diff --git a/cmd/nginx/flags.go b/cmd/nginx/flags.go
index 780bd546f..19f60dc34 100644
--- a/cmd/nginx/flags.go
+++ b/cmd/nginx/flags.go
@@ -20,7 +20,6 @@ import (
"flag"
"fmt"
"os"
- "runtime"
"github.com/golang/glog"
"github.com/spf13/pflag"
@@ -130,10 +129,6 @@ extension for this to succeed.`)
`Customized address to set as the load-balancer status of Ingress objects this controller satisfies.
Requires the update-status parameter.`)
- dynamicConfigurationEnabled = flags.Bool("enable-dynamic-configuration", true,
- `Dynamically refresh backends on topology changes instead of reloading NGINX.
-Feature backed by OpenResty Lua libraries.`)
-
dynamicCertificatesEnabled = flags.Bool("enable-dynamic-certificates", false,
`Dynamically update SSL certificates instead of reloading NGINX.
Feature backed by OpenResty Lua libraries. Requires that OCSP stapling is not enabled`)
@@ -200,7 +195,7 @@ Feature backed by OpenResty Lua libraries. Requires that OCSP stapling is not en
glog.Warningf("SSL certificate chain completion is disabled (--enable-ssl-chain-completion=false)")
}
- if (*enableSSLChainCompletion || !*dynamicConfigurationEnabled) && *dynamicCertificatesEnabled {
+ if *enableSSLChainCompletion && *dynamicCertificatesEnabled {
return false, nil, fmt.Errorf(`SSL certificate chain completion cannot be enabled and dynamic configuration cannot be disabled when
dynamic certificates functionality is enabled. Please check the flags --enable-ssl-chain-completion and --enable-dynamic-configuration`)
}
@@ -209,40 +204,28 @@ dynamic certificates functionality is enabled. Please check the flags --enable-s
return false, nil, fmt.Errorf("Flags --publish-service and --publish-status-address are mutually exclusive")
}
- // LuaJIT is not available on arch s390x and ppc64le
- disableLua := false
- if runtime.GOARCH == "s390x" || runtime.GOARCH == "ppc64le" {
- disableLua = true
- if *dynamicConfigurationEnabled {
- *dynamicConfigurationEnabled = false
- glog.Warningf("LuaJIT is not available on s390x and ppc64le architectures: disabling dynamic configuration feature.")
- }
- }
-
config := &controller.Configuration{
- APIServerHost: *apiserverHost,
- KubeConfigFile: *kubeConfigFile,
- UpdateStatus: *updateStatus,
- ElectionID: *electionID,
- EnableProfiling: *profiling,
- EnableSSLPassthrough: *enableSSLPassthrough,
- EnableSSLChainCompletion: *enableSSLChainCompletion,
- ResyncPeriod: *resyncPeriod,
- DefaultService: *defaultSvc,
- Namespace: *watchNamespace,
- ConfigMapName: *configMap,
- DefaultSSLCertificate: *defSSLCertificate,
- DefaultHealthzURL: *defHealthzURL,
- PublishService: *publishSvc,
- PublishStatusAddress: *publishStatusAddress,
- ForceNamespaceIsolation: *forceIsolation,
- UpdateStatusOnShutdown: *updateStatusOnShutdown,
- SortBackends: *sortBackends,
- UseNodeInternalIP: *useNodeInternalIP,
- SyncRateLimit: *syncRateLimit,
- DynamicConfigurationEnabled: *dynamicConfigurationEnabled,
- DisableLua: disableLua,
- DynamicCertificatesEnabled: *dynamicCertificatesEnabled,
+ APIServerHost: *apiserverHost,
+ KubeConfigFile: *kubeConfigFile,
+ UpdateStatus: *updateStatus,
+ ElectionID: *electionID,
+ EnableProfiling: *profiling,
+ EnableSSLPassthrough: *enableSSLPassthrough,
+ EnableSSLChainCompletion: *enableSSLChainCompletion,
+ ResyncPeriod: *resyncPeriod,
+ DefaultService: *defaultSvc,
+ Namespace: *watchNamespace,
+ ConfigMapName: *configMap,
+ DefaultSSLCertificate: *defSSLCertificate,
+ DefaultHealthzURL: *defHealthzURL,
+ PublishService: *publishSvc,
