Skip to content

Commit c35f8c3

Browse files
filippomcfilippomc
authored
Merge pull request #702 from MetaCell/feature/701
Configure proxy timeouts and payload size
2 parents 0a5af04 + a4c1e57 commit c35f8c3

15 files changed

Lines changed: 1001 additions & 852 deletions

‎deployment-configuration/helm/templates/auto-gatekeepers.yaml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,12 @@ data:
1818
enable-default-deny: {{ eq (.app.harness.secured | toString) "true" }}
1919
listen: 0.0.0.0:8080
2020
enable-refresh-tokens: true
21-
server-write-timeout: 180s
22-
upstream-response-header-timeout: 180s
21+
server-write-timeout: {{ .app.harness.proxy.timeout.send | default .root.Values.proxy.timeout.send | default 180 }}s
22+
upstream-timeout: {{ .app.harness.proxy.timeout.read | default .root.Values.proxy.timeout.read | default 180 }}s
23+
upstream-response-header-timeout: {{ .app.harness.proxy.timeout.read | default .root.Values.proxy.timeout.read | default 180 }}s
24+
upstream-expect-continue-timeout: {{ .app.harness.proxy.timeout.read | default .root.Values.proxy.timeout.read | default 180 }}s
25+
server-read-timeout: {{ .app.harness.proxy.timeout.read | default .root.Values.proxy.timeout.read | default 180 }}s
26+
upstream-keepalive-timeout: {{ .app.harness.proxy.timeout.keepalive | default .root.Values.proxy.timeout.keepalive | default 180 }}s
2327
http-only-cookie: false
2428
tls-cert:
2529
tls-private-key:
@@ -65,7 +69,7 @@ data:
6569
<h2 class="message">403 Permission Denied</h2>
6670
<div class="error-details">
6771
Sorry, you do not have access to this page, please contact your administrator.
68-
If you have been assigned new authorizations try to <a href="/oauth/logout?redirect=/">login again</a>.
72+
If you have been assigned new authorizations, try to refresh the page or to <a href="/oauth/logout?redirect=/">login again</a>.
6973
</div>
7074
</div>
7175
</div>

‎deployment-configuration/helm/templates/ingress.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,13 @@ metadata:
3838
cert-manager.io/issuer: {{ printf "%s-%s" "letsencrypt" .Values.namespace }}
3939
{{- end }}
4040
nginx.ingress.kubernetes.io/ssl-redirect: {{ (and $tls .Values.ingress.ssl_redirect) | quote }}
41-
nginx.ingress.kubernetes.io/proxy-body-size: '250m'
41+
nginx.ingress.kubernetes.io/proxy-body-size: '{{ .Values.proxy.payload.max }}m'
4242
nginx.ingress.kubernetes.io/proxy-buffer-size: '128k'
4343
nginx.ingress.kubernetes.io/from-to-www-redirect: 'true'
4444
nginx.ingress.kubernetes.io/rewrite-target: /$1
45+
nginx.ingress.kubernetes.io/auth-keepalive-timeout: {{ .Values.proxy.timeout.keepalive | quote }}
46+
nginx.ingress.kubernetes.io/proxy-read-timeout: {{ .Values.proxy.timeout.read | quote }}
47+
nginx.ingress.kubernetes.io/proxy-send-timeout: {{ .Values.proxy.timeout.send | quote }}
4548
spec:
4649
rules:
4750
{{- range $app := .Values.apps }}

‎deployment-configuration/helm/values.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,3 +67,13 @@ backup:
6767
memory: "64Mi"
6868
# -- K8s cpu resource definition.
6969
cpu: "50m"
70+
proxy:
71+
timeout:
72+
# -- Timeout for proxy connections in seconds.
73+
send: 60
74+
# -- Timeout for proxy responses in seconds.
75+
read: 60
76+
keepalive: 60
77+
payload:
78+
# -- Maximum size of payload in MB
79+
max: 250

