sdx token, path validation and activity update

.github/workflows/dev.yml

@@ -141,6 +141,7 @@ jobs:
         with:
           context: microservices/gatewayApi
           file: microservices/gatewayApi/Dockerfile
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: ghcr.io/bcgov/gwa-api/gwa-gateway-api:${{ steps.tag.outputs.tag }}
           labels: |
@@ -186,6 +187,7 @@ jobs:
         with:
           context: microservices/gatewayJobScheduler
           file: microservices/gatewayJobScheduler/Dockerfile
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: ghcr.io/bcgov/gwa-api/gwa-scheduler:${{ steps.tag.outputs.tag }}
           labels: |
@@ -231,6 +233,7 @@ jobs:
         with:
           context: microservices/kubeApi
           file: microservices/kubeApi/Dockerfile
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: ghcr.io/bcgov/gwa-api/gwa-kube-api:${{ steps.tag.outputs.tag }}
           labels: |
@@ -276,6 +279,7 @@ jobs:
         with:
           context: microservices/compatibilityApi
           file: microservices/compatibilityApi/Dockerfile
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: ghcr.io/bcgov/gwa-api/gwa-compatibility-api:${{ steps.tag.outputs.tag }}
           labels: |
@@ -289,7 +293,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: 2 
+          fetch-depth: 2
       - name: Check if build needed
         id: check
         run: |
@@ -321,6 +325,7 @@ jobs:
         with:
           context: microservices/csitOasValidationApi
           file: microservices/csitOasValidationApi/Dockerfile
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: ghcr.io/bcgov/gwa-api/gwa-csit-oas-validation-api:${{ steps.tag.outputs.tag }}
           labels: |
@@ -366,6 +371,7 @@ jobs:
         with:
           context: microservices/sdxStepTokenApi
           file: microservices/sdxStepTokenApi/Dockerfile
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: ghcr.io/bcgov/gwa-api/gwa-sdx-ca-token-api:${{ steps.tag.outputs.tag }}
           labels: |

.github/workflows/pr-build.yml

@@ -1,8 +1,8 @@
 on:
   # Trigger analysis when pushing in master or pull requests, and when creating
-  # a pull request. 
+  # a pull request.
   pull_request:
-      types: [opened, synchronize, reopened]
+    types: [opened, synchronize, reopened]
   push:
     branches:
       - master
@@ -11,12 +11,12 @@ jobs:
   sonarcloud:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
-      with:
-        # Disabling shallow clone is recommended for improving relevancy of reporting
-        fetch-depth: 0
-    - name: SonarCloud Scan
-      uses: sonarsource/sonarcloud-github-action@master
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      - uses: actions/checkout@v2
+        with:
+          # Disabling shallow clone is recommended for improving relevancy of reporting
+          fetch-depth: 0
+      - name: SonarCloud Scan
+        uses: sonarsource/sonarqube-scan-action@v8.1.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.spectral.yaml

@@ -0,0 +1,2 @@
+extends:
+  - https://raw.githubusercontent.com/bcgov/csit-api-governance-spectral-style-guide/main/dist/spectral/basic-ruleset.yaml

microservices/gatewayApi/Dockerfile

@@ -15,18 +15,25 @@ WORKDIR /app
 
 RUN apk add build-base libffi-dev openssl openssl-dev curl
 
-RUN curl -LO "https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl" && \
+# TARGETARCH is amd64/arm64 from BuildKit (docker buildx / compose build)
+ARG TARGETARCH
+
+RUN curl -LO "https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/${TARGETARCH}/kubectl" && \
     chmod +x kubectl; mv kubectl /usr/local/bin/.
 
 #COPY --from=build /deck/deck /usr/local/bin
 
-# gwa api (kong 2)
-RUN curl -sL https://github.com/kong/deck/releases/download/v1.5.0/deck_1.5.0_linux_amd64.tar.gz -o deck.tar.gz && \
-   tar -xf deck.tar.gz -C /tmp && \
-   cp /tmp/deck /usr/local/bin/deck_kong2_150
+# gwa api (kong 2) — v1.5.0 has no linux_arm64 release
+RUN if [ "$TARGETARCH" = "amd64" ]; then \
+      curl -sL https://github.com/kong/deck/releases/download/v1.5.0/deck_1.5.0_linux_amd64.tar.gz -o deck.tar.gz && \
+      tar -xf deck.tar.gz -C /tmp && \
+      cp /tmp/deck /usr/local/bin/deck_kong2_150; \
+    else \
+      echo "Skipping deck_kong2_150 on ${TARGETARCH} (no upstream arm64 release for v1.5.0)"; \
+    fi
 
