Skip to content

Commit 5046ebe

Browse files
cjcocokrispcjcocokrisp
committed
feat(webhook): add env variables for rate limit flags and update manifests to include them
Signed-off-by: Christopher Coco <[email protected]>
1 parent 2b8e464 commit 5046ebe

File tree

4 files changed

+57
-13
lines changed

4 files changed

+57
-13
lines changed

‎cmd/run.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"context"
55
"errors"
66
"fmt"
7+
"math"
78
"os"
89
"strings"
910
"sync"
@@ -345,10 +346,10 @@ func newRunCommand() *cobra.Command {
345346
runCmd.Flags().StringVar(&webhookCfg.GHCRSecret, "ghcr-webhook-secret", env.GetStringVal("GHCR_WEBHOOK_SECRET", ""), "Secret for validating GitHub Container Registry webhooks")
346347
runCmd.Flags().StringVar(&webhookCfg.QuaySecret, "quay-webhook-secret", env.GetStringVal("QUAY_WEBHOOK_SECRET", ""), "Secret for validating Quay webhooks")
347348
runCmd.Flags().StringVar(&webhookCfg.HarborSecret, "harbor-webhook-secret", env.GetStringVal("HARBOR_WEBHOOK_SECRET", ""), "Secret for validating Harbor webhooks")
348-
runCmd.Flags().BoolVar(&webhookCfg.RateLimitEnabled, "enable-webhook-ratelimit", false, "Enable rate limiting for the webhook endpoint")
349-
runCmd.Flags().IntVar(&webhookCfg.RateLimitNumAllowedRequests, "webhook-ratelimit-num-allowed", 100, "The number of allowed requests in a window for webhook rate limiting")
350-
runCmd.Flags().DurationVar(&webhookCfg.RateLimitWindow, "webhook-ratelimit-window", 2*time.Minute, "The duration for the window for the webhook rate limiting")
351-
runCmd.Flags().DurationVar(&webhookCfg.RateLimitCleanUpInterval, "webhook-ratelimit-cleanup-interval", 1*time.Hour, "How often the rate limiter cleans up stale clients")
349+
runCmd.Flags().BoolVar(&webhookCfg.RateLimitEnabled, "enable-webhook-ratelimit", env.GetBoolVal("ENABLE_WEBHOOK_RATELIMIT", false), "Enable rate limiting for the webhook endpoint")
350+
runCmd.Flags().IntVar(&webhookCfg.RateLimitNumAllowedRequests, "webhook-ratelimit-num-allowed", env.ParseNumFromEnv("WEBHOOK_RATELIMIT_NUM_ALLOWED_REQUESTS", 100, 0, math.MaxInt), "The number of allowed requests in a window for webhook rate limiting")
351+
runCmd.Flags().DurationVar(&webhookCfg.RateLimitWindow, "webhook-ratelimit-window", env.GetDurationVal("WEBHOOK_RATELIMIT_WINDOW", 2*time.Minute), "The duration for the window for the webhook rate limiting")
352+
runCmd.Flags().DurationVar(&webhookCfg.RateLimitCleanUpInterval, "webhook-ratelimit-cleanup-interval", env.GetDurationVal("WEBHOOK_RATELIMIT_CLEANUP_INTERVAL", 1*time.Hour), "How often the rate limiter cleans up stale clients")
352353

