Initial commit

CODE_OF_CONDUCT.md

@@ -0,0 +1,4 @@
+## Code of Conduct
+This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct).
+For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact
+[email protected] with any additional questions or comments.

CONTRIBUTING.md

@@ -0,0 +1,59 @@
+# Contributing Guidelines
+
+Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional
+documentation, we greatly value feedback and contributions from our community.
+
+Please read through this document before submitting any issues or pull requests to ensure we have all the necessary
+information to effectively respond to your bug report or contribution.
+
+
+## Reporting Bugs/Feature Requests
+
+We welcome you to use the GitHub issue tracker to report bugs or suggest features.
+
+When filing an issue, please check existing open, or recently closed, issues to make sure somebody else hasn't already
+reported the issue. Please try to include as much information as you can. Details like these are incredibly useful:
+
+* A reproducible test case or series of steps
+* The version of our code being used
+* Any modifications you've made relevant to the bug
+* Anything unusual about your environment or deployment
+
+
+## Contributing via Pull Requests
+Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that:
+
+1. You are working against the latest source on the *main* branch.
+2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already.
+3. You open an issue to discuss any significant work - we would hate for your time to be wasted.
+
+To send us a pull request, please:
+
+1. Fork the repository.
+2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change.
+3. Ensure local tests pass.
+4. Commit to your fork using clear commit messages.
+5. Send us a pull request, answering any default questions in the pull request interface.
+6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation.
+
+GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and
+[creating a pull request](https://help.github.com/articles/creating-a-pull-request/).
+
+
+## Finding contributions to work on
+Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any 'help wanted' issues is a great place to start.
+
+
+## Code of Conduct
+This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct).
+For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact
+[email protected] with any additional questions or comments.
+
+
+## Security issue notifications
+If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue.
+
+
+## Licensing
+
+See the [LICENSE](LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution.

LICENSE

@@ -0,0 +1,15 @@
+Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+

README.md

@@ -0,0 +1,61 @@
+# AWS Sample: Simple Go Web Server for Amazon EKS
+## Overview
+
+This repository contains a webserver written in Go. Its only function is to
+return a web page showing some interesting data about the Kubernetes Pod and EC2
+instance on which it runs, along with remote IP address information.
+
+This server can be used to illustrate the differences in behavior when you
+choose Instances versus IP addresses in a Network or Application Load Balancer's
+Target Group type. It can also be used to show the impact of enabling the Proxy
+v2 Protocol on Network Load Balancers.
+
+The server listens on ports 8080 and 9080. Port 9080 requires the [Proxy v2
+protocol supported by AWS Network Load
+Balancers](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#proxy-protocol)
+to provide client IP address information. Port 8080 is for use without the Proxy
+protocol.
+
+## Prerequisites
+
+You'll need to create an IAM policy as follows. The policy only allows the webserver
+to describe EC2 network interfaces:
+
+```sh
+POLICY_ARN=$(aws iam create-policy \
+  --policy-name EKSLoadBalancerDemo \
+  --policy-document file://policy.json \
+  --query 'Policy.Arn' --output text)
+```
+
+Then, you'll need to create a Service Account in your EKS cluster. This service
+is called `aws-lb-demo` in the `default` namespace. The podspec located in
+`deployment.yaml` refers to this name and namespace. You can change these if you
+like, but you'll need to make sure the podspec is also changed if you do.
+
+```sh
+eksctl create iamserviceaccount \
+  --cluster $CLUSTER \
+  --attach-policy-arn $POLICY_ARN \
+  --namespace default \
+  --name aws-lb-demo \
+  --override-existing-serviceaccounts \
+  --approve
+```
+
+## Other files
+
+The `deployment.yaml` file has a couple of application deployment manifests in
+it. `ingresses.yaml` contains some service and ingress manifests. Finally, the
+`nlb-services.yaml` file defines some Load Balancer services that create Network
+Load Balancers. It creates multiple Load Balancers via both the legacy
+in-tree NLB controller and the AWS Load Balancer v2 controller.
+
+## Warnings
+
+This software is unsupported and not for production use. It is for demonstration
+purposes only.
+
+Use of this software may cause you to incur AWS charges for the resources
+created. Charges are the sole responsibility of the customer. We encourage you to
+destroy these resources after you have finished using them.

