Merge pull request #168 from emilevauge/add-marathon-basic-authentication

Add basic authentication support in Marathon

build.Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.5
+FROM golang:1.5.3
 
 RUN go get github.com/Masterminds/glide
 RUN go get github.com/mitchellh/gox

docs/index.md

@@ -487,7 +487,8 @@ domain = "marathon.localhost"
 Labels can be used on containers to override default behaviour:
 
 - `traefik.backend=foo`: assign the application to `foo` backend
-- `traefik.port=80`: register this port. Useful when the application exposes multiples ports.
+- `traefik.portIndex=1`: register port by index in the application's ports array. Useful when the application exposes multiple ports.
+- `traefik.port=80`: register the explicit application port value. Cannot be used alongside `traefik.portIndex`.
 - `traefik.protocol=https`: override the default `http` protocol
 - `traefik.weight=10`: assign this weight to the application
 - `traefik.enable=false`: disable this application in Træfɪk
@@ -515,7 +516,7 @@ Træfɪk can be configured to use Consul as a backend configuration:
 #
 # Required
 #
-endpoint = "http://127.0.0.1:8500"
+endpoint = "127.0.0.1:8500"
 
 # Enable watch Consul changes
 #

provider/marathon.go

@@ -18,9 +18,16 @@ type Marathon struct {
 	Endpoint         string
 	Domain           string
 	NetworkInterface string
+	Basic            *MarathonBasic
 	marathonClient   lightMarathonClient
 }
 
+// MarathonBasic holds basic authentication specific configurations
+type MarathonBasic struct {
+	HTTPBasicAuthUser string
+	HTTPBasicPassword string
+}
+
 type lightMarathonClient interface {
 	Applications(url.Values) (*marathon.Applications, error)
 	AllTasks(v url.Values) (*marathon.Tasks, error)
@@ -32,6 +39,10 @@ func (provider *Marathon) Provide(configurationChan chan<- types.ConfigMessage)
 	config := marathon.NewDefaultConfig()
 	config.URL = provider.Endpoint
 	config.EventsInterface = provider.NetworkInterface
+	if provider.Basic != nil {
+		config.HTTPBasicAuthUser = provider.Basic.HTTPBasicAuthUser
+		config.HTTPBasicPassword = provider.Basic.HTTPBasicPassword
+	}
 	client, err := marathon.NewClient(config)
 	if err != nil {
 		log.Errorf("Failed to create a client for marathon, error: %s", err)
@@ -123,20 +134,55 @@ func taskFilter(task marathon.Task, applications *marathon.Applications) bool {
 		log.Debug("Filtering marathon task without port %s", task.AppID)
 		return false
 	}
-	application, errApp := getApplication(task, applications.Apps)
-	if errApp != nil {
+	application, err := getApplication(task, applications.Apps)
+	if err != nil {
 		log.Errorf("Unable to get marathon application from task %s", task.AppID)
 		return false
 	}
-	_, err := strconv.Atoi(application.Labels["traefik.port"])
-	if len(application.Ports) > 1 && err != nil {
-		log.Debugf("Filtering marathon task %s with more than 1 port and no traefik.port label", task.AppID)
-		return false
-	}
 	if application.Labels["traefik.enable"] == "false" {
 		log.Debugf("Filtering disabled marathon task %s", task.AppID)
 		return false
 	}
+
+	//filter indeterminable task port
+	portIndexLabel := application.Labels["traefik.portIndex"]
+	portValueLabel := application.Labels["traefik.port"]
+	if portIndexLabel != "" && portValueLabel != "" {
+		log.Debugf("Filtering marathon task %s specifying both traefik.portIndex and traefik.port labels", task.AppID)
+		return false
+	}
+	if portIndexLabel == "" && portValueLabel == "" && len(application.Ports) > 1 {
+		log.Debugf("Filtering marathon task %s with more than 1 port and no traefik.portIndex or traefik.port label", task.AppID)
+		return false
+	}
+	if portIndexLabel != "" {
+		index, err := strconv.Atoi(application.Labels["traefik.portIndex"])
+		if err != nil || index < 0 || index > len(application.Ports)-1 {
+			log.Debugf("Filtering marathon task %s with unexpected value for traefik.portIndex label", task.AppID)
+			return false
+		}
+	}
+	if portValueLabel != "" {
+		port, err := strconv.Atoi(application.Labels["traefik.port"])
+		if err != nil {
+			log.Debugf("Filtering marathon task %s with unexpected value for traefik.port label", task.AppID)
+			return false
+		}
+
+		var foundPort bool
+		for _, exposedPort := range task.Ports {
+			if port == exposedPort {
+				foundPort = true
+				break
+			}
+		}
+
+		if !foundPort {
+			log.Debugf("Filtering marathon task %s without a matching port for traefik.port label", task.AppID)
+			return false
+		}
+	}
+
 	//filter healthchecks
 	if application.HasHealthChecks() {
 		if task.HasHealthCheckResults() {
@@ -179,7 +225,22 @@ func (provider *Marathon) getLabel(application marathon.Application, label strin
 	return "", errors.New("Label not found:" + label)
 }
 