353354
return runCmd
354355
}

‎cmd/webhook.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"context"
55
"errors"
66
"fmt"
7+
"math"
78
"os"
89
"os/signal"
910
"strconv"
@@ -195,10 +196,10 @@ Supported registries:
195196
webhookCmd.Flags().StringVar(&webhookCfg.GHCRSecret, "ghcr-webhook-secret", env.GetStringVal("GHCR_WEBHOOK_SECRET", ""), "Secret for validating GitHub Container Registry webhooks")
196197
webhookCmd.Flags().StringVar(&webhookCfg.QuaySecret, "quay-webhook-secret", env.GetStringVal("QUAY_WEBHOOK_SECRET", ""), "Secret for validating Quay webhooks")
197198
webhookCmd.Flags().StringVar(&webhookCfg.HarborSecret, "harbor-webhook-secret", env.GetStringVal("HARBOR_WEBHOOK_SECRET", ""), "Secret for validating Harbor webhooks")
198-
webhookCmd.Flags().BoolVar(&webhookCfg.RateLimitEnabled, "enable-webhook-ratelimit", false, "Enable rate limiting for the webhook endpoint")
199-
webhookCmd.Flags().IntVar(&webhookCfg.RateLimitNumAllowedRequests, "webhook-ratelimit-num-allowed", 100, "The number of allowed requests in a window for webhook rate limiting")
200-
webhookCmd.Flags().DurationVar(&webhookCfg.RateLimitWindow, "webhook-ratelimit-window", 2*time.Minute, "The duration for the window for the webhook rate limiting")
201-
webhookCmd.Flags().DurationVar(&webhookCfg.RateLimitCleanUpInterval, "webhook-ratelimit-cleanup-interval", 1*time.Hour, "How often the rate limiter cleans up stale clients")
199+
webhookCmd.Flags().BoolVar(&webhookCfg.RateLimitEnabled, "enable-webhook-ratelimit", env.GetBoolVal("ENABLE_WEBHOOK_RATELIMIT", false), "Enable rate limiting for the webhook endpoint")
200+
webhookCmd.Flags().IntVar(&webhookCfg.RateLimitNumAllowedRequests, "webhook-ratelimit-num-allowed", env.ParseNumFromEnv("WEBHOOK_RATELIMIT_NUM_ALLOWED_REQUESTS", 100, 0, math.MaxInt), "The number of allowed requests in a window for webhook rate limiting")
201+
webhookCmd.Flags().DurationVar(&webhookCfg.RateLimitWindow, "webhook-ratelimit-window", env.GetDurationVal("WEBHOOK_RATELIMIT_WINDOW", 2*time.Minute), "The duration for the window for the webhook rate limiting")
202+
webhookCmd.Flags().DurationVar(&webhookCfg.RateLimitCleanUpInterval, "webhook-ratelimit-cleanup-interval", env.GetDurationVal("WEBHOOK_RATELIMIT_CLEANUP_INTERVAL", 1*time.Hour), "How often the rate limiter cleans up stale clients")
202203

203204
return webhookCmd
204205
}

‎manifests/base/deployment/argocd-image-updater-deployment.yaml

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,28 @@ spec:
149149
name: argocd-image-updater-secret
150150
key: webhook.harbor-secret
151151
optional: true
152-
livenessProbe:
152+
- name: ENABLE_WEBHOOK_RATELIMIT
153+
valueFrom:
154+
configMapKeyRef:
155+
name: argocd-image-updater-config
156+
key: webhook.enable-rate-limit
157+
optional: true
158+
- name: WEBHOOK_RATELIMIT_NUM_ALLOWED_REQUESTS
159+
valueFrom:
160+
configMapKeyRef:
161+
name: argocd-image-updater-config
162+
key: webhook.ratelimit-num-allowed-requests
163+
livenessProbe:
164+
- name: WEBHOOK_RATELIMIT_WINDOW
165+
valueFrom:
166+
configMapKeyRef:
167+
name: argocd-image-updater-config
168+
key: webhook.ratelimit-window
169+
- name: WEBHOOK_RATELIMIT_CLEANUP_INTERVAL
170+
valueFrom:
171+
configMapKeyRef:
172+
name: argocd-image-updater-config
173+
key: webhook.ratelimit-cleanup-interval
153174
httpGet:
154175
path: /healthz
155176
port: 8080

‎manifests/install.yaml

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -257,14 +257,35 @@ spec:
257257
key: webhook.harbor-secret
258258
name: argocd-image-updater-secret
259259
optional: true
260-
image: quay.io/argoprojlabs/argocd-image-updater:latest
261-
imagePullPolicy: Always
262-
livenessProbe:
263-
httpGet:
260+
- name: ENABLE_WEBHOOK_RATELIMIT
261+
valueFrom:
262+
configMapKeyRef:
263+
key: webhook.enable-rate-limit
264+
name: argocd-image-updater-config
265+
optional: true
266+
- livenessProbe: null
267+
name: WEBHOOK_RATELIMIT_NUM_ALLOWED_REQUESTS
268+
valueFrom:
269+
configMapKeyRef:
270+
key: webhook.ratelimit-num-allowed-requests
271+
name: argocd-image-updater-config
272+
- name: WEBHOOK_RATELIMIT_WINDOW
273+
valueFrom:
274+
configMapKeyRef:
275+
key: webhook.ratelimit-window
276+
name: argocd-image-updater-config
277+
- httpGet:
264278
path: /healthz
265279
port: 8080
266280
initialDelaySeconds: 3
281+
name: WEBHOOK_RATELIMIT_CLEANUP_INTERVAL
267282
periodSeconds: 30
283+
valueFrom:
284+
configMapKeyRef:
285+
key: webhook.ratelimit-cleanup-interval
286+
name: argocd-image-updater-config
287+
image: quay.io/argoprojlabs/argocd-image-updater:latest
288+
imagePullPolicy: Always
268289
name: argocd-image-updater
269290
ports:
270291
- containerPort: 8080

0 commit comments

Comments
 (0)