Skip to content

Commit 619c8ea

Browse files
corneliusludmannroboquat
corneliusludmann
authored and
roboquat
committed
Add OpenVSX proxy component
1 parent 953f1d0 commit 619c8ea

33 files changed

+2070
-1374
lines changed

‎.werft/values.dev.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,6 @@ resources:
2929
# => 32Gi / 100 ~ 328Mi => 350Mi
3030
memory: 350Mi
3131

32-
vsxRegistry:
33-
proxy: true
34-
3532
components:
3633

3734
agentSmith:
@@ -108,6 +105,9 @@ components:
108105
cpu: 1m
109106
ephemeral-storage: 5Gi
110107
memory: 4608Mi # = 2 * 2304Mi
108+
openVsxProxy:
109+
disabled: false
110+
replicas: 2
111111

112112
# Allow per-branch ingress from another, in-cluster proxy
113113
proxy:

‎chart/templates/blobserve-configmap.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,10 @@ data:
3232
"replacements": [
3333
{ "search": "vscode-webview.net", "replacement": "{{ .Values.hostname }}", "path": "/ide/out/vs/workbench/workbench.web.api.js" },
3434
{ "search": "vscode-webview.net", "replacement": "{{ .Values.hostname }}", "path": "/ide/out/vs/workbench/services/extensions/worker/extensionHostWorker.js" }
35-
{{- if .Values.vsxRegistry.proxy }}
36-
, { "search": "open-vsx.org", "replacement": "open-vsx.{{ .Values.hostname }}", "path": "/ide/out/vs/workbench/workbench.web.api.js" }
37-
{{- else if (and .Values.vsxRegistry.host (ne .Values.vsxRegistry.host "open-vsx.org")) }}
38-
, { "search": "open-vsx.org", "replacement": "{{ .Values.vsxRegistry.host }}", "path": "/ide/out/vs/workbench/workbench.web.api.js" }
35+
{{- if not .Values.components.openVsxProxy.disabled }}
36+
, { "search": "https://open-vsx.org", "replacement": "https://open-vsx.{{ .Values.hostname }}", "path": "/ide/out/vs/workbench/workbench.web.api.js" }
37+
{{- else if (and .Values.components.openVsxProxy.vsxRegistryUrl (ne .Values.components.openVsxProxy.vsxRegistryUrl "https://open-vsx.org")) }}
38+
, { "search": "https://open-vsx.org", "replacement": "{{ .Values.components.openVsxProxy.vsxRegistryUrl }}", "path": "/ide/out/vs/workbench/workbench.web.api.js" }
3939
{{- end }}
4040
],
4141
"inlineStatic": [

‎chart/templates/openvsx-proxy-configmap.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
# Licensed under the MIT License. See License-MIT.txt in the project root for license information.
3+
4+
{{ if not .Values.components.openVsxProxy.disabled -}}
5+
apiVersion: v1
6+
kind: ConfigMap
7+
metadata:
8+
name: {{ .Values.components.openVsxProxy.name }}-config
9+
labels:
10+
app: {{ template "gitpod.fullname" $ }}
11+
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
12+
release: "{{ .Release.Name }}"
13+
heritage: "{{ .Release.Service }}"
14+
data:
15+
config.json: |
16+
{
17+
"log_debug": true,
18+
"cache_duration_regular": "{{ .Values.components.openVsxProxy.cacheDurationRegular | default "1m" }}",
19+
"cache_duration_backup": "{{ .Values.components.openVsxProxy.cacheDurationBackup | default "72h" }}",
20+
"url_upstream": "{{ .Values.components.openVsxProxy.vsxRegistryUrl | default "https://open-vsx.org" }}",
21+
"url_local": "https://open-vsx.{{ .Values.hostname }}",
22+
"max_idle_conns": {{ .Values.components.openVsxProxy.maxIdleConns | default "1000" }},
23+
"max_idle_conns_per_host": {{ .Values.components.openVsxProxy.maxIdleConnsPerHost | default "1000" }},
24+
{{ if .Values.components.openVsxProxy.enableRedis }}"redis_addr": "localhost:6379",{{ end }}
25+
"prometheusAddr": ":{{ .Values.components.openVsxProxy.ports.metrics.containerPort | default "9500" }}"
26+
}
27+
{{ if .Values.components.openVsxProxy.enableRedis }}
28+
redis.conf: |
29+
maxmemory {{ .Values.components.openVsxProxy.redisMaxMemory | default "100mb" }}
30+
maxmemory-policy allkeys-lfu
31+
{{ end }}
32+
{{ end }}

