Deploy GitHub Pages

examples/customization/external-auth-headers/Makefile

@@ -0,0 +1,23 @@
+all: push
+
+TAG=0.1
+PREFIX?=electroma/ingress-demo-
+ARCH?=amd64
+GOLANG_VERSION=1.9
+TEMP_DIR:=$(shell mktemp -d)
+
+build: clean
+	CGO_ENABLED=0 GOOS=linux GOARCH=$(ARCH) go build -o authsvc/authsvc authsvc/authsvc.go
+	CGO_ENABLED=0 GOOS=linux GOARCH=$(ARCH) go build -o echosvc/echosvc echosvc/echosvc.go
+
+container: build
+	docker build --pull -t $(PREFIX)authsvc-$(ARCH):$(TAG) authsvc
+	docker build --pull -t $(PREFIX)echosvc-$(ARCH):$(TAG) echosvc
+
+push: container
+	docker push $(PREFIX)authsvc-$(ARCH):$(TAG)
+	docker push $(PREFIX)echosvc-$(ARCH):$(TAG)
+
+clean:
+	rm -f authsvc/authsvc echosvc/echosvc
+

examples/customization/external-auth-headers/authsvc/Dockerfile

@@ -0,0 +1,5 @@
+FROM alpine:3.5
+MAINTAINER Roman Safronov <electroma@gmail.com>
+COPY authsvc /
+EXPOSE 8080
+ENTRYPOINT ["/authsvc"]

examples/customization/external-auth-headers/authsvc/authsvc.go

@@ -0,0 +1,49 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"math/rand"
+	"net/http"
+	"strconv"
+	"strings"
+)
+
+// Sample authentication service returning several HTTP headers in response
+func main() {
+	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		if strings.ContainsAny(r.Header.Get("User"), "internal") {
+			w.Header().Add("UserID", strconv.Itoa(rand.Int()))
+			w.Header().Add("UserRole", "admin")
+			w.Header().Add("Other", "not used")
+			fmt.Fprint(w, "ok")
+		} else {
+			rc := http.StatusForbidden
+			if c := r.URL.Query().Get("code"); len(c) > 0 {
+				c, _ := strconv.Atoi(c)
+				if c > 0 && c < 600 {
+					rc = c
+				}
+			}
+
+			w.WriteHeader(rc)
+			fmt.Fprint(w, "unauthorized")
+		}
+	})
+	http.ListenAndServe(":8080", nil)
+}

examples/customization/external-auth-headers/deploy/auth-service.yaml

@@ -0,0 +1,44 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: demo-auth-service
+  labels:
+    k8s-app: demo-auth-service
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      k8s-app: demo-auth-service
+  template:
+    metadata:
+      labels:
+        k8s-app: demo-auth-service
+    spec:
+      terminationGracePeriodSeconds: 60
+      containers:
+      - name: auth-service
+        image: electroma/ingress-demo-authsvc-amd64:0.1
+        ports:
+        - containerPort: 8080
+        resources:
+          limits:
+            cpu: 10m
+            memory: 20Mi
+          requests:
+            cpu: 10m
+            memory: 20Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: demo-auth-service
+  labels:
+    k8s-app: demo-auth-service
+  namespace: default
+spec:
+  ports:
+  - port: 80
+    targetPort: 8080
+  selector:
+    k8s-app: demo-auth-service

examples/customization/external-auth-headers/deploy/echo-service.yaml

@@ -0,0 +1,80 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: demo-echo-service
+  labels:
+    k8s-app: demo-echo-service
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      k8s-app: demo-echo-service
+  template:
+    metadata:
+      labels:
+        k8s-app: demo-echo-service
+    spec:
+      terminationGracePeriodSeconds: 60
+      containers:
+      - name: echo-service
+        image: electroma/ingress-demo-echosvc-amd64:0.1
+        ports:
+        - containerPort: 8080
+        resources:
+          limits:
+            cpu: 10m
+            memory: 20Mi
+          requests:
+            cpu: 10m
+            memory: 20Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: demo-echo-service
+  labels:
+    k8s-app: demo-echo-service
+  namespace: default
+spec:
+  ports:
+  - port: 80
+    targetPort: 8080
+  selector:
+    k8s-app: demo-echo-service
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: public-demo-echo-service
+  annotations:
+    nginx.ingress.kubernetes.io/auth-url: http://demo-auth-service.default.svc.cluster.local?code=200
+    nginx.ingress.kubernetes.io/auth-response-headers: UserID, UserRole
+  namespace: default
+spec:
+  rules:
+  - host: public-demo-echo-service.kube.local
+    http:
+      paths:
+      - backend:
+          serviceName: demo-echo-service
+          servicePort: 80
+        path: /
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: secure-demo-echo-service
+  annotations:
+    nginx.ingress.kubernetes.io/auth-url: http://demo-auth-service.default.svc.cluster.local
+    nginx.ingress.kubernetes.io/auth-response-headers: UserID, UserRole
+  namespace: default
+spec:
+  rules:
+  - host: secure-demo-echo-service.kube.local
+    http:
+      paths:
+      - backend:
+          serviceName: demo-echo-service
+          servicePort: 80
+        path: /

examples/customization/external-auth-headers/echosvc/Dockerfile

@@ -0,0 +1,5 @@
+FROM alpine:3.5
+MAINTAINER Roman Safronov <electroma@gmail.com>
+COPY echosvc /
+EXPOSE 8080
+ENTRYPOINT ["/echosvc"]

examples/customization/external-auth-headers/echosvc/echosvc.go

@@ -0,0 +1,32 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"net/http"
+)
+
+func handler(w http.ResponseWriter, r *http.Request) {
+	fmt.Fprintf(w, "UserID: %s, UserRole: %s", r.Header.Get("UserID"), r.Header.Get("UserRole"))
+}
+
+// Sample  "echo" service displaying UserID and UserRole HTTP request headers
+func main() {
+	http.HandleFunc("/", handler)
+	http.ListenAndServe(":8080", nil)
+}