Update

deploy/db_migrations/basket-svc/0001_create_base_tables.up.sql

@@ -1,5 +1,7 @@
 CREATE EXTENSION IF NOT EXISTS "pgcrypto";
 
+CREATE SCHEMA "basket" AUTHORIZATION egommerce;
+
 CREATE TABLE IF NOT EXISTS basket.basket
 (
     id uuid NOT NULL DEFAULT gen_random_uuid(),

deploy/db_migrations/catalog-svc/0001_create_base_tables.up.sql

@@ -1,5 +1,7 @@
 CREATE EXTENSION IF NOT EXISTS "pgcrypto";
 
+CREATE SCHEMA "catalog" AUTHORIZATION egommerce;
+
 CREATE TABLE catalog.product
 (
     id uuid NOT NULL DEFAULT gen_random_uuid(),

deploy/db_migrations/config-svc/0001_create_base_tables.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS config.settings;

deploy/db_migrations/config-svc/0001_create_base_tables.up.sql

@@ -0,0 +1,15 @@
+CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+
+CREATE SCHEMA "config" AUTHORIZATION egommerce;
+
+CREATE TABLE IF NOT EXISTS config.settings
+(
+    id uuid NOT NULL DEFAULT gen_random_uuid(),
+    "name" character varying NOT NULL,
+    "value" character varying NOT NULL,
+    PRIMARY KEY (id),
+    UNIQUE (name)
+);
+
+
+ALTER TABLE IF EXISTS config.settings OWNER to egommerce;

deploy/db_migrations/identity-svc/0001_create_base_tables.up.sql

@@ -1,5 +1,7 @@
 CREATE EXTENSION IF NOT EXISTS "pgcrypto";
 
+CREATE SCHEMA "identity" AUTHORIZATION egommerce;
+
 CREATE TABLE IF NOT EXISTS identity.users
 (
     id uuid NOT NULL DEFAULT gen_random_uuid(),

deploy/db_migrations/init/init.sql

@@ -4,7 +4,3 @@ CREATE DATABASE egommerce;
 GRANT ALL PRIVILEGES ON DATABASE egommerce TO egommerce;
 
 CREATE EXTENSION IF NOT EXISTS "pgcrypto";
-
-CREATE SCHEMA "identity" AUTHORIZATION egommerce;
-CREATE SCHEMA catalog AUTHORIZATION egommerce;
-CREATE SCHEMA basket AUTHORIZATION egommerce;

deploy/db_migrations/order-svc/0001_create_base_tables.up.sql

@@ -1,6 +1,8 @@
 CREATE EXTENSION IF NOT EXISTS "pgcrypto";
 
-CREATE TABLE IF NOT EXISTS "ordering"."order"
+CREATE SCHEMA "order" AUTHORIZATION egommerce;
+
+CREATE TABLE IF NOT EXISTS "order"."order"
 (
     id uuid NOT NULL DEFAULT gen_random_uuid(),
     "state" character varying NOT NULL DEFAULT 'new',
@@ -9,7 +11,7 @@ CREATE TABLE IF NOT EXISTS "ordering"."order"
     PRIMARY KEY (id)
 );
 
-CREATE TABLE IF NOT EXISTS "ordering".order_item
+CREATE TABLE IF NOT EXISTS "order".order_item
 (
     id uuid NOT NULL DEFAULT gen_random_uuid(),
     order_id uuid NOT NULL,
@@ -21,12 +23,12 @@ CREATE TABLE IF NOT EXISTS "ordering".order_item
     PRIMARY KEY (id)
 );
 
-ALTER TABLE IF EXISTS "ordering".order_item
+ALTER TABLE IF EXISTS "order".order_item
     ADD CONSTRAINT order_item_order_fkey FOREIGN KEY (order_id)
     REFERENCES "ordering"."order" (id) MATCH SIMPLE
     ON UPDATE NO ACTION
     ON DELETE NO ACTION
     NOT VALID;
 
