golang http proxy

.github/workflows/integration.yml

@@ -99,9 +99,6 @@ jobs:
         id: set-architectures
         run: |
           ARCHITECTURES=${{ needs.configure.outputs.architectures }}
-          if [ "${{ matrix.component }}" == "proxy" ]; then
-            ARCHITECTURES=$(echo ${ARCHITECTURES} | sed 's/,linux\/arm\/v7//')
-          fi
           echo "ARCHITECTURES=${ARCHITECTURES}" >> $GITHUB_ENV
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3.2.0

cmd/proxy/doc.go

@@ -0,0 +1,16 @@
+// Copyright 2019-2024 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package proxy contains the logic for the Liqo proxy.
+package main

cmd/proxy/main.go

@@ -0,0 +1,41 @@
+// Copyright 2019-2024 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"context"
+	"flag"
+	"os"
+
+	"k8s.io/klog/v2"
+
+	"github.com/liqotech/liqo/pkg/proxy"
+)
+
+func main() {
+	ctx := context.Background()
+
+	port := flag.Int("port", 8080, "port to listen on")
+	allowedHosts := flag.String("allowed-hosts", "", "comma separated list of allowed hosts")
+
+	flag.Parse()
+
+	p := proxy.New(*allowedHosts, *port)
+
+	if err := p.Start(ctx); err != nil {
+		klog.Error(err)
+		os.Exit(1)
+	}
+}

deployments/liqo/templates/liqo-proxy-deployment.yaml

@@ -36,23 +36,16 @@ spec:
           ports:
           - containerPort: {{ .Values.proxy.config.listeningPort }}
           resources: {{- toYaml .Values.proxy.pod.resources | nindent 12 }}
-          volumeMounts:
-          - mountPath: /etc/envoy/envoy.yaml
-            name: config-volume
-            subPath: config
-          {{- if or .Values.common.extraArgs .Values.proxy.pod.extraArgs }}
           args:
+          - --port={{ .Values.proxy.config.listeningPort }}
+          {{- if or .Values.common.extraArgs .Values.proxy.pod.extraArgs }}
           {{- if .Values.common.extraArgs }}
           {{- toYaml .Values.common.extraArgs | nindent 10 }}
           {{- end }}
           {{- if .Values.proxy.pod.extraArgs }}
           {{- toYaml .Values.proxy.pod.extraArgs | nindent 10 }}
           {{- end }}
           {{- end }}
-      volumes:
-      - name: config-volume
-        configMap:
-          name: {{ include "liqo.prefixedName" $proxyConfig }}
       {{- if ((.Values.common).nodeSelector) }}
       nodeSelector:
       {{- toYaml .Values.common.nodeSelector | nindent 8 }}

docs/advanced/k8s-api-server-proxy.md

@@ -8,7 +8,7 @@ This feature is **internally** used by the [in-band peering](UsagePeeringInBand)
 If you just need to peer two clusters without publicly exposing the Kubernetes API server, you can use the [in-band peering](UsagePeeringInBand).
 ```
 
-The Kubernetes API Server Proxy is an Envoy HTTP server that accepts [HTTP Connect](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT) requests and forwards them to the Kubernetes API Server of the local cluster.
+The Kubernetes API Server Proxy is an HTTP server that accepts [HTTP Connect](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT) requests and forwards them to the Kubernetes API Server of the local cluster.
 It just proxy the requests to the API server and it has no permission on the local cluster.
 This means that, as usual, all the requesters must authenticate with the Kubernetes API Server to access the resources.
 

pkg/proxy/connect.go

@@ -0,0 +1,103 @@
+// Copyright 2019-2024 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package proxy
+
+import (
+	"bufio"
+	"io"
+	"net"
+	"net/http"
+	"time"
+
+	"k8s.io/klog/v2"
+)
+
+func (p *Proxy) handleConnect(c net.Conn) {
+	br := bufio.NewReader(c)
+	req, err := http.ReadRequest(br)
+	if err != nil {
+		klog.Errorf("error reading request: %v", err)
+		return
+	}
+
+	if req.Method != http.MethodConnect {
+		response := &http.Response{
+			StatusCode: http.StatusMethodNotAllowed,
+			ProtoMajor: 1,
+			ProtoMinor: 1,
+		}
+		if err := response.Write(c); err != nil {
+			klog.Errorf("error writing response: %v", err)
+		}
+		if err := c.Close(); err != nil {
+			klog.Errorf("error closing connection: %v", err)
+		}
+		return
+	}
+
+	if !p.isAllowed(req.URL.Host) {
+		klog.Infof("host %s is not allowed", req.URL.Host)
+
+		response := &http.Response{
+			StatusCode: http.StatusForbidden,
+			ProtoMajor: 1,
+			ProtoMinor: 1,
+		}
+		if err := response.Write(c); err != nil {
+			klog.Errorf("error writing response: %v", err)
+		}
+		return
+	}
+
+	klog.Infof("handling CONNECT to %s", req.URL.Host)
+
+	response := &http.Response{
+		StatusCode: 200,
+		ProtoMajor: 1,
+		ProtoMinor: 1,
+	}
+	if err := response.Write(c); err != nil {
+		klog.Errorf("error writing response: %v", err)
+		if err := c.Close(); err != nil {
+			klog.Errorf("error closing connection: %v", err)
+		}
+		return
+	}
+
+	destConn, err := net.DialTimeout("tcp", req.URL.Host, 30*time.Second)
+	if err != nil {
+		response := &http.Response{
+			StatusCode: http.StatusRequestTimeout,
+			ProtoMajor: 1,
+			ProtoMinor: 1,
+		}
+		if err := response.Write(c); err != nil {
+			klog.Errorf("error writing response: %v", err)
+		}
+		return
+	}
+
+	go transfer(destConn, c)
+	go transfer(c, destConn)
+}
+
+func transfer(destination io.WriteCloser, source io.ReadCloser) {
+	defer destination.Close()
+	defer source.Close()
+	_, err := io.Copy(destination, source)
+	if err != nil {
+		klog.Errorf("error copying data: %v", err)
+	}
+}

pkg/proxy/doc.go

@@ -0,0 +1,16 @@
+// Copyright 2019-2024 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package proxy contains the logic for the Liqo proxy.
+package proxy

pkg/proxy/types.go

@@ -0,0 +1,89 @@
+// Copyright 2019-2024 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package proxy
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"strings"
+
+	"k8s.io/klog/v2"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+)
+
+var _ manager.Runnable = &Proxy{}
+
+// Proxy is a simple HTTP Connect proxy.
+type Proxy struct {
+	AllowedHosts []string
+	Port         int
+}
+
+// New creates a new Proxy.
+func New(allowedHosts string, port int) *Proxy {
+	ah := strings.Split(allowedHosts, ",")
+	// remove empty strings
+	for i := 0; i < len(ah); i++ {
+		if ah[i] == "" {
+			ah = append(ah[:i], ah[i+1:]...)
+			i--
+		}
+	}
+
+	return &Proxy{
+		AllowedHosts: ah,
+		Port:         port,
+	}
+}
+
+// Start starts the proxy.
+func (p *Proxy) Start(ctx context.Context) error {
+	klog.Infof("proxy listening on port %d", p.Port)
+	listener, err := net.Listen("tcp", fmt.Sprintf(":%d", p.Port))
+	if err != nil {
+		return err
+	}
+	defer listener.Close()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		default:
+		}
+
+		conn, err := listener.Accept()
+		if err != nil {
+			klog.Errorf("error accepting connection: %v", err)
+			continue
+		}
+
+		go p.handleConnect(conn)
+	}
+}
+
+func (p *Proxy) isAllowed(host string) bool {
+	if len(p.AllowedHosts) == 0 {
+		return true
+	}
+
+	for _, allowedHost := range p.AllowedHosts {
+		if host == allowedHost {
+			return true
+		}
+	}
+	return false
+}