Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ManagementPortMiddleware should support CF_INSTANCE_PORTS #1419

Open
TimHess opened this issue Jan 2, 2025 · 0 comments
Open

ManagementPortMiddleware should support CF_INSTANCE_PORTS #1419

TimHess opened this issue Jan 2, 2025 · 0 comments
Labels
Component/Management Issues related to Steeltoe Management (actuators) ReleaseLine/4.x Identified as a feature/fix for the 4.x release line Type/enhancement New feature or request

Comments

@TimHess
Copy link
Member

TimHess commented Jan 2, 2025

Is your feature request related to a problem? Please describe.

When using cf register-metrics-endpoint APP-NAME PATH --internal-port PORT, HTTP requests aren't actually sent to the port specified, but rather to a proxy port that can be found by parsing the environment variable CF_INSTANCE_PORTS.

Example value of CF_INSTANCE_PORTS from a sample app that is configured for port 8091:

[{\"internal\":8080,\"external_tls_proxy\":61004,\"internal_tls_proxy\":61001},{\"internal\":8080,\"internal_tls_proxy\":61443},{\"internal\":8091,\"external_tls_proxy\":61005,\"internal_tls_proxy\":61002},{\"internal\":2222,\"external_tls_proxy\":61058,\"internal_tls_proxy\":61003}]

Describe the solution you'd like

Steeltoe should evaluate CF_INSTANCE_PORTS and consider one or both of the proxy ports to effectively count as requests to the management port.

Prototype

private static bool IsRequestAllowed(HttpRequest request, ManagementOptions managementOptions, ILogger logger)
{
    if (int.TryParse(managementOptions.Port, CultureInfo.InvariantCulture, out int managementPort) && managementPort > 0)
    {
        bool isManagementPath = request.Path.StartsWithSegments(managementOptions.Path);
        bool isManagementScheme = managementOptions.SslEnabled ? request.Scheme == Uri.UriSchemeHttps : request.Scheme == Uri.UriSchemeHttp;
        bool isManagementPort = request.Host.Port == managementPort;

        string? instancePorts = Environment.GetEnvironmentVariable("CF_INSTANCE_PORTS");

        if (isManagementPort || string.IsNullOrEmpty(instancePorts))
        {
            return isManagementPath ? isManagementScheme && isManagementPort : !isManagementScheme || !isManagementPort;
        }

        var portMappings = JsonSerializer.Deserialize<List<PortMapping>>(instancePorts);

        if (portMappings != null)
        {
            isManagementPort = portMappings.Exists(mapping => mapping.Internal == managementPort && (request.Host.Port == mapping.ExternalTlsProxy || request.Host.Port == mapping.InternalTlsProxy));
        }

        return isManagementPath ? isManagementScheme && isManagementPort : !isManagementScheme || !isManagementPort;
    }

    return true;
}

private sealed class PortMapping
{
    [JsonPropertyName("internal")]
    public int Internal { get; set; }
    [JsonPropertyName("external_tls_proxy")]
    public int? ExternalTlsProxy { get; set; } // Nullable, since not all objects have this property
    [JsonPropertyName("internal_tls_proxy")]
    public int? InternalTlsProxy { get; set; } // Nullable, since not all objects have this property
}
@TimHess TimHess added Type/enhancement New feature or request Component/Management Issues related to Steeltoe Management (actuators) ReleaseLine/4.x Identified as a feature/fix for the 4.x release line labels Jan 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Component/Management Issues related to Steeltoe Management (actuators) ReleaseLine/4.x Identified as a feature/fix for the 4.x release line Type/enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant