"
+ # Configures the Kubernetes Gateway API integration.
+ gatewayAPI:
+ # -- Whether to enable the Kubernetes Gateway API related controllers.
+ # Requires that the gateway.networking.k8s.io/v1 resources are installed on the cluster.
+ enabled: false
+ # -- Controller name referred in the GatewayClasses managed by this operator. The value must be a path prefixed by the domain `microgateway.airlock.com`.
+ controllerName: microgateway.airlock.com/gatewayclass-controller
engine:
# Specifies the Airlock Microgateway Engine image.
image:
# -- Image repository from which to pull the Airlock Microgateway Engine image.
repository: "quay.io/airlock/microgateway-engine"
# -- Image tag to pull.
- tag: "4.3.4"
+ tag: "4.4.0"
# -- SHA256 image digest to pull (in the format "sha256:a3051f42d3013813b05f7513bb86ed6a3209cb3003f1bb2f7b72df249aa544d3").
# Overrides tag when specified.
- digest: "sha256:91e05c509bed3b51ff4888d7475980d56cbc85db121aa766d1bde413204f9070"
+ digest: "sha256:c29adf07e7536b72447ea694d0e19fe19235306c26d412a9abc43e4dd99b84c8"
# -- Pull policy for this image.
pullPolicy: IfNotPresent
# -- Resource restrictions to apply to the Airlock Microgateway Engine container.
@@ -141,21 +148,29 @@ networkValidator:
repository: "cgr.dev/chainguard/netcat"
# -- Image tag to pull.
tag: ""
- # -- SHA256 image digest to pull (in the format "sha256:7a73d4b82a2d4165bbc5efa55de4fee9d43f2b1c1edb3505cdc8afd1361bad9b").
+ # -- SHA256 image digest to pull (in the format "sha256:05585644690678ae6453ab12e3a5f899e7be5ab70f56c6bf1c4484d3b53587d2").
# Overrides tag when specified.
- digest: "sha256:7a73d4b82a2d4165bbc5efa55de4fee9d43f2b1c1edb3505cdc8afd1361bad9b"
+ digest: "sha256:05585644690678ae6453ab12e3a5f899e7be5ab70f56c6bf1c4484d3b53587d2"
# -- Pull policy for this image.
pullPolicy: IfNotPresent
+ # -- Resource restrictions to apply to the Airlock Microgateway Network Validator init-container.
+ resources:
+ limits:
+ cpu: 25m
+ memory: 12Mi
+ requests:
+ cpu: 5m
+ memory: 1Mi
sessionAgent:
# Specifies the Airlock Microgateway Session Agent image.
image:
# -- Image repository from which to pull the Airlock Microgateway Session Agent image.
repository: "quay.io/airlock/microgateway-session-agent"
# -- Image tag to pull.
- tag: "4.3.4"
+ tag: "4.4.0"
# -- SHA256 image digest to pull (in the format "sha256:a3051f42d3013813b05f7513bb86ed6a3209cb3003f1bb2f7b72df249aa544d3").
# Overrides tag when specified.
- digest: "sha256:df4e50d0929cb4c5e4486452979b59ec17f5e49a1516b685acd3a1ab0ddb3cf4"
+ digest: "sha256:fbb90f2a52bb1b19cca6c5c133e80331153c019ec905db052c250fedbb09c3bc"
# -- Pull policy for this image.
pullPolicy: IfNotPresent
# -- Resource restrictions to apply to the Airlock Microgateway Session Agent container.
@@ -205,6 +220,15 @@ dashboards:
blockLogs:
# -- Whether to create the block logs dashboard.
create: true
+ headerLogs:
+ # -- Whether to create the header rewrite logs dashboard.
+ create: true
+ logOnlyMetrics:
+ # -- Whether to create the log only metrics dashboard
+ create: true
+ logOnlyLogs:
+ # -- Whether to create the log only logs dashboard.
+ create: true
# Check whether the installation of the Airlock Microgateway Helm Chart was successful.
# Requires a secret with a valid Airlock Microgateway license key already to be present.
tests:
diff --git a/examples/README.md b/examples/README.md
index f34c035..3afdc38 100644
--- a/examples/README.md
+++ b/examples/README.md
@@ -1,4 +1,2 @@
# Description
-The following folders contain example configurations and utility manifest files. This should help to get started with Airlock Microgateway.