‎chart/templates/openvsx-proxy-deny-all-allow-explicit-networkpolicy.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
# Licensed under the MIT License. See License-MIT.txt in the project root for license information.
3+
4+
{{ if .Values.installNetworkPolicies -}}
5+
{{ if not .Values.components.openVsxProxy.disabled -}}
6+
apiVersion: networking.k8s.io/v1
7+
kind: NetworkPolicy
8+
metadata:
9+
name: openvsx-proxy-deny-all-allow-explicit
10+
labels:
11+
app: {{ template "gitpod.fullname" . }}
12+
component: openvsx-proxy
13+
kind: networkpolicy
14+
stage: {{ .Values.installation.stage }}
15+
spec:
16+
podSelector:
17+
matchLabels:
18+
app: {{ template "gitpod.fullname" . }}
19+
component: openvsx-proxy
20+
policyTypes:
21+
- Ingress
22+
ingress:
23+
# Allow access to HTTP on port 8080 from everywhere
24+
- ports:
25+
- protocol: TCP
26+
port: 8080
27+
# Allow prometheus scraping from openvsx-proxy /metrics endpoint
28+
- ports:
29+
- protocol: TCP
30+
port: 9500
31+
from:
32+
- namespaceSelector:
33+
matchLabels:
34+
chart: monitoring
35+
- podSelector:
36+
matchLabels:
37+
app: prometheus
38+
component: server
39+
{{- end -}}
40+
{{- end -}}

‎chart/templates/openvsx-proxy-rolebinding.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
# Licensed under the MIT License. See License-MIT.txt in the project root for license information.
3+
4+
{{ if not .Values.components.openVsxProxy.disabled -}}
5+
kind: RoleBinding
6+
apiVersion: rbac.authorization.k8s.io/v1
7+
metadata:
8+
name: openvsx-proxy
9+
labels:
10+
app: {{ template "gitpod.fullname" . }}
11+
component: openvsx-proxy
12+
kind: role-binding
13+
stage: {{ .Values.installation.stage }}
14+
subjects:
15+
- kind: ServiceAccount
16+
name: openvsx-proxy
17+
roleRef:
18+
kind: ClusterRole
19+
name: {{ .Release.Namespace }}-ns-psp:restricted-root-user
20+
apiGroup: rbac.authorization.k8s.io
21+
{{- end }}
22+
23+
---
24+
25+
{{ if not .Values.components.openVsxProxy.disabled -}}
26+
kind: ClusterRoleBinding
27+
apiVersion: rbac.authorization.k8s.io/v1
28+
metadata:
29+
name: {{ .Release.Namespace }}-openvsx-proxy-kube-rbac-proxy
30+
labels:
31+
app: {{ template "gitpod.fullname" . }}
32+
component: openvsx-proxy
33+
kind: role-binding
34+
stage: {{ .Values.installation.stage }}
35+
subjects:
36+
- kind: ServiceAccount
37+
name: openvsx-proxy
38+
namespace: {{ .Release.Namespace }}
39+
roleRef:
40+
kind: ClusterRole
41+
name: {{ .Release.Namespace }}-kube-rbac-proxy
42+
apiGroup: rbac.authorization.k8s.io
43+
{{- end -}}

