Sign inSign up

f5devcentral/f5-icontrol-gateway

By f5devcentral

•Updated almost 5 years ago

Gateway for trusted iControl REST services to BIG-IP devices

Image
0

2.5K

f5devcentral/f5-icontrol-gateway repository overview

⁠f5-icontrol-gateway Container

Available on Github⁠

f5-icontrol-gateway container

A container in the spirit of the f5-api-services-gateway, but:

  • with Apache replaced by NGINX
  • iControl LX removed
  • NGINX Unit application server installed with module support for:
    • node (10.16)
    • go (1.12)
    • perl (5.28)
    • php (7.3)
    • python2 (2.7)
    • python3 (3.7)
    • java (11)

⁠Running with Docker##

docker run -p 8443:443 --rm --name f5-icontrol-gateway f5devcentral/f5-icontrol-gateway:latest

⁠Trusted Devices Application

The default image comes with a nodejs swagger generated server application. The application lets you manage device trusts between the container and remote TMOS devices. The application can establish and manage device trusts, provide access to query parameter authorization tokens for trusted devices, and securely proxy all iControl REST requests to remote trusted TMOS devices. It has a full swagger-UI web explorer interface to navigate the APIs and process requests through your browser's XHR client.

NGINX has been configured to redirect the / index on the container to the trusted devices application.

⁠Configurations

The /etc/nginx directory can be volume mounted to secure access to this container as documented in the Deploying NGINX Plus as an API Gateway⁠ publication. That publication details proper NGINX configuration composition to support circuit breaking, rate limiting, multiple authentication mechanisms, and RBAC.

By default the nginx configuration uses a self-signed certificate for TLS and requires BASIC authentication with:

user: admin
password: admin

NGINX is configured with the following default listeners from the /etc/nginx/apigateway.conf file:

server {
   # TLS listener
   listen 443 ssl;
   listen [::]:443 ssl;

   # self-signed certificates
   ssl_certificate /etc/ssl/nginx-selfsigned.crt;
   ssl_certificate_key /etc/ssl/nginx-selfsigned-key.default;

   # secured default Unit listener access
   rewrite ^/$ /TrustedDevicesUI last;

   # secured remote access to Unit configuration
   location ~ ^/config(/?)(.*) {
       include /etc/nginx/auth.conf;
       if ($request_method = OPTIONS) {
           add_header Allow "*";
           add_header Access-Control-Allow-Headers "*";
           add_header Access-Control-Allow-Origin "*";
           return 200;
       }
       proxy_pass http://unix:/var/run/unit/control.sock:/config/$2;
   }

   # secured remote access to iControl REST
   location /mgmt {
       include /etc/nginx/auth.conf;
       if ($request_method = OPTIONS) {
           add_header Allow "*";
           add_header Access-Control-Allow-Headers "*";
           add_header Access-Control-Allow-Origin "*";
           return 200;
       }
       proxy_pass http://127.0.0.1:8100;
       proxy_set_header Authorization "Basic YWRtaW46";
   }

   # Don't require auth for the Swagger UI
   location /TrustedDevicesUI {
       if ($request_method = OPTIONS) {
           add_header Allow "*";
           add_header Access-Control-Allow-Headers "*";
           add_header Access-Control-Allow-Origin "*";
           return 200;                                       
       }
       proxy_pass http://127.0.0.1:8105;
   }

   # send all other URI path requests to Unit for processing
   location / {
       include /etc/nginx/auth.conf;
       if ($request_method = OPTIONS) {
           add_header Allow "*";
           add_header Access-Control-Allow-Headers "*";
           add_header Access-Control-Allow-Origin "*";
           return 200;                                       
       }
       proxy_pass http://127.0.0.1:8105;
   }

}

# local access for Unit configuration for local scripting
server {
    listen 127.0.0.1:8101;
    location / {
        proxy_pass http://unix:/var/run/unit/control.sock;
    }
}

# expose unprotected restjavad for linked container setups
#server {
#    listen 172.17.0.2:8100;
#    location / {
#        proxy_pass http://127.0.0.1:8100;
#    }
#}

These default listeners support the following service endpoints:

/ - published app default listener

/config - NGINX unit control endpoint

GET /config

{
	"listeners": {
		"127.0.0.1:8105": {
			"pass": "routes"
		}
	},

	"routes": [
		{
			"match": {
				"uri": "/TrustedDevicesUI*"
			},

			"action": {
				"pass": "applications/trusteddevices"
			}
		},
		{
			"match": {
				"uri": "/TrustedDevices*"
			},

			"action": {
				"pass": "applications/trusteddevices"
			}
		},
		{
			"match": {
				"uri": "/TrustedProxy*"
			},

			"action": {
				"pass": "applications/trusteddevices"
			}
		}
	],

	"applications": {
		"trusteddevices": {
			"type": "external",
			"working_directory": "/var/lib/f5-icontrol-trusted-devices",
			"executable": "unitapp.js",
			"user": "nginx",
			"group": "nginx"
		}
	}
}

/mgmt - restjavad iControl REST endpoint

GET /mgmt/shared/echo 
{
	"stage": "STARTED",
	"stageEnumValues": ["CREATED", "STARTED", "SHUTDOWN"],
	"generation": 0,
	"lastUpdateMicros": 0,
	"kind": "shared:echo:echoworkerstate",
	"selfLink": "https://localhost/mgmt/shared/echo"
}

Further details on configuring NGINX⁠

Once started you can either use the /config endpoint or add a JSON configuration file 02_applications.conf to the /etc/unit/ directory.

The intent is that only routes and application directives in the unit configuration be changed, providing the ability to specify a route path and the locally published application listening on 127.0.0.1:[your_application_port].

Further details on configuring NGIX Unit⁠

Further details on using F5 iControl REST⁠

Build Your Own Node Express App for this Container⁠

Build Your Own Python Flask App for this Container⁠

Tag summary

Content type

Image

Digest

Size

475.6 MB

Last updated

almost 5 years ago

docker pull f5devcentral/f5-icontrol-gateway