/kheper

Kheper is a tool designed to mock Kong Gateway data plane nodes for testing and developing your control plane.

Primary LanguageGo

Kheper

codecov

Kheper is a tool designed to mock Kong Gateway data plane nodes for testing and developing your control plane. It simulates node behavior using standard and JSON RPC protocols, handles WebSocket events, manages pings, and processes configuration updates. Additionally, Kheper provides a RESTful API for inspecting the configuration received by each node, eliminating the need for a full Kong Gateway setup.

Features:

  • Simulates Kong Gateway data plane node connections to a control plane using multiple WebSocket protocols
    • Supports both standard and JSON RPC protocols
  • Manages connections, pings, and configuration updates
  • Enables communication with multiple control planes for cross-region/environment testing
  • Offers simple configuration through YAML files or environment variables
  • Exposes a RESTful API for inspecting the configuration of each node
  • Supports the simulation of extensive network loads by creating thousands of mock Kong Gateway data plane nodes
  • Compatible with both OSS and Enterprise versions of Kong Gateway

Getting Started

Installation

To use Kheper, you'll need to have Go installed on your system. You can download and install Go from the official website.

Building Kheper

git clone https://github.com/mikefero/kheper.git
cd kheper
make build

Usage

Configuration

Kheper can be configured using a YAML file or environment variables. Below are the configuration options available:

Configuration Options

Kheper Admin API
YAML Key Environment Variable Description
api.enabled KHEPER_API_ENABLED Whether the admin API server should be enabled. (default: false)
api.port KHEPER_API_PORT The port to run the Aadmin PI server on. (default: 5000)
api.timeouts.read KHEPER_API_TIMEOUTS_READ The timeout for reading the request body. (default: 15s)
api.timeouts.read_header KHEPER_API_TIMEOUTS_READ_HEADER The timeout for reading the headers. (default: 15s)
api.timeouts.write KHEPER_API_TIMEOUTS_WRITE The timeout for writing the response. (default: 15s)
OpenTelemetry
YAML Key Environment Variable Description
open_telemetry.enabled KHEPER_OPEN_TELEMETRY_ENABLED Whether the OpenTelemetry collector should be enabled. (default: false)
open_telemetry.host KHEPER_OPEN_TELEMETRY_HOST The host of the OpenTelemetry collector. (default: localhost)
open_telemetry.port KHEPER_OPEN_TELEMETRY_PORT The port of the OpenTelemetry collector. (default: 4317)
open_telemetry.service_name KHEPER_OPEN_TELEMETRY_SERVICE_NAME The service name for the traces and metrics sent to the OpenTelemetry collector. (default: kheper)
open_telemetry.metric_interval KHEPER_OPEN_TELEMETRY_METRIC_INTERVAL The interval at which the OpenTelemetry collector should collect metrics. (default: 2s)
open_telemetry.shutdown_interval KHEPER_OPEN_TELEMETRY_SHUTDOWN_INTERVAL The interval at which the OpenTelemetry collector should shutdown. (default: 10s)
Global configurations
Node
YAML Key Environment Variable Description
globals.node.handshake_timeout KHEPER_GLOBALS_NODE_HANDSHAKE_TIMEOUT The amount of time allowed to complete the WebSocket handshake. (default: 15s)
globals.node.node_creation_delay KHEPER_GLOBALS_NODE_NODE_CREATION_DELAY The amount of time to wait before creating the next node. (default: 20ms)
globals.node.ping_interval KHEPER_GLOBALS_NODE_PING_INTERVAL The interval at which the node should ping the control plane. This interval must be greater than 0. (default: 15s)
globals.node.ping_jitter KHEPER_GLOBALS_NODE_PING_JITTER The jitter to apply to the ping interval. This jitter must be greater than 0. (default: 5s)
globals.node.reconnection_interval KHEPER_GLOBALS_NODE_RECONNECTION_INTERVAL The interval at which the node should attempt to reconnect to the control plane. This interval must be greater than 0.(default: 10s)
globals.node.reconnection_jitter KHEPER_GLOBALS_NODE_RECONNECTION_JITTER The jitter to apply to the reconnection interval. This jitter must be greater than 0. (default: 5s)
Nodes
YAML Key Environment Variable Description
nodes.instances KHEPER_NODES_INSTANCES The number of node instances to create. (default: 1)
nodes.group KHEPER_NODES_GROUP The name of the group to which the node instance belongs.
nodes.hostname KHEPER_NODES_HOSTNAME The RFC 1123 hostname of the node. This can be a sequential hostname or a specific hostname. when sequential is specified, a sequential hostname will be generated starting with 00000000-0000-4000-8000-000000000001 and incrementing by 1 hexadecimal digit for each node. (default: sequential)
nodes.id KHEPER_NODES_ID The unique ID of the node. This can be a sequential, unique, or a specific UUID. When sequential is specified, a sequential UUID will be generated starting with 00000000-0000-4000-8000-000000000001 and incrementing by 1 hexadecimal digit for each node. When unique is specified, a unique UUID will be generated. (default: sequential)
nodes.required_payload_entities KHEPER_NODES_REQUIRED_PAYLOAD_ENTITIES The entities that must be present in the payload sent from the control plane.
nodes.versions KHEPER_NODES_VERSIONS The Kong Gateway semantic versions of the node. This version can be represented as 3 or 4 integers separated by dots (e.g. 1.2.3 or 1.2.3.4). Each version in the slice will be "round-robin" across the nodes based on the number of instances. (default: 3.7.1)
Connection
YAML Key Environment Variable Description
nodes.connection.host KHEPER_NODES_CONNECTION_HOST The RFC 1123 IP address or hostname of the control plane to connect to.
nodes.connection.port KHEPER_NODES_CONNECTION_PORT The port of the control plane to connect to (range 1-65535).
nodes.connection.protocol KHEPER_NODES_CONNECTION_PROTOCOL The protocol to use to communicate with the control plane. Supported values are 'standard' and 'jsonrpc'. (default: standard)
nodes.connection.cipher_suites KHEPER_NODES_CONNECTION_CIPHER_SUITES The OpenSSL or TLS cipher suites to use when connecting to the control plane. Each cipher suite in the slice will be "round-robin" across the nodes based on the number of instances. If not specified, the default cipher suite will be used.
nodes.connection.tls_version KHEPER_NODES_CONNECTION_TLS_VERSION The TLS version to use when connecting to the control plane. If not specified, TLS v1.3 will be used.
nodes.connection.certificate KHEPER_NODES_CONNECTION_CERTIFICATE The TLS certificate in PEM format to use when connecting to the control plane.
nodes.connection.key KHEPER_NODES_CONNECTION_KEY The TLS key in PEM format to use when connecting to the control plane.

