Skip to content

Commit 833a608

Browse files
bjee19bjee19
authored
Allow configuration of NGINX Plus API access (#3066)
Allow configuration of NGINX Plus API access. Problem: We want the ability to configure access to the NGINX Plus dashboard. Solution: Add a field AllowedAddresses in the NginxProxy API to allow the user to configure access to the NGINX Plus dashboard. Testing: Unit tests. Manually configured an NginxProxy resource, set up a Kind cluster with a Nodeport following our Get started guide, and confirmed that I could access the dashboard without needing to port-forward. Verified nginx plus template code is present when running on nginx plus and not present when running on nginx oss.
1 parent 7a08f11 commit 833a608

20 files changed

+1073
-252
lines changed

‎apis/v1alpha1/nginxproxy_types.go

+44-13
Original file line numberDiff line numberDiff line change
@@ -49,11 +49,21 @@ type NginxProxySpec struct {
4949
//
5050
// +optional
5151
Logging *NginxLogging `json:"logging,omitempty"`
52+
// NginxPlus specifies NGINX Plus additional settings.
53+
//
54+
// +optional
55+
NginxPlus *NginxPlus `json:"nginxPlus,omitempty"`
5256
// DisableHTTP2 defines if http2 should be disabled for all servers.
5357
// Default is false, meaning http2 will be enabled for all servers.
58+
DisableHTTP2 bool `json:"disableHTTP2,omitempty"`
59+
}
60+
61+
// NginxPlus specifies NGINX Plus additional settings. These will only be applied if NGINX Plus is being used.
62+
type NginxPlus struct {
63+
// AllowedAddresses specifies IPAddresses or CIDR blocks to the allow list for accessing the NGINX Plus API.
5464
//
5565
// +optional
56-
DisableHTTP2 bool `json:"disableHTTP2,omitempty"`
66+
AllowedAddresses []NginxPlusAllowAddress `json:"allowedAddresses,omitempty"`
5767
}
5868

5969
// Telemetry specifies the OpenTelemetry configuration.
@@ -149,7 +159,7 @@ type RewriteClientIP struct {
149159
// +listType=map
150160
// +listMapKey=type
151161
// +kubebuilder:validation:MaxItems=16
152-
TrustedAddresses []Address `json:"trustedAddresses,omitempty"`
162+
TrustedAddresses []RewriteClientIPAddress `json:"trustedAddresses,omitempty"`
153163
}
154164

155165
// RewriteClientIPModeType defines how NGINX Gateway Fabric will determine the client's original IP address.
@@ -183,28 +193,49 @@ const (
183193
IPv6 IPFamilyType = "ipv6"
184194
)
185195

186-
// Address is a struct that specifies address type and value.
187-
type Address struct {
196+
// RewriteClientIPAddress specifies the address type and value for a RewriteClientIP address.
197+
type RewriteClientIPAddress struct {
188198
// Type specifies the type of address.
189-
Type AddressType `json:"type"`
199+
Type RewriteClientIPAddressType `json:"type"`
190200

191201
// Value specifies the address value.
192202
Value string `json:"value"`
193203
}
194204

195-
// AddressType specifies the type of address.
205+
// RewriteClientIPAddressType specifies the type of address.
196206
// +kubebuilder:validation:Enum=CIDR;IPAddress;Hostname
197-
type AddressType string
207+
type RewriteClientIPAddressType string
198208

199209
const (
200-
// CIDRAddressType specifies that the address is a CIDR block.
201-
CIDRAddressType AddressType = "CIDR"
210+
// RewriteClientIPCIDRAddressType specifies that the address is a CIDR block.
211+
RewriteClientIPCIDRAddressType RewriteClientIPAddressType = "CIDR"
212+
213+
// RewriteClientIPIPAddressType specifies that the address is an IP address.
214+
RewriteClientIPIPAddressType RewriteClientIPAddressType = "IPAddress"
215+
216+
// RewriteClientIPHostnameAddressType specifies that the address is a Hostname.
217+
RewriteClientIPHostnameAddressType RewriteClientIPAddressType = "Hostname"
218+
)
202219

