Add pgsql scenario

api/buf.lock

@@ -9,8 +9,8 @@ deps:
   - remote: buf.build
     owner: envoyproxy
     repository: envoy
-    commit: 5b59168cb47246a3b40d27598b6d5909
-    digest: shake256:e219b11f3e40c9e2956286c5de5d2cb3ea6288228b5f6126be163dbe62b050e7accef81d13e5cf35b447e6903a3f21b82019e676ad8b858ca60c48ca8126e391
+    commit: 39f01805b8754956a78bc77bda4c3761
+    digest: shake256:a7e7c7675618056879597d6205e394e85b63b71fd1766818042e6fd9b5c4fd623bede2784a9c635dced61fb40a22610812f164ed40c7a0cecbe50c0ecc76952d
   - remote: buf.build
     owner: envoyproxy
     repository: protoc-gen-validate

playground/scenarios/postgres-concurrency/load-generator/test.js

@@ -0,0 +1,50 @@
+import { randomIntBetween } from "https://jslib.k6.io/k6-utils/1.4.0/index.js";
+import { check, sleep } from "k6";
+import { vu } from "k6/execution";
+import http from "k6/http";
+
+export let vuStages = [
+  { duration: "10s", target: 10 },
+  { duration: "2m", target: 50 },
+  { duration: "10s", target: 10 },
+];
+
+export let options = {
+  discardResponseBodies: true,
+  scenarios: {
+    guests: {
+      executor: "ramping-vus",
+      stages: vuStages,
+      env: { USER_TYPE: "guest" },
+    },
+    subscribers: {
+      executor: "ramping-vus",
+      stages: vuStages,
+      env: { USER_TYPE: "subscriber" },
+    },
+  },
+};
+
+export default function () {
+  let userType = __ENV.USER_TYPE;
+  let userId = vu.idInTest;
+  const url = "http://localhost:8099/postgres";
+  const headers = {
+    "Content-Type": "application/json",
+    Cookie:
+      "session=eyJ1c2VyIjoia2Vub2JpIn0.YbsY4Q.kTaKRTyOIfVlIbNB48d9YH6Q0wo",
+    "User-Type": userType,
+    "User-Id": userId,
+  };
+  const body = {}
+  let res = http.request("POST", url, JSON.stringify(body), {
+    headers: headers,
+  });
+  const ret = check(res, {
+    "http status was 200": res.status === 200,
+  });
+  if (!ret) {
+    // sleep for 10ms to 25ms
+    sleep(randomIntBetween(0.01, 0.025));
+  }
+}

playground/scenarios/postgres-concurrency/metadata.json

@@ -0,0 +1,26 @@
+{
+  "renderer": "tanka",
+  "tkenv": "playground/tanka/apps/aperture-go-example",
+  "needs": ["postgresql"],
+  "aperture_policies": [
+    {
+      "policy_name": "concurrency-scheduling",
+      "values_file": "policies/concurrency-scheduling.yaml"
+    }
+  ],
+  "images": [
+    {
+      "ref": "aperture-go-example",
+      "context": "sdks/aperture-go",
+      "dockerfile": "Dockerfile.manual",
+      "ssh": "default"
+    }
+  ],
+  "child_resources": [
+    {
+      "workload": "aperture-go-example",
+      "resource_deps": ["cluster-bootstrap", "postgresql"],
+      "extra_objects": ["aperture-go-example:serviceaccount"]
+    }
+  ]
+}

playground/scenarios/postgres-concurrency/policies/concurrency-scheduling-cr.yaml

@@ -0,0 +1,51 @@
+apiVersion: fluxninja.com/v1alpha1
+kind: Policy
+metadata:
+  labels:
+    fluxninja.com/validate: "true"
+  name: concurrency-scheduling
+spec:
+  circuit:
+    components:
+    - flow_control:
+        concurrency_scheduler:
+          concurrency_limiter:
+            limit_by_label_key: limit_by_label_key
+            max_idle_time: 7200s
+            max_inflight_duration: 60s
+          in_ports:
+            max_concurrency:
+              constant_signal:
+                value: 10
+          out_ports:
+            accept_percentage:
+              signal_name: ACCEPT_PERCENTAGE
+          scheduler:
+            denied_response_status_code: BadRequest
+            priority_label_key: priority
+            tokens_label_key: tokens
+            workload_label_key: userType
+          selectors:
+          - agent_group: default
+            control_point: postgres
+    - decider:
+        in_ports:
+          lhs:
+            signal_name: ACCEPT_PERCENTAGE
+          rhs:
+            constant_signal:
+              value: 90
+        operator: gte
+        out_ports:
+          output:
+            signal_name: ACCEPT_PERCENTAGE_ALERT
+    - alerter:
+        in_ports:
+          signal:
+            signal_name: ACCEPT_PERCENTAGE_ALERT
+        parameters:
+          alert_name: Too many inflight requests
+    evaluation_interval: 1s
+  resources:
+    flow_control:
+      classifiers: []