-* `configurations`: Folder that contains examples on how to protect an application with Airlock Microgateway.
-* `utilities`: Contains utility manifests, like backends and prerequisites for the Airlock Microgateway Operator Deployment.
\ No newline at end of file
+The following folders contain example configurations. This should help to get started with Airlock Microgateway.
\ No newline at end of file
diff --git a/examples/configurations/basic/README.md b/examples/configurations/basic/README.md
deleted file mode 100644
index ad40588..0000000
--- a/examples/configurations/basic/README.md
+++ /dev/null
@@ -1,43 +0,0 @@
-# Description
-This folder contains the most basic example to get started with an almost empty `SidecarGateway` CR that will protect the `nginx` backend. The backend is defined in `examples/utilities/backends/nginx-protected`.
-
-* Execute
- ```
- kubectl apply -k https://github.com/airlock/microgateway/examples/configurations/basic/
- ```
- to deploy the application.
-
-
-* Perform a test call
-
- *Request*
- ```
- kubectl run test-caller --image=curlimages/curl --rm --restart=Never -i --tty --command -- curl -v "http://nginx:8080/"
- ```
-
- *Output*
- ```
-
-
-
- Welcome to nginx!
-
-
-
- Welcome to nginx!
- If you see this page, the nginx web server is successfully installed and
- working. Further configuration is required.
-
- For online documentation and support please refer to
- nginx.org.
- Commercial support is available at
- nginx.com.
-
- Thank you for using nginx.
-
-
- ```
\ No newline at end of file
diff --git a/examples/configurations/basic/kustomization.yaml b/examples/configurations/basic/kustomization.yaml
deleted file mode 100644
index 1737f3f..0000000
--- a/examples/configurations/basic/kustomization.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
- - ../../utilities/backends/nginx-protected
- - sidecargateway.yaml
diff --git a/examples/configurations/basic/sidecargateway.yaml b/examples/configurations/basic/sidecargateway.yaml
deleted file mode 100644
index 5138779..0000000
--- a/examples/configurations/basic/sidecargateway.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: microgateway.airlock.com/v1alpha1
-kind: SidecarGateway
-metadata:
- name: basic
-spec:
- podSelector:
- matchLabels:
- app: nginx
- applications:
- - containerPort: 8080
\ No newline at end of file
diff --git a/examples/configurations/policy/README.md b/examples/configurations/policy/README.md
deleted file mode 100644
index 52c77f8..0000000
--- a/examples/configurations/policy/README.md
+++ /dev/null
@@ -1,56 +0,0 @@
-# Description
-There are different tools available to enforce policies for Kubernetes resources. The most famous ones are Open Policy Agent Gatekeeper, Kyverno or Kubewarden. They allow enforcing constraints on Kubernetes resources which includes the Microgateway CRDs.
-
-Basically, the mentioned tools do the same but in detail, they differ in their policy language, Kubernetes-native integration, possibility to use outside Kubernetes, and integration in CI/CD pipeline. This is why you should check which of them suits best for you and whether you use already one of them.
-
-## Examples
-### Prerequisites
-1. Install the Kyverno operator as described in [utilities/kyverno](/examples/utilities/kyverno/README.md).
-
-2. Apply the Kyverno policy:
-```
-kubectl apply -k https://github.com/airlock/microgateway/examples/configurations/policy
-```
-
-
-### Allowed Example
-The following example shows a policy with Kyverno which allows secure deny rules settings.
-
-```
-kubectl apply -k https://github.com/airlock/microgateway/examples/configurations/policy/allowed
-```
-
-Output
-```
-denyrules.microgateway.airlock.com/denyrule1-ok created
-denyrules.microgateway.airlock.com/denyrule2-ok created
-```
-
-### Denied Example
-This following example shows a policy with Kyverno which denies insecure deny rules settings.
