Skip to content

Commit

Permalink
Changed config of envoy to a template, and added a start-envoy.sh scr…
Browse files Browse the repository at this point in the history 
…ipt that is run on initialization that creates the actual config file using the template and the env config variables

Signed-off-by: Alfredo Gutierrez <[email protected]>
  • Loading branch information
@AlfredoG87
AlfredoG87 committed Mar 30, 2024
1 parent d0a1898 commit a3b0773
Show file tree
Hide file tree
Showing 5 changed files with 39 additions and 57 deletions.
18 changes: 17 additions & 1 deletion auth-layer-proxy/Dockerfile
View file
Original file line number Diff line number Diff line change
@@ -1,11 +1,27 @@
FROM envoyproxy/envoy:v1.28-latest

# Copy the Filter Scripts
COPY /filters/ /filters/
COPY /filters/ /etc/envoy/filters/
# Copy the Configs templates
COPY /configs/ /etc/envoy/configs/
# Copy the start script
COPY /scripts/start-envoy.sh /etc/envoy/start-envoy.sh

# Make the script executable
RUN chmod +x /etc/envoy/start-envoy.sh
# give ownership to envoy user
RUN chown -R envoy:envoy /etc/envoy

# install gettext for envsubst
RUN apt-get update

Check warning on line 16 in auth-layer-proxy/Dockerfile

View check run for this annotation

Wiz Inc. (8f76296f7c) / Wiz IaC Scanner

Update Instruction Alone 

Rule ID: 4b6f3b0e-cba2-4cc9-96f6-b8ee68067f8b
Severity: Medium

Instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement
Raw output 
Resource: FROM={{   envoyproxy/envoy:v1.28-latest}}.RUN={{apt-get update}}
File Type: Dockerfile
Expected: Instruction 'RUN <package-manager> update' should be followed by 'RUN <package-manager> install' 
Found: Instruction 'RUN <package-manager> update' isn't followed by 'RUN <package-manager> install in the same 'RUN' statement

Check notice on line 16 in auth-layer-proxy/Dockerfile

View check run for this annotation

Wiz Inc. (8f76296f7c) / Wiz IaC Scanner

Multiple RUN, ADD, COPY, Instructions Listed 

Rule ID: 201694ed-d11b-4848-8d6a-2e5f6bbe0fac
Severity: Low

Multiple commands (RUN, Copy, And) should be grouped in order to reduce the number of layers.
Raw output 
Resource: FROM={{   envoyproxy/envoy:v1.28-latest}}.{{RUN     apt-get update}}
File Type: Dockerfile
Expected: There isn´t any RUN instruction that could be grouped
Found: There are RUN instructions that could be grouped
RUN apt-get install -y gettext-base

Check warning on line 17 in auth-layer-proxy/Dockerfile

View check run for this annotation

Wiz Inc. (8f76296f7c) / Wiz IaC Scanner

Apt Get Install Pin Version Not Defined 

Rule ID: 0518662c-4712-415e-b472-81149607b767
Severity: Medium

When installing a package, its pin version should be defined
Raw output 
Resource: FROM={{   envoyproxy/envoy:v1.28-latest}}.RUN={{apt-get install -y gettext-base}}
File Type: Dockerfile
Expected: Package 'gettext-base' has version defined
Found: Package 'gettext-base' does not have version defined

Check notice on line 17 in auth-layer-proxy/Dockerfile

View check run for this annotation

Wiz Inc. (8f76296f7c) / Wiz IaC Scanner

APT-GET Not Avoiding Additional Packages 

Rule ID: 15862929-8b16-4974-b8dc-04bb9db86686
Severity: None

Check if any apt-get installs don't use '--no-install-recommends' flag to avoid installing additional packages.
Raw output 
Resource: FROM={{   envoyproxy/envoy:v1.28-latest}}.{{RUN     apt-get install -y gettext-base}}
File Type: Dockerfile
Expected: 'RUN     apt-get install -y gettext-base' uses '--no-install-recommends' flag to avoid installing additional packages
Found: 'RUN     apt-get install -y gettext-base' does not use '--no-install-recommends' flag to avoid installing additional packages

Check notice on line 17 in auth-layer-proxy/Dockerfile

View check run for this annotation

Wiz Inc. (8f76296f7c) / Wiz IaC Scanner

Apt Get Install Lists Were Not Deleted 

Rule ID: fbdbab3e-4714-4c6f-9837-8f0e3e23a1f4
Severity: None

After using apt-get install, it is needed to delete apt-get lists
Raw output 
Resource: FROM={{   envoyproxy/envoy:v1.28-latest}}.RUN={{apt-get install -y gettext-base}}
File Type: Dockerfile
Expected: After using apt-get install, the apt-get lists should be deleted
Found: After using apt-get install, the apt-get lists were not deleted

# Install Lua and Luarocks
RUN apt-get update && apt-get install -y lua5.1 luarocks git

# clean up temp data
RUN rm -rf /var/lib/apt/lists/*

# Install Lua modules
RUN luarocks install lua-cjson

Expand Down
9 changes: 8 additions & 1 deletion auth-layer-proxy/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -103,14 +103,21 @@ docker build -t envoy-auth-proxy .
Add Postgres or Redis credentials to the .env file

```
# EnvoyProxy Configuration
SERVICE_TYPE=LOGICAL_DNS
SERVICE_ADDRESS=host.docker.internal
SERVICE_PORT=8020
ENVOY_ADMIN_PORT=15000
PROXY_PORT=10000
# OAuth
CLIENT_ID=<clientId>
CLIENT_SECRET=<client_secret>
TOKEN_INTROSPECTION_URL=http://host.docker.internal:8080/realms/HederaTheGraph/protocol/openid-connect/token/introspect
```

### Configure the details of the service to be proxied on the envoy.yam
### Configure the details of the service to be proxied on the envoy.yaml
Edit `envoy-auth.yaml` file with config needs, by default will be proxying/relaying the request to address: `host.docker.internal` and port `8020`

```yaml
Expand Down
49 changes: 0 additions & 49 deletions auth-layer-proxy/configs/envoy-auth.yaml
View file

This file was deleted.

13 changes: 7 additions & 6 deletions auth-layer-proxy/docker-compose.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,16 @@ version: '3'

services:
envoy:
image: envoy-auth-layer:latest
command: -c /configs/envoy-auth.yaml
image: envoy-auth-proxy:latest
command: ["/etc/envoy/start-envoy.sh"]
env_file:
- .env
volumes:
- ./configs/:/configs/
- ./filters/:/filters/
ports:
- "9901:9901"
- ./configs/:/etc/envoy/configs/
- ./filters/:/etc/envoy/filters/
- ./scripts/start-envoy.sh:/start-envoy.sh
ports:
- "10000:10000"
- "15000:15000"
stdin_open: true
tty: true
7 changes: 7 additions & 0 deletions auth-layer-proxy/example.env
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,10 @@
# EnvoyProxy Configuration
SERVICE_TYPE=LOGICAL_DNS
SERVICE_ADDRESS=host.docker.internal
SERVICE_PORT=8020
ENVOY_ADMIN_PORT=15000
PROXY_PORT=10000

# OAuth
CLIENT_ID=htg-auth-layer
CLIENT_SECRET=0cyYtDVVbVvaZjrDViiw4p2kegTy9Q5X
Expand Down

0 comments on commit a3b0773

Please sign in to comment.