app/Dockerfile

@@ -0,0 +1,23 @@
+FROM golang:1.15.4 as build
+
+ENV GOPROXY=direct CGO_ENABLED=0
+
+RUN mkdir /build
+COPY go.mod go.sum main.go /build/
+WORKDIR /build
+RUN go mod download
+RUN go build -o server
+
+FROM scratch
+COPY --from=build /build/server /server
+COPY --from=build /etc/ssl/certs/ /etc/ssl/certs/
+COPY html/ /html/
+
+# Standard HTTP port
+EXPOSE 8080
+# HTTP wrapped in PROXY protocol
+EXPOSE 9080
+
+USER 101
+
+ENTRYPOINT ["/server"]

app/Makefile

@@ -0,0 +1,11 @@
+ECR_ENDPOINT := 749049578452.dkr.ecr.us-west-2.amazonaws.com
+ECR_REPO := $(ECR_ENDPOINT)/eks-demo-app
+
+.PHONY: push
+push: build
+	aws ecr get-login-password | docker login -u AWS --password-stdin $(ECR_ENDPOINT)
+	docker push $(ECR_REPO)
+
+.PHONY: build
+build:
+	docker build -t $(ECR_REPO) .

app/default.conf

@@ -0,0 +1,63 @@
+server {
+    listen       8080;
+    listen  [::]:8080;
+
+    listen       9080 proxy_protocol;
+    listen  [::]:9080 proxy_protocol;
+
+    server_name  localhost;
+
+    real_ip_header proxy_protocol;
+    # Assume RFC1918 address spaces are VPC-local and trustworthy
+    set_real_ip_from 10.0.0.0/8;
+    set_real_ip_from 192.168.0.0/16;
+
+
+    location / {
+        root   /usr/share/nginx/html;
+        try_files $uri /index.html;
+        ssi on;
+    }
+
+    location /run/ {
+        internal;
+        alias /run/;
+    }
+
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+        root   /usr/share/nginx/html;
+    }
+}
+
+# server {
+#     listen       9080 proxy_protocol;
+#     listen  [::]:9080 proxy_protocol;
+
+#     error_log /dev/stderr debug;
+
+#     real_ip_header proxy_protocol;
+#     # Assume RFC1918 address spaces are VPC-local and trustworthy
+#     set_real_ip_from 10.0.0.0/8;
+#     set_real_ip_from 192.168.0.0/16;
+
+#     server_name  localhost;
+
+#     log_subrequest on;
+
+#     location / {
+#         root   /usr/share/nginx/html;
+#         try_files $uri index.html;
+#         ssi on;
+#     }
+
+#     location /run/ {
+#         internal;
+#         alias /run/;
+#     }
+
+#     error_page   500 502 503 504  /50x.html;
+#     location = /50x.html {
+#         root   /usr/share/nginx/html;
+#     }
+# }

app/entrypoint.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+
+set -ex
+
+mkdir -p /var/cache/nginx
+
+get_metadata() {
+    metadata_url="http://169.254.169.254/latest/meta-data/$1"; shift
+    file="$1"; shift
+
+    if ! curl -sf -o "$file" "$metadata_url"; then
+        if [ -z "$TOKEN" ]; then
+            TOKEN=`curl -sf -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"`
+        fi
+        curl -H "X-aws-ec2-metadata-token: $TOKEN" -sSf -o "$file" "$metadata_url"
+    fi
+}
+
+# /run must be mounted read-write via tmpfs
+get_metadata instance-id /run/instance-id.txt
+get_metadata placement/availability-zone /run/availability-zone.txt
+