-
-```
-kubectl apply -k https://github.com/airlock/microgateway/examples/configurations/policy/denied
-```
-
-Output
-```
-Error from server: error when creating "https://github.com/airlock/microgateway/examples/configurations/policy/denied/denyrules-1.yaml": admission webhook "validate.kyverno.svc-fail" denied the request:
-
-resource DenyRules/default/denyrule1-nok was blocked due to the following policies
-
-disallow-insecure-denyrules:
- disallow-insecure-threatHandlingMode: 'DenyRules with ''threatHandlingMode'' other
- than ''Block'' is not allowed. '
-
-Error from server: error when creating "https://github.com/airlock/microgateway/examples/configurations/policy/denied/denyrules-2.yaml": admission webhook "validate.kyverno.svc-fail" denied the request:
-
-resource DenyRules/default/denyrule2-nok was blocked due to the following policies
-
-disallow-insecure-denyrules:
- disallow-denyRules-with-insecure-security-level: 'DenyRules with ''level'' other
- than ''Standard'' or ''Strict'' is not allowed. '
-
-```
-
-For detailed information consult the [documentation](https://docs.airlock.com/microgateway/nightly/#data/1668421866273.html).
\ No newline at end of file
diff --git a/examples/configurations/policy/allowed/denyrules-1.yaml b/examples/configurations/policy/allowed/denyrules-1.yaml
deleted file mode 100644
index 199ff75..0000000
--- a/examples/configurations/policy/allowed/denyrules-1.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: microgateway.airlock.com/v1alpha1
-kind: DenyRules
-metadata:
- annotations:
- name: denyrule1-ok
-spec:
- request:
- builtIn:
- settings:
- level: Strict
- threatHandlingMode: Block
diff --git a/examples/configurations/policy/allowed/denyrules-2.yaml b/examples/configurations/policy/allowed/denyrules-2.yaml
deleted file mode 100644
index 7f9088a..0000000
--- a/examples/configurations/policy/allowed/denyrules-2.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: microgateway.airlock.com/v1alpha1
-kind: DenyRules
-metadata:
- annotations:
- name: denyrule2-ok
-spec:
- request:
- builtIn:
- settings:
- threatHandlingMode: Block
diff --git a/examples/configurations/policy/allowed/kustomization.yaml b/examples/configurations/policy/allowed/kustomization.yaml
deleted file mode 100644
index f315f93..0000000
--- a/examples/configurations/policy/allowed/kustomization.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
- - denyrules-1.yaml
- - denyrules-2.yaml
diff --git a/examples/configurations/policy/denied/denyrules-1.yaml b/examples/configurations/policy/denied/denyrules-1.yaml
deleted file mode 100644
index fb8f1a0..0000000
--- a/examples/configurations/policy/denied/denyrules-1.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: microgateway.airlock.com/v1alpha1
-kind: DenyRules
-metadata:
- annotations:
- name: denyrule1-nok
-spec:
- request:
- builtIn:
- settings:
- level: Strict
- threatHandlingMode: LogOnly
diff --git a/examples/configurations/policy/denied/denyrules-2.yaml b/examples/configurations/policy/denied/denyrules-2.yaml
deleted file mode 100644
index 488b498..0000000
--- a/examples/configurations/policy/denied/denyrules-2.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: microgateway.airlock.com/v1alpha1
-kind: DenyRules
-metadata:
- annotations:
- name: denyrule2-nok
-spec:
- request:
- builtIn:
- settings:
- level: Basic
- threatHandlingMode: Block
diff --git a/examples/configurations/policy/denied/kustomization.yaml b/examples/configurations/policy/denied/kustomization.yaml
deleted file mode 100644
index f315f93..0000000
--- a/examples/configurations/policy/denied/kustomization.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
- - denyrules-1.yaml
- - denyrules-2.yaml
diff --git a/examples/configurations/policy/kustomization.yaml b/examples/configurations/policy/kustomization.yaml
deleted file mode 100644
index 5ab8995..0000000
--- a/examples/configurations/policy/kustomization.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
- - kyverno-policy.yaml
diff --git a/examples/configurations/policy/kyverno-policy.yaml b/examples/configurations/policy/kyverno-policy.yaml
deleted file mode 100644
index 6acc2ca..0000000
--- a/examples/configurations/policy/kyverno-policy.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
- name: disallow-insecure-denyrules
- annotations:
- policies.kyverno.io/title: Disallow insecure DenyRules
- policies.kyverno.io/category: Security
- policies.kyverno.io/severity: high
- kyverno.io/kyverno-version: 1.6.0
- policies.kyverno.io/minversion: 1.6.0
- kyverno.io/kubernetes-version: "1.20"
- policies.kyverno.io/subject: DenyRules
- policies.kyverno.io/description: >-
- Description: Disallow insecure DenyRules settings for 'threatHandlingMode', security 'level', ...