 # gwa api (kong 3)
-RUN curl -sL https://github.com/Kong/deck/releases/download/v1.53.1/deck_1.53.1_linux_amd64.tar.gz -o deck.tar.gz && \
+RUN curl -sL https://github.com/Kong/deck/releases/download/v1.53.1/deck_1.53.1_linux_${TARGETARCH}.tar.gz -o deck.tar.gz && \
    tar -xf deck.tar.gz -C /tmp && \
    cp /tmp/deck /usr/local/bin/deck && \
    cp /tmp/deck /usr/local/bin/deck_kong3_1531

microservices/gatewayApi/README.md

@@ -89,3 +89,9 @@ poetry run coverage run --branch -m pytest -s
 
 coverage xml
 ```
+
+Or
+
+```sh
+ENV=test GITHASH=11223344 poetry run pytest -s --cov=. --cov-branch --cov-report=xml
+```

microservices/gatewayApi/clients/kong.py

@@ -1,6 +1,6 @@
 from flask import current_app as app
 import requests
-import urllib.parse
+from urllib.parse import quote, quote_plus
 
 # Access the Kong Admin API for details about the Kong configuration
 #
@@ -11,6 +11,9 @@ def get_routes ():
 def get_plugins ():
     return recurse_get_records ([], "/plugins")
 
+def get_tagged_resources_by_tag (tag, base_url = None):
+    return recurse_get_records ([], "/tags/" + quote(tag), base_url=base_url)
+
 def get_services_by_ns (ns):
     return recurse_get_records ([], "/services?tags=ns.%s" % ns)
 
@@ -38,9 +41,12 @@ def get_acls ():
 def get_consumer (consumer_id):
     return get_record ([], "/consumers/%s" % consumer_id)
 
-def recurse_get_records (result, url):
+def recurse_get_records (result, url, base_url = None):
     log = app.logger
-    admin_url = app.config['kongAdminUrl']
+    if base_url is None:
+        admin_url = app.config['kongAdminUrl']
+    else:
+        admin_url = base_url
 
     log.debug("%s%s" % (admin_url, url))
     r = requests.get("%s%s" % (admin_url, url))
@@ -49,7 +55,7 @@ def recurse_get_records (result, url):
     result.extend(data)
 
     if json['next'] is not None:
-        recurse_get_records (result, json['next'])
+        recurse_get_records (result, json['next'], base_url=admin_url)
     return result
 
 def get_record (result, url):

microservices/gatewayApi/config/test.json

@@ -25,7 +25,11 @@
       "kube-ns": "abcd-1234",
       "validate-upstreams": true
     },
-    "sdx-edge": {}
+    "sdx-edge": {
+      "kube-api": "http://kube-api",
+      "kube-ns": "abcd-1234",
+      "enforce-route-paths": true
+    }
   },
   "kubeApiCreds": {
     "kubeApiPass": "password",

microservices/gatewayApi/tests/conftest.py

@@ -30,6 +30,10 @@
 def app(mocker):
     """Create and configure a new app instance for each test."""
 
+    sys.modules.pop("app", None)
+    sys.modules.pop("v1.routes.gateway", None)
+    sys.modules.pop("v2.routes.gateway", None)
+
     mock_auth(mocker)
     mock_keycloak(mocker)
     mock_kong(mocker)
@@ -54,8 +58,9 @@ def decorated_function(*args, **kwargs):
             return f(*args, **kwargs)
         return decorated_function
 
-    mocker.patch('auth.auth.admin_jwt', return_value=mock_decorator)
-
+    mocker.patch('auth.auth.admin_jwt', side_effect=lambda *a, **k: (lambda f: f))
+    mocker.patch('v1.auth.auth.admin_jwt', return_value=mock_decorator)
+    mocker.patch('v1.auth.auth.enforce_authorization', return_value=None)
     mocker.patch("auth.uma.enforce", return_value=True)
 
 def mock_keycloak(mocker):
@@ -106,11 +111,13 @@ def get_group(id):
                 return {
                     "attributes": {
                         "perm-data-plane": ["sdx-edge"],
-                        "perm-domains": [ "sdx01.servers.sdx" ]
+                        "perm-domains": [ "sdx01.servers.sdx" ],
+                        "perm-route-paths": ["/sdx/0/LAB.MIN.CITZ.DATA-USAGE.v1", "/sdx/0/LAB.MIN.CITZ.DATA-USAGE.v2"]
                     }
                 }
-
+            
     mocker.patch("v2.services.namespaces.admin_api", return_value=mock_kc_admin)
+    mocker.patch("v1.services.namespaces.admin_api", return_value=mock_kc_admin)
 
 def mock_kong(mocker):
 
@@ -134,7 +141,8 @@ def json():
         elif (path == 'http://kong/certificates?tags=gwa.ns.mytest' or
               path == 'http://kong/certificates?tags=gwa.ns.sescookie' or
               path == 'http://kong/certificates?tags=gwa.ns.dclass' or
-              path == 'http://kong/certificates?tags=gwa.ns.customcert'):
+              path == 'http://kong/certificates?tags=gwa.ns.customcert' or
+              path == 'http://kong/certificates?tags=ns.sdx01'):
             class Response:
                 def json():
                     return {
@@ -182,20 +190,23 @@ class Response:
 
 def mock_deck(mocker):
     class decoded_response:
-        def __init__ (self, output):
+        def __init__(self, output):
             self.output = output
+
         def decode(self, utf):
             return self.output
 
     class mock_popen_instance:
-        def __init__ (self, output):
+        def __init__(self, output):
             self.output = output
+
         def communicate(self):
             return decoded_response(self.output), None
+
         returncode = 0
 
     mock_output = "Deck reported no changes"
-    mocker.patch("v2.routes.gateway.Popen", return_value=mock_popen_instance(mock_output))
+    mocker.patch("subprocess.Popen", return_value=mock_popen_instance(mock_output))
 
 def mock_kubeapi(mocker):
 
@@ -281,6 +292,10 @@ class Response:
                 # def json():
                 #     return {}
             return Response
+        elif (url == 'http://kube-api/namespaces/sdx01/routes'):
+            class Response:
+                status_code = 201
+            return Response
         else:
             raise Exception(url)