Skip to content

Commit

Permalink
Refactor/conf (Kong#1297)
Browse files Browse the repository at this point in the history
Adding missing properties to the configuration file.
  • Loading branch information
subnetmarco committed Jun 8, 2016
1 parent e85881e commit 85b2d3e
Show file tree
Hide file tree
Showing 6 changed files with 308 additions and 103 deletions.
205 changes: 162 additions & 43 deletions kong.conf.default
Original file line number Diff line number Diff line change
@@ -1,47 +1,166 @@
#admin_listen = 0.0.0.0:8001
#proxy_listen = 0.0.0.0:8000

#log_level = notice

#ssl = off
#ssl_cert =
#ssl_cert_key =
#proxy_listen_ssl = 0.0.0.0:8443

#custom_plugins =

#cluster_listen = 0.0.0.0:7946
#cluster_listen_rpc = 127.0.0.1:7373
#cluster_advertise =
#cluster_secret =

#database = postgres

#pg_host = 127.0.0.1
#pg_port = 5432
#pg_user = kong
#pg_password = kong
#pg_database = kong

#cassandra_contact_points = 127.0.0.1:9042
#cassandra_keyspace = kong
#cassandra_repl_strategy = SimpleStrategy
#cassandra_repl_factor = 1
#cassandra_data_centers = dc1:2,dc2:3
#cassandra_timeout = 5000
#cassandra_consistency = ONE
# Kong configuration file.
#
# All commented values are default values. Uncomment and update a property to
# configure it.

# The Kong working directory. The directory will contain Kong process files and
# logs. Each Kong process on the machine must have a separate working directory.
# prefix = /usr/local/kong/

################################## NETWORK #####################################

# This section determines the network settings for Kong. By default Kong listens
# for connections from all the network interfaces available on the server.

# Address and port on which the server will accept HTTP requests, consumers will
# make requests on this port.
# proxy_listen = 0.0.0.0:8000

# Same as proxy_listen, but for HTTPS requests.
# proxy_listen_ssl = 0.0.0.0:8443

# Address and port on which the admin API will listen to. The admin API is a
# private API which lets you manage your Kong infrastructure. It needs to be
# secured appropriately.
# admin_listen = 0.0.0.0:8001

# Address and port used by the node to communicate with other Kong nodes in the
# cluster with both UDP and TCP messages. All the nodes in the cluster must be
# able to communicate with this node on this address. Only IPv4 addresses are
# allowed (no hostnames).
# cluster_listen = 0.0.0.0:7946

# Address and port used by the node to communicate with the local clustering
# agent (TCP only, and local only). Used internally by this Kong node. Only
# IPv4 addresses are allowed (no hostnames).
# cluster_listen_rpc = 127.0.0.1:7373

################################## DATABASE ####################################

# This section determines the database settings for Kong. Kong will store all of
# its data in either Cassandra or PostgreSQL, and the database selected must be
# reachable by every Kong node in the same cluster.

# Only "cassandra" and "postgres" are currently supported.
# database = postgres

# PostgreSQL connection and security settings.
# pg_host = 127.0.0.1
# pg_port = 5432
# pg_database = kong
# pg_user = kong
# pg_password = kong

# Cassandra connection, replication and security settings.

# Comma separated list of Cassandra hosts
# cassandra_contact_points = 127.0.0.1

# cassandra_port = 9042
# cassandra_keyspace = kong
# cassandra_repl_strategy = SimpleStrategy

# The number of replicas, for "SimpleStrategy" only.
# cassandra_repl_factor = 1

# The number of replicas in each datacenter. For "NetworkTopologyStrategy" only.
# cassandra_data_centers = dc1:2,dc2:3

# cassandra_consistency = ONE

# Connection and reading timeout in milliseconds.
# cassandra_timeout = 5000

# If true, will connect to your Cassandra instance using TLS.
#cassandra_ssl = off
#cassandra_ssl_verify = off
#cassandra_ssl_trusted_cert =
#cassandra_username = kong
#cassandra_password = kong

#dnsmasq = on
#dns_resolver = 127.0.0.1:8053
# If true, will verify the server certificate using the given CA file.
# cassandra_ssl_verify = off
# cassandra_ssl_trusted_cert = NONE

# Cluster authentication options. Provide a user and a password here if your
# cluster uses the "PasswordAuthenticator" scheme.
# cassandra_username = kong
# cassandra_password = kong

################################## CLUSTER #####################################

# Cluster settings for Kong nodes. Every Kong node that points to the same
# database MUST join together to form a Kong Cluster, in both single or multi-DC
# setups. Kong works on the IP layer (hostnames are not supported, only IPs are
# allowed) and it expects a flat network topology without any NAT between the
# datacenters. A common setup is having a VPN between the two datacenters such
# that the "flat" network assumption of Kong is not violated.