+ PublishStatusAddress: *publishStatusAddress,
+ ForceNamespaceIsolation: *forceIsolation,
+ UpdateStatusOnShutdown: *updateStatusOnShutdown,
+ SortBackends: *sortBackends,
+ UseNodeInternalIP: *useNodeInternalIP,
+ SyncRateLimit: *syncRateLimit,
+ DynamicCertificatesEnabled: *dynamicCertificatesEnabled,
ListenPorts: &ngx_config.ListenPorts{
Default: *defServerPort,
Health: *healthzPort,
diff --git a/internal/ingress/controller/checker.go b/internal/ingress/controller/checker.go
index e53cfc74c..118cbeb3f 100644
--- a/internal/ingress/controller/checker.go
+++ b/internal/ingress/controller/checker.go
@@ -44,15 +44,13 @@ func (n *NGINXController) Check(_ *http.Request) error {
return fmt.Errorf("ingress controller is not healthy")
}
- if n.cfg.DynamicConfigurationEnabled {
- res, err := http.Get(fmt.Sprintf("http://127.0.0.1:%v/is-dynamic-lb-initialized", n.cfg.ListenPorts.Status))
- if err != nil {
- return err
- }
- defer res.Body.Close()
- if res.StatusCode != 200 {
- return fmt.Errorf("dynamic load balancer not started")
- }
+ res, err = http.Get(fmt.Sprintf("http://127.0.0.1:%v/is-dynamic-lb-initialized", n.cfg.ListenPorts.Status))
+ if err != nil {
+ return err
+ }
+ defer res.Body.Close()
+ if res.StatusCode != 200 {
+ return fmt.Errorf("dynamic load balancer not started")
}
// check the nginx master process is running
diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go
index 5a0d8b332..67e04540b 100644
--- a/internal/ingress/controller/config/config.go
+++ b/internal/ingress/controller/config/config.go
@@ -685,26 +685,24 @@ func (cfg Configuration) BuildLogFormatUpstream() string {
// TemplateConfig contains the nginx configuration to render the file nginx.conf
type TemplateConfig struct {
- ProxySetHeaders map[string]string
- AddHeaders map[string]string
- MaxOpenFiles int
- BacklogSize int
- Backends []*ingress.Backend
- PassthroughBackends []*ingress.SSLPassthroughBackend
- Servers []*ingress.Server
- HealthzURI string
- CustomErrors bool
- Cfg Configuration
- IsIPV6Enabled bool
- IsSSLPassthroughEnabled bool
- NginxStatusIpv4Whitelist []string
- NginxStatusIpv6Whitelist []string
- RedirectServers map[string]string
- ListenPorts *ListenPorts
- PublishService *apiv1.Service
- DynamicConfigurationEnabled bool
- DynamicCertificatesEnabled bool
- DisableLua bool
+ ProxySetHeaders map[string]string
+ AddHeaders map[string]string
+ MaxOpenFiles int
+ BacklogSize int
+ Backends []*ingress.Backend
+ PassthroughBackends []*ingress.SSLPassthroughBackend
+ Servers []*ingress.Server
+ HealthzURI string
+ CustomErrors bool
+ Cfg Configuration
+ IsIPV6Enabled bool
+ IsSSLPassthroughEnabled bool
+ NginxStatusIpv4Whitelist []string
+ NginxStatusIpv6Whitelist []string
+ RedirectServers map[string]string
+ ListenPorts *ListenPorts
+ PublishService *apiv1.Service
+ DynamicCertificatesEnabled bool
}
// ListenPorts describe the ports required to run the
diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go
index 719a89d6b..b2109bd6b 100644
--- a/internal/ingress/controller/controller.go
+++ b/internal/ingress/controller/controller.go
@@ -86,10 +86,6 @@ type Configuration struct {
SyncRateLimit float32
- DynamicConfigurationEnabled bool
-
- DisableLua bool
-
DynamicCertificatesEnabled bool
}
@@ -162,9 +158,7 @@ func (n *NGINXController) syncIngress(interface{}) error {
return nil
}
- if n.cfg.DynamicConfigurationEnabled && n.IsDynamicConfigurationEnough(pcfg) {
- glog.Infof("Changes handled by the dynamic configuration, skipping backend reload.")
