Brigade: Generic Webhook Handler

[technosophos]

Per the 1.0.0 feature list:

• Add a generic webhook gateway to the API server (POST /webook/:projectID/:secret)
• Make this webhook callback configurable: It should be possible to disable this from config
• Add support in the charts/brigade chart (to turn of webhook gateway)

The gateway should create an event named webhook, and the payload should be whatever data was posted.

For :secret, we need to generate a per-project secret that can be embedded in the URL and validated per request. This prevents someone from finding all the projects and just spamming these projects with requests.

[technosophos]

It should be disabled by default, and the main documentation should include enabling it:

$ helm install brigade/brigade --set generic-gateway=true

[dgkanatsios]

Started a PoC for this on my local fork here, looking for an initial review before I submit a WIP PR:

Points:

• what would the Generic Webhook payload contain? Currently I'm using

{
    "ref":"master",
    "commit": "lolo"
}

Is it enough?

• missing tests - will do as soon as we agree on the design
• missing chart configuration (need to deep dive into charts' creation, pretty n00b)
• feeling a bit weird about this. Explain: all source code files in the 'webhook' folder use Gin, whereas I used go-restful, since all the other methods on API server use that. Thoughts?
• added a new field on Project struct with the GenericWebhook secret which can be auto-generated
• not sure about this configuration
• there should also be a note in documentation for upgrading brigade on existing projects, since their genericWebhookSecret would be equal to the empty string

Thank you!

[vdice]

@dgkanatsios the PoC looks great to me. Let me know when I can help test and perhaps later next week @technosophos and others can take a look (hectic conference schedule currently!)

[dgkanatsios]

Thanks for the review! I’m off as well, will resume mid next week and let you know :)

[dgkanatsios]

PR created here

[radu-matei]

First of all, sorry for commenting so late in the development process for this feature.

This approach to implementing the generic gateway poses an interesting question - up until the implementation of this feature, the Brigade API server was read-only (accepting only GET requests).

Because the generic gateway is intended to be exposed publicly and used by other services, this means that unless we use ingress paths (not necessarily a straightforward task, and depends on what ingress is used), we would be exposing the entire Brigade API.

Is there a reason why this wouldn't be a separate service, like all other Brigade gateways?
Thanks!

cc @technosophos, @vdice, @dgkanatsios

[dgkanatsios]

As discussed, Generic Webhook is now a separate component