- Contact: security@company.com
-spec:
- validationFailureAction: Enforce
- background: true
- rules:
- - name: disallow-insecure-threatHandlingMode
- match:
- any:
- - resources:
- kinds:
- - microgateway.airlock.com/v1alpha1/DenyRules
- preconditions:
- all:
- - key: "{{ request.operation || 'BACKGROUND' }}"
- operator: NotEquals
- value: DELETE
- validate:
- message: >-
- DenyRules with 'threatHandlingMode' other than 'Block' is not allowed.
- deny:
- conditions:
- all:
- - key: "{{ request.object.spec.request.builtIn.settings.threatHandlingMode }}"
- operator: AnyNotIn
- value:
- - Block
- - name: disallow-denyRules-with-insecure-security-level
- match:
- any:
- - resources:
- kinds:
- - microgateway.airlock.com/v1alpha1/DenyRules
- preconditions:
- all:
- - key: "{{ request.operation || 'BACKGROUND' }}"
- operator: NotEquals
- value: DELETE
- validate:
- message: >-
- DenyRules with 'level' other than 'Standard' or 'Strict' is not allowed.
- deny:
- conditions:
- all:
- - key: "{{ request.object.spec.request.builtIn.settings.level }}"
- operator: AnyNotIn
- value:
- - Standard
- - Strict
diff --git a/examples/configurations/templating/README.md b/examples/configurations/templating/README.md
deleted file mode 100644
index b780540..0000000
--- a/examples/configurations/templating/README.md
+++ /dev/null
@@ -1,17 +0,0 @@
-# Description
-This folder contains example manifest files to be used with kustomize for the templating use-case. With this use-case one defines a base template (analogous to the `templates` folder) that contains the base configuration,
-which can be reused by a varity of application deployments. To override configuration elements of the template, apply a kustomization manifest file on top of the template (See [kustomize](https://kustomize.io/) for more information).
-The folder `templates` contains the template manifest files that are referenced in the `kustomization.yaml` file which applies various patches to the resources. Instead of a folder it is possible to reference a git repository which contains the templates. To use a remote target change the `resources` in the kustomization file as follows:
-
-local folder
-```yaml
-resources:
- - templates
-```
-remote target
-```yaml
-resources:
- - https://github.com/your-organisation/repository/templates/
-```
-
-For detailed information consult the [documentation](https://docs.airlock.com/microgateway/latest/#data/1668421864983.html).
\ No newline at end of file
diff --git a/examples/configurations/templating/kustomization.yaml b/examples/configurations/templating/kustomization.yaml
deleted file mode 100644
index 3c7b7a3..0000000
--- a/examples/configurations/templating/kustomization.yaml
+++ /dev/null
@@ -1,79 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
- - templates
-
-commonAnnotations:
- mycompany.com/owner: "Project X"
- mycompany.com/contact: "+41 00 123 45 67"
-
-commonLabels:
- app.kubernetes.io/name: my-application
- app.kubernetes.io/part-of: my-application-i-belong-too
-
-patchesJSON6902:
- - target:
- group: microgateway.airlock.com
- version: v1alpha1
- kind: SidecarGateway
- name: template
- patch: |-
- - op: replace
- path: /metadata/name
- value: my-app
- - op: replace
- path: /spec/podSelector/matchLabels/app
- value: my-app-label
- - op: replace
- path: /spec/applications
- value:
- - containerPort: 8080
- routes:
- - pathPrefix: /
- secured:
- contentSecurityRef:
- name: my-app
- - target:
- group: microgateway.airlock.com
- version: v1alpha1
- kind: ContentSecurity
- name: template
- patch: |-
- - op: replace
- path: /metadata/name
- value: my-app
- - op: replace
- path: /spec/filter/denyRulesRef/name
- value: my-app
- - op: replace
- path: /spec/headerRewritesRef/name
- value: my-app
- - target:
- group: microgateway.airlock.com
- version: v1alpha1
- kind: DenyRules
- name: template
- patch: |-
- - op: replace
- path: /metadata/name
- value: my-app
- - op: add
- path: /spec/request/builtIn/exceptions
- value:
- - blockedData:
- header:
- name:
- matcher:
- exact: User-Agent
- ruleKeys:
- - XSS
- - target:
- group: microgateway.airlock.com
- version: v1alpha1
- kind: HeaderRewrites
- name: template
- patch: |-
- - op: replace
- path: /metadata/name
- value: my-app
\ No newline at end of file
diff --git a/examples/configurations/templating/templates/contentsecurity.yaml b/examples/configurations/templating/templates/contentsecurity.yaml
