Naeel
e9a26f7975
Phase 1 (Critical): - #1 JWT auth (done in v0.1.16) - #2 Batch message size validation in send_message_batch.go - #10 RLock in GetQueueUrlV1 (data race fix) Phase 2 (AWS-compatible limits): - #3 QueueName validation: max 80 chars, [a-zA-Z0-9_-](.fifo)? - #4 WaitTimeSeconds clamped to 0-20 - #5 ReceiveMessageWaitTimeSeconds clamped to 0-20 - #6 DelaySeconds clamped to 0-900 - #7 VisibilityTimeout clamped to 0-43200 - #8 MaxNumberOfMessages clamped to 1-10 - #9 Message attributes limited to 10 per message - #15 BatchEntryId length validated (max 80) - #16 DeduplicationID length validated (max 128) - #17 GroupID length validated (max 128) Phase 3 (Per-tenant resource limits): - #11 Max messages per queue (120K standard, 20K FIFO) - #12 Global tenant limit (1000) - #3.5 HTTP request body size limit (1MB via MaxBytesReader) Phase 4 (Stability): - #14 Duplicates map cleanup (already in PeriodicTasks) - #13 FIFO group lock timeout (already in visibility timeout reset) - #18 Redis size guard: skip save if >50MB Skipped (Low, no real risk): - #19 {account} URL param (informational only, not used for access) - #20 ReceiptHandle format (self-validating UUID#UUID) New file: app/gosqs/validation.go — centralized AWS SQS limits and validators
78 lines
2.0 KiB
YAML
78 lines
2.0 KiB
YAML
# deployments/k8s/deployment.yaml
|
|
# Deployment shared-sqs — strategy RollingUpdate (теперь возможен т.к. Redis хранит состояние)
|
|
# Updated: 2026-04-10 — v0.1.17: security fixes (20 vulnerabilities), AWS-compatible limits
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: shared-sqs
|
|
namespace: shared-sqs
|
|
labels:
|
|
app: shared-sqs
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 1
|
|
maxUnavailable: 0
|
|
selector:
|
|
matchLabels:
|
|
app: shared-sqs
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: shared-sqs
|
|
spec:
|
|
containers:
|
|
- name: shared-sqs
|
|
image: naeel/shared-sqs:v0.1.17
|
|
ports:
|
|
- containerPort: 4100
|
|
name: http
|
|
env:
|
|
- name: SHARED_SQS_ADMIN_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: shared-sqs-admin
|
|
key: token
|
|
- name: SHARED_SQS_SEED_DEMO
|
|
value: "true"
|
|
- name: REDIS_ADDR
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: shared-sqs-redis
|
|
key: addr
|
|
- name: REDIS_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: shared-sqs-redis
|
|
key: user
|
|
- name: REDIS_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: shared-sqs-redis
|
|
key: password
|
|
- name: NUBES_ENDPOINT
|
|
value: "https://deck-api-test.ngcloud.ru/api/v1"
|
|
resources:
|
|
requests:
|
|
memory: "64Mi"
|
|
cpu: "50m"
|
|
limits:
|
|
memory: "256Mi"
|
|
cpu: "500m"
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 4100
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 4100
|
|
initialDelaySeconds: 3
|
|
periodSeconds: 5
|
|
imagePullSecrets:
|
|
- name: sless-registry-auth
|