Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(Traefik Hub): add OAS validateRequestMethodAndPath - CRDs update #1299

Merged
merged 6 commits into from
Jan 15, 2025
Merged

feat(Traefik Hub): add OAS validateRequestMethodAndPath - CRDs update #1299

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
aa5a305
chore: update CRDs to v1.13.0
jspdown Jan 9, 2025
8bfae2a
restore gw crd
mloiseleur Jan 10, 2025
0c25bff
update crds chart
mloiseleur Jan 10, 2025
9811edf
add OAS validation
mloiseleur Jan 15, 2025
705f916
Merge branch 'master' into update-crds-v1.13.0
mloiseleur Jan 15, 2025
d930eb3
update docs & schema
mloiseleur Jan 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions traefik-crds/crds-files/hub/hub.traefik.io_apis.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,6 +153,11 @@ spec:
x-kubernetes-validations:
- message: must be a valid URL
rule: isURL(self)
validateRequestMethodAndPath:
description: |-
ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.
This option overrides the default behavior configured in the static configuration.
type: boolean
type: object
x-kubernetes-validations:
- message: path or url must be defined
Expand Down
5 changes: 5 additions & 0 deletions traefik-crds/crds-files/hub/hub.traefik.io_apiversions.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,6 +157,11 @@ spec:
x-kubernetes-validations:
- message: must be a valid URL
rule: isURL(self)
validateRequestMethodAndPath:
description: |-
ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.
This option overrides the default behavior configured in the static configuration.
type: boolean
type: object
x-kubernetes-validations:
- message: path or url must be defined
Expand Down
1 change: 1 addition & 0 deletions traefik/VALUES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,7 @@ Kubernetes: `>=1.22.0-0`
| hub.apimanagement.admission.listenAddr | string | `""` | WebHook admission server listen address. Default: "0.0.0.0:9943". |
| hub.apimanagement.admission.secretName | string | `""` | Certificate of the WebHook admission server. Default: "hub-agent-cert". |
| hub.apimanagement.enabled | bool | `false` | Set to true in order to enable API Management. Requires a valid license token. |
| hub.apimanagement.openApi.validateRequestMethodAndPath | bool | `false` | When set to true, it will only accept paths and methods that are explicitly defined in its OpenAPI specification |
| hub.experimental.aigateway | bool | `false` | Set to true in order to enable AI Gateway. Requires a valid license token. |
| hub.redis.cluster | string | `nil` | Enable Redis Cluster. Default: true. |
| hub.redis.database | string | `nil` | Database used to store information. Default: "0". |
Expand Down
5 changes: 5 additions & 0 deletions traefik/crds/hub.traefik.io_apis.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,6 +153,11 @@ spec:
x-kubernetes-validations:
- message: must be a valid URL
rule: isURL(self)
validateRequestMethodAndPath:
description: |-
ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.
This option overrides the default behavior configured in the static configuration.
type: boolean
type: object
x-kubernetes-validations:
- message: path or url must be defined
Expand Down
5 changes: 5 additions & 0 deletions traefik/crds/hub.traefik.io_apiversions.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,6 +157,11 @@ spec:
x-kubernetes-validations:
- message: must be a valid URL
rule: isURL(self)
validateRequestMethodAndPath:
description: |-
ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.
This option overrides the default behavior configured in the static configuration.
type: boolean
type: object
x-kubernetes-validations:
- message: path or url must be defined
Expand Down
3 changes: 3 additions & 0 deletions traefik/templates/_podtemplate.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -777,6 +777,9 @@
{{- with .admission.secretName }}
- "--hub.apimanagement.admission.secretName={{ . }}"
{{- end }}
{{- if .openApi.validateRequestMethodAndPath }}
- "--hub.apiManagement.openApi.validateRequestMethodAndPath=true"
{{- end }}
{{- end }}
{{- end }}
{{- if .experimental.aigateway }}
Expand Down
11 changes: 11 additions & 0 deletions traefik/tests/deployment-hub-config_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,17 @@ tests:
- contains:
path: spec.template.spec.containers[0].args
content: "--hub.apimanagement.admission.secretName=secret"
- it: should be possible to enforce OAS
set:
hub:
apimanagement:
enabled: true
openApi:
validateRequestMethodAndPath: true
asserts:
- contains:
path: spec.template.spec.containers[0].args
content: "--hub.apiManagement.openApi.validateRequestMethodAndPath=true"
- it: api management and ai gateway should not be enabled by default
asserts:
- notContains:
Expand Down
8 changes: 8 additions & 0 deletions traefik/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -270,6 +270,14 @@
},
"enabled": {
"type": "boolean"
},
"openApi": {
"properties": {
"validateRequestMethodAndPath": {
"type": "boolean"
}
},
"type": "object"
}
},
"type": "object"
Expand Down
4 changes: 4 additions & 0 deletions traefik/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -941,6 +941,10 @@ hub:
listenAddr: ""
# -- Certificate of the WebHook admission server. Default: "hub-agent-cert".
secretName: ""
openApi:
# -- When set to true, it will only accept paths and methods that are explicitly defined in its OpenAPI specification
validateRequestMethodAndPath: false

experimental:
# -- Set to true in order to enable AI Gateway. Requires a valid license token.
aigateway: false
Expand Down
Loading