git.iko.soy/typeable/oauth2-proxy
on master help sign in
incorporate suggestions from @benfdking
ff4e558timothy-spencer
http.go+23−1
compare with master
unifiedsplit
@@ -24,9 +24,15 @@ func (s *Server) ListenAndServe() {
24 }
24 }
25}
25}
26
26
27+// Used with gcpHealthcheck()
28+const userAgentHeader = "User-Agent"
29+const googleHealthCheckUserAgent = "GoogleHC/1.0"
30+const rootPath = "/"
31+
27−// gcpHealthcheck handles healthcheck queries from GCP
32+// gcpHealthcheck handles healthcheck queries from GCP.
28func gcpHealthcheck(h http.Handler) http.Handler {
33func gcpHealthcheck(h http.Handler) http.Handler {
29 return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
34 return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
35+ // Check for liveness and readiness: used for Google App Engine
30 if r.URL.EscapedPath() == "/liveness_check" {
36 if r.URL.EscapedPath() == "/liveness_check" {
31 w.WriteHeader(http.StatusOK)
37 w.WriteHeader(http.StatusOK)
32 w.Write([]byte("OK"))
38 w.Write([]byte("OK"))
@@ -37,6 +43,22 @@ func gcpHealthcheck(h http.Handler) http.Handler {
37 w.Write([]byte("OK"))
43 w.Write([]byte("OK"))
38 return
44 return
39 }
45 }
46+
47+ // Check for GKE ingress healthcheck: The ingress requires the root
48+ // path of the target to return a 200 (OK) to indicate the service's good health. This can be quite a challenging demand
49+ // depending on the application's path structure. This middleware filters out the requests from the health check by
50+ //
51+ // 1. checking that the request path is indeed the root path
52+ // 2. ensuring that the User-Agent is "GoogleHC/1.0", the health checker
53+ // 3. ensuring the request method is "GET"
54+ if r.URL.Path == rootPath &&
55+ r.Header.Get(userAgentHeader) == googleHealthCheckUserAgent &&
56+ r.Method == http.MethodGet {
57+
58+ w.WriteHeader(http.StatusOK)
59+ return
60+ }
61+
40 h.ServeHTTP(w, r)
62 h.ServeHTTP(w, r)
41 })
63 })
42}
64}
http_test.go+33
@@ -54,3 +54,36 @@ func TestGCPHealthcheckNotHealthcheck(t *testing.T) {
54
54
55 assert.Equal(t, "test", rw.Body.String())
55 assert.Equal(t, "test", rw.Body.String())
56}
56}
57+
58+func TestGCPHealthcheckIngress(t *testing.T) {
59+ handler := func(w http.ResponseWriter, req *http.Request) {
60+ w.Write([]byte("test"))
61+ }
62+
63+ h := gcpHealthcheck(http.HandlerFunc(handler))
64+ rw := httptest.NewRecorder()
65+ r, _ := http.NewRequest("GET", "/", nil)
66+ r.RemoteAddr = "127.0.0.1"
67+ r.Host = "test-server"
68+ r.Header.Set(userAgentHeader, googleHealthCheckUserAgent)
69+ h.ServeHTTP(rw, r)
70+
71+ assert.Equal(t, 200, rw.Code)
72+ assert.Equal(t, "", rw.Body.String())
73+}
74+
75+func TestGCPHealthcheckNotIngress(t *testing.T) {
76+ handler := func(w http.ResponseWriter, req *http.Request) {
77+ w.Write([]byte("test"))
78+ }
79+
80+ h := gcpHealthcheck(http.HandlerFunc(handler))
81+ rw := httptest.NewRecorder()
82+ r, _ := http.NewRequest("GET", "/foo", nil)
83+ r.RemoteAddr = "127.0.0.1"
84+ r.Host = "test-server"
85+ r.Header.Set(userAgentHeader, googleHealthCheckUserAgent)
86+ h.ServeHTTP(rw, r)
87+
88+ assert.Equal(t, "test", rw.Body.String())
89+}