Cipher Suites

The Kheper application allows configuring various TLS cipher suites to ensure secure communication. The cipher suites can be specified using either the OpenSSL or TLS enumeration. Below is a table listing the supported cipher suites and their corresponding identifiers.

For more details on OpenSSL cipher suites, you can refer to the Kong Gateway constants. The mapping between OpenSSL cipher suites and their TLS counterparts were taken from the OpenSSL documentation.

Supported TLS Version

The Kheper application supports TLS versions 1.0 through 1.3. When configuring the application, it is important to note the following:

  • TLS v1.0, TLS v1.1, and TLS v1.2: Clients can specify the desired cipher suite.
  • TLS v1.3: The cipher suites are predefined and cannot be specified by the client. This version uses a fixed set of cipher suites that are considered secure and efficient. As a result, attempting to configure specific cipher suite when using TLS v1.3 will not have any effect.
Supported Cipher Suites
OpenSSL Identifier TLS Identifier Kong Gateway SSL Cipher Suite
ECDHE-RSA-AES128-GCM-SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 intermediate
ECDHE-RSA-AES256-GCM-SHA384 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 intermediate
ECDHE-RSA-CHACHA20-POLY1305 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 intermediate
ECDHE-ECDSA-AES128-GCM-SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 intermediate
ECDHE-ECDSA-AES256-GCM-SHA384 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 intermediate
ECDHE-ECDSA-CHACHA20-POLY1305 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 intermediate
ECDHE-ECDSA-AES128-SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 old
ECDHE-RSA-AES128-SHA256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 old
ECDHE-RSA-AES128-SHA TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA old
ECDHE-RSA-AES256-SHA TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA old
ECDHE-ECDSA-AES128-SHA TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA old
ECDHE-ECDSA-AES256-SHA TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA old
AES128-GCM-SHA256 TLS_RSA_WITH_AES_128_GCM_SHA256 old
AES256-GCM-SHA384 TLS_RSA_WITH_AES_256_GCM_SHA384 old
AES128-SHA256 TLS_RSA_WITH_AES_128_CBC_SHA256 old
AES128-SHA TLS_RSA_WITH_AES_128_CBC_SHA old
AES256-SHA TLS_RSA_WITH_AES_256_CBC_SHA old