-ALTER TABLE IF EXISTS "ordering"."order" OWNER to egommerce;
+ALTER TABLE IF EXISTS "order"."order" OWNER to egommerce;
-ALTER TABLE IF EXISTS "ordering".order_item OWNER to egommerce;
+ALTER TABLE IF EXISTS "order".order_item OWNER to egommerce;

deploy/k8s/api-cache.yml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: api-cache-pv
-  namespace: egommerce
+  # namespace: egommerce
 spec:
   capacity:
     storage: 5Gi

deploy/k8s/api-eventbus.yml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: api-eventbus-pv
-  namespace: egommerce
+  # namespace: egommerce
 spec:
   capacity:
     storage: 10Gi
@@ -41,7 +41,7 @@ spec:
       protocol: TCP
       port: 9092
       nodePort: 31200
-    - name: api-eventbus-controller
+    - name: api-eventbus-ctrl
       protocol: TCP
       port: 9093
       nodePort: 31299
@@ -68,7 +68,7 @@ spec:
           imagePullPolicy: Always # For future image
           ports:
             - containerPort: 9092
-              name: eventbus
+              name: eventbus-brkr
             - containerPort: 9093
               name: eventbus-ctrl
           volumeMounts:
@@ -79,14 +79,16 @@ spec:
               value: "broker,controller"
             - name: KAFKA_CONTROLLER_LISTENER_NAMES
               value: "CONTROLLER"
+            - name: KAFKA_NODE_ID
+              value: "1"
             - name: KAFKA_LISTENERS
               value: "PLAINTEXT://:9092,CONTROLLER://:9093"
             - name: KAFKA_CONTROLLER_QUORUM_VOTERS
-              value: "1@localhost:9093"
+              value: "1@api-eventbus:9093"
-            - name: KAFKA_NODE_ID
-              value: "1"
             - name: KAFKA_ADVERTISED_LISTENERS
-              value: "PLAINTEXT://localhost:9092"
+              value: "PLAINTEXT://api-eventbus:9092"
+            - name: KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR
+              value: "1"
             - name: KAFKA_LOG_DIRS
               value: "/var/lib/kafka/data"
       imagePullSecrets:

deploy/k8s/api-gateway.yml

@@ -1,4 +1,20 @@
 apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: api-gateway-config
+  namespace: egommerce
+data:
+  global-config-snippet: |
+    # lua-prepend-path /usr/local/lib/lua/5.4/?.lua
+    # set-dumpable
+    log 127.0.0.1 local0 debug
+    lua-load /etc/haproxy/lua/jwt_auth.lua
+  frontend-config-snippet: |
+    http-request lua.jwt_auth
+    http-response lua.jwt_auth
+    # http-request deny if !{ var(txn.authenticated) -m bool }
+---
+apiVersion: v1
 kind: Service
 metadata:
   name: api-gateway
@@ -18,11 +34,10 @@ spec:
 kind: IngressClass
 apiVersion: networking.k8s.io/v1
 metadata:
-  name: haproxy
+  name: api-gateway
   namespace: egommerce
 spec:
   controller: haproxy.org/ingress-controller/haproxy
-# PROBABLY NOT NEEDED :D
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -32,18 +47,23 @@ metadata:
   annotations:
     haproxy.org/server-ssl: "true"
     haproxy.org/server-ca: "egommerce/ca-root"
+    haproxy.org/server-alpn: "h2,http/1.1"
+    haproxy.org/enable-lua: "true"
+    haproxy.org/backend-config-snippet: |
+      http-response set-header X-Custom-Backend-Header "value"
     haproxy.org/path-rewrite: |
       /api/identity/(.*) /\1
       /api/catalog/(.*) /\1
       /api/basket/(.*) /\1
+      /api/config/(.*) /\1
 spec:
-  ingressClassName: haproxy
+  ingressClassName: api-gateway
   tls:
   - secretName: api-gateway-cert
     hosts:
-    - egommerce.io # CHANGE TO PROD DOMAIN
+    - egommerce.io # CHANGE TO THE PROD DOMAIN
   rules:
-  - host: egommerce.io # CHANGE TO PROD DOMAIN
+  - host: egommerce.io # CHANGE TO THE PROD DOMAIN
     http:
       paths:
       - path: /api/identity
@@ -67,6 +87,13 @@ spec:
             name: basket-svc
             port:
               number: 443
+      - path: /api/config
+        pathType: Prefix
+        backend:
+          service:
+            name: config-svc
+            port:
+              number: 443
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -88,19 +115,13 @@ spec:
       - name: api-gateway
         image: git.ego.freeddns.org/egommerce/api-gateway:dev
         imagePullPolicy: Always
-        resources:
-          limits:
-            cpu: 100m
-            memory: 512M
-          requests:
-            cpu: 50m
-            memory: 256M
-        ports:
-        - containerPort: 8443
         args:
         - --publish-service=egommerce/api-gateway
+        - --configmap=egommerce/api-gateway-config
         - --ingress.class=haproxy
         - --https-bind-port=8443
+        ports:
+        - containerPort: 8443
         env:
           - name: POD_NAME
             valueFrom:
@@ -112,22 +133,34 @@ spec:
               fieldRef:
                 apiVersion: v1
                 fieldPath: metadata.namespace
-          - name: POD_IP
+        #   - name: POD_IP
-            valueFrom:
+        #     valueFrom:
-              fieldRef:
+        #       fieldRef:
-                apiVersion: v1
+        #         apiVersion: v1
-                fieldPath: status.podIP
+        #         fieldPath: status.podIP
-        securityContext:
+        resources:
-          capabilities:
+          limits:
-            add:
+            cpu: 100m
-              - NET_BIND_SERVICE
+            memory: 512M
-            drop:
+          requests:
-              - ALL
+            cpu: 50m
+            memory: 256M
+        # securityContext:
+        #   capabilities:
+        #     add:
+        #       - NET_BIND_SERVICE
+        #     drop:
+        #       - ALL
+          # readOnlyRootFilesystem: false
           # runAsUser: 1000
           # runAsGroup: 1000
           # runAsNonRoot: true
           # allowPrivilegeEscalation: false
           # seccompProfile:
           #   type: RuntimeDefault
+      volumes:
+        - name: api-gateway-config
+          configMap:
+            name: api-gateway-config
       imagePullSecrets:
       - name: regcred

deploy/k8s/api-logger.yml

@@ -159,7 +159,7 @@ apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: api-logger-prometheus-pv
-  namespace: egommerce
+  # namespace: egommerce
 spec:
   capacity:
     storage: 5Gi
@@ -325,7 +325,7 @@ apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: api-logger-grafana-pv
-  namespace: egommerce
+  # namespace: egommerce
 spec:
   capacity:
     storage: 5Gi

deploy/k8s/config-svc.yml

@@ -0,0 +1,133 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: config-svc
+  namespace: egommerce
+  annotations:
+    haproxy.org/check: "true"
+  labels:
+    app: config-svc
+spec:
+  type: NodePort
+  selector:
+    app: config-svc
+  ports:
+  - name: config-svc
+    port: 443
+    nodePort: 31811
+  # - name: config-svc-metrics
+  #   port: 9090
+  #   nodePort: 31811
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: config-svc
+  namespace: egommerce
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1           # Number of extra pods that can be created during update
+      maxUnavailable: 1     # Max number of pods that can be unavailable during update
+  selector:
+    matchLabels:
+      app: config-svc
+  template:
+    metadata:
+      labels:
+        app: config-svc
+    spec:
+      # initContainers:
+      # - name: config-svc-init
+      #   image: busybox:1.28
+      #   command: [
+      #     'sh',
+      #     '-c',
+      #     '/bin/migrate'
+      #   ]
+      containers:
+      - name: config-svc
+        image: git.ego.freeddns.org/egommerce/config-svc:dev
+        imagePullPolicy: Always
+        env:
+          - name: APP_NAME
+            value: config-svc
+          - name: APP_DOMAIN
+            value: config-svc.egommerce.io
+          - name: APP_PATH_PREFIX
+            value: /config
+          - name: API_DATABASE_URL
+            value: postgres://egommerce:12345678@db-postgres:5432/egommerce?sslmode=disable
+        readinessProbe:
+          httpGet:
+            scheme: HTTPS
+            port: config-svc
+            path: /health
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          failureThreshold: 1
+        livenessProbe:
+          httpGet:
+            scheme: HTTPS
+            port: config-svc
+            path: /health
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          failureThreshold: 1
+        volumeMounts:
+          - name: config-cert
+            mountPath: /certs/config-svc.crt
+            readOnly: true
+          - name: config-key
+            mountPath: /certs/config-svc.key
+            readOnly: true
+          - name: config-migrations
+            mountPath: /migrations
+            readOnly: true
+        resources:
+          limits:
+            cpu: 100m
+            memory: 512M
+          requests:
+            cpu: 50m
+            memory: 256M
+        ports:
+        - name: config-svc
+          containerPort: 443
+      # - name: config-svc-metrics
+      #   image: prom/prometheus-exporter:latest
+      #   ports:
+      #     - containerPort: 9090
+      #   args:
+      #     - --web.listen-address=:9090
+        #     - --web.telemetry-path=/metrics
+      # - name: config-scheduler # Scheduler Container
+      #   image: git.ego.freeddns.org/egommerce/config-svc:dev
+      #   imagePullPolicy: Always
+      #   command: [
+      #     "/usr/local/bin/scheduler"
+      #   ]
+      #   resources:
+      #     limits:
+      #       cpu: 100m
+      #       memory: 512Mi
+      #     requests:
+      #       cpu: 50m
+      #       memory: 256Mi
+      imagePullSecrets:
+      - name: regcred
+      volumes:
+      - name: config-cert
+        hostPath:
+          path: /egommerce/stack/deploy/certs/config-svc/config-svc.crt
+          type: File
+      - name: config-key
+        hostPath:
+          path: /egommerce/stack/deploy/certs/config-svc/config-svc.key
+          type: File
+      - name: config-migrations
+        hostPath:
+          path: /egommerce/stack/deploy/db_migrations/config-svc
+          type: Directory