app/go.mod

@@ -0,0 +1,10 @@
+module aws-lb-v2-demo
+
+go 1.15
+
+require (
+	github.com/aws/aws-sdk-go v1.35.22
+	github.com/pires/go-proxyproto v0.3.1
+	github.com/sebest/xff v0.0.0-20160910043805-6c115e0ffa35
+	github.com/stretchr/testify v1.6.1 // indirect
+)

app/go.sum

@@ -0,0 +1,30 @@
+github.com/aws/aws-sdk-go v1.35.22 h1:Do184JJHgque0dK/udq6MC14W4hCEGkjLDtzRjxLKGM=
+github.com/aws/aws-sdk-go v1.35.22/go.mod h1:tlPOdRjfxPBpNIwqDj61rmsnA85v9jc0Ps9+muhnW+k=
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
+github.com/pires/go-proxyproto v0.3.1 h1:eWb52zeDUbSUDBV+8aVCfOy0pnEG6DrDW3cJ/WKdQsk=
+github.com/pires/go-proxyproto v0.3.1/go.mod h1:Odh9VFOZJCf9G8cLW5o435Xf1J95Jw9Gw5rnCjcwzAY=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/sebest/xff v0.0.0-20160910043805-6c115e0ffa35 h1:eajwn6K3weW5cd1ZXLu2sJ4pvwlBiCWY4uDejOr73gM=
+github.com/sebest/xff v0.0.0-20160910043805-6c115e0ffa35/go.mod h1:wozgYq9WEBQBaIJe4YZ0qTSFAMxmcwBhQH0fO0R34Z0=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/net v0.0.0-20200202094626-16171245cfb2 h1:CCH4IOTTfewWjGOlSp+zGcjutRKlBEZQ6wTn8ozI/nI=
+golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

app/html/index.html.tmpl

@@ -0,0 +1,39 @@
+<head>
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
+    <link rel="manifest" href="/site.webmanifest">
+
+    <title>
+        Sample EKS application
+    </title>
+    <style>
+        .page {
+            background-color: rgb(35, 47, 62);
+        }
+        img.logo {
+            max-width: 7.5%;
+            height: auto;
+        }
+        .align-center {
+            text-align: center;
+        }
+        span.bold {
+            font-weight: bold;
+        }
+        p {
+            color: white;
+            font-family: AmazonEmber,"Helvetica Neue",Helvetica,Arial,sans-serif;
+        }
+    </style>
+    <body class="page">
+        <div class="align-center"><img class="logo" src="/[email protected]"></div>
+        <p class="align-center">App label: <span class="bold">{{.AppLabel}}</span></p>
+        <p class="align-center">Requested URI: <span class="bold">{{.URL.Path}}</span></p>
+        <p class="align-center">This application is being run on instance ID <span class="bold">{{.Identity.InstanceID}}</span>
+          in Availability Zone <span class="bold">{{.Identity.AvailabilityZone}}</span>.</p>
+        <p class="align-center">Pod: <span class="bold">{{.PodName}}</span> in namespace <span class="bold">{{.PodNamespace}}</span>.</p>
+        <p class="align-center">Your client IP address appears to be <span class="bold">{{.RemoteAddr}} ({{.RemoteType}})</span>{{if ne .RemoteAddr .PeerAddr}} (via {{.PeerAddr}} ({{.PeerType}})){{end}}
+          (PROXY protocol is <span class="bold">{{if .ProxyProtocolEnabled}}enabled{{else}}disabled{{end}}</span>).</p>
+    </body>
+</head>

app/html/site.webmanifest

@@ -0,0 +1 @@
+{"name":"","short_name":"","icons":[{"src":"/android-chrome-192x192.png","sizes":"192x192","type":"image/png"},{"src":"/android-chrome-512x512.png","sizes":"512x512","type":"image/png"}],"theme_color":"#ffffff","background_color":"#ffffff","display":"standalone"}