-func (provider *Marathon) getPort(task marathon.Task) string {
+func (provider *Marathon) getPort(task marathon.Task, applications []marathon.Application) string {
+	application, err := getApplication(task, applications)
+	if err != nil {
+		log.Errorf("Unable to get marathon application from task %s", task.AppID)
+		return ""
+	}
+
+	if portIndexLabel, err := provider.getLabel(application, "traefik.portIndex"); err == nil {
+		if index, err := strconv.Atoi(portIndexLabel); err == nil {
+			return strconv.Itoa(task.Ports[index])
+		}
+	}
+	if portValueLabel, err := provider.getLabel(application, "traefik.port"); err == nil {
+		return portValueLabel
+	}
+
 	for _, port := range task.Ports {
 		return strconv.Itoa(port)
 	}

provider/marathon_test.go

@@ -201,6 +201,97 @@ func TestMarathonTaskFilter(t *testing.T) {
 			},
 			expected: false,
 		},
+		{
+			task: marathon.Task{
+				AppID: "specify-port-number",
+				Ports: []int{80, 443},
+			},
+			applications: &marathon.Applications{
+				Apps: []marathon.Application{
+					{
+						ID:    "specify-port-number",
+						Ports: []int{80, 443},
+						Labels: map[string]string{
+							"traefik.port": "80",
+						},
+					},
+				},
+			},
+			expected: true,
+		},
+		{
+			task: marathon.Task{
+				AppID: "specify-unknown-port-number",
+				Ports: []int{80, 443},
+			},
+			applications: &marathon.Applications{
+				Apps: []marathon.Application{
+					{
+						ID:    "specify-unknown-port-number",
+						Ports: []int{80, 443},
+						Labels: map[string]string{
+							"traefik.port": "8080",
+						},
+					},
+				},
+			},
+			expected: false,
+		},
+		{
+			task: marathon.Task{
+				AppID: "specify-port-index",
+				Ports: []int{80, 443},
+			},
+			applications: &marathon.Applications{
+				Apps: []marathon.Application{
+					{
+						ID:    "specify-port-index",
+						Ports: []int{80, 443},
+						Labels: map[string]string{
+							"traefik.portIndex": "0",
+						},
+					},
+				},
+			},
+			expected: true,
+		},
+		{
+			task: marathon.Task{
+				AppID: "specify-out-of-range-port-index",
+				Ports: []int{80, 443},
+			},
+			applications: &marathon.Applications{
+				Apps: []marathon.Application{
+					{
+						ID:    "specify-out-of-range-port-index",
+						Ports: []int{80, 443},
+						Labels: map[string]string{
+							"traefik.portIndex": "2",
+						},
+					},
+				},
+			},
+			expected: false,
+		},
+		{
+			task: marathon.Task{
+				AppID: "specify-both-port-index-and-number",
+				Ports: []int{80, 443},
+			},
+			applications: &marathon.Applications{
+				Apps: []marathon.Application{
+					{
+						ID:    "specify-both-port-index-and-number",
+						Ports: []int{80, 443},
+						Labels: map[string]string{
+							"traefik.port":      "443",
+							"traefik.portIndex": "1",
+						},
+					},
+				},
+			},
+			expected: false,
+		},
 		{
 			task: marathon.Task{
 				AppID: "foo",
@@ -370,29 +461,84 @@ func TestMarathonGetPort(t *testing.T) {
 	provider := &Marathon{}
 
