Skip to content

Commit 8cc3dc6

Browse files
dseevrdseevr
committed
Split auth_proxy routes out into auth_proxy.raml, updated Dockerfile to rely on bindmounts rather than copying in files, changed protocol to https
Signed-off-by: Bill Robinson <[email protected]>
1 parent 95a136f commit 8cc3dc6

14 files changed

+539
-931
lines changed

‎scripts/build.sh

-2
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,6 @@ mv spec/netmaster.raml ./spec/contiv/libraries/netmaster.raml
1717
# run the raml2html tool to generate docs under spec/docs
1818
pushd spec
1919
make docs
20-
mkdir -p docs
21-
mv contiv.html docs/
2220
popd
2321

2422
# because we have to do some tidying up of the output HTML and it requires some

‎spec/Dockerfile

+2-4
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,8 @@ FROM node:alpine
22

33
RUN npm install -g raml2html
44

5-
COPY . /contiv
5+
RUN mkdir /contiv
66

77
WORKDIR /contiv
88

9-
RUN raml2html -i contiv.raml -o contiv.html
10-
11-
ENTRYPOINT ["/bin/sh"]
9+
ENTRYPOINT ["raml2html"]

‎spec/Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
all: docs
22

33
docs:
4-
@./build.sh
4+
@bash ./build.sh
55

66
.PHONY: docs

‎spec/auth_proxy.raml

+96
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
#%RAML 1.0
2+
title: Contiv
3+
description: Contiv API Specification
4+
version: v1
5+
baseUri:
6+
value: https://{serverfqdn}:10000/api/{version}
7+
(rediractable): true
8+
baseUriParameters:
9+
serverfqdn:
10+
type: string
11+
protocols: [ HTTPS ]
12+
mediaType: [ application/json ]
13+
14+
resourceTypes:
15+
collection: !include contiv/schemas/collection.raml
16+
non-upd-collection-item: !include contiv/schemas/non-upd-collection-item.raml
17+
collection-item: !include contiv/schemas/collection-item.raml
18+
ro-collection-item: !include contiv/schemas/ro-collection-item.raml
19+
20+
annotationTypes:
21+
info:
22+
properties:
23+
license:
24+
type: string
25+
enum: [ "Apache 2.0" ]
26+
allowedTargets: API
27+
rediractable: boolean
28+
29+
securitySchemes:
30+
custom_scheme: !include contiv/schemas/custom-scheme.raml
31+
32+
# Resource templates
33+
uses:
34+
auth_proxy: contiv/libraries/auth_proxy.raml
35+
36+
securedBy: custom_scheme
37+
38+
# auth_proxy endpoints
39+
/auth_proxy:
40+
displayName: Auth API
41+
description: Authentication/Authorization related API
42+
43+
/health:
44+
get:
45+
securedBy: [ null ]
46+
responses:
47+
200:
48+
body:
49+
application/json:
50+
type: auth_proxy.health
51+
52+
/login:
53+
post:
54+
description: Login to Contiv API server
55+
securedBy: [ null ]
56+
body:
57+
application/json:
58+
type: auth_proxy.login
59+
responses:
60+
200:
61+
body:
62+
application/json:
63+
type: auth_proxy.login_response
64+
400:
65+
401:
66+
67+
/version:
68+
get:
69+
securedBy: [ null ]
70+
responses:
71+
200:
72+
body:
73+
application/json: |
74+
{ "version": "1.0.0-beta" }
75+
76+
/authorizations:
77+
type: {collection: {provider: auth_proxy}}
78+
displayName: Authorizations
79+
80+
/{authzUUID}:
81+
type: {non-upd-collection-item: {provider: auth_proxy}}
82+
displayName: Authorization
83+
84+
/local_users:
85+
type: {collection: {provider: auth_proxy}}
86+
displayName: Local Users
87+
88+
/{username}:
89+
type: {collection-item: {provider: auth_proxy}}
90+
displayName: Local User
91+
put:
92+
93+
/ldap_configuration:
94+
type: {collection-item: {provider: auth_proxy}}
95+
displayName: LDAP Configuration
96+
put:

‎spec/auth_proxy/libraries/auth_proxy.raml

+126
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
#%RAML 1.0 Library
2+
types:
3+
health:
4+
properties:
5+
status:
6+
enum: [ "healthy", "unhealthy" ]
7+
version: string
8+
netmaster:
9+
properties:
10+
status:
11+
enum: [ "healthy", "unhealthy" ]
12+
reason:
13+
type: string
14+
required: false
15+
description: reason for netmaster being unhealthy
16+
version:
17+
type: string
18+
required: false
19+
description: omitted in case netmaster is unhealthy
20+
example: |
21+
{"netmaster":{"status":"healthy","version":"pv1.0.0-alpha-01-27-2017.23-16-47.UTC"},"status":"healthy","version":"1.0.0-alpha"}
22+
23+
ldap_configuration:
24+
properties:
25+
server:
26+
type: string
27+
description: FQDN or IP address of AD server
28+
example: auth.local.com
29+
port:
30+
type: integer
31+
format: int16
32+
minimum: 0
33+
description: port where AD server is listening
34+
example: 389
35+
base_dn:
36+
type: string
37+
description: Distinguished name for base entity. All search queries will be scope to this BaseDN
38+
example: ou=eng,dc=auth,dc=com
39+
service_account_dn:
40+
type: string
41+
description: DN of the service account. auth_proxy will use this account to communicate with AD server. Hence this account must have appropriate privileges, specifically for lookup.
42+
service_account_password:
43+
type: string
44+
start_tls:
45+
type: boolean
46+
description: switch session to TLS after proxy connects to AD server. This option must be configured on AD server. Recommended to set to true in production environments.
47+
insecure_skip_verify:
48+
type: boolean
49+
description: skip cert check on AD server. Recommended to set to false for production environments.
50+
upd_ldap_configuration:
51+
type: ldap_configuration
52+
53+
54+
local_user:
55+
properties:
56+
username: string
57+
password: string
58+
firstname:
59+
type: string
60+
example: John
61+
required: false
62+
lastname:
63+
type: string
64+
example: Doe
65+
required: false
66+
disable:
67+
type: boolean
68+
required: false
69+
example:
70+
username: johndoe
71+
password: p@ssw0rd
72+
upd_local_user:
73+
properties:
74+
firstname:
75+
type: string
76+
required: false
77+
lastname:
78+
type: string
79+
required: false
80+
disable:
81+
type: boolean
82+
required: false
83+
password:
84+
type: string
85+
required: false
86+
example:
87+
firstname: Jane
88+
disable: true
89+
local_users:
90+
type: array
91+
items:
92+
type: local_user
93+
94+
login:
95+
properties:
96+
username:
97+
type: string
98+
description: user name. If a local user doesn't exist by that name, AD authentication will be tried using sAMAccountName=username in BaseDN scope of the AD server (see ldap configuration for more details)
99+
password: string
100+
example:
101+
username: johndoe
102+
password: p@ssw0rd
103+
login_response:
104+
properties:
105+
token:
106+
type: string
107+
description: opaque token string, callers should set custom security header to this token before calling further APIs (see security information for protected APIs)
108+
109+
110+
authorization:
111+
properties:
112+
principalName: string
113+
local: boolean
114+
role: string
115+
tenantName: string
116+
example:
117+
principalName: johndoe
118+
local: true
119+
role: ops
120+
tenantName: johnstenant
121+
upd_authorization:
122+
type: authorization
123+
authorizations:
124+
type: array
125+
items:
126+
type: authorization

