git.iko.soy/typeable/oauth2-proxy
on master help sign in
incorporate suggestions from @benfdking
commitff4e5588d87cf92b2df01b0ab16c7ebd8ec02d43 authortimothy-spencer <timothy.spencer@gsa.gov> dateMon 25 Mar 2019, 10:32 (8 years ago) parent1ff17a3
2 files changed+56−1
compare with master
unifiedsplit
http.go+23−1 http_test.go+33
http.go+23−1
@@ -24,9 +24,15 @@ func (s *Server) ListenAndServe() {
2424 }
2525}
2626
27−// gcpHealthcheck handles healthcheck queries from GCP
27+// Used with gcpHealthcheck()
28+const userAgentHeader = "User-Agent"
29+const googleHealthCheckUserAgent = "GoogleHC/1.0"
30+const rootPath = "/"
31+
32+// gcpHealthcheck handles healthcheck queries from GCP.
2833func gcpHealthcheck(h http.Handler) http.Handler {
2934 return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
35+ // Check for liveness and readiness: used for Google App Engine
3036 if r.URL.EscapedPath() == "/liveness_check" {
3137 w.WriteHeader(http.StatusOK)
3238 w.Write([]byte("OK"))
@@ -37,6 +43,22 @@ func gcpHealthcheck(h http.Handler) http.Handler {
3743 w.Write([]byte("OK"))
3844 return
3945 }
46+
47+ // Check for GKE ingress healthcheck: The ingress requires the root
48+ // path of the target to return a 200 (OK) to indicate the service's good health. This can be quite a challenging demand
49+ // depending on the application's path structure. This middleware filters out the requests from the health check by
50+ //
51+ // 1. checking that the request path is indeed the root path
52+ // 2. ensuring that the User-Agent is "GoogleHC/1.0", the health checker
53+ // 3. ensuring the request method is "GET"
54+ if r.URL.Path == rootPath &&
55+ r.Header.Get(userAgentHeader) == googleHealthCheckUserAgent &&
56+ r.Method == http.MethodGet {
57+
58+ w.WriteHeader(http.StatusOK)
59+ return
60+ }
61+
4062 h.ServeHTTP(w, r)
4163 })
4264}
http_test.go+33
@@ -54,3 +54,36 @@ func TestGCPHealthcheckNotHealthcheck(t *testing.T) {
5454
5555 assert.Equal(t, "test", rw.Body.String())
5656}
57+
58+func TestGCPHealthcheckIngress(t *testing.T) {
59+ handler := func(w http.ResponseWriter, req *http.Request) {
60+ w.Write([]byte("test"))
61+ }
62+
63+ h := gcpHealthcheck(http.HandlerFunc(handler))
64+ rw := httptest.NewRecorder()
65+ r, _ := http.NewRequest("GET", "/", nil)
66+ r.RemoteAddr = "127.0.0.1"
67+ r.Host = "test-server"
68+ r.Header.Set(userAgentHeader, googleHealthCheckUserAgent)
69+ h.ServeHTTP(rw, r)
70+
71+ assert.Equal(t, 200, rw.Code)
72+ assert.Equal(t, "", rw.Body.String())
73+}
74+
75+func TestGCPHealthcheckNotIngress(t *testing.T) {
76+ handler := func(w http.ResponseWriter, req *http.Request) {
77+ w.Write([]byte("test"))
78+ }
79+
80+ h := gcpHealthcheck(http.HandlerFunc(handler))
81+ rw := httptest.NewRecorder()
82+ r, _ := http.NewRequest("GET", "/foo", nil)
83+ r.RemoteAddr = "127.0.0.1"
84+ r.Host = "test-server"
85+ r.Header.Set(userAgentHeader, googleHealthCheckUserAgent)
86+ h.ServeHTTP(rw, r)
87+
88+ assert.Equal(t, "test", rw.Body.String())
89+}