deleted file mode 100644
index 49160be..0000000
--- a/examples/configurations/templating/templates/contentsecurity.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: microgateway.airlock.com/v1alpha1
-kind: ContentSecurity
-metadata:
- name: template
-spec:
- filter:
- denyRulesRef:
- name: template
- headerRewritesRef:
- name: template
\ No newline at end of file
diff --git a/examples/configurations/templating/templates/denyrules.yaml b/examples/configurations/templating/templates/denyrules.yaml
deleted file mode 100644
index bccaaec..0000000
--- a/examples/configurations/templating/templates/denyrules.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: microgateway.airlock.com/v1alpha1
-kind: DenyRules
-metadata:
- name: template
-spec:
- request:
- builtIn:
- settings:
- level: Standard
- threatHandlingMode: Block
\ No newline at end of file
diff --git a/examples/configurations/templating/templates/headerrewrites.yaml b/examples/configurations/templating/templates/headerrewrites.yaml
deleted file mode 100644
index 96b0a60..0000000
--- a/examples/configurations/templating/templates/headerrewrites.yaml
+++ /dev/null
@@ -1,83 +0,0 @@
-apiVersion: microgateway.airlock.com/v1alpha1
-kind: HeaderRewrites
-metadata:
- name: template
-spec:
- request:
- allow:
- matchingHeaders:
- builtIn:
- standardHeaders: true
- custom:
- - name: Allow additional request header
- headers:
- - name:
- matcher:
- exact: Accept-Auth
- - name:
- matcher:
- exact: Depth
- - name:
- matcher:
- exact: Destination
- - name:
- matcher:
- exact: If
- - name:
- matcher:
- exact: Lock-Token
- - name:
- matcher:
- exact: Overwrite
- - name:
- matcher:
- exact: Timeout
- - name:
- matcher:
- exact: translate
- - name:
- matcher:
- exact: X-FeatureVersion
- - name:
- matcher:
- exact: X-IDCRL_ACCEPTED
- - name:
- matcher:
- exact: X-IDCRL_OPTIONS
- - name:
- matcher:
- exact: X-MSGETWEBURL
- - name:
- matcher:
- exact: X-MS-CookieUri-Requested
- - name:
- matcher:
- exact: X-Office-Major-Version
- - name:
- matcher:
- exact: Content-Length
- remove:
- builtIn:
- alternativeForwardedHeaders: true
- response:
- add:
- builtIn:
- csp: true
- featurePolicy: true
- permissionsPolicy: true
- hsts: true
- hstsPreload: false
- referrerPolicy: true
- xContentTypeOptions: true
- xFrameOptions: true
- allow:
- matchingHeaders:
- builtIn:
- standardHeaders: false
- remove:
- builtIn:
- auth:
- basic: false
- negotiate: true
- ntlm: true
- permissiveCors: true
\ No newline at end of file
diff --git a/examples/configurations/templating/templates/kustomization.yaml b/examples/configurations/templating/templates/kustomization.yaml
deleted file mode 100644
index 1f43e61..0000000
--- a/examples/configurations/templating/templates/kustomization.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
- - sidecargateway.yaml
- - contentsecurity.yaml
- - headerrewrites.yaml
- - denyrules.yaml
-
-commonLabels:
- app.kubernetes.io/template-version: 1.0.1
- app.kubernetes.io/version: 4.0.0
- app.kubernetes.io/component: airlock-microgateway
\ No newline at end of file
diff --git a/examples/configurations/templating/templates/sidecargateway.yaml b/examples/configurations/templating/templates/sidecargateway.yaml
deleted file mode 100644
index 311d8a9..0000000
--- a/examples/configurations/templating/templates/sidecargateway.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-apiVersion: microgateway.airlock.com/v1alpha1
-kind: SidecarGateway
-metadata:
- name: template
-spec:
- podSelector:
- matchLabels:
- app:
- applications:
- - containerPort:
- routes:
- - pathPrefix: /
- secured:
- contentSecurityRef:
- name: template
\ No newline at end of file
diff --git a/examples/gateway-api/conformance/conformance.md b/examples/gateway-api/conformance/conformance.md
new file mode 100644
index 0000000..517af1c
--- /dev/null
+++ b/examples/gateway-api/conformance/conformance.md
@@ -0,0 +1,53 @@
+# Gateway API conformance of Airlock Microgateway
+
+## Prerequisites
+* [Airlock Microgateway License](#obtain-airlock-microgateway-license)
+* [cert-manager](https://cert-manager.io/)
+* [helm](https://helm.sh/docs/intro/install/) (>= v3.8.0)
+
+In order to use Airlock Microgateway you need a license and the cert-manager. You may either request a community license free of charge or purchase a premium license.
+For an easy start in non-production environments, you may deploy the same cert-manager we are using internally for testing.
+### Obtain Airlock Microgateway License
+1. Either request a community or premium license
+ * Community license: [airlock.com/microgateway-community](https://airlock.com/en/microgateway-community)
+ * Premium license: [airlock.com/microgateway-premium](https://airlock.com/en/microgateway-premium)
+2. Check your inbox and save the license file microgateway-license.txt locally.
+
+> See [Community vs. Premium editions in detail](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) to choose the right license type.
+### Deploy cert-manager
+```bash
+helm repo add jetstack https://charts.jetstack.io
+helm install cert-manager jetstack/cert-manager --version 'v1.16.1' -n cert-manager --create-namespace --set crds.enabled=true --wait
+```
+
+## Deploy Airlock Microgateway Operator
+
+> This guide assumes a microgateway-license.txt file is present in the working directory.
+
+1. Install CRDs and Operator.
+ ```bash
+ # Create namespace
+ kubectl create namespace airlock-microgateway-system
+
+ # Install License
+ kubectl -n airlock-microgateway-system create secret generic airlock-microgateway-license --from-file=microgateway-license.txt
+
+ # Install the operator and activate the Gateway API support.
+ helm install -n airlock-microgateway-system airlock-microgateway oci://quay.io/airlockcharts/microgateway --wait --version '4.4.0' --set=operator.gatewayAPI.enabled=true
+ ```
+
+2. Verify that the operator started successfully:
+ ```bash
+ kubectl -n airlock-microgateway-system wait --for=condition=Available deployments --all --timeout=3m
+ ```
+
+3. Deploy manifests (GatewayClass, ServiceAccount and ClusterRoleBinding) and run Job to generate report
+ ```bash
+ kubectl apply -f manifests/conformance-report.yaml
+ ```
+
+4. After running, see the conformance report:
+ ```bash
+ kubectl logs jobs/gateway-conformance-tests -f
+ ```
+
diff --git a/examples/gateway-api/conformance/manifests/conformance-report.yaml b/examples/gateway-api/conformance/manifests/conformance-report.yaml
new file mode 100644
index 0000000..4eefb08
--- /dev/null
+++ b/examples/gateway-api/conformance/manifests/conformance-report.yaml
@@ -0,0 +1,71 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+ name: gateway-conformance
+spec:
+ controllerName: microgateway.airlock.com/gatewayclass-controller
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+ name: gateway-conformance-tests
+spec:
+ template:
+ spec:
+ initContainers:
+ - name: git-checkout
+ image: bitnami/git:latest
+ command:
+ - sh
+ - -c
+ - |
+ cd /workspace
+
+ git clone https://github.com/kubernetes-sigs/gateway-api.git --branch v1.1.0
+ volumeMounts:
+ - name: workspace
+ mountPath: /workspace
+ containers:
+ - name: go-test
+ image: golang:1.23.2-alpine
+ command:
+ - sh
+ - -c
+ - |
+ cd /workspace/gateway-api
+
+ go test ./conformance -run TestConformance -args \
+ --supported-features=Gateway,GatewayPort8080,HTTPRoute,HTTPRouteBackendProtocolH2C,HTTPRouteBackendProtocolWebSocket,HTTPRouteDestinationPortMatching,HTTPRouteMethodMatching,HTTPRouteParentRefPort,HTTPRouteQueryParamMatching,ReferenceGrant \
+ --organization=airlock --project=microgateway --url="https://github.com/airlock/microgateway" --version=v4.4.0 --contact="https://www.airlock.com/en/contact" \
+ --conformance-profiles=GATEWAY-HTTP \
+ --report-output=/workspace/conformance-profile.yaml
+
+ cat /workspace/conformance-profile.yaml
+ volumeMounts:
+ - name: workspace
+ mountPath: /workspace
+ volumes:
+ - name: workspace
+ emptyDir: {}
+ serviceAccountName: gateway-conformance-tests
+ restartPolicy: Never
+ backoffLimit: 0
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: gateway-conformance-tests
+ namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+ name: gateway-conformance-tests
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: cluster-admin
+subjects:
+ - kind: ServiceAccount
+ name: gateway-conformance-tests
+ namespace: default
\ No newline at end of file
diff --git a/examples/utilities/backends/README.md b/examples/utilities/backends/README.md
deleted file mode 100644
index a318afb..0000000
--- a/examples/utilities/backends/README.md
+++ /dev/null
@@ -1,5 +0,0 @@
-# Description
-This folder contains example backends which can be deployed and protected by Airlock Microgateway.