‎deployment-configuration/value-template.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,3 +125,13 @@ harness:
125125
smoketest: true
126126
ignoreConsoleErrors: false
127127
ignoreRequestErrors: false
128+
proxy:
129+
timeout:
130+
# -- Timeout for proxy connections in seconds.
131+
send:
132+
# -- Timeout for proxy responses in seconds.
133+
read:
134+
keepalive:
135+
payload:
136+
# -- Maximum size of payload in MB
137+
max:

‎docs/accounts.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,22 @@ harness:
6262
secured: open
6363
```
6464

65+
#### Proxy specific configurations
66+
Proxy configurations can be personalized in the application in the case that we want to have more restrictive values than the global ones (see [here](./ingress-domains-proxies.md#proxy-configurations) for more )
6567

68+
```yaml
69+
harness:
70+
proxy:
71+
timeout:
72+
# -- Timeout for proxy connections in seconds.
73+
send:
74+
# -- Timeout for proxy responses in seconds.
75+
read:
76+
keepalive:
77+
payload:
78+
# -- Maximum size of payload in MB
79+
max:
80+
```
6681
### Secure an enpoint with OpenAPI
6782

6883
In every api endpoint that you want to secure, add the bearerAuth security as in the example:

‎docs/ingress-domains-proxies.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Ingress, domains and proxies
2+
3+
## Default configurations for domain and subdomains
4+
Cloud Harness makes it very easy to configure domains and proxies, by making
5+
an underlying assumption:
6+
7+
- Applications share a main base domain (say ch.org)
8+
- Applications can define a subdomain (say myapp)
9+
10+
The main domain is configured in the [root values file](../deployment-configuration/values-template.yaml) and
11+
it is usually overridden by the `harness-deployment` command, e.g.
12+
13+
```
14+
harness-deployment ... -d ch.org
15+
```
16+
17+
The subdomain is defined in the application's values.yaml file in
18+
harness.subdomain (see for instance the [samples application configuration](../applications/samples/deploy/values.yaml))
19+
20+
For instance on applications/myapp/deploy/values.yaml:
21+
22+
```yaml
23+
harness:
24+
subdomain: myapp
25+
```
26+
27+
The above configurations put together create an ingress configuration for https://myapp.ch.org and automatically configure letsencrypt to create and renew certificates.
28+
29+
Note:
30+
that the tls and letsencrypt configurations are enabled by default but should usually be disabled locally with
31+
32+
```
33+
harness-deployment ... -dtls -l
34+
```
35+
36+
## Main application
37+
38+
The "main" application is deployed on the base domain.
39+
In order to specify a main application, override the value in your `/deployment-configuration/values-template.yaml` file.
40+
41+
Example
42+
```yaml
43+
mainapp: myapp
44+
```
45+
This creates a reverse proxy to https://ch.org pointing to myapp
46+
47+
## Proxy configurations
48+
49+
Ingress is a reverse proxy and as such has some configurations to take into account.
50+
The most common configurations are connection timeouts and payload size.
51+
52+
To configure it, override the following values in your `deployment-configuration/values-template.yaml` file.
53+
54+
```yaml
55+
proxy:
56+
timeout:
57+
# -- Timeout for proxy connections in seconds.
58+
send: 60
59+
# -- Timeout for proxy responses in seconds.
60+
read: 60
61+
keepalive: 60
62+
payload:
63+
# -- Maximum size of payload in MB
64+
max: 250
65+
```
66+
67+
Note that in the case that gatekeepers are enabled, the same configurations are applied
68+
to the gatekeepers, unless the application override them on `harness.proxy.*`.
69+
See also the [gatekeepers documentation](./accounts.md#secure-and-enpoint-with-the-gatekeeper).

‎docs/model/ApplicationHarnessConfig.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ Key | Input Type | Accessed Type | Description | Notes
3030
