Bump actions/upload-artifact from 2 to 3

.github/dependabot.yml

@@ -5,11 +5,14 @@ updates:
     directory: "/"
     schedule:
       interval: "monthly"
+    target-branch: "staging"
   - package-ecosystem: "gomod"
     directory: "/"
     schedule:
       interval: "monthly"
+    target-branch: "staging"
   - package-ecosystem: "terraform"
     directory: "/terraform"
     schedule:
       interval: "monthly"
+    target-branch: "staging"

.github/workflows/release.yml

@@ -46,22 +46,22 @@ jobs:
         env:
           IMAGE: ${{ github.repository }}
       - name: upload-convox-linux-amd64
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: convox-linux-amd64
           path: ./cmd/convox/pkg/convox-linux-amd64
       - name: upload-convox-linux-arm64
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: convox-linux-arm64
           path: ./cmd/convox/pkg/convox-linux-arm64
       - name: upload-convox-darwin-10.16-amd64
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: convox-darwin-10.16-amd64
           path: ./cmd/convox/pkg/convox-darwin-10.16-amd64
       - name: upload-convox-darwin-arm64
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: convox-darwin-arm64
           path: ./cmd/convox/pkg/convox-darwin-arm64

docs/installation/production-rack/aws.md

@@ -49,6 +49,7 @@ The following environment variables are required:
 | **cert_duration**        | **2160h**              | Certification renew period                                                                                     | 
 | **cidr**                 | **10.1.0.0/16**        | CIDR range for VPC                                                                                             |
 | **high_availability**    | **true**               | Setting this to "false" will create a cluster with less reduntant resources for cost optimization              |
+| **internal_router**  |     **false**        | Install an internal loadbalancer within the vpc |
 | **internet_gateway_id**  |                        | If you're using an existing vpc for your rack, use this field to pass the id of the attached internet gateway  |
 | **idle_timeout**         | **3600**               | Idle timeout value (in seconds) for the Rack Load Balancer                                                     |
 | **key_pair_name**        |                        | AWS key pair to use for ssh|

docs/management/cli-rack-management.md

@@ -46,6 +46,7 @@ The parameters available for your Rack depend on the underlying cloud provider.
 |---------------------------------- |-----------------|
 | **cidr**                          | **10.1.0.0/16** |
 | **internet_gateway_id**           |                 |
+| **internal_router**               | **false**       |
 | **node_capacity_type**            | **on_demand**   |
 | **node_disk**                     | **20**          |
 | **node_type**                     | **t3.small**    |

docs/reference/primitives/app/service.md

@@ -87,6 +87,7 @@ services:
 | **health**      | string/map | /                   | Health check definition (see below)                                                                                                        |
 | **image**       | string     |                     | An external Docker image to use for this Service (supercedes **build**)                                                                      |
 | **internal**    | boolean    | false               | Set to **true** to make this Service only accessible inside the Rack                                                                         |
+| **internalRouter** | boolean    | false               | Set it to **true** to make this Service only accessible using internal loadbalancer. You also have to set the rack parameter [internal_router](/installation/production-rack/aws) to **true**                 |
 | **port**        | string     |                     | The port that the default Rack balancer will use to [route incoming traffic](/configuration/load-balancers)                     |
 | **ports**       | list       |                     | A list of ports available for internal [service discovery](/configuration/service-discovery) or custom [Balancers](/reference/primitives/app/balancer) |
 | **privileged**  | boolean    | true                | Set to **false** to prevent [Processes](/reference/primitives/app/process) of this Service from running as root inside their container                              |

go.mod

@@ -24,14 +24,14 @@ require (
 	github.com/convox/stdsdk v0.0.0-20201005151143-fb7f05286eea
 	github.com/convox/version v0.0.0-20160822184233-ffefa0d565d2
 	github.com/crazy-max/xgo v0.24.0
-	github.com/creack/pty v1.1.13
+	github.com/creack/pty v1.1.18
 	github.com/docker/docker v1.4.2-0.20190710153559-aa8249ae1b8b
 	github.com/dustin/go-humanize v1.0.0
 	github.com/elastic/go-elasticsearch/v6 v6.8.2
 	github.com/fsouza/go-dockerclient v1.4.2
 	github.com/gobuffalo/packr v1.30.1
 	github.com/gobwas/glob v0.2.3
-	github.com/gorilla/mux v1.7.3
+	github.com/gorilla/mux v1.8.0
 	github.com/goware/modvendor v0.1.0
 	github.com/headzoo/surf v1.0.0
 	github.com/headzoo/ut v0.0.0-20181013193318-a13b5a7a02ca // indirect