203-
// IPAddressType specifies that the address is an IP address.
204-
IPAddressType AddressType = "IPAddress"
220+
// NginxPlusAllowAddress specifies the address type and value for an NginxPlus allow address.
221+
type NginxPlusAllowAddress struct {
222+
// Type specifies the type of address.
223+
Type NginxPlusAllowAddressType `json:"type"`
224+
225+
// Value specifies the address value.
226+
Value string `json:"value"`
227+
}
228+
229+
// NginxPlusAllowAddressType specifies the type of address.
230+
// +kubebuilder:validation:Enum=CIDR;IPAddress
231+
type NginxPlusAllowAddressType string
232+
233+
const (
234+
// NginxPlusAllowCIDRAddressType specifies that the address is a CIDR block.
235+
NginxPlusAllowCIDRAddressType NginxPlusAllowAddressType = "CIDR"
205236

206-
// HostnameAddressType specifies that the address is a Hostname.
207-
HostnameAddressType AddressType = "Hostname"
237+
// NginxPlusAllowIPAddressType specifies that the address is an IP address.
238+
NginxPlusAllowIPAddressType NginxPlusAllowAddressType = "IPAddress"
208239
)
209240

210241
// NginxLogging defines logging related settings for NGINX.

‎apis/v1alpha1/zz_generated.deepcopy.go

+56-16
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/nginx-gateway-fabric/values.schema.json

+28
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,34 @@
9393
"required": [],
9494
"type": "object"
9595
},
96+
"nginxPlus": {
97+
"description": "NginxPlus specifies NGINX Plus additional settings.",
98+
"properties": {
99+
"allowedAddresses": {
100+
"items": {
101+
"properties": {
102+
"type": {
103+
"enum": [
104+
"CIDR",
105+
"IPAddress"
106+
],
107+
"required": [],
108+
"type": "string"
109+
},
110+
"value": {
111+
"required": [],
112+
"type": "string"
113+
}
114+
},
115+
"required": []
116+
},
117+
"required": [],
118+
"type": "array"
119+
}
120+
},
121+
"required": [],
122+
"type": "object"
123+
},
96124
"rewriteClientIP": {
97125
"description": "RewriteClientIP defines configuration for rewriting the client IP to the original client's IP.",
98126
"properties": {

‎charts/nginx-gateway-fabric/values.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,21 @@ nginx:
244244
# - crit
245245
# - alert
246246
# - emerg
247+
# nginxPlus:
248+
# type: object
249+
# description: NginxPlus specifies NGINX Plus additional settings.
250+
# properties:
251+
# allowedAddresses:
252+
# type: array
253+
# items:
254+
# properties:
255+
# type:
256+
# type: string
257+
# enum:
258+
# - CIDR
259+
# - IPAddress
260+
# value:
261+
# type: string
247262
# @schema
248263
# -- The configuration for the data plane that is contained in the NginxProxy resource.
249264
config: {}

‎config/crd/bases/gateway.nginx.org_nginxproxies.yaml

+27-2
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,31 @@ spec:
8383
- emerg
8484
type: string
8585
type: object
86+
nginxPlus:
87+
description: NginxPlus specifies NGINX Plus additional settings.
88+
properties:
89+
allowedAddresses:
90+
description: AllowedAddresses specifies IPAddresses or CIDR blocks
91+
to the allow list for accessing the NGINX Plus API.
92+
items:
93+
description: NginxPlusAllowAddress specifies the address type
94+
and value for an NginxPlus allow address.
95+
properties:
96+
type:
97+
description: Type specifies the type of address.
98+
enum:
99+
- CIDR
100+
- IPAddress
101+
type: string
102+
value:
103+
description: Value specifies the address value.
104+
type: string
105+
required:
106+
- type
107+
- value
108+
type: object
109+
type: array
110+
type: object
86111
rewriteClientIP:
87112
description: RewriteClientIP defines configuration for rewriting the
88113
client IP to the original client's IP.
@@ -122,8 +147,8 @@ spec:
122147
Sets NGINX directive set_real_ip_from: https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
123148
This field is required if mode is set.
124149
items:
125-
description: Address is a struct that specifies address type
126-
and value.
150+
description: RewriteClientIPAddress specifies the address type
151+
and value for a RewriteClientIP address.
127152
properties:
128153
type:
129154
description: Type specifies the type of address.