The application currently does not support certain Kong Gateway cipher suites in Go, such as AES256-SHA256, DES-CBC3-SHA, DHE-RSA-AES128-GCM-SHA256, DHE-RSA-AES256-GCM-SHA384, DHE-RSA-CHACHA20-POLY1305, DHE-RSA-AES128-SHA256, DHE-RSA-AES256-SHA256. ECDHE-ECDSA-AES256-SHA384, and ECDHE-RSA-AES256-SHA384

For any unsupported cipher suite, an error will be returned indicating the unsupported status.

Example YAML Configuration

Here is an example YAML configuration file:

# Admin API server configuration
api:
  enabled: true
  port: 5000
  timeouts:
    read: 15s
    read_header: 15s
    write: 15s

# OpenTelemetry configuration
open_telemetry:
  enabled: true
  host: localhost
  port: 4317
  service_name: kheper
  metric_interval: 2s
  shutdown_interval: 10s

# Global configuration for various features of Kheper
globals:
  # Node Configurations that are shared across all nodes
  node:
    handshake_timeout: 15s
    node_creation_delay: 20ms
    ping_interval: 15s
    ping_jitter: 5s
    reconnection_interval: 10s
    reconnection_jitter: 5s

# Node configuration for single or multiple control planes
nodes:
  - instances: 8
    hostname: sequential
    id: sequential
    require_payload_entities:
      - parameters
    versions:
      - 3.4.0
      - 3.4.1
      - 3.4.2
      - 3.5.0
      - 3.6.0
      - 3.6.1
      - 3.7.0
      - 3.7.1
    connection:
      host: localhost
      port: 8005
      protocol: standard
      cipher_suites:
        - ECDHE-ECDSA-AES128-GCM-SHA256
        - ECDHE-ECDSA-AES256-GCM-SHA384
        - ECDHE-ECDSA-CHACHA20-POLY1305
        - ECDHE-ECDSA-AES128-SHA256
        - ECDHE-ECDSA-AES128-SHA
        - ECDHE-ECDSA-AES256-SHA
      tls_version: TLSv1.2
      certificate: |
        -----BEGIN CERTIFICATE-----
        MIIBkTCCATegAwIBAgIUNafcmtDPirW6BY512Kn4LVm49ggwCgYIKoZIzj0EAwIw
        HTEbMBkGA1UEAwwSa2hlcGVyLmV4YW1wbGUuY29tMCAXDTI0MDcxNTE1NTExNloY
        DzIxMjQwNjIxMTU1MTE2WjAdMRswGQYDVQQDDBJraGVwZXIuZXhhbXBsZS5jb20w
        WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARnfTV7waofWrgsN86ueBRl+HuF5+3B
        WQgRxu0s1XJqvEgTCsMObNo5c87PA9NpmP2t0O2S8mjonJ2VUOE896CPo1MwUTAd
        BgNVHQ4EFgQU5qSZisQi+Gg5b/W8ianbh9+f1DcwHwYDVR0jBBgwFoAU5qSZisQi
        +Gg5b/W8ianbh9+f1DcwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBF
        AiBxcYu26lPkyxqDjas6gAXIuyJLK4IlDkvkRQxU0Ko9zAIhAJF0vuSPLvp+4L/G
        rrfgvmrE10iZPEm0/Iq2vlF/hZ63
        -----END CERTIFICATE-----
      key: |
        -----BEGIN PRIVATE KEY-----
        MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgc5u/SwkNIuzrCMxr
        IxFc1FAzG1O4Rfm6lWxrFVrTAvahRANCAARnfTV7waofWrgsN86ueBRl+HuF5+3B
        WQgRxu0s1XJqvEgTCsMObNo5c87PA9NpmP2t0O2S8mjonJ2VUOE896CP
        -----END PRIVATE KEY-----

