[TT-15398] added basic configuration for ExternalServiceConfig #7272
Conversation
|
I'm a bot and I 👍 this PR title. 🤖 |
|
This PR is too huge for one to review 💔
Consider breaking it down into multiple small PRs. Check out this guide to learn more about PR best-practices. |
github-actions
bot
changed the title
PR Reviewer Guide 🔍(Review updated until commit 42c142a)Here are some key observations to aid the review process:
|
PR Code Suggestions ✨No code suggestions found for the PR. |
|
API Changes --- prev.txt 2025-08-12 19:18:34.419550397 +0000
+++ current.txt 2025-08-12 19:18:25.002526828 +0000
@@ -5571,6 +5571,16 @@
DefaultOTelResourceName = "tyk-gateway"
)
+const (
+ ServiceTypeOAuth = "oauth"
+ ServiceTypeAnalytics = "analytics"
+ ServiceTypeStorage = "storage"
+ ServiceTypeWebhook = "webhook"
+ ServiceTypeHealth = "health"
+ ServiceTypeDiscovery = "discovery"
+)
+ Service type constants for identifying different external service types
+
const GracefulShutdownDefaultDuration = 30
VARIABLES
@@ -5817,6 +5827,9 @@
// Global Certificate configuration
Security SecurityConfig `json:"security"`
+ // External service configuration for proxy and mTLS support
+ ExternalServices ExternalServiceConfig `json:"external_services"`
+
// Gateway HTTP server configuration
HttpServerOptions HttpServerOptionsConfig `json:"http_server_options"`
@@ -6388,6 +6401,20 @@
}
EventMessage is a standard form to send event data to handlers
+type ExternalServiceConfig struct {
+ // Global proxy configuration that applies to all external services
+ Proxy ProxyConfig `json:"proxy"`
+ // Service-specific configurations that can override global settings
+ OAuth ServiceConfig `json:"oauth"`
+ Analytics ServiceConfig `json:"analytics"`
+ Storage ServiceConfig `json:"storage"`
+ Webhooks ServiceConfig `json:"webhooks"`
+ Health ServiceConfig `json:"health"`
+ Discovery ServiceConfig `json:"discovery"`
+}
+ ExternalServiceConfig defines configuration for external service
+ interactions including proxy settings and mTLS client certificate support.
+
type HealthCheckConfig struct {
// Setting this value to `true` will enable the health-check endpoint on /Tyk/health.
EnableHealthChecks bool `json:"enable_health_checks"`
@@ -6542,6 +6569,20 @@
CacheSessionEviction int `json:"cached_session_eviction"`
}
+type MTLSConfig struct {
+ // Enabled controls whether mTLS is enabled for this service
+ Enabled bool `json:"enabled"`
+ // CertFile path to the client certificate file
+ CertFile string `json:"cert_file"`
+ // KeyFile path to the client private key file
+ KeyFile string `json:"key_file"`
+ // CAFile path to the CA certificate file for server verification
+ CAFile string `json:"ca_file"`
+ // InsecureSkipVerify disables server certificate verification (not recommended for production)
+ InsecureSkipVerify bool `json:"insecure_skip_verify"`
+}
+ MTLSConfig defines mTLS client certificate configuration.
+
type MonitorConfig struct {
// Set this to `true` to have monitors enabled in your configuration for the node.
EnableTriggerMonitors bool `json:"enable_trigger_monitors"`
@@ -6667,6 +6708,20 @@
func (p Private) GetOAuthTokensPurgeInterval() time.Duration
GetOAuthTokensPurgeInterval returns purge interval for lapsed OAuth tokens.
+type ProxyConfig struct {
+ // UseEnvironment enables reading proxy configuration from environment variables
+ // (HTTP_PROXY, HTTPS_PROXY, NO_PROXY)
+ UseEnvironment bool `json:"use_environment"`
+ // HTTPProxy sets the HTTP proxy URL (e.g., http://proxy:8080)
+ HTTPProxy string `json:"http_proxy"`
+ // HTTPSProxy sets the HTTPS proxy URL (e.g., https://proxy:8080)
+ HTTPSProxy string `json:"https_proxy"`
+ // NoProxy defines addresses that should bypass the proxy (comma-separated)
+ NoProxy string `json:"no_proxy"`
+}
+ ProxyConfig defines HTTP proxy configuration for external service
+ connections.