# By default, the cluster_listen address is advertised. If the cluster_listen
# host is "0.0.0.0", then the first local, non-loopback, IPv4 address will be
# advertised to the other nodes. However, in some cases (specifically NAT
# traversal), there may be a routable address that cannot be bound to. This flag
# enables gossiping a different address to support this.
# cluster_advertise = NONE

# Key for encrypting network traffic within Kong. Must be a base64-encoded
# 16-byte key.
# cluster_encrypt = NONE

# The TTL (time to live), in seconds, of a node in the cluster when it stops
# sending healthcheck pings, possibly caused by a node or network failure. If
# the node is not able to send a new healthcheck ping before the expiration,
# then new nodes in the cluster will stop attempting to connect to it on
# startup. Should be at least 60.
# cluster_ttl_on_failure = 3600

#################################### DNS #######################################

# By default Kong leverages on dnsmasq to resolve DNS addresses to the upstream
# services by using the system settings in /etc/hosts and /etc/resolv.conf.
# dnsmasq = on

# The port used by dnsmasq, only used locally by Kong.
# dnsmasq_port = 8053

# You can specify and alternate DNS server that Kong will use when proxying
# requests to the final upstream services. You can't simultaneously specify this
# setting and have "dnsmasq = on".
# dns_resolver = NONE

#################################### SSL #######################################

# By default Kong listens on both HTTP and HTTPs, as configured in the
# proxy_listen and proxy_listen_ssl properties. You can optionally enable or
# disable SSL support (note that this may break plugins that are leveraging it).

ssl = on
ssl_cert = NONE
ssl_cert_key = NONE

################################## GENERAL #####################################

# The log level for the events returned by Kong and its services.
# log_level = error

# Comma separated list of additional plugins names to load on this node, used to
# load custom plugins that are not already bundled with Kong.
# Plugins will be loaded from the kong.plugins.{name}.* namespace.
# custom_plugins = NONE

# The path to the SSL certificate and key that Kong will use when listening on
# the proxy_listen_ssl port.
# ssl_cert = NONE
# ssl_cert_key = NONE

# Partecipate in the anonymous report program, which sends anonymous data like
# error stack traces to Mashape, to help improving Kong.
# anonymous_reports = on

# Nginx configuration parameters that will be dynamically set by Kong.
# nginx_daemon = on
# nginx_worker_processes = auto

#anonymous_reports = on
#mem_cache_size = 128m
# Allows Kong to set specific connection and proxying settings in Nginx.
# nginx_optimizations = on

#nginx_daemon = on
#nginx_optimizations = on
#nginx_worker_processes = auto
# The size in MB of the internal preallocated in-memory cache for database
# entities. The default value is `128`, and the potential maximum value is the
# total size of the datastore.
# mem_cache_size = 128m
72 changes: 49 additions & 23 deletions kong/conf_loader.lua
Original file line number Diff line number Diff line change
Expand Up @@ -3,39 +3,47 @@ local DEFAULT_PATHS = {
"/etc/kong/kong.conf"
}

local CONF_SCHEMA = {
-- kong
log_level = {enum = {"debug", "info", "notice", "warn",
"error", "crit", "alert", "emerg"}},

ssl = {typ = "boolean"},

custom_plugins = {typ = "array"},

local CONF_INFERENCES = {

-- forced string inference
proxy_listen = {typ = "string"},
proxy_listen_ssl = {typ = "string"},
admin_listen = {typ = "string"},
cluster_listen = {typ = "string"},
cluster_listen_rpc = {typ = "string"},
cluster_advertise = {typ = "string"},
nginx_worker_processes = {typ = "string"},