**jupyterhub** | [**JupyterHubConfig**](JupyterHubConfig.md) | [**JupyterHubConfig**](JupyterHubConfig.md) | | [optional]
3131
**accounts** | [**ApplicationAccountsConfig**](ApplicationAccountsConfig.md) | [**ApplicationAccountsConfig**](ApplicationAccountsConfig.md) | | [optional]
3232
**test** | [**ApplicationTestConfig**](ApplicationTestConfig.md) | [**ApplicationTestConfig**](ApplicationTestConfig.md) | | [optional]
33+
**quotas** | [**Quota**](Quota.md) | [**Quota**](Quota.md) | | [optional]
3334
**any_string_name** | dict, frozendict.frozendict, str, date, datetime, uuid.UUID, int, float, decimal.Decimal, bool, None, list, tuple, bytes, io.FileIO, io.BufferedReader, | frozendict.frozendict, str, decimal.Decimal, BoolClass, NoneClass, tuple, bytes, FileIO | any string name can be used but the value must be the correct type | [optional]
3435

3536
# aliases

‎docs/model/HarnessMainConfig.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ Key | Input Type | Accessed Type | Description | Notes
2121
**backup** | [**BackupConfig**](BackupConfig.md) | [**BackupConfig**](BackupConfig.md) | | [optional]
2222
**name** | str, | str, | Base name | [optional]
2323
**task-images** | [**SimpleMap**](SimpleMap.md) | [**SimpleMap**](SimpleMap.md) | | [optional]
24-
**any_string_name** | dict, frozendict.frozendict, str, date, datetime, int, float, bool, decimal.Decimal, None, list, tuple, bytes, io.FileIO, io.BufferedReader | frozendict.frozendict, str, BoolClass, decimal.Decimal, NoneClass, tuple, bytes, FileIO | any string name can be used but the value must be the correct type | [optional]
24+
**any_string_name** | dict, frozendict.frozendict, str, date, datetime, uuid.UUID, int, float, decimal.Decimal, bool, None, list, tuple, bytes, io.FileIO, io.BufferedReader, | frozendict.frozendict, str, decimal.Decimal, BoolClass, NoneClass, tuple, bytes, FileIO | any string name can be used but the value must be the correct type | [optional]
2525

2626
# env
2727

‎docs/model/Quota.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ dict, frozendict.frozendict, | frozendict.frozendict, | |
88
### Dictionary Keys
99
Key | Input Type | Accessed Type | Description | Notes
1010
------------ | ------------- | ------------- | ------------- | -------------
11-
**any_string_name** | str, | str, | any string name can be used but the value must be the correct type | [optional]
11+
**any_string_name** | dict, frozendict.frozendict, str, date, datetime, uuid.UUID, int, float, decimal.Decimal, bool, None, list, tuple, bytes, io.FileIO, io.BufferedReader, | frozendict.frozendict, str, decimal.Decimal, BoolClass, NoneClass, tuple, bytes, FileIO | any string name can be used but the value must be the correct type | [optional]
1212

1313
[[Back to Model list]](../../README.md#documentation-for-models) [[Back to API list]](../../README.md#documentation-for-api-endpoints) [[Back to README]](../../README.md)
1414

‎docs/model/SimpleMap.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ dict, frozendict.frozendict, | frozendict.frozendict, | |
88
### Dictionary Keys
99
Key | Input Type | Accessed Type | Description | Notes
1010
------------ | ------------- | ------------- | ------------- | -------------
11-
**any_string_name** | str, | str, | any string name can be used but the value must be the correct type | [optional]
11+
**any_string_name** | dict, frozendict.frozendict, str, date, datetime, uuid.UUID, int, float, decimal.Decimal, bool, None, list, tuple, bytes, io.FileIO, io.BufferedReader, | frozendict.frozendict, str, decimal.Decimal, BoolClass, NoneClass, tuple, bytes, FileIO | any string name can be used but the value must be the correct type | [optional]
1212

1313
[[Back to Model list]](../../README.md#documentation-for-models) [[Back to API list]](../../README.md#documentation-for-api-endpoints) [[Back to README]](../../README.md)
1414

0 commit comments

Comments
 (0)