Example Environment Variables Configuration

You can override the YAML configuration using environment variables:

# API
export KHEPER_API_ENABLED=true
export KHEPER_API_PORT=5000
export KHEPER_API_TIMEOUTS_READ=15s
export KHEPER_API_TIMEOUTS_READ_HEADER=15s
export KHEPER_API_TIMEOUTS_WRITE=15s

# OpenTelemetry configuration
export KHEPER_OPEN_TELEMETRY_ENABLED=true
export KHEPER_OPEN_TELEMETRY_HOST=localhost
export KHEPER_OPEN_TELEMETRY_PORT=4317
export KHEPER_OPEN_TELEMETRY_SERVICE_NAME=kheper
export KHEPER_OPEN_TELEMETRY_METRIC_INTERVAL=2s
export KHEPER_OPEN_TELEMETRY_SHUTDOWN_INTERVAL=10s

# Shared node configuration
export KHEPER_GLOBALS_NODE_HANDSHAKE_TIMEOUT=15s
export KHEPER_GLOBALS_NODE_NODE_CREATION_DELAY=20ms
export KHEPER_GLOBALS_NODE_PING_INTERVAL=15s
export KHEPER_GLOBALS_NODE_PING_JITTER=5s
export KHEPER_GLOBALS_NODE_RECONNECTION_INTERVAL=10s
export KHEPER_GLOBALS_NODE_RECONNECTION_JITTER=5s

# Nodes
export KHEPER_NODES_INSTANCES=14
export KHEPER_NODES_HOSTNAME=sequential
export KHEPER_NODES_ID=sequential
export KHEPER_NODES_REQUIRED_PAYLOAD_ENTITIES=parameters
export KHEPER_NODES_VERSIONS=3.7.1,3.7.0
export KHEPER_NODES_CONNECTION_HOST=localhost
export KHEPER_NODES_CONNECTION_PORT=8005
export KHEPER_NODES_CONNECTION_PROTOCOL=standard
export KHEPER_NODES_CONNECTION_CIPHER_SUITE="ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-ECDSA-AES128-SHA256,ECDHE-ECDSA-AES128-SHA,ECDHE-ECDSA-AES256-SHA"
export KHEPER_NODES_CONNECTION_TLS_VERSION=TLSv1.2
export KHEPER_NODES_CONNECTION_CERTIFICATE="-----BEGIN CERTIFICATE-----
MIIBkTCCATegAwIBAgIUNafcmtDPirW6BY512Kn4LVm49ggwCgYIKoZIzj0EAwIw
HTEbMBkGA1UEAwwSa2hlcGVyLmV4YW1wbGUuY29tMCAXDTI0MDcxNTE1NTExNloY
DzIxMjQwNjIxMTU1MTE2WjAdMRswGQYDVQQDDBJraGVwZXIuZXhhbXBsZS5jb20w
WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARnfTV7waofWrgsN86ueBRl+HuF5+3B
WQgRxu0s1XJqvEgTCsMObNo5c87PA9NpmP2t0O2S8mjonJ2VUOE896CPo1MwUTAd
BgNVHQ4EFgQU5qSZisQi+Gg5b/W8ianbh9+f1DcwHwYDVR0jBBgwFoAU5qSZisQi
+Gg5b/W8ianbh9+f1DcwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBF
AiBxcYu26lPkyxqDjas6gAXIuyJLK4IlDkvkRQxU0Ko9zAIhAJF0vuSPLvp+4L/G
rrfgvmrE10iZPEm0/Iq2vlF/hZ63
-----END CERTIFICATE-----"
export KHEPER_NODES_CONNECTION_KEY="-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgc5u/SwkNIuzrCMxr
IxFc1FAzG1O4Rfm6lWxrFVrTAvahRANCAARnfTV7waofWrgsN86ueBRl+HuF5+3B
WQgRxu0s1XJqvEgTCsMObNo5c87PA9NpmP2t0O2S8mjonJ2VUOE896CP
-----END PRIVATE KEY-----"

Hostname and ID

  • nodes.hostname and KHEPER_NODES_HOSTNAME: The RFC 1123 hostname of the node.