+
type RateLimit struct {
// EnableFixedWindow enables fixed window rate limiting.
EnableFixedWindowRateLimiter bool `json:"enable_fixed_window_rate_limiter"`
@@ -6760,6 +6815,15 @@
Certificates CertificatesConfig `json:"certificates"`
}
+type ServiceConfig struct {
+ // Proxy configuration for this specific service type
+ Proxy ProxyConfig `json:"proxy"`
+ // MTLS configuration for secure external communications
+ MTLS MTLSConfig `json:"mtls"`
+}
+ ServiceConfig defines service-specific configuration that can override
+ global settings.
+
type ServiceDiscoveryConf struct {
// Service discovery cache timeout
DefaultCacheTimeout int `json:"default_cache_timeout"`
@@ -9482,6 +9546,37 @@
SetUser(string, *user.SessionState, int64) error
}
+type ExternalHTTPClientFactory struct {
+ // Has unexported fields.
+}
+ ExternalHTTPClientFactory creates HTTP clients for external service
+ interactions with support for proxy configuration and mTLS client
+ certificates.
+
+func NewExternalHTTPClientFactory(gw *Gateway) *ExternalHTTPClientFactory
+ NewExternalHTTPClientFactory creates a new HTTP client factory.
+
+func (f *ExternalHTTPClientFactory) CreateAnalyticsClient() (*http.Client, error)
+ CreateAnalyticsClient creates an HTTP client for analytics requests.
+
+func (f *ExternalHTTPClientFactory) CreateClient(serviceType string) (*http.Client, error)
+ CreateClient creates an HTTP client configured for the specified service
+ type. It applies proxy settings and mTLS configuration based on the service
+ configuration hierarchy: 1. Service-specific configuration 2. Global
+ configuration 3. Environment variables (for proxy) 4. Default settings
+
+func (f *ExternalHTTPClientFactory) CreateIntrospectionClient() (*http.Client, error)
+ CreateIntrospectionClient creates an HTTP client for OAuth introspection
+ requests.
+
+func (f *ExternalHTTPClientFactory) CreateJWKClient(insecureSkipVerify bool) (*http.Client, error)
+ CreateJWKClient creates an HTTP client specifically configured for JWK
+ endpoint requests. This method preserves existing SSL skip verify behavior
+ while adding proxy support.
+
+func (f *ExternalHTTPClientFactory) CreateWebhookClient() (*http.Client, error)
+ CreateWebhookClient creates an HTTP client for webhook requests.
+
type ExternalOAuthMiddleware struct {
*BaseMiddleware
} |
🚀 Performance Snapshot
## Performance Impact AnalysisThis PR introduces external service configuration for proxy and mTLS settings with minimal performance impact. The main overhead comes from proxy determination logic that runs per request and mTLS handshakes when enabled. However, the implementation uses connection pooling with reasonable defaults (MaxIdleConns: 100, MaxIdleConnsPerHost: 10) and performs expensive operations like certificate loading only during initialization. ## Critical AreasThe proxy determination logic in ## Optimization RecommendationsConsider caching the results of proxy determination for frequently accessed hosts to reduce per-request overhead. For large NO_PROXY lists, a more efficient matching algorithm could be implemented. The default timeout of 30 seconds seems reasonable, but consider making it configurable per service type for fine-tuning in production environments. ## Summary
Tip: Mention me again using |
🛡️ Security Snapshot
## Security Impact AnalysisThis PR introduces a new The code demonstrates good security practices with proper error handling for certificate loading failures and clear separation between global and service-specific configurations. The implementation of NO_PROXY support enhances security by allowing selective proxy bypassing. ## Identified VulnerabilitiesMedium Risk:
Low Risk:
## Security Recommendations
## OWASP ComplianceThe implementation generally aligns with OWASP best practices:
The code could be improved regarding:
## Summary
Tip: Mention me again using |
🛡️ Security Snapshot
## Security Impact AnalysisThe PR introduces a new
The implementation follows secure coding practices with proper error handling, input validation, and comprehensive test coverage. ## Identified VulnerabilitiesMedium Risk:
Low Risk:
## Security Recommendations
## OWASP ComplianceThe implementation generally aligns with OWASP security best practices:
## Summary
Tip: Mention me again using |
📦 Impact Review Snapshot
## Impact AssessmentThe PR introduces a new ## Required Updates
## Compatibility ConcernsThe changes are backward compatible as they add new optional configuration without modifying existing behavior. Default values ensure existing deployments continue to work without changes. The InsecureSkipVerify option should be documented with appropriate security warnings. ## Summary & Recommendations
Tip: Mention me again using |
📦 Impact Review Snapshot