playground/scenarios/postgres-concurrency/policies/concurrency-scheduling.yaml

@@ -0,0 +1,27 @@
+# yaml-language-server: $schema=../../../../blueprints/concurrency-scheduling/base/gen/definitions.json
+# Generated values file for concurrency-scheduling/base blueprint
+# Documentation/Reference for objects and parameters can be found at:
+# https://docs.fluxninja.com/reference/blueprints/concurrency-scheduling/base
+
+blueprint: concurrency-scheduling/base
+uri: ../../../../blueprints
+policy:
+  components: []
+  policy_name: concurrency-scheduling
+  resources:
+    flow_control:
+      classifiers: []
+  concurrency_scheduler:
+    alerter:
+      alert_name: "Too many inflight requests"
+    concurrency_limiter:
+      max_inflight_duration: 60s
+      max_idle_time: "7200s"
+    max_concurrency: 10
+    scheduler:
+      workload_label_key: "userType"
+      priority_label_key: "priority"
+      denied_response_status_code: BadRequest
+    selectors:
+      - agent_group: default
+        control_point: postgres

playground/tanka/lib/apps/aperture-sdk-example/aperture-sdk-example.libsonnet

@@ -2,9 +2,11 @@ local k = import 'k.libsonnet';
 
 local container = k.core.v1.container;
 local containerPort = k.core.v1.containerPort;
+local namespace = k.core.v1.namespace;
 local deployment = k.apps.v1.deployment;
 local service = k.core.v1.service;
 local servicePort = k.core.v1.servicePort;
+local serviceAccount = k.core.v1.serviceAccount;
 
 local defaults = {
   environment:: {
@@ -22,9 +24,10 @@ local defaults = {
       port: 80,
     },
     labels: {
-      'app.kubernetes.io/name': $.environment.name,
+      'app.kubernetes.io/name': 'example',
+      'app.kubernetes.io/instance': $.environment.name,
     },
-    app_port: 8080,
+    app_port: 8099,
     agent: {
       address: 'aperture-agent.aperture-agent.svc.cluster.local:8080',
     },
@@ -35,27 +38,36 @@ function(values={}, environment={}) {
   local _merged = defaults { environment+: environment, values+: values },
   local _environment = _merged.environment,
   local _values = _merged.values,
+  namespace:
+    namespace.new(_environment.namespace)
+    + namespace.metadata.withLabels(_values.labels),
   deployment:
     deployment.new(name=_environment.name, containers=[
       container.new(_environment.name, image='%(repository)s:%(tag)s' % _values.image)
       + container.withImagePullPolicy(_values.image.pullPolicy)
       + container.withPorts([
-        containerPort.newNamed(_values.app_port, 'http'),
+        containerPort.newNamed(_values.app_port, 'srvhttp'),
       ])
       + container.withEnvMap({
         APERTURE_APP_PORT: std.toString(_values.app_port),
         APERTURE_AGENT_ADDRESS: _values.agent.address,
         APERTURE_AGENT_INSECURE: 'true',
+        APERTURE_ENABLE_POSTGRES: 'true',
       }),
     ])
+    + deployment.metadata.withLabels(_values.labels)
     + deployment.metadata.withNamespace(_environment.namespace)
     + deployment.spec.selector.withMatchLabels(_values.labels)
-    + deployment.spec.template.metadata.withLabels(_values.labels),
+    + deployment.spec.template.metadata.withLabels(_values.labels)
+    + deployment.spec.template.spec.withServiceAccountName(_environment.name),
   service:
     service.new($.deployment.metadata.name, selector=_values.labels, ports=[
-      local portName = 'http';
-      servicePort.newNamed(name=portName, port=_values.service.port, targetPort=portName),
+      servicePort.newNamed(name='http', port=_values.service.port, targetPort='srvhttp'),
     ])
-    + service.metadata.withNamespace(_environment.namespace)
-    + service.metadata.withLabels(_values.labels),
+    + service.spec.withSelector(_values.labels)
+    + service.metadata.withNamespace(_environment.namespace),
+  serviceAccount:
+    serviceAccount.new($.deployment.metadata.name)
+    + serviceAccount.metadata.withNamespace(_environment.namespace)
+    + serviceAccount.metadata.withLabels(_values.labels),
 }

sdks/aperture-go/Dockerfile.manual

@@ -0,0 +1,24 @@
+# syntax=docker/dockerfile:1
+FROM golang:1.21.5 AS builder
+
+WORKDIR /src
+COPY --link . .
+RUN cd examples/manual && go mod download && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o "example" .
+
+# Final image
+FROM debian:bullseye-slim
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+  ca-certificates \
+  wget \
+  curl \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /src/examples/manual/example /local/bin/example
+
+HEALTHCHECK --interval=5s --timeout=60s --retries=3 --start-period=5s \
+  CMD wget --no-verbose --tries=1 --spider 127.0.0.1:8080/health || exit 1
+
+CMD ["/local/bin/example"]