go.sum

@@ -147,8 +147,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsr
 github.com/crazy-max/xgo v0.24.0 h1:X4zUOt7ua6t+PYjUGWzaFZeIWE8lQahIwNUQQRcstkM=
 github.com/crazy-max/xgo v0.24.0/go.mod h1:m/aqfKaN/cYzfw+Pzk7Mk0tkmShg3/rCS4Zdhdugi4o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/creack/pty v1.1.13 h1:rTPnd/xocYRjutMfqide2zle1u96upp1gm6eUHKi7us=
-github.com/creack/pty v1.1.13/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
+github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -283,8 +283,9 @@ github.com/googleapis/gnostic v0.4.1/go.mod h1:LRhVm6pbyptWbWbuZ38d1eyptfvIytN3i
 github.com/gorilla/context v1.1.1 h1:AWwleXJkX/nhcU9bZSnZoi3h/qGYqQAGhq6zZe/aQW8=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
 github.com/gorilla/mux v1.7.0/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
-github.com/gorilla/mux v1.7.3 h1:gnP5JzjVOuiZD07fKKToCAOjS0yOpj/qPETTXCCS6hw=
 github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
+github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
+github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
 github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
 github.com/gorilla/sessions v1.1.3 h1:uXoZdcdA5XdXF3QzuSlheVRUvjl+1rKY7zBXL68L9RU=

pkg/manifest/manifest_test.go

@@ -269,8 +269,8 @@ func TestManifestLoad(t *testing.T) {
 				},
 				Init: true,
 				Scale: manifest.ServiceScale{
-					Count:  manifest.ServiceScaleCount{Min: 1, Max: 1},
-					Gpu:    manifest.ServiceScaleGpu{Count: 2, Vendor: "nvidia"},
+					Count: manifest.ServiceScaleCount{Min: 1, Max: 1},
+					Gpu:   manifest.ServiceScaleGpu{Count: 2, Vendor: "nvidia"},
 				},
 				Sticky: false,
 				Termination: manifest.ServiceTermination{
@@ -695,6 +695,7 @@ func TestManifestValidate(t *testing.T) {
 		"service deployment-invalid-low deployment maximum can not be less than 100",
 		"service deployment-invalid-high deployment minimum can not be greater than 100",
 		"service deployment-invalid-high deployment maximum can not be greater than 200",
+		"service internal-router-invalid can not have both internal and internalRouter set as true",
 		"service name serviceF invalid, must contain only lowercase alphanumeric and dashes",
 		"service serviceF references a resource that does not exist: foo",
 		"timer name timer_1 invalid, must contain only lowercase alphanumeric and dashes",

pkg/manifest/service.go

@@ -10,32 +10,33 @@ import (
 type Service struct {
 	Name string `yaml:"-"`
 
-	Agent       ServiceAgent          `yaml:"agent,omitempty"`
-	Annotations ServiceAnnotations    `yaml:"annotations,omitempty"`
-	Build       ServiceBuild          `yaml:"build,omitempty"`
-	Certificate Certificate           `yaml:"certificate,omitempty"`
-	Command     string                `yaml:"command,omitempty"`
-	Deployment  ServiceDeployment     `yaml:"deployment,omitempty"`
-	Domains     ServiceDomains        `yaml:"domain,omitempty"`
-	Drain       int                   `yaml:"drain,omitempty"`
-	Environment Environment           `yaml:"environment,omitempty"`
-	Health      ServiceHealth         `yaml:"health,omitempty"`
-	Image       string                `yaml:"image,omitempty"`
-	Init        bool                  `yaml:"init,omitempty"`
-	Internal    bool                  `yaml:"internal,omitempty"`
-	Port        ServicePortScheme     `yaml:"port,omitempty"`
-	Ports       []ServicePortProtocol `yaml:"ports,omitempty"`
-	Privileged  bool                  `yaml:"privileged,omitempty"`
-	Resources   []string              `yaml:"resources,omitempty"`
-	Scale       ServiceScale          `yaml:"scale,omitempty"`
-	Singleton   bool                  `yaml:"singleton,omitempty"`
-	Sticky      bool                  `yaml:"sticky,omitempty"`
-	Termination ServiceTermination    `yaml:"termination,omitempty"`
-	Test        string                `yaml:"test,omitempty"`
-	Timeout     int                   `yaml:"timeout,omitempty"`
-	Tls         ServiceTls            `yaml:"tls,omitempty"`
-	Volumes     []string              `yaml:"volumes,omitempty"`
-	Whitelist   string                `yaml:"whitelist,omitempty"`
+	Agent          ServiceAgent          `yaml:"agent,omitempty"`
+	Annotations    ServiceAnnotations    `yaml:"annotations,omitempty"`
+	Build          ServiceBuild          `yaml:"build,omitempty"`
+	Certificate    Certificate           `yaml:"certificate,omitempty"`
+	Command        string                `yaml:"command,omitempty"`
+	Deployment     ServiceDeployment     `yaml:"deployment,omitempty"`
+	Domains        ServiceDomains        `yaml:"domain,omitempty"`
+	Drain          int                   `yaml:"drain,omitempty"`
+	Environment    Environment           `yaml:"environment,omitempty"`
+	Health         ServiceHealth         `yaml:"health,omitempty"`
+	Image          string                `yaml:"image,omitempty"`
+	Init           bool                  `yaml:"init,omitempty"`
+	Internal       bool                  `yaml:"internal,omitempty"`
+	InternalRouter bool                  `yaml:"internalRouter,omitempty"`
+	Port           ServicePortScheme     `yaml:"port,omitempty"`
+	Ports          []ServicePortProtocol `yaml:"ports,omitempty"`
+	Privileged     bool                  `yaml:"privileged,omitempty"`
+	Resources      []string              `yaml:"resources,omitempty"`
+	Scale          ServiceScale          `yaml:"scale,omitempty"`
+	Singleton      bool                  `yaml:"singleton,omitempty"`
+	Sticky         bool                  `yaml:"sticky,omitempty"`
+	Termination    ServiceTermination    `yaml:"termination,omitempty"`
+	Test           string                `yaml:"test,omitempty"`
+	Timeout        int                   `yaml:"timeout,omitempty"`
+	Tls            ServiceTls            `yaml:"tls,omitempty"`
+	Volumes        []string              `yaml:"volumes,omitempty"`
+	Whitelist      string                `yaml:"whitelist,omitempty"`
 }
 