## Impact AssessmentThe PR introduces a new ## Required Updatestyk-charts:
No updates required for tyk-operator, portal, or tyk-sink as the changes don't affect their integration points. ## Compatibility ConcernsThe changes are additive and don't modify existing behavior, so backward compatibility is maintained. The new configuration is optional, and services will continue to work with direct connections if no proxy or mTLS is configured. The ## Summary & Recommendations
Tip: Mention me again using |
🚦 Connectivity Review Snapshot
## Connectivity Assessment
## Test Coverage Validation
## Security & Performance Impact
## Summary & Recommendations
Tip: Mention me again using |
🚀 Performance Snapshot
## Performance Impact AnalysisThe new external service configuration introduces minimal performance overhead. The HTTP client factory creates clients with proper connection pooling (MaxIdleConns: 100, MaxIdleConnsPerHost: 10) and reasonable timeouts. Client creation happens infrequently, typically at startup or on-demand, not in hot request paths. The proxy resolution logic adds negligible overhead per request. ## Critical AreasCertificate loading from disk occurs during client initialization, not per-request. The proxy function execution adds a small overhead to each external request for determining which proxy to use, but the implementation efficiently handles NO_PROXY rules with minimal string operations. The configuration merging logic (service-specific vs. global) is straightforward and has negligible impact. ## Optimization RecommendationsConsider adding metrics to track external service request latencies to monitor any potential proxy-related slowdowns. The ## Summary
Tip: Mention me again using |
🚦 Connectivity Review Snapshot
## Connectivity Assessment
## Test Coverage Validation
## Security & Performance Impact
## Summary & Recommendations
Tip: Mention me again using |
🚀 Performance Snapshot
## Performance Impact AnalysisThis PR introduces external service configuration for proxy and mTLS settings with minimal performance impact. The main overhead comes from proxy determination logic that runs per request and mTLS handshakes when enabled. However, the implementation uses connection pooling with reasonable defaults (MaxIdleConns: 100, MaxIdleConnsPerHost: 10) and performs expensive operations like certificate loading only during initialization. ## Critical AreasThe proxy determination logic in ## Optimization RecommendationsConsider caching the results of proxy determination for frequently accessed hosts to reduce per-request overhead. For large NO_PROXY lists, a more efficient matching algorithm could be implemented. The default timeout of 30 seconds seems reasonable, but consider making it configurable per service type for fine-tuning in production environments. ## Summary
Tip: Mention me again using |
📦 Impact Review Snapshot
## Impact AssessmentThe PR introduces a new ## Required Updates
## Compatibility ConcernsThe changes are backward compatible as they add new optional configuration without modifying existing behavior. Default values ensure existing deployments continue to work without changes. The InsecureSkipVerify option should be documented with appropriate security warnings to prevent misuse in production environments. ## Summary & Recommendations
Tip: Mention me again using |
🚦 Connectivity Review Snapshot
## Connectivity Assessment
## Test Coverage Validation
## Security & Performance Impact
## Summary & Recommendations
Tip: Mention me again using |
🛡️ Security Snapshot
## Security Impact AnalysisThis PR introduces a new
The implementation follows secure coding practices with proper error handling, input validation, and comprehensive test coverage. ## Identified VulnerabilitiesMedium Risk:
Low Risk:
## Security Recommendations
## OWASP ComplianceThe implementation generally aligns with OWASP security best practices:
## Summary
Tip: Mention me again using |
|
Persistent review updated to latest commit 42c142a |
PR Code Suggestions ✨No code suggestions found for the PR. |
🚀 Performance Snapshot
The PR introduces a well-designed external service configuration system with minimal performance impact. The implementation uses proper connection pooling (MaxIdleConns: 100, MaxIdleConnsPerHost: 10) and performs expensive operations like certificate loading only during initialization, not in request hot paths. Performance AnalysisThe The proxy determination logic in When mTLS is enabled, there will be additional TLS handshake overhead for new connections, but this is mitigated by connection pooling which allows connections to be reused. Certificate loading happens during client initialization rather than per request, which is the correct approach. The default timeout of 30 seconds is reasonable for most external service communications, and the connection pool settings strike a good balance between resource usage and performance. Overall, this PR follows best practices for HTTP client management and should have minimal performance impact on the gateway's operation. Tip: Mention me again using |
🛡️ Security Snapshot
## Security Impact AnalysisThis PR introduces a new
The implementation follows secure coding practices with proper error handling, input validation, and comprehensive test coverage. ## Identified VulnerabilitiesMedium Risk:
Low Risk:
## Security Recommendations
## OWASP ComplianceThe implementation generally aligns with OWASP security best practices:
## Summary
Tip: Mention me again using |
External Service Configuration PR AnalysisThis PR introduces a well-structured foundation for configuring external service communications in Tyk Gateway, providing centralized proxy and mTLS configuration capabilities. Key ComponentsConfiguration Structure
HTTP Client Factory
Schema Updates
Implementation Quality
Security ConsiderationsThe Overall AssessmentThis PR provides a solid foundation for external service communications that can be leveraged by different parts of the Tyk Gateway. The implementation follows good software engineering practices with proper abstraction, configuration hierarchy, and comprehensive test coverage. The changes are additive and backward compatible, making it a safe enhancement to the codebase. Tip: Mention me again using |
📦 Impact Review Snapshot
## Impact AssessmentThe PR introduces a new ## Required Updates
## Compatibility ConcernsThe changes are backward compatible as they add new optional configuration without modifying existing behavior. Default values ensure existing deployments continue to work without changes. The InsecureSkipVerify option should be documented with appropriate security warnings to prevent misuse in production environments. ## Summary & Recommendations
Tip: Mention me again using |
|
User description
TT-15398
Description
This PR introduces foundational support for external service configuration in Tyk Gateway, enabling centralized proxy and mTLS configuration for all external service communications. Additionally, it includes improvements to API versioning validation and OAS utility functions.
Key Changes:
External Service Configuration (TT-15398):
ExternalServiceConfigto main gateway configuration with support for:ExternalHTTPClientFactoryfor creating configured HTTP clients for different service types:API Versioning Improvements:
new_version_namerequirementVersionQueryParametersutility for handling version-related HTTP parametersOAS and Utility Enhancements:
Related Issue
Tyk: TT-15398 - Foundation for External Proxy Service
Motivation and Context
This change is required to provide a unified way to configure external service communications across Tyk Gateway. Currently, different parts of the system handle external communications inconsistently, with no centralized way to configure proxy settings or mTLS for external service calls.
Problems solved:
How This Has Been Tested
External Service Configuration:
API Versioning:
Test Coverage:
config/external_service_test.go: 331 lines of comprehensive configuration testsgateway/external_http_client_test.go: 535 lines of HTTP client factory testslib/apidef/version_test.go: 188 lines of versioning validation testsScreenshots (if appropriate)
N/A - Infrastructure changes only
Types of changes
Checklist
Note: This PR does not modify go.mod dependencies. All changes use existing standard library and internal packages only.
PR Type
Enhancement, Tests
Description
Introduced
ExternalServiceConfigfor external proxy and mTLS configurationAdded
ExternalHTTPClientFactoryfor service-specific HTTP clientsUpdated JSON schema to support new external service config structure
Comprehensive unit tests for configuration and HTTP client logic
Diagram Walkthrough
File Walkthrough
config.go
Add ExternalServices config field for proxy/mTLSconfig/config.go
ExternalServicesfield to mainConfigstructexternal_service.go
Define structs for external service proxy/mTLS configconfig/external_service.go
ExternalServiceConfig,ProxyConfig,ServiceConfig, andMTLSConfigstructsexternal_http_client.go
Add HTTP client factory for external servicesgateway/external_http_client.go
ExternalHTTPClientFactoryfor service-specific HTTPclients
schema.json
Update JSON schema for external service configcli/linter/schema.json
external_servicesconfigServiceConfig,ProxyConfig, andMTLSConfigexternal_service_test.go
Unit tests for external service config structsconfig/external_service_test.go
external_http_client_test.go
Unit tests for external HTTP client factorygateway/external_http_client_test.go