‎chart/templates/openvsx-proxy-service.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
# Licensed under the MIT License. See License-MIT.txt in the project root for license information.
3+
4+
{{ template "gitpod.service.default" dict "root" . "gp" .Values "comp" .Values.components.openVsxProxy }}

‎chart/templates/openvsx-proxy-serviceaccount.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
# Licensed under the MIT License. See License-MIT.txt in the project root for license information.
3+
4+
{{ if not .Values.components.openVsxProxy.disabled -}}
5+
apiVersion: v1
6+
kind: ServiceAccount
7+
metadata:
8+
name: openvsx-proxy
9+
labels:
10+
app: {{ template "gitpod.fullname" . }}
11+
component: openvsx-proxy
12+
kind: service-account
13+
stage: {{ .Values.installation.stage }}
14+
{{- end -}}

‎chart/templates/openvsx-proxy-statefulset.yaml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
# Licensed under the MIT License. See License-MIT.txt in the project root for license information.
3+
4+
{{ $comp := .Values.components.openVsxProxy -}}
5+
{{- $this := dict "root" . "gp" $.Values "comp" $comp -}}
6+
{{- if not $comp.disabled -}}
7+
kind: StatefulSet
8+
apiVersion: apps/v1
9+
metadata:
10+
name: openvsx-proxy
11+
labels:
12+
app: {{ template "gitpod.fullname" . }}
13+
component: openvsx-proxy
14+
kind: statefulset
15+
stage: {{ .Values.installation.stage }}
16+
spec:
17+
selector:
18+
matchLabels:
19+
app: {{ template "gitpod.fullname" . }}
20+
component: openvsx-proxy
21+
kind: pod
22+
stage: {{ .Values.installation.stage }}
23+
serviceName: openvsx-proxy
24+
replicas: {{ $comp.replicas | default 1 }}
25+
template:
26+
metadata:
27+
name: openvsx-proxy
28+
labels:
29+
app: {{ template "gitpod.fullname" . }}
30+
component: openvsx-proxy
31+
kind: pod
32+
stage: {{ .Values.installation.stage }}
33+
spec:
34+
{{ include "gitpod.pod.affinity" $this | indent 6 }}
35+
serviceAccount: openvsx-proxy
36+
containers:
37+
- name: openvsx-proxy
38+
image: {{ template "gitpod.comp.imageFull" $this }}
39+
args:
40+
- /config/config.json
41+
readinessProbe:
42+
httpGet:
43+
path: /openvsx-proxy-status
44+
port: 8080
45+
{{ include "gitpod.container.imagePullPolicy" $this | indent 8 }}
46+
{{ include "gitpod.container.resources" $this | indent 8 }}
47+
{{ include "gitpod.container.ports" $this | indent 8 }}
48+
volumeMounts:
49+
- name: config
50+
mountPath: "/config"
51+
{{ include "gitpod.container.defaultEnv" (dict "root" . "gp" $.Values "comp" $comp) | indent 8 }}
52+
{{ if $comp.enableRedis }}
53+
- name: redis
54+
image: redis:6.2
55+
command:
56+
- redis-server
57+
- "/config/redis.conf"
58+
env:
59+
- name: MASTER
60+
value: "true"
61+
ports:
62+
- containerPort: 6379
63+
{{ include "gitpod.container.imagePullPolicy" $this | indent 8 }}
64+
{{ include "gitpod.container.resources" $this | indent 8 }}
65+
volumeMounts:
66+
- mountPath: /config
67+
name: config
68+
- mountPath: /data
69+
name: redis-data
70+
{{ end }}
71+
volumes:
72+
- name: config
73+
configMap:
74+
name: {{ template "gitpod.comp.configMap" $this }}
75+
{{ toYaml .Values.defaults | indent 6 }}
76+
77+
{{ if $comp.enableRedis }}
78+
volumeClaimTemplates:
79+
- metadata:
80+
name: redis-data
81+
labels:
82+
app: {{ template "gitpod.fullname" . }}
83+
component: openvsx-proxy
84+
kind: volumeclaim
85+
stage: {{ .Values.installation.stage }}
86+
spec:
87+
accessModes: [ "ReadWriteOnce" ]
88+
resources:
89+
requests:
90+
storage: 8Gi
91+
{{ end }}
92+
93+
{{ end }}

