diff --git a/cmd/nginx/flags.go b/cmd/nginx/flags.go index 780bd546f..19f60dc34 100644 --- a/cmd/nginx/flags.go +++ b/cmd/nginx/flags.go @@ -20,7 +20,6 @@ import ( "flag" "fmt" "os" - "runtime" "github.com/golang/glog" "github.com/spf13/pflag" @@ -130,10 +129,6 @@ extension for this to succeed.`) `Customized address to set as the load-balancer status of Ingress objects this controller satisfies. Requires the update-status parameter.`) - dynamicConfigurationEnabled = flags.Bool("enable-dynamic-configuration", true, - `Dynamically refresh backends on topology changes instead of reloading NGINX. -Feature backed by OpenResty Lua libraries.`) - dynamicCertificatesEnabled = flags.Bool("enable-dynamic-certificates", false, `Dynamically update SSL certificates instead of reloading NGINX. Feature backed by OpenResty Lua libraries. Requires that OCSP stapling is not enabled`) @@ -200,7 +195,7 @@ Feature backed by OpenResty Lua libraries. Requires that OCSP stapling is not en glog.Warningf("SSL certificate chain completion is disabled (--enable-ssl-chain-completion=false)") } - if (*enableSSLChainCompletion || !*dynamicConfigurationEnabled) && *dynamicCertificatesEnabled { + if *enableSSLChainCompletion && *dynamicCertificatesEnabled { return false, nil, fmt.Errorf(`SSL certificate chain completion cannot be enabled and dynamic configuration cannot be disabled when dynamic certificates functionality is enabled. Please check the flags --enable-ssl-chain-completion and --enable-dynamic-configuration`) } @@ -209,40 +204,28 @@ dynamic certificates functionality is enabled. Please check the flags --enable-s return false, nil, fmt.Errorf("Flags --publish-service and --publish-status-address are mutually exclusive") } - // LuaJIT is not available on arch s390x and ppc64le - disableLua := false - if runtime.GOARCH == "s390x" || runtime.GOARCH == "ppc64le" { - disableLua = true - if *dynamicConfigurationEnabled { - *dynamicConfigurationEnabled = false - glog.Warningf("LuaJIT is not available on s390x and ppc64le architectures: disabling dynamic configuration feature.") - } - } - config := &controller.Configuration{ - APIServerHost: *apiserverHost, - KubeConfigFile: *kubeConfigFile, - UpdateStatus: *updateStatus, - ElectionID: *electionID, - EnableProfiling: *profiling, - EnableSSLPassthrough: *enableSSLPassthrough, - EnableSSLChainCompletion: *enableSSLChainCompletion, - ResyncPeriod: *resyncPeriod, - DefaultService: *defaultSvc, - Namespace: *watchNamespace, - ConfigMapName: *configMap, - DefaultSSLCertificate: *defSSLCertificate, - DefaultHealthzURL: *defHealthzURL, - PublishService: *publishSvc, - PublishStatusAddress: *publishStatusAddress, - ForceNamespaceIsolation: *forceIsolation, - UpdateStatusOnShutdown: *updateStatusOnShutdown, - SortBackends: *sortBackends, - UseNodeInternalIP: *useNodeInternalIP, - SyncRateLimit: *syncRateLimit, - DynamicConfigurationEnabled: *dynamicConfigurationEnabled, - DisableLua: disableLua, - DynamicCertificatesEnabled: *dynamicCertificatesEnabled, + APIServerHost: *apiserverHost, + KubeConfigFile: *kubeConfigFile, + UpdateStatus: *updateStatus, + ElectionID: *electionID, + EnableProfiling: *profiling, + EnableSSLPassthrough: *enableSSLPassthrough, + EnableSSLChainCompletion: *enableSSLChainCompletion, + ResyncPeriod: *resyncPeriod, + DefaultService: *defaultSvc, + Namespace: *watchNamespace, + ConfigMapName: *configMap, + DefaultSSLCertificate: *defSSLCertificate, + DefaultHealthzURL: *defHealthzURL, + PublishService: *publishSvc, + PublishStatusAddress: *publishStatusAddress, + ForceNamespaceIsolation: *forceIsolation, + UpdateStatusOnShutdown: *updateStatusOnShutdown, + SortBackends: *sortBackends, + UseNodeInternalIP: *useNodeInternalIP, + SyncRateLimit: *syncRateLimit, + DynamicCertificatesEnabled: *dynamicCertificatesEnabled, ListenPorts: &ngx_config.ListenPorts{ Default: *defServerPort, Health: *healthzPort, diff --git a/internal/ingress/controller/checker.go b/internal/ingress/controller/checker.go index e53cfc74c..118cbeb3f 