[Snyk] Security upgrade golang from 1.14 to 1.17.13

.circleci/config.yml

@@ -0,0 +1,76 @@
+version: 2.1
+
+job-defaults: &job-defaults
+  working_directory: &working_directory
+    ~/app
+  environment:
+    - AWS_DEFAULT_REGION: us-west-2
+    - AWS_REGION: us-west-2
+    - AWS_ACCOUNT_ID: "883127560329"
+    - AWS_PROFILE: dev/vault
+
+attach-workspace: &attach-workspace
+  attach_workspace:
+    at: *working_directory
+
+jobs:
+  build:
+    <<: *job-defaults
+    environment:
+      - USE_STATSD=false
+      - LOG_LEVEL=debug
+      - REDIS_SOCKET_TYPE=tcp
+      - REDIS_URL=localhost:6379
+    docker:
+      - image: circleci/golang:1.14
+      - image: redis:alpine
+    steps:
+      - checkout
+      - setup_remote_docker
+      - run:
+          name: Compile
+          command: |
+            make compile
+
+  release-image-quay:
+    machine:
+      docker_layer_caching: true
+    <<: *job-defaults
+    steps:
+      - checkout
+      - run:
+          name: push to Quay
+          command: |
+            unset AWS_ACCESS_KEY_ID; unset AWS_SECRET_ACCESS_KEY;
+            ./ops/docker-login-quay.sh
+
+            export VERSION=${CIRCLE_TAG}
+
+            docker-compose build
+            docker-compose push
+
+            if [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              docker tag quay.io/verygoodsecurity/ratelimit:${VERSION} quay.io/verygoodsecurity/ratelimit:latest
+              VERSION=latest docker-compose push
+            fi
+
+workflows:
+  version: 2
+  test_and_build:
+    jobs:
+      - build:
+          context: circleci
+          filters:
+            tags:
+              only: /^\d+\.\d+\.\d+(?:-\w+){0,1}$/
+            branches:
+              only: /.*/      
+      - release-image-quay:
+          context: circleci
+          requires:
+            - build
+          filters:
+            tags:
+              only: /^\d+\.\d+\.\d+(?:-\w+){0,1}$/
+            branches:
+              ignore: /.*/

Dockerfile

@@ -10,6 +10,13 @@ COPY script script
 
 RUN CGO_ENABLED=0 GOOS=linux go build -o /go/bin/ratelimit -ldflags="-w -s" -v github.com/envoyproxy/ratelimit/src/service_cmd
 
-FROM alpine:3.11 AS final
+FROM alpine:3.11
 RUN apk --no-cache add ca-certificates
+
+FROM ubuntu:latest
+RUN apt-get update && apt-get install -y supervisor
 COPY --from=build /go/bin/ratelimit /bin/ratelimit
+COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
+RUN mkdir -p /var/log/supervisor
+
+ENTRYPOINT ["/usr/bin/supervisord"]

Dockerfile.integration

@@ -1,5 +1,5 @@
 # Running this docker image runs the integration tests.
-FROM golang:1.14
+FROM golang:1.17.13
 
 RUN apt-get update -y && apt-get install sudo stunnel4 redis memcached -y && rm -rf /var/lib/apt/lists/*
 

README.md

@@ -38,6 +38,8 @@
 
 # Overview
 
+[![CircleCI](https://circleci.com/gh/verygoodsecurity/ratelimit.svg?style=svg)](https://circleci.com/gh/verygoodsecurity/ratelimit)
+
 The rate limit service is a Go/gRPC service designed to enable generic rate limit scenarios from different types of
 applications. Applications request a rate limit decision based on a domain and a set of descriptors. The service
 reads the configuration from disk via [runtime](https://github.com/lyft/goruntime), composes a cache key, and talks to the Redis cache. A

docker-compose.yml

@@ -37,9 +37,10 @@ services:
       - binary:/usr/local/bin/
 
   ratelimit:
-    image: alpine:3.6
-    command: >
-        sh -c "until test -f /usr/local/bin/ratelimit; do sleep 5; done; /usr/local/bin/ratelimit"
+    image: quay.io/verygoodsecurity/ratelimit:${VERSION:-latest}
+    build:
+      context: .
+      dockerfile: Dockerfile
     ports:
       - 8080:8080
       - 8081:8081

ops/docker-login-quay.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+docker login quay.io --username "$QUAY_DOCKER_LOGIN" --password "$QUAY_DOCKER_LOGIN_PASSWORD"

src/config/config_impl.go

@@ -267,7 +267,9 @@ func (this *rateLimitConfigImpl) GetLimit(
 	}
 
 	if descriptor.GetLimit() != nil {
-		rateLimitKey := domain + "." + this.descriptorToKey(descriptor)
+		//rateLimitKey := domain + "." + this.descriptorToKey(descriptor)
+		// when ip is unique for each request it generates too many stats counters and never cleans them up
+		rateLimitKey := domain + ".override"
 		rateLimitOverrideUnit := pb.RateLimitResponse_RateLimit_Unit(descriptor.GetLimit().GetUnit())
 		rateLimit = NewRateLimit(
 			descriptor.GetLimit().GetRequestsPerUnit(),

supervisord.conf

@@ -0,0 +1,16 @@
+[supervisord]
+logfile=/var/log/supervisor/supervisord.log
+pidfile=/var/run/supervisord.pid
+nodaemon=true
+
+[unix_http_server]
+file = /var/tmp/supervisor.sock
+
+[supervisorctl]
+serverurl=unix:///var/tmp/supervisor.sock
+
+[program:app]
+command=/bin/ratelimit
+redirect_stderr=true
+stdout_logfile=/dev/stdout ; Just dump to stdout, Docker should find it
+stdout_logfile_maxbytes = 0