‎deploy/crds.yaml

+27-2
Original file line numberDiff line numberDiff line change
@@ -668,6 +668,31 @@ spec:
668668
- emerg
669669
type: string
670670
type: object
671+
nginxPlus:
672+
description: NginxPlus specifies NGINX Plus additional settings.
673+
properties:
674+
allowedAddresses:
675+
description: AllowedAddresses specifies IPAddresses or CIDR blocks
676+
to the allow list for accessing the NGINX Plus API.
677+
items:
678+
description: NginxPlusAllowAddress specifies the address type
679+
and value for an NginxPlus allow address.
680+
properties:
681+
type:
682+
description: Type specifies the type of address.
683+
enum:
684+
- CIDR
685+
- IPAddress
686+
type: string
687+
value:
688+
description: Value specifies the address value.
689+
type: string
690+
required:
691+
- type
692+
- value
693+
type: object
694+
type: array
695+
type: object
671696
rewriteClientIP:
672697
description: RewriteClientIP defines configuration for rewriting the
673698
client IP to the original client's IP.
@@ -707,8 +732,8 @@ spec:
707732
Sets NGINX directive set_real_ip_from: https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
708733
This field is required if mode is set.
709734
items:
710-
description: Address is a struct that specifies address type
711-
and value.
735+
description: RewriteClientIPAddress specifies the address type
736+
and value for a RewriteClientIP address.
712737
properties:
713738
type:
714739
description: Type specifies the type of address.

‎internal/mode/static/handler.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,7 @@ func (h *eventHandlerImpl) HandleEventBatch(ctx context.Context, logger logr.Log
174174
return
175175
case state.EndpointsOnlyChange:
176176
h.version++
177-
cfg := dataplane.BuildConfiguration(ctx, gr, h.cfg.serviceResolver, h.version)
177+
cfg := dataplane.BuildConfiguration(ctx, gr, h.cfg.serviceResolver, h.version, h.cfg.plus)
178178
depCtx, getErr := h.getDeploymentContext(ctx)
179179
if getErr != nil {
180180
logger.Error(getErr, "error getting deployment context for usage reporting")
@@ -190,7 +190,7 @@ func (h *eventHandlerImpl) HandleEventBatch(ctx context.Context, logger logr.Log
190190
}
191191
case state.ClusterStateChange:
192192
h.version++
193-
cfg := dataplane.BuildConfiguration(ctx, gr, h.cfg.serviceResolver, h.version)
193+
cfg := dataplane.BuildConfiguration(ctx, gr, h.cfg.serviceResolver, h.version, h.cfg.plus)
194194
depCtx, getErr := h.getDeploymentContext(ctx)
195195
if getErr != nil {
196196
logger.Error(getErr, "error getting deployment context for usage reporting")

‎internal/mode/static/handler_test.go

+1
Original file line numberDiff line numberDiff line change
@@ -442,6 +442,7 @@ var _ = Describe("eventHandler", func() {
442442
handler.HandleEventBatch(context.Background(), ctlrZap.New(), batch)
443443

444444
dcfg := dataplane.GetDefaultConfiguration(&graph.Graph{}, 1)
445+
dcfg.NginxPlus = dataplane.NginxPlus{AllowedAddresses: []string{"127.0.0.1"}}
445446
Expect(helpers.Diff(handler.GetLatestConfiguration(), &dcfg)).To(BeEmpty())
446447

447448
Expect(fakeGenerator.GenerateCallCount()).To(Equal(0))

‎internal/mode/static/nginx/conf/nginx-plus.conf

-24
Original file line numberDiff line numberDiff line change
@@ -27,30 +27,6 @@ http {
2727
tcp_nopush on;
2828

2929
server_tokens off;
30-
31-
server {
32-
listen 127.0.0.1:8765;
33-
root /usr/share/nginx/html;
34-
access_log off;
35-
36-
allow 127.0.0.1;
37-
deny all;
38-
39-
location = /dashboard.html {}
40-
41-
location /api {
42-
api write=off;
43-
}
44-
}
45-
46-
server {
47-
listen unix:/var/run/nginx/nginx-plus-api.sock;
48-
access_log off;
49-
50-
location /api {
51-
api write=on;
52-
}
53-
}
5430
}
5531

5632
stream {

0 commit comments

Comments
 (0)