-
-The folder with the '-protected' suffix already contains the required Kubernetes annotation in order to be protected by Airlock Microgateway.
-Please note that additional configuration like CustomResources SidecarGateway are required. Please consult the [documentation](https://docs.airlock.com/microgateway/latest/) for detailed instructions.
diff --git a/examples/utilities/backends/nginx-protected/kustomization.yaml b/examples/utilities/backends/nginx-protected/kustomization.yaml
deleted file mode 100644
index 6738404..0000000
--- a/examples/utilities/backends/nginx-protected/kustomization.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-resources:
- - ../nginx
-
-components:
- - ../../../components/mgw-injection
diff --git a/examples/utilities/backends/nginx/common.conf b/examples/utilities/backends/nginx/common.conf
deleted file mode 100644
index 7eba9a8..0000000
--- a/examples/utilities/backends/nginx/common.conf
+++ /dev/null
@@ -1,15 +0,0 @@
-location / {
- root /usr/share/nginx/html;
- index index.html index.htm;
-
- # Serve index.html for all paths
- try_files $uri /index.html;
-}
-
-# Hack to allow POST on static pages
-error_page 405 =200 $uri;
-
-error_page 500 502 503 504 /50x.html;
-location = /50x.html {
- root /usr/share/nginx/html;
-}
diff --git a/examples/utilities/backends/nginx/default.conf b/examples/utilities/backends/nginx/default.conf
deleted file mode 100644
index 2422a19..0000000
--- a/examples/utilities/backends/nginx/default.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-server {
- listen 8080;
- listen [::]:8080;
- server_name localhost;
-
- include /etc/nginx/server.conf.d/*.conf;
-}
diff --git a/examples/utilities/backends/nginx/deployment.yaml b/examples/utilities/backends/nginx/deployment.yaml
deleted file mode 100644
index 3ddfec3..0000000
--- a/examples/utilities/backends/nginx/deployment.yaml
+++ /dev/null
@@ -1,59 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
- labels:
- app: backend
- name: nginx
-spec:
- replicas: 1
- selector:
- matchLabels:
- app: backend
- template:
- metadata:
- labels:
- app: backend
- spec:
- containers:
- - image: nginxinc/nginx-unprivileged:1.23-alpine
- name: nginx
- ports:
- - containerPort: 8080
- securityContext:
- allowPrivilegeEscalation: false
- privileged: false
- runAsNonRoot: true
- capabilities:
- drop: [ "ALL" ]
- readOnlyRootFilesystem: true
- seccompProfile:
- type: RuntimeDefault
- volumeMounts:
- - name: config-volume
- mountPath: /etc/nginx/nginx.conf
- subPath: nginx.conf
- readOnly: true
- - name: config-include-volume
- mountPath: /etc/nginx/conf.d
- readOnly: true
- - name: server-config-include-volume
- mountPath: /etc/nginx/server.conf.d
- readOnly: true
- - name: run
- mountPath: /var/run/
- - name: tmp
- mountPath: /tmp
- volumes:
- - name: config-volume
- configMap:
- name: nginx-config
- - name: config-include-volume
- configMap:
- name: nginx-default-config
- - name: server-config-include-volume
- configMap:
- name: nginx-server-config
- - name: run
- emptyDir: {}
- - name: tmp
- emptyDir: {}
diff --git a/examples/utilities/backends/nginx/kustomization.yaml b/examples/utilities/backends/nginx/kustomization.yaml
deleted file mode 100644
index 442520a..0000000
--- a/examples/utilities/backends/nginx/kustomization.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-resources:
-- deployment.yaml
-- service.yaml
-
-configMapGenerator:
-- name: nginx-config
- files:
- - nginx.conf
-- name: nginx-default-config
- files:
- - default.conf
-- name: nginx-server-config
- files:
- - common.conf
-
-generatorOptions:
- disableNameSuffixHash: true