deploy/k8s/db-postgres.yml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: db-postgres-pv
-  namespace: egommerce
+  # namespace: egommerce
 spec:
   capacity:
     storage: 5Gi

deploy/k8s/identity-svc.yml

@@ -5,6 +5,8 @@ metadata:
   namespace: egommerce
   annotations:
     haproxy.org/check: "true"
+    # haproxy.org/backend-config-snippet: |
+    #   http-response set-header X-Custom-Header-Service "rojter"
   labels:
     app: identity-svc
 spec:

deploy/scripts/gen-certs.sh

@@ -19,6 +19,8 @@ export POSTGRES_CN="db-postgres.egommerce.local,db-postgres"
 export POSTGRES_SAN="DNS:db-postgres.egommerce.local,DNS:db-postgres,IP:127.0.0.1"
 # export MONGO_CN="mongo.db.egommerce.local,db-mongo"
 # export MONGO_SAN="DNS:mongo.db.egommerce.local,DNS:db-mongo,IP:127.0.0.1"
+export CONFIG_CN="config-svc.egommerce.local"
+export CONFIG_SAN="DNS:config-svc.egommerce.local,IP:127.0.0.1"
 export IDENTITY_CN="identity-svc.egommerce.local"
 export IDENTITY_SAN="DNS:identity-svc.egommerce.local,IP:127.0.0.1"
 export CATALOG_CN="catalog-svc.egommerce.local,catalog-svc"
@@ -39,6 +41,7 @@ mkdir -p \
     ${CERTS_DIR}api-cache \
     ${CERTS_DIR}api-logger \
     ${CERTS_DIR}db-postgres \
+    ${CERTS_DIR}config-svc \
     ${CERTS_DIR}identity-svc \
     ${CERTS_DIR}basket-svc \
     ${CERTS_DIR}catalog-svc \
@@ -46,13 +49,15 @@ mkdir -p \
     ${CERTS_DIR}pricing-svc
 
 # Generate Root CA cert
-openssl req -newkey rsa:2048 -nodes -x509 -days 1024 \
+# openssl req -newkey rsa:2048 -nodes -x509 -days 1024 \
-    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/OU=DevOps Team/CN=Egommerce CA" \
+#     -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/OU=DevOps Team/CN=Egommerce CA" \
-    -keyout ${CERTS_DIR}ca-root/ca-root.key -out ${CERTS_DIR}ca-root/ca-root.crt >/dev/null
+#     -keyout ${CERTS_DIR}ca-root/ca-root.key -out ${CERTS_DIR}ca-root/ca-root.crt >/dev/null
 