-- Other properties
database = {enum = {"postgres", "cassandra"}},
pg_port = {typ = "number"},

cassandra_contact_points = {typ = "array"},
cassandra_port = {typ = "number"},
cassandra_repl_strategy = {enum = {"SimpleStrategy", "NetworkTopologyStrategy"}},
cassandra_repl_factor = {typ = "number"},
cassandra_data_centers = {typ = "array"},
cassandra_timeout = {typ = "number"},
cassandra_consistency = {enum = {"ALL", "EACH_QUORUM", "QUORUM", "LOCAL_QUORUM", "ONE",
"TWO", "THREE", "LOCAL_ONE"}}, -- no ANY: this is R/W
cassandra_timeout = {typ = "number"},
cassandra_ssl = {typ = "boolean"},
cassandra_ssl_verify = {typ = "boolean"},

dnsmasq = {typ = "boolean"},
cluster_ttl_on_failure = {typ = "number"},

anonymous_reports = {typ = "boolean"},
dnsmasq = {typ = "boolean"},
dnsmasq_port = {typ = "number"},

-- ngx_lua
lua_code_cache = {typ = "ngx_boolean"},
ssl = {typ = "boolean"},

-- nginx
log_level = {enum = {"debug", "info", "notice", "warn",
"error", "crit", "alert", "emerg"}},
custom_plugins = {typ = "array"},
anonymous_reports = {typ = "boolean"},
nginx_daemon = {typ = "ngx_boolean"},
nginx_optimizations = {typ = "boolean"},
nginx_worker_processes = {typ = "string"} -- force string inference

lua_code_cache = {typ = "ngx_boolean"}
}

local kong_default_conf = require "kong.templates.kong_defaults"
Expand All @@ -53,14 +61,14 @@ local typ_checks = {
string = function(v) return type(v) == "string" end,
number = function(v) return type(v) == "number" end,
boolean = function(v) return type(v) == "boolean" end,
ngx_boolean = function(v) return v == "on" or v == "off" end,
ngx_boolean = function(v) return v == "on" or v == "off" end
}

local function check_and_infer(conf)
local errors = {}

for k, value in pairs(conf) do
local v_schema = CONF_SCHEMA[k] or {}
local v_schema = CONF_INFERENCES[k] or {}
local typ = v_schema.typ

-- transform {boolean} values ("on"/"off" aliasing to true/false)
Expand Down Expand Up @@ -100,12 +108,30 @@ local function check_and_infer(conf)

-- custom validation
if conf.ssl then
if not conf.ssl_cert then
errors[#errors+1] = "ssl_cert required if SSL enabled"
elseif not conf.ssl_cert_key then
errors[#errors+1] = "ssl_cert_key required if SSL enabled"
if conf.ssl_cert and not conf.ssl_cert_key then
errors[#errors+1] = "ssl_cert_key must be enabled"
elseif (conf.ssl_cert_key and not conf.ssl_cert) then
errors[#errors+1] = "ssl_cert must be enabled"
end
end

if conf.dns_resolver and conf.dnsmasq then
errors[#errors+1] = "when specifying a custom DNS resolver you must turn off dnsmasq"
end

local ipv4_port_pattern = "^(%d+)%.(%d+)%.(%d+)%.(%d+):(%d+)$"
if not conf.cluster_listen:match(ipv4_port_pattern) then
errors[#errors+1] = "cluster_listen must be in the form of IPv4:port"
end
if not conf.cluster_listen_rpc:match(ipv4_port_pattern) then
errors[#errors+1] = "cluster_listen_rpc must be in the form of IPv4:port"
end
if cluster_advertise and not conf.cluster_advertise:match(ipv4_port_pattern) then
errors[#errors+1] = "cluster_advertise must be in the form of IPv4:port"
end
if conf.cluster_ttl_on_failure < 60 then
errors[#errors+1] = "cluster_ttl_on_failure must be at least 60 seconds"
end

return #errors == 0, errors[1], errors
end
Expand Down Expand Up @@ -230,4 +256,4 @@ local function load(path, custom_conf)
return setmetatable(conf, nil) -- remove Map mt
end

return load
return load
Loading

0 comments on commit 85b2d3e

Please sign in to comment.