diff --git a/examples/utilities/backends/nginx/nginx.conf b/examples/utilities/backends/nginx/nginx.conf
deleted file mode 100644
index c055a92..0000000
--- a/examples/utilities/backends/nginx/nginx.conf
+++ /dev/null
@@ -1,64 +0,0 @@
-# Patched Parts
-# * error_log
-# * access_log
-# * http.log_format
-worker_processes auto;
-
-error_log /dev/stderr debug;
-pid /tmp/nginx.pid;
-
-events {
- worker_connections 1024;
-}
-
-http {
-
- log_format main escape=json '{'
- '"timestamp": "$time_iso8601", '
- '"req_id": "$request_id", '
- '"upstream_status": "$upstream_status", '
- '"upstream_addr": "$upstream_addr", '
- '"http_req":{ '
- ' "http_method": "$request_method", '
- ' "entry_url": "$scheme://$host$request_uri", '
- ' "entry_path": "$request_uri", '
- ' "entry_query": "$query_string", '
- ' "http_status": $status, '
- ' "vhost_proto":"$scheme", '
- ' "vhost_proto_vers": "$server_protocol", '
- ' "http_user_agent": "$http_user_agent", '
- ' "http_referrer": "$http_referer", '
- ' "http_content_type": "$content_type", '
- ' "http_host": "$host", '
- ' "http_x_request_id": "$http_x_request_id", '
- ' "req_size": "$request_length", '
- ' "resp_size": "$upstream_response_length", '
- ' "time_resp": "$upstream_response_time s", '
- ' "client_ip": "$remote_addr", '
- ' "front_src_ip": "$http_x_forwarded_for", '
- ' "front_src_port": "$remote_port", '
- ' "front_dst_port": "$server_port", '
- ' "front_tls_proto": "$ssl_protocol", '
- ' "front_tls_cipher": "$ssl_cipher" '
- '}}';
-
- proxy_temp_path /tmp/proxy_temp;
- client_body_temp_path /tmp/client_temp;
- fastcgi_temp_path /tmp/fastcgi_temp;
- uwsgi_temp_path /tmp/uwsgi_temp;
- scgi_temp_path /tmp/scgi_temp;
-
- include /etc/nginx/mime.types;
- default_type application/octet-stream;
-
- access_log /dev/stdout main;
-
- sendfile on;
-
- keepalive_timeout 65;
-
- # Disable body size limit
- client_max_body_size 0;
-
- include /etc/nginx/conf.d/*.conf;
-}
diff --git a/examples/utilities/backends/nginx/service.yaml b/examples/utilities/backends/nginx/service.yaml
deleted file mode 100644
index 1de3fbf..0000000
--- a/examples/utilities/backends/nginx/service.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
- labels:
- app: backend
- name: backend
-spec:
- ports:
- - name: http
- port: 8080
- protocol: TCP
- selector:
- app: backend
- type: NodePort
diff --git a/examples/utilities/kyverno/.gitignore b/examples/utilities/kyverno/.gitignore
deleted file mode 100644
index 80bf7fc..0000000
--- a/examples/utilities/kyverno/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-charts
\ No newline at end of file
diff --git a/examples/utilities/kyverno/README.md b/examples/utilities/kyverno/README.md
deleted file mode 100644
index 8a4b943..0000000
--- a/examples/utilities/kyverno/README.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# Description
-Airlock Microgateway can be used together with [kyverno](https://kyverno.io/).
-
-For an easy start in non-production environments, you may deploy the same kyverno operator we are using internally for testing.
-
-```
-helm repo add kyverno https://kyverno.github.io/kyverno/
-helm install kyverno kyverno/kyverno --version '3.2.5' -n kyverno --create-namespace --wait -f https://raw.githubusercontent.com/airlock/microgateway/main/examples/utilities/kyverno/values.yaml
-```
diff --git a/examples/utilities/kyverno/values.yaml b/examples/utilities/kyverno/values.yaml
deleted file mode 100644
index 3a1fe5c..0000000
--- a/examples/utilities/kyverno/values.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-config:
- resourceFiltersExcludeNamespaces:
- - "kube-system"
- webhooks: null
\ No newline at end of file