- } else {
+ if !n.IsDynamicConfigurationEnough(pcfg) {
glog.Infof("Configuration changes detected, backend reload required.")
hash, _ := hashstructure.Hash(pcfg, &hashstructure.HashOptions{
@@ -189,23 +183,21 @@ func (n *NGINXController) syncIngress(interface{}) error {
n.metricCollector.SetSSLExpireTime(servers)
}
- if n.cfg.DynamicConfigurationEnabled {
- isFirstSync := n.runningConfig.Equal(&ingress.Configuration{})
- go func(isFirstSync bool) {
- if isFirstSync {
- glog.Infof("Initial synchronization of the NGINX configuration.")
+ isFirstSync := n.runningConfig.Equal(&ingress.Configuration{})
+ go func(isFirstSync bool) {
+ if isFirstSync {
+ glog.Infof("Initial synchronization of the NGINX configuration.")
- // it takes time for NGINX to start listening on the configured ports
- time.Sleep(1 * time.Second)
- }
- err := configureDynamically(pcfg, n.cfg.ListenPorts.Status, n.cfg.DynamicCertificatesEnabled)
- if err == nil {
- glog.Infof("Dynamic reconfiguration succeeded.")
- } else {
- glog.Warningf("Dynamic reconfiguration failed: %v", err)
- }
- }(isFirstSync)
- }
+ // it takes time for NGINX to start listening on the configured ports
+ time.Sleep(1 * time.Second)
+ }
+ err := configureDynamically(pcfg, n.cfg.ListenPorts.Status, n.cfg.DynamicCertificatesEnabled)
+ if err == nil {
+ glog.Infof("Dynamic reconfiguration succeeded.")
+ } else {
+ glog.Warningf("Dynamic reconfiguration failed: %v", err)
+ }
+ }(isFirstSync)
ri := getRemovedIngresses(n.runningConfig, pcfg)
re := getRemovedHosts(n.runningConfig, pcfg)
diff --git a/internal/ingress/controller/nginx.go b/internal/ingress/controller/nginx.go
index f3903ad93..935f8dcdd 100644
--- a/internal/ingress/controller/nginx.go
+++ b/internal/ingress/controller/nginx.go
@@ -571,26 +571,24 @@ func (n *NGINXController) OnUpdate(ingressCfg ingress.Configuration) error {
cfg.SSLDHParam = sslDHParam
tc := ngx_config.TemplateConfig{
- ProxySetHeaders: setHeaders,
- AddHeaders: addHeaders,
- MaxOpenFiles: maxOpenFiles,
- BacklogSize: sysctlSomaxconn(),
- Backends: ingressCfg.Backends,
- PassthroughBackends: ingressCfg.PassthroughBackends,
- Servers: ingressCfg.Servers,
- HealthzURI: ngxHealthPath,
- CustomErrors: len(cfg.CustomHTTPErrors) > 0,
- Cfg: cfg,
- IsIPV6Enabled: n.isIPV6Enabled && !cfg.DisableIpv6,
- NginxStatusIpv4Whitelist: cfg.NginxStatusIpv4Whitelist,
- NginxStatusIpv6Whitelist: cfg.NginxStatusIpv6Whitelist,
- RedirectServers: redirectServers,
- IsSSLPassthroughEnabled: n.cfg.EnableSSLPassthrough,
- ListenPorts: n.cfg.ListenPorts,
- PublishService: n.GetPublishService(),
- DynamicConfigurationEnabled: n.cfg.DynamicConfigurationEnabled,
- DynamicCertificatesEnabled: n.cfg.DynamicCertificatesEnabled,
- DisableLua: n.cfg.DisableLua,
+ ProxySetHeaders: setHeaders,
+ AddHeaders: addHeaders,
+ MaxOpenFiles: maxOpenFiles,
+ BacklogSize: sysctlSomaxconn(),
+ Backends: ingressCfg.Backends,
+ PassthroughBackends: ingressCfg.PassthroughBackends,
+ Servers: ingressCfg.Servers,
+ HealthzURI: ngxHealthPath,
+ CustomErrors: len(cfg.CustomHTTPErrors) > 0,
+ Cfg: cfg,
+ IsIPV6Enabled: n.isIPV6Enabled && !cfg.DisableIpv6,
+ NginxStatusIpv4Whitelist: cfg.NginxStatusIpv4Whitelist,
+ NginxStatusIpv6Whitelist: cfg.NginxStatusIpv6Whitelist,
+ RedirectServers: redirectServers,
+ IsSSLPassthroughEnabled: n.cfg.EnableSSLPassthrough,
+ ListenPorts: n.cfg.ListenPorts,
+ PublishService: n.GetPublishService(),
+ DynamicCertificatesEnabled: n.cfg.DynamicCertificatesEnabled,
}
tc.Cfg.Checksum = ingressCfg.ConfigurationChecksum
diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go