 type Services []Service
@@ -271,7 +272,7 @@ func (s Service) ResourcesName() []string {
 
 func (ss Services) External() Services {
 	return ss.Filter(func(s Service) bool {
-		return !s.Internal
+		return !s.Internal && !s.InternalRouter
 	})
 }
 
@@ -288,6 +289,12 @@ func (ss Services) Filter(fn func(s Service) bool) Services {
 	return fss
 }
 
+func (ss Services) InternalRouter() Services {
+	return ss.Filter(func(s Service) bool {
+		return s.InternalRouter
+	})
+}
+
 func (ss Services) Routable() Services {
 	return ss.Filter(func(s Service) bool {
 		return s.Port.Port > 0

pkg/manifest/testdata/validate.yml

@@ -17,6 +17,9 @@ services:
     deployment:
       minimum: 101
       maximum: 201
+  internal-router-invalid:
+    internal: true
+    internalRouter: true
   serviceF:
     build: .
     resources:

pkg/manifest/validate.go

@@ -114,6 +114,10 @@ func (m *Manifest) validateServices() []error {
 			errs = append(errs, fmt.Errorf("service %s deployment maximum can not be greater than 200", s.Name))
 		}
 
+		if s.Internal && s.InternalRouter {
+			errs = append(errs, fmt.Errorf("service %s can not have both internal and internalRouter set as true", s.Name))
+		}
+
 		for _, r := range s.ResourcesName() {
 			if _, err := m.Resource(r); err != nil {
 				if strings.HasPrefix(err.Error(), "no such resource") {

pkg/mock/engine.go

@@ -31,6 +31,10 @@ func (*TestEngine) IngressClass() string {
 	return ""
 }
 
+func (*TestEngine) IngressInternalClass() string {
+	return ""
+}
+
 func (*TestEngine) Log(_, _ string, _ time.Time, _ string) error {
 	return nil
 }

provider/aws/ingress.go

@@ -15,3 +15,7 @@ func (p *Provider) IngressAnnotations(certDuration string) (map[string]string, e
 func (p *Provider) IngressClass() string {
 	return "nginx"
 }
+
+func (p *Provider) IngressInternalClass() string {
+	return "nginx-internal"
+}

provider/azure/ingress.go

@@ -15,3 +15,7 @@ func (p *Provider) IngressAnnotations(certDuration string) (map[string]string, e
 func (p *Provider) IngressClass() string {
 	return "convox"
 }
+
+func (p *Provider) IngressInternalClass() string {
+	return "nginx-internal"
+}

provider/do/ingress.go

@@ -15,3 +15,7 @@ func (p *Provider) IngressAnnotations(certDuration string) (map[string]string, e
 func (p *Provider) IngressClass() string {
 	return "nginx"
 }
+
+func (p *Provider) IngressInternalClass() string {
+	return "nginx-internal"
+}

provider/gcp/ingress.go

@@ -15,3 +15,7 @@ func (p *Provider) IngressAnnotations(certDuration string) (map[string]string, e
 func (p *Provider) IngressClass() string {
 	return "nginx"
 }
+
+func (p *Provider) IngressInternalClass() string {
+	return "nginx-internal"
+}