sdks/aperture-go/examples/manual/go.mod

@@ -0,0 +1,36 @@
+module github.com/fluxninja/aperture-go/v2/manual
+
+go 1.21.5
+
+require (
+	github.com/fluxninja/aperture-go/v2 v2.0.0
+	github.com/gorilla/mux v1.8.1
+	github.com/lib/pq v1.10.9
+	google.golang.org/grpc v1.59.0
+)
+
+require (
+	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.0.2 // indirect
+	github.com/fluxninja/aperture/api/v2 v2.0.0-20240101092959-235caef8dbad // indirect
+	github.com/go-logr/logr v1.3.0 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.1 // indirect
+	go.opentelemetry.io/otel v1.21.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 // indirect
+	go.opentelemetry.io/otel/metric v1.21.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.21.0 // indirect
+	go.opentelemetry.io/otel/trace v1.21.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
+	golang.org/x/net v0.19.0 // indirect
+	golang.org/x/sys v0.15.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
+	google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20231127180814-3a041ad873d4 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20231127180814-3a041ad873d4 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
+)
+
+replace github.com/fluxninja/aperture-go/v2 => ../../

sdks/aperture-go/examples/manual/go.sum

@@ -0,0 +1,66 @@
+github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
+github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/envoyproxy/protoc-gen-validate v1.0.2 h1:QkIBuU5k+x7/QXPvPPnWXWlCdaBFApVqftFV6k087DA=
+github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE=
+github.com/fluxninja/aperture/api/v2 v2.0.0-20240101092959-235caef8dbad h1:J4SgDerz6NPEARbKEXvR5nAjSN1DWJ2J3NnzJKM+JcU=
+github.com/fluxninja/aperture/api/v2 v2.0.0-20240101092959-235caef8dbad/go.mod h1:KSjIteqXmGJl1WOxQeBF9/K6/0sMHfKsRl5VOQkxyNg=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
+github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.1 h1:6UKoz5ujsI55KNpsJH3UwCq3T8kKbZwNZBNPuTTje8U=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.1/go.mod h1:YvJ2f6MplWDhfxiUC3KpyTy76kYUZA4W3pTv/wdKQ9Y=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+go.opentelemetry.io/otel v1.21.0 h1:hzLeKBZEL7Okw2mGzZ0cc4k/A7Fta0uoPgaJCr8fsFc=
+go.opentelemetry.io/otel v1.21.0/go.mod h1:QZzNPQPm1zLX4gZK4cMi+71eaorMSGT3A4znnUvNNEo=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 h1:cl5P5/GIfFh4t6xyruOgJP5QiA1pw4fYYdv6nc6CBWw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0/go.mod h1:zgBdWWAu7oEEMC06MMKc5NLbA/1YDXV1sMpSqEeLQLg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 h1:tIqheXEFWAZ7O8A7m+J0aPTmpJN3YQ7qetUAdkkkKpk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0/go.mod h1:nUeKExfxAQVbiVFn32YXpXZZHZ61Cc3s3Rn1pDBGAb0=
+go.opentelemetry.io/otel/metric v1.21.0 h1:tlYWfeo+Bocx5kLEloTjbcDwBuELRrIFxwdQ36PlJu4=
+go.opentelemetry.io/otel/metric v1.21.0/go.mod h1:o1p3CA8nNHW8j5yuQLdc1eeqEaPfzug24uvsyIEJRWM=
+go.opentelemetry.io/otel/sdk v1.21.0 h1:FTt8qirL1EysG6sTQRZ5TokkU8d0ugCj8htOgThZXQ8=
+go.opentelemetry.io/otel/sdk v1.21.0/go.mod h1:Nna6Yv7PWTdgJHVRD9hIYywQBRx7pbox6nwBnZIxl/E=
+go.opentelemetry.io/otel/trace v1.21.0 h1:WD9i5gzvoUPuXIXH24ZNBudiarZDKuekPqi/E8fpfLc=
+go.opentelemetry.io/otel/trace v1.21.0/go.mod h1:LGbsEB0f9LGjN+OZaQQ26sohbOmiMR+BaslueVtS/qQ=
+go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
+go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
+golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
+golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f h1:Vn+VyHU5guc9KjB5KrjI2q0wCOWEOIh0OEsleqakHJg=
+google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f/go.mod h1:nWSwAFPb+qfNJXsoeO3Io7zf4tMSfN8EA8RlDA04GhY=
+google.golang.org/genproto/googleapis/api v0.0.0-20231127180814-3a041ad873d4 h1:ZcOkrmX74HbKFYnpPY8Qsw93fC29TbJXspYKaBkSXDQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20231127180814-3a041ad873d4/go.mod h1:k2dtGpRrbsSyKcNPKKI5sstZkrNCZwpU/ns96JoHbGg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231127180814-3a041ad873d4 h1:DC7wcm+i+P1rN3Ff07vL+OndGg5OhNddHyTA+ocPqYE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231127180814-3a041ad873d4/go.mod h1:eJVxU6o+4G1PSczBr85xmyvSNYAKvAYgkub40YGomFM=
+google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
+google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=