    • If sequential is specified, a sequential hostname will be generated.

  • nodes.id and KHEPER_NODES_ID: The unique ID of the node.

    • If sequential is specified, a sequential ID will be generated.
    • If unique is specified, a unique ID will be generated as a random UUID.

Note: If a specific value is provided for hostname or id, it will be used as-is. However, if instances is greater than 1, the same hostname and id will be duplicated for each instance.

Running Kheper

To run Kheper, use the following command:

./bin/kheper

Admin API for Kheper Mock Data Plane Node Application

The Kheper Mock Data Plane Node Application provides an Admin API to manage and retrieve information about hosts and nodes connected to control planes. This API allows users to list all hosts, nodes connected to a specific host, retrieve specific nodes, and access particular resources from a node's payload. Below are the available endpoints and their functionalities:

Endpoints

When OpenTelemetry is enabled, the response will contain the following headers:

  • X-Span-Id: The span context of the request.
  • X-Trace-Id: The trace ID of the request.
List All Groups
  • Endpoint: /v1/groups
  • Method: GET
  • Summary: Retrieve a list of all groups for data plane nodes connected to control planes.
[
  "kong-gateway-oss",
  "kong-gateway-enterprise"
]
List All Nodes Connected to a Group
  • Endpoint: /v1/groups/{group}
  • Method: GET
  • Summary: Retrieve a list of all nodes connected to a specific group.
  • Parameters:
    • group: The name of the group.
[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "cipher_suite": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "group": "kong-gateway-oss",
    "hostname": "node1.example-host.com",
    "tls_version": "TLSv1.2",
    "version": "1.2.3"
  },
  {
    "id": "223e4567-e89b-12d3-a456-426614174001",
    "cipher_suite": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "group": "kong-gateway-oss",
    "hostname": "node2.example-host.com",
    "tls_version": "TLSv1.2",
    "version": "1.2.3.1"
  }
]
List All Hosts
  • Endpoint: /v1/hosts
  • Method: GET
  • Summary: Retrieve a list of all hosts for data plane nodes connected to control planes.
[
  {
    "hostname": "example-host1.com"
  },
  {
    "groups": [
      "kong-gateway-oss",
    ],
    "hostname":"example-host2.com"
  }
]
List All Nodes Connected to a Host
  • Endpoint: /v1/hosts/{host}
  • Method: GET
  • Summary: Retrieve a list of all nodes connected to a specific host or address.
  • Parameters:
    • host: The IP address or hostname of the control plane.
[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "cipher_suite": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "group": "kong-gateway-oss",
    "hostname": "node1.example-host.com",
    "tls_version": "TLSv1.2",
    "version": "1.2.3"
  },
  {
    "id": "223e4567-e89b-12d3-a456-426614174001",
    "cipher_suite": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "group": "kong-gateway-oss",
    "hostname": "node2.example-host.com",
    "tls_version": "TLSv1.2",
    "version": "1.2.3.1"
  }
]
Retrieve a Specific Node
  • Endpoint: /v1/hosts/{host}/{node-id}
  • Method: GET
  • Summary: Retrieve a specific node.
  • Parameters:
    • host: The IP address or hostname of the control plane.
    • node-id: The node ID in UUID format.
{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "cipher_suite": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "group": "kong-gateway-oss",
  "hostname": "node1.example-host.com",
  "tls_version": "TLSv1.2",
  "version": "1.2.3",
  "payload": {
    "config_hash": "374d97a6cdede7dbe918d7e72c29e6c8",
    "config_table": {
      "_format_version": "3.0",
      "_transform": false,
      "parameters": [
        {
          "created_at": 1719610962,
          "key": "cluster_id",
          "value": "46956d6b-4d94-4621-8663-87302bf5b18e"
        }
      ],
      "workspaces": [
        {
          "comment": "default workspace",
          "config": {},
          "created_at": 1719610962,
          "id": "0b38010c-9279-4c3e-a669-9b4f977a1efa",
          "meta": {},
          "name": "default",
          "updated_at": 1719610962
        }
      ]
    },
    "hashes": {
      "config": "374d97a6cdede7dbe918d7e72c29e6c8",
      "plugins": "00000000000000000000000000000000",
      "routes": "00000000000000000000000000000000",
      "services": "00000000000000000000000000000000",
      "targets": "00000000000000000000000000000000"
    },
    "timestamp": 1719750771.23,
    "type": "reconfigure"
  }
}
Retrieve a Specific Resource from a Node Payload
  • Endpoint: /v1/hosts/{host}/{node-id}/{resource}
  • Method: GET
  • Summary: Retrieve a specific resource from the root level of the config_table in the payload JSON object of a node.
  • Parameters:
    • host: The IP address or hostname of the control plane.
    • node-id: The node ID in UUID format.
    • resource: The resource name.
{
  "data": [
    {
      "ca_certificates": null,
      "client_certificate": null,
      "connect_timeout": 60000,
      "created_at": 1719863489,
      "enabled": true,
      "host": "kheper.local",
      "id": "3ec50d85-808a-4ddc-9d72-d5a29fa30aa3",
      "name": "kheper",
      "path": null,
      "port": 80,
      "protocol": "http",
      "read_timeout": 60000,
      "retries": 5,
      "tags": null,
      "tls_verify": null,
      "tls_verify_depth": null,
      "updated_at": 1719863489,
      "write_timeout": 60000
    }
  ],
  "next": null
}

