
secretRefs map[string]*secrets.SecretReference,
10561071
) *validationResults {
10571072
res := newValidationResults()
1058-
if p.JWTAuth != nil {
1073+
if p.JWTAuth.Auth != nil {
10591074
res.addWarningf("Multiple jwt policies in the same context is not valid. JWT policy %s will be ignored", polKey)
10601075
return res
10611076
}
@@ -1076,7 +1091,7 @@ func (p *policiesCfg) addJWTAuthConfig(
10761091
return res
10771092
}
10781093

1079-
p.JWTAuth = &version2.JWTAuth{
1094+
p.JWTAuth.Auth = &version2.JWTAuth{
10801095
Secret: secretRef.Path,
10811096
Realm: jwtAuth.Realm,
10821097
Token: jwtAuth.Token,
@@ -1092,14 +1107,14 @@ func (p *policiesCfg) addJWTAuthConfig(
10921107
JwksPath: uri.Path,
10931108
}
10941109

1095-
p.JWTAuth = &version2.JWTAuth{
1110+
p.JWTAuth.Auth = &version2.JWTAuth{
10961111
Key: polKey,
10971112
JwksURI: *JwksURI,
10981113
Realm: jwtAuth.Realm,
10991114
Token: jwtAuth.Token,
11001115
KeyCache: jwtAuth.KeyCache,
11011116
}
1102-
p.JWKSAuthEnabled = true
1117+
p.JWTAuth.JWKSEnabled = true
11031118
return res
11041119
}
11051120
return res
@@ -1359,7 +1374,7 @@ func (p *policiesCfg) addAPIKeyConfig(
13591374
secretRefs map[string]*secrets.SecretReference,
13601375
) *validationResults {
13611376
res := newValidationResults()
1362-
if p.APIKey != nil {
1377+
if p.APIKey.Key != nil {
13631378
res.addWarningf(
13641379
"Multiple API Key policies in the same context is not valid. API Key policy %s will be ignored",
13651380
polKey,
@@ -1384,20 +1399,20 @@ func (p *policiesCfg) addAPIKeyConfig(
13841399
return res
13851400
}
13861401

1387-
p.APIKeyClients = generateAPIKeyClients(secretRef.Secret.Data)
1402+
p.APIKey.Clients = generateAPIKeyClients(secretRef.Secret.Data)
13881403

13891404
mapName := fmt.Sprintf(
13901405
"apikey_auth_client_name_%s_%s_%s",
13911406
rfc1123ToSnake(vsNamespace),
13921407
rfc1123ToSnake(vsName),
13931408
strings.Split(rfc1123ToSnake(polKey), "/")[1],
13941409
)
1395-
p.APIKey = &version2.APIKey{
1410+
p.APIKey.Key = &version2.APIKey{
13961411
Header: apiKey.SuppliedIn.Header,
13971412
Query: apiKey.SuppliedIn.Query,
13981413
MapName: mapName,
13991414
}
1400-
p.APIKeyEnabled = true
1415+
p.APIKey.Enabled = true
14011416
return res
14021417
}
14031418

@@ -1655,14 +1670,14 @@ func removeDuplicateLimitReqZones(rlz []version2.LimitReqZone) []version2.LimitR
16551670
func addPoliciesCfgToLocation(cfg policiesCfg, location *version2.Location) {
16561671
location.Allow = cfg.Allow
16571672
location.Deny = cfg.Deny
1658-
location.LimitReqOptions = cfg.LimitReqOptions
1659-
location.LimitReqs = cfg.LimitReqs
1660-
location.JWTAuth = cfg.JWTAuth
1673+
location.LimitReqOptions = cfg.RateLimit.Options
1674+
location.LimitReqs = cfg.RateLimit.Reqs
1675+
location.JWTAuth = cfg.JWTAuth.Auth
16611676
location.BasicAuth = cfg.BasicAuth
16621677
location.EgressMTLS = cfg.EgressMTLS
16631678
location.OIDC = cfg.OIDC
16641679
location.WAF = cfg.WAF
1665-
location.APIKey = cfg.APIKey
1680+
location.APIKey = cfg.APIKey.Key
16661681
location.PoliciesErrorReturn = cfg.ErrorReturn
16671682
}
16681683

0 commit comments

Comments
 (0)