provider/k8s/engine.go

@@ -12,6 +12,7 @@ type Engine interface {
 	Heartbeat() (map[string]interface{}, error)
 	IngressAnnotations(certDuration string) (map[string]string, error)
 	IngressClass() string
+	IngressInternalClass() string
 	Log(app, stream string, ts time.Time, message string) error
 	ManifestValidate(m *manifest.Manifest) error
 	RegistryAuth(host, username, password string) (string, string, error)

provider/k8s/k8s.go

@@ -35,25 +35,26 @@ const (
 )
 
 type Provider struct {
-	Atom          atom.Interface
-	CertManager   bool
-	Config        *rest.Config
-	Convox        cv.Interface
-	Cluster       kubernetes.Interface
-	Domain        string
-	Engine        Engine
-	Image         string
-	Name          string
-	MetricsClient metricsclientset.Interface
-	MetricScraper *MetricScraperClient
-	Namespace     string
-	Password      string
-	Provider      string
-	Resolver      string
-	Router        string
-	Socket        string
-	Storage       string
-	Version       string
+	Atom           atom.Interface
+	CertManager    bool
+	Config         *rest.Config
+	Convox         cv.Interface
+	Cluster        kubernetes.Interface
+	Domain         string
+	DomainInternal string
+	Engine         Engine
+	Image          string
+	Name           string
+	MetricsClient  metricsclientset.Interface
+	MetricScraper  *MetricScraperClient
+	Namespace      string
+	Password       string
+	Provider       string
+	Resolver       string
+	Router         string
+	Socket         string
+	Storage        string
+	Version        string
 
 	ctx       context.Context
 	logger    *logger.Logger
@@ -102,24 +103,25 @@ func FromEnv() (*Provider, error) {
 	ms := NewMetricScraperClient(kc, os.Getenv("METRICS_SCRAPER_HOST"))
 
 	p := &Provider{
-		Atom:          ac,
-		CertManager:   os.Getenv("CERT_MANAGER") == "true",
-		Config:        rc,
-		Convox:        cc,
-		Cluster:       kc,
-		Domain:        os.Getenv("DOMAIN"),
-		Image:         os.Getenv("IMAGE"),
-		MetricsClient: mc,
-		MetricScraper: ms,
-		Name:          ns.Labels["rack"],
-		Namespace:     ns.Name,
-		Password:      os.Getenv("PASSWORD"),
-		Provider:      common.CoalesceString(os.Getenv("PROVIDER"), "k8s"),
-		Resolver:      os.Getenv("RESOLVER"),
-		Router:        os.Getenv("ROUTER"),
-		Socket:        common.CoalesceString(os.Getenv("SOCKET"), "/var/run/docker.sock"),
-		Storage:       common.CoalesceString(os.Getenv("STORAGE"), "/var/storage"),
-		Version:       common.CoalesceString(os.Getenv("VERSION"), "dev"),
+		Atom:           ac,
+		CertManager:    os.Getenv("CERT_MANAGER") == "true",
+		Config:         rc,
+		Convox:         cc,
+		Cluster:        kc,
+		Domain:         os.Getenv("DOMAIN"),
+		DomainInternal: os.Getenv("DOMAIN_INTERNAL"),
+		Image:          os.Getenv("IMAGE"),
+		MetricsClient:  mc,
+		MetricScraper:  ms,
+		Name:           ns.Labels["rack"],
+		Namespace:      ns.Name,
+		Password:       os.Getenv("PASSWORD"),
+		Provider:       common.CoalesceString(os.Getenv("PROVIDER"), "k8s"),
+		Resolver:       os.Getenv("RESOLVER"),
+		Router:         os.Getenv("ROUTER"),
+		Socket:         common.CoalesceString(os.Getenv("SOCKET"), "/var/run/docker.sock"),
+		Storage:        common.CoalesceString(os.Getenv("STORAGE"), "/var/storage"),
+		Version:        common.CoalesceString(os.Getenv("VERSION"), "dev"),
 	}
 
 	return p, nil

provider/k8s/k8s_test.go

@@ -81,15 +81,16 @@ func testProvider(t *testing.T, fn func(*k8s.Provider)) {
 	require.NoError(t, err)
 
 	p := &k8s.Provider{
-		Atom:          a,
-		Cluster:       c,
-		Convox:        cc,
-		Domain:        "domain1",
-		Engine:        &mock.TestEngine{},
-		MetricsClient: mc,
-		Name:          "rack1",
-		Namespace:     "ns1",
-		Provider:      "test",
+		Atom:           a,
+		Cluster:        c,
+		Convox:         cc,
+		Domain:         "domain1",
+		DomainInternal: "domain-internal",
+		Engine:         &mock.TestEngine{},
+		MetricsClient:  mc,
+		Name:           "rack1",
+		Namespace:      "ns1",
+		Provider:       "test",
 	}
 
 	err = p.Initialize(structs.ProviderOptions{})