Generating a Certificate and Key Pair

Here is an example of how to generate a certificate and key pair using OpenSSL for multiple cipher suites:

Elliptic Curve Key Pair

openssl req \
  -new \
  -newkey ec:<(openssl ecparam -name prime256v1) \
  -keyout docker/kong/cluster_ec.key \
  -nodes \
  -x509 \
  -days 36500 \
  -out docker/kong/cluster_ec.crt \
  -subj "/CN=kheper.example.com"

RSA Key Pair

openssl req \
  -new \
  -newkey rsa:2048 \
  -keyout docker/kong/cluster_rsa.key \
  -nodes \
  -x509 \
  -days 36500 \
  -out docker/kong/cluster_rsa.crt \
  -subj "/CN=kheper.example.com"

This command generates a new self-signed X.509 certificate valid for 100 years using an elliptic curve key with the prime256v1 curve. It outputs the private key to cluster_ec.key and the certificate to cluster_ec.crt, with the common name (CN) set to kheper.example.com. This PEM-encoded certificate and key can be used as the certificate and key values in the YAML configuration along with the Kong Gateway control plane cluster_cert and cluster_cert_key configuration fields.

Note: A cluster_ec.crt and cluster_ec.key file are included in the repository for convenience and are used in the yaml configuration file example. Additionally cluster_rsa.crt and cluster_rsa.key are included for completeness in order to utilize all cipher suites.

Testing With Kong Gateway

To test Kheper with Kong Gateway, you can use the following commands to start and stop Kong Gateway:

make kong-up
make kong-down

To have the containers log to stdout, you can use the following command:

make kong-up-stdout

Testing With Jaeger, Grafana, and Prometheus

To test Kheper with Jaeger, Grafana, and Prometheus, you can use the following commands to start and stop the services which will allow the metrics to be viewed:

make monitoring-up
make monitoring-down

To have the containers log to stdout, you can use the following command:

make monitoring-up-stdout

TODO

  • Develop a handler for the JSON-RPC protocol.
  • Create default Grafana dashboards.
  • Incorporate a configuration section for both standard and custom plugins.

License

Kheper is licensed under the Apache License, Version 2.0. See the LICENSE file for more information.

Acknowledgements

  • Gorilla WebSocket - A fast, well-tested, and widely used WebSocket library in Go.
  • golangci-lint - A fast Go linters runner for Go. It runs linters in parallel, caching their results for much faster runs.
  • go-memdb - Golang in-memory database built on immutable radix trees
  • kin-openapi - OpenAPI 3.0 (and Swagger v2) implementation for Go (parsing, converting, validation, and more).
  • mockio - A mocking framework for Go that helps in creating and using mocks for testing purposes.
  • OpenTelemetry - High-quality, ubiquitous, and portable telemetry to enable effective observability
  • viper - Go configuration with fangs.
  • zap - Blazing fast, structured, leveled logging in Go.