index 24466e4fc..e6df56282 100644
--- a/internal/ingress/controller/template/template.go
+++ b/internal/ingress/controller/template/template.go
@@ -198,24 +198,20 @@ func shouldConfigureLuaRestyWAF(disableLuaRestyWAF bool, mode string) bool {
return false
}
-func buildLuaSharedDictionaries(s interface{}, dynamicConfigurationEnabled bool, disableLuaRestyWAF bool) string {
+func buildLuaSharedDictionaries(s interface{}, disableLuaRestyWAF bool) string {
servers, ok := s.([]*ingress.Server)
if !ok {
glog.Errorf("expected an '[]*ingress.Server' type but %T was returned", s)
return ""
}
- out := []string{}
-
- if dynamicConfigurationEnabled {
- out = append(out,
- "lua_shared_dict configuration_data 5M",
- "lua_shared_dict certificate_data 16M",
- "lua_shared_dict locks 512k",
- "lua_shared_dict balancer_ewma 1M",
- "lua_shared_dict balancer_ewma_last_touched_at 1M",
- "lua_shared_dict sticky_sessions 1M",
- )
+ out := []string{
+ "lua_shared_dict configuration_data 5M",
+ "lua_shared_dict certificate_data 16M",
+ "lua_shared_dict locks 512k",
+ "lua_shared_dict balancer_ewma 1M",
+ "lua_shared_dict balancer_ewma_last_touched_at 1M",
+ "lua_shared_dict sticky_sessions 1M",
}
if !disableLuaRestyWAF {
@@ -439,7 +435,7 @@ func buildLoadBalancingConfig(b interface{}, fallbackLoadBalancing string) strin
// (specified through the nginx.ingress.kubernetes.io/rewrite-target annotation)
// If the annotation nginx.ingress.kubernetes.io/add-base-url:"true" is specified it will
// add a base tag in the head of the response from the service
-func buildProxyPass(host string, b interface{}, loc interface{}, dynamicConfigurationEnabled bool) string {
+func buildProxyPass(host string, b interface{}, loc interface{}) string {
backends, ok := b.([]*ingress.Backend)
if !ok {
glog.Errorf("expected an '[]*ingress.Backend' type but %T was returned", b)
@@ -473,10 +469,6 @@ func buildProxyPass(host string, b interface{}, loc interface{}, dynamicConfigur
upstreamName := "upstream_balancer"
- if !dynamicConfigurationEnabled {
- upstreamName = location.Backend
- }
-
for _, backend := range backends {
if backend.Name == location.Backend {
if backend.SSLPassthrough {
@@ -487,10 +479,6 @@ func buildProxyPass(host string, b interface{}, loc interface{}, dynamicConfigur
}
}
- if !dynamicConfigurationEnabled && isSticky(host, location, backend.SessionAffinity.CookieSessionAffinity.Locations) {
- upstreamName = fmt.Sprintf("sticky-%v", upstreamName)
- }
-
break
}
}
@@ -724,14 +712,7 @@ func buildDenyVariable(a interface{}) string {
return fmt.Sprintf("$deny_%v", denyPathSlugMap[l])
}
-func buildUpstreamName(host string, b interface{}, loc interface{}, dynamicConfigurationEnabled bool) string {
-
- backends, ok := b.([]*ingress.Backend)
- if !ok {
- glog.Errorf("expected an '[]*ingress.Backend' type but %T was returned", b)
- return ""
- }
-
+func buildUpstreamName(loc interface{}) string {
location, ok := loc.(*ingress.Location)
if !ok {
glog.Errorf("expected a '*ingress.Location' type but %T was returned", loc)
@@ -740,19 +721,6 @@ func buildUpstreamName(host string, b interface{}, loc interface{}, dynamicConfi
upstreamName := location.Backend
- if !dynamicConfigurationEnabled {
- for _, backend := range backends {
- if backend.Name == location.Backend {
- if backend.SessionAffinity.AffinityType == "cookie" &&
- isSticky(host, location, backend.SessionAffinity.CookieSessionAffinity.Locations) {
- upstreamName = fmt.Sprintf("sticky-%v", upstreamName)
- }
-
- break
- }
- }
- }
-
return upstreamName
}
diff --git a/internal/ingress/controller/template/template_test.go b/internal/ingress/controller/template/template_test.go