 # Create fullchain pem file
-cat ${CERTS_DIR}ca-root/ca-root.key ${CERTS_DIR}ca-root/ca-root.crt > ${CERTS_DIR}ca-root/ca-root.pem
+# cat ${CERTS_DIR}ca-root/ca-root.key ${CERTS_DIR}ca-root/ca-root.crt > ${CERTS_DIR}ca-root/ca-root.pem
 
+# Shortcut openssl command
+# openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout app1-tls.key -out app1-tls.crt -subj "/CN=egommerce.io/O=sisox"
 
 # Generate Gateway cert
 openssl req -newkey rsa:2048 -nodes \
@@ -122,7 +127,20 @@ openssl x509 -req -days 365 \
     -out ${CERTS_DIR}db-postgres/db-postgres.crt >/dev/null
 
 
-# Generate Identity cert
+# Generate config-svc cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$CONFIG_CN" \
+    -keyout ${CERTS_DIR}config-svc/config-svc.key \
+    -out ${CERTS_DIR}config-svc/config-svc.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}config-svc/config-svc.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${CONFIG_SAN}")) \
+    -out ${CERTS_DIR}config-svc/config-svc.crt >/dev/null
+
+
+# Generate identity-svc cert
 openssl req -newkey rsa:2048 -nodes \
     -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$IDENTITY_CN" \
     -keyout ${CERTS_DIR}identity-svc/identity-svc.key \
@@ -135,7 +153,7 @@ openssl x509 -req -days 365 \
     -out ${CERTS_DIR}identity-svc/identity-svc.crt >/dev/null
 
 
-# Generate Basket cert
+# Generate basket-svc cert
 openssl req -newkey rsa:2048 -nodes \
     -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$BASKET_CN" \
     -keyout ${CERTS_DIR}basket-svc/basket-svc.key \
@@ -148,7 +166,7 @@ openssl x509 -req -days 365 \
     -out ${CERTS_DIR}basket-svc/basket-svc.crt >/dev/null
 
 
-# Generate Catalog cert
+# Generate catalog-svc cert
 openssl req -newkey rsa:2048 -nodes \
     -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$CATALOG_CN" \
     -keyout ${CERTS_DIR}catalog-svc/catalog-svc.key \
@@ -161,7 +179,7 @@ openssl x509 -req -days 365 \
     -out ${CERTS_DIR}catalog-svc/catalog-svc.crt >/dev/null
 
 
-# Generate Order cert
+# Generate order-svc cert
 openssl req -newkey rsa:2048 -nodes \
     -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$ORDER_CN" \
     -keyout ${CERTS_DIR}order-svc/order-svc.key \
@@ -174,7 +192,7 @@ openssl x509 -req -days 365 \
     -out ${CERTS_DIR}order-svc/order-svc.crt >/dev/null
 
 
-# Generate Pricing cert
+# Generate pricing-svc cert
 openssl req -newkey rsa:2048 -nodes \
     -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$PRICING_CN" \
     -keyout ${CERTS_DIR}pricing-svc/pricing-svc.key \

deploy/scripts/start-k8s.sh

@@ -15,6 +15,7 @@ kubectl apply -f deploy/k8s/api-logger.yml
 kubectl apply -f deploy/k8s/db-postgres.yml
 # kubectl apply -f deploy/k8s/db-mongo.yml
 
+kubectl apply -f deploy/k8s/config-svc.yml
 kubectl apply -f deploy/k8s/identity-svc.yml
 kubectl apply -f deploy/k8s/catalog-svc.yml
 kubectl apply -f deploy/k8s/basket-svc.yml

deploy/scripts/stop-k8s.sh

@@ -5,6 +5,7 @@ alias kubectl="microk8s kubectl" # MicroK8S fix
 
 echo "Stopping egommerce k8s stack..."
 
+kubectl delete -f deploy/k8s/config-svc.yml
 kubectl delete -f deploy/k8s/identity-svc.yml
 kubectl delete -f deploy/k8s/catalog-svc.yml
 kubectl delete -f deploy/k8s/basket-svc.yml

deploy/scripts/tunnel-eventbus-to-local.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+# Tunnel local port 9092(kafka) to k8s service node port 31200 (kafka)
+
+socat TCP-LISTEN:9092,fork TCP:127.0.0.1:31200