‎chart/templates/proxy-configmap.yaml‎

Lines changed: 3 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -51,54 +51,15 @@ data:
5151
}
5252
}
5353
{{- end }}
54-
{{- if .Values.vsxRegistry.proxy }}
54+
{{- if not .Values.components.openVsxProxy.disabled }}
5555
vhost.open-vsx: |
56-
# We cache the requests to the VSX registry and in case of an upstream server error we serve the the cached results.
5756
https://open-vsx.{$GITPOD_DOMAIN} {
5857
import enable_log_debug
5958
import remove_server_header
6059
import ssl_configuration
6160
62-
# The http_cache plugin does not allow to cache the HTTP OPTIONS method.
63-
# That's why we simply serve a static respond instead of asking the upstream server.
64-
@options method OPTIONS
65-
header @options {
66-
Access-Control-Allow-Credentials "true"
67-
Access-Control-Allow-Headers "content-type,x-market-client-id,x-market-user-id,x-client-commit,x-client-name,x-client-version,x-machine-id"
68-
Access-Control-Allow-Methods "OPTIONS,GET,POST,PATCH,PUT,DELETE"
69-
Access-Control-Allow-Origin "*"
70-
}
71-
respond @options 204 {
72-
close
73-
}
74-
75-
reverse_proxy {
76-
to https://{{ .Values.vsxRegistry.host | default "open-vsx.org" }}
77-
78-
# health_uri /api/-/search
79-
80-
header_up Host "{{ .Values.vsxRegistry.host | default "open-vsx.org" }}"
81-
header_up -Connection
82-
83-
# Override/remove existing cache control headers from the upstream server.
84-
header_down Cache-Control "max-age=30, public" # cache for 30 seconds
85-
header_down -Vary
86-
header_down -Pragma
87-
header_down -Expires
88-
}
89-
90-
gitpod.body_intercept {
91-
search "{{ .Values.vsxRegistry.host | default "open-vsx.org" }}"
92-
replace "open-vsx.{$GITPOD_DOMAIN}"
93-
}
94-
95-
http_cache {
96-
cache_type file
97-
path /tmp/openvsx-cache
98-
match_path /
99-
match_methods GET HEAD POST
100-
stale_max_age 72h # 3 days
101-
cache_key "{http.request.method} {http.request.host}{http.request.uri.path}?{http.request.uri.query} {http.request.contentlength} {http.request.bodyhash}"
61+
reverse_proxy {
62+
to openvsx-proxy.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:{{.Values.components.openVsxProxy.ports.http.servicePort}}
10263
}
10364
}
10465
{{- end }}

‎chart/templates/server-configmap.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,10 +61,10 @@ data:
6161
"contentServiceAddr": {{ $comp.contentServiceAddr | quote }},
6262
"imageBuilderAddr": {{ $comp.imageBuilderAddr | quote }},
6363
"codeSync": {{ $comp.codeSync | toJson }},
64-
{{- if .Values.vsxRegistry.proxy }}
64+
{{- if not .Values.components.openVsxProxy.disabled }}
6565
"vsxRegistryUrl": "https://open-vsx.{{ .Values.hostname }}",
6666
{{- else }}
67-
"vsxRegistryUrl": "https://{{ .Values.vsxRegistry.host | default "open-vsx.org" }}",
67+
"vsxRegistryUrl": "{{ .Values.components.openVsxProxy.vsxRegistryUrl | default "https://open-vsx.org" }}",
6868
{{- end }}
6969
"enablePayment": {{ $comp.enablePayment }},
7070
"insecureNoDomain": {{ $comp.insecureNoDomain }},

0 commit comments

Comments
 (0)