index 7fcd43d41..2da1c25c6 100644
--- a/internal/ingress/controller/template/template_test.go
+++ b/internal/ingress/controller/template/template_test.go
@@ -40,41 +40,26 @@ import (
var (
// TODO: add tests for SSLPassthrough
tmplFuncTestcases = map[string]struct {
- Path string
- Target string
- Location string
- ProxyPass string
- AddBaseURL bool
- BaseURLScheme string
- Sticky bool
- XForwardedPrefix bool
- DynamicConfigurationEnabled bool
- SecureBackend bool
- enforceRegex bool
+ Path string
+ Target string
+ Location string
+ ProxyPass string
+ AddBaseURL bool
+ BaseURLScheme string
+ Sticky bool
+ XForwardedPrefix bool
+ SecureBackend bool
+ enforceRegex bool
}{
"when secure backend enabled": {
"/",
"/",
"/",
- "proxy_pass https://upstream-name;",
+ "proxy_pass https://upstream_balancer;",
false,
"",
false,
false,
- false,
- true,
- false,
- },
- "when secure backend and stickeness enabled": {
- "/",
- "/",
- "/",
- "proxy_pass https://sticky-upstream-name;",
- false,
- "",
- true,
- false,
- false,
true,
false,
},
@@ -88,8 +73,8 @@ var (
false,
false,
true,
- true,
- false},
+ false,
+ },
"when secure backend, stickeness and dynamic config enabled": {
"/",
"/",
@@ -100,7 +85,6 @@ var (
true,
false,
true,
- true,
false,
},
"invalid redirect / to / with dynamic config enabled": {
@@ -112,7 +96,6 @@ var (
"",
false,
false,
- true,
false,
false,
},
@@ -120,14 +103,13 @@ var (
"/",
"/",
"/",
- "proxy_pass http://upstream-name;",
+ "proxy_pass http://upstream_balancer;",
false,
"",
false,
false,
false,
false,
- false,
},
"redirect / to /jenkins": {
"/",
@@ -136,14 +118,13 @@ var (
`
rewrite "(?i)/(.*)" /jenkins/$1 break;
rewrite "(?i)/$" /jenkins/ break;
-proxy_pass http://upstream-name;
+proxy_pass http://upstream_balancer;
`,
false,
"",
false,
false,
false,
- false,
true,
},
"redirect /something to /": {
@@ -153,14 +134,13 @@ proxy_pass http://upstream-name;
`
rewrite "(?i)/something/(.*)" /$1 break;
rewrite "(?i)/something$" / break;
-proxy_pass http://upstream-name;
+proxy_pass http://upstream_balancer;
`,
false,
"",
false,
false,
false,
- false,
true,
},
"redirect /end-with-slash/ to /not-root": {
@@ -170,14 +150,13 @@ proxy_pass http://upstream-name;
`
rewrite "(?i)/end-with-slash/(.*)" /not-root/$1 break;
rewrite "(?i)/end-with-slash/$" /not-root/ break;
-proxy_pass http://upstream-name;
+proxy_pass http://upstream_balancer;
`,
false,
"",
false,
false,
false,
- false,
true,
},
"redirect /something-complex to /not-root": {
@@ -187,14 +166,13 @@ proxy_pass http://upstream-name;
`
rewrite "(?i)/something-complex/(.*)" /not-root/$1 break;
rewrite "(?i)/something-complex$" /not-root/ break;
-proxy_pass http://upstream-name;
+proxy_pass http://upstream_balancer;
`,
false,
"",
false,
false,
false,
- false,
true,
},
"redirect / to /jenkins and rewrite": {
@@ -204,7 +182,7 @@ proxy_pass http://upstream-name;
`
rewrite "(?i)/(.*)" /jenkins/$1 break;
rewrite "(?i)/$" /jenkins/ break;
-proxy_pass http://upstream-name;
+proxy_pass http://upstream_balancer;
set_escape_uri $escaped_base_uri $baseuri;
subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1' ro;
@@ -214,7 +192,6 @@ subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1' ro;
@@ -234,7 +211,6 @@ subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1' ro;
@@ -254,7 +230,6 @@ subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1' ro;
@@ -274,7 +249,6 @@ subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1' ro;
@@ -294,7 +268,6 @@ subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1