‎spec/auth_proxy/schemas/collection-item.raml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#%RAML 1.0 ResourceType
2+
description: Entity representing <<resourcePathName|!singularize>>
3+
get:
4+
description: returns <<resourcePathName|!singularize>>.
5+
responses:
6+
200:
7+
body:
8+
application/json:
9+
type: <<provider>>.<<resourcePathName|!singularize>>
10+
404:
11+
body:
12+
application/json: |
13+
{"message": "<<resourcePathName|!singularize>> not found" }
14+
delete:
15+
description: deletes <<resourcePathName|!singularize>>.
16+
responses:
17+
204:
18+
put?:
19+
description: updates/creates <<resourcePathName|!singularize>>
20+
body:
21+
application/json:
22+
type: <<provider>>.upd_<<resourcePathName|!singularize>>
23+
responses:
24+
200:
25+
body:
26+
application/json:
27+
type: <<provider>>.<<resourcePathName|!singularize>>
28+
404:
29+
body:
30+
application/json: |
31+
{"message": "<<resourcePathName|!singularize>> not found" }
32+

‎spec/auth_proxy/schemas/collection.raml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#%RAML 1.0 ResourceType
2+
description: A collection of <<resourcePathName>>
3+
get:
4+
description: returns a list of <<resourcePathName|!singularize>>.
5+
responses:
6+
200:
7+
body:
8+
application/json:
9+
type: <<provider>>.<<resourcePathName>>
10+
post:
11+
description: Add a new <<resourcePathName|!singularize>>.
12+
body:
13+
application/json:
14+
type: <<provider>>.<<resourcePathName|!singularize>>
15+
responses:
16+
201:
17+
404:

‎spec/auth_proxy/schemas/custom-scheme.raml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#%RAML 1.0 SecurityScheme
2+
3+
description: |
4+
A custom security scheme for authenticating requests.
5+
type: x-custom
6+
describedBy:
7+
headers:
8+
X-Auth-Token:
9+
description: |
10+
Used to send a custom token. Obtained via /login API.
11+
type: string
12+
responses:
13+
401:
14+
description: |
15+
Authentication failed.
16+
403:
17+
description: |
18+
Forbidden.
19+

‎spec/auth_proxy/schemas/non-upd-collection-item.raml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#%RAML 1.0 ResourceType
2+
description: Entity representing <<resourcePathName|!singularize>>
3+
get:
4+
description: returns <<resourcePathName|!singularize>>.
5+
responses:
6+
200:
7+
body:
8+
application/json:
9+
type: <<provider>>.<<resourcePathName|!singularize>>
10+
404:
11+
body:
12+
application/json: |
13+
{"message": "<<resourcePathName|!singularize>> not found" }
14+
delete:
15+
description: deletes <<resourcePathName|!singularize>>.
16+
responses:
17+
204:
18+

‎spec/auth_proxy/schemas/ro-collection-item.raml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#%RAML 1.0 ResourceType
2+
description: Entity representing <<resourcePathName|!singularize>>
3+
get:
4+
description: returns <<resourcePathName|!singularize>>.
5+
responses:
6+
200:
7+
body:
8+
application/json:
9+
type: <<provider>>.inspect_<<resourcePathName|!singularize>>
10+
404:
11+
body:
12+
application/json: |
13+
{"message": "<<resourcePathName|!singularize>> not found" }

‎spec/build.sh

+18-4
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,21 @@
22

33
set -euo pipefail
44

5-
docker build -t contiv/spec .
6-
cid=$(docker run -itd contiv/spec)
7-
docker cp ${cid}:/contiv/contiv.html .
8-
docker rm -fv ${cid}
5+
IMAGE_NAME="contiv/raml2html"
6+
7+
mkdir -p docs
8+
9+
docker build -t $IMAGE_NAME .
10+
11+
echo "generating netmaster docs"
12+
docker run --rm \
13+
-u $(id -u):$(id -g) \
14+
-v $(pwd):/contiv \
15+
$IMAGE_NAME -i contiv.raml -o docs/contiv.html
16+
17+
echo "generating auth_proxy docs"
18+
docker run --rm \
19+
-u $(id -u):$(id -g) \
20+
-v $(pwd):/contiv \
21+
$IMAGE_NAME -i auth_proxy.raml -o docs/auth_proxy.html
22+

0 commit comments

Comments
 (0)