 	cases := []struct {
-		task     marathon.Task
-		expected string
+		applications []marathon.Application
+		task         marathon.Task
+		expected     string
 	}{
 		{
-			task:     marathon.Task{},
+			applications: []marathon.Application{},
+			task:         marathon.Task{},
+			expected:     "",
+		},
+		{
+			applications: []marathon.Application{
+				{
+					ID: "test1",
+				},
+			},
+			task: marathon.Task{
+				AppID: "test2",
+			},
 			expected: "",
 		},
 		{
+			applications: []marathon.Application{
+				{
+					ID: "test1",
+				},
+			},
 			task: marathon.Task{
+				AppID: "test1",
 				Ports: []int{80},
 			},
 			expected: "80",
 		},
 		{
+			applications: []marathon.Application{
+				{
+					ID: "test1",
+				},
+			},
 			task: marathon.Task{
+				AppID: "test1",
 				Ports: []int{80, 443},
 			},
 			expected: "80",
 		},
+		{
+			applications: []marathon.Application{
+				{
+					ID: "specify-port-number",
+					Labels: map[string]string{
+						"traefik.port": "443",
+					},
+				},
+			},
+			task: marathon.Task{
+				AppID: "specify-port-number",
+				Ports: []int{80, 443},
+			},
+			expected: "443",
+		},
+		{
+			applications: []marathon.Application{
+				{
+					ID: "specify-port-index",
+					Labels: map[string]string{
+						"traefik.portIndex": "1",
+					},
+				},
+			},
+			task: marathon.Task{
+				AppID: "specify-port-index",
+				Ports: []int{80, 443},
+			},
+			expected: "443",
+		},
 	}
 
 	for _, c := range cases {
-		actual := provider.getPort(c.task)
+		actual := provider.getPort(c.task, c.applications)
 		if actual != c.expected {
 			t.Fatalf("expected %q, got %q", c.expected, actual)
 		}

templates/marathon.tmpl

@@ -1,7 +1,7 @@
 {{$apps := .Applications}}
 [backends]{{range .Tasks}}
     [backends.backend{{.AppID | replace "/" "-"}}.servers.server-{{.ID | replace "." "-"}}]
-    url = "{{getProtocol . $apps}}://{{.Host}}:{{getPort .}}"
+    url = "{{getProtocol . $apps}}://{{.Host}}:{{getPort . $apps}}"
     weight = {{getWeight . $apps}}
 {{end}}
 
@@ -12,4 +12,4 @@
     [frontends.frontend{{.ID | replace "/" "-"}}.routes.route-host{{.ID | replace "/" "-"}}]
     rule = "{{getFrontendRule .}}"
     value = "{{getFrontendValue .}}"
-{{end}}
+{{end}}

tests/compose-marathon.yml

@@ -6,7 +6,7 @@ zk:
     ZK_ID: 1
 
 master:
-  image: mesosphere/mesos-master:0.23.0-1.0.ubuntu1404
+  image: mesosphere/mesos-master:0.26.0-0.2.145.ubuntu1404
   net: host
   environment:
     MESOS_ZK: zk://127.0.0.1:2181/mesos
@@ -17,7 +17,7 @@ master:
     MESOS_WORK_DIR: /var/lib/mesos
 
 slave:
-  image: mesosphere/mesos-slave:0.23.0-1.0.ubuntu1404
+  image: mesosphere/mesos-slave:0.26.0-0.2.145.ubuntu1404
   net: host
   pid: host
   privileged: true
@@ -33,7 +33,7 @@ slave:
     - /var/run/docker.sock:/var/run/docker.sock
 
 marathon:
-  image: mesosphere/marathon:v0.9.2
+  image: mesosphere/marathon:v0.13.0
   net: host
   environment:
     MARATHON_MASTER: zk://127.0.0.1:2181/mesos

tests/whoami.json

@@ -10,14 +10,7 @@
       "network": "BRIDGE",
       "portMappings": [
         { "containerPort": 80, "hostPort": 0, "protocol": "tcp" }
-      ],
-      "parameters": [{
-        "key": "log-driver",
-        "value": "gelf"
-      }, {
-        "key": "log-opt",
-        "value": "gelf-address=udp://172.17.42.1:12201"
-      }]
+      ]
     }
   },
   "healthChecks": [
@@ -32,8 +25,6 @@
   ],
   "labels": {
       "traefik.weight": "1",
-      "traefik.protocole": "https",
-      "traefik.frontend.rule": "Path",
-      "traefik.frontend.value": "/test"
+      "traefik.protocole": "http"
   }
 }

traefik.sample.toml

@@ -142,6 +142,8 @@
 
 # Enable docker TLS connection
 #
+# Optional
+#
 #  [docker.tls]
 #  ca = "/etc/ssl/ca.crt"
 #  cert = "/etc/ssl/docker.crt"
@@ -192,6 +194,14 @@
 #
 # filename = "marathon.tmpl"
 
+# Enable Marathon basic authentication
+#
+# Optional
+#
+#  [marathon.basic]
+#  httpBasicAuthUser = "foo"
+#  httpBasicPassword = "bar"
+
 
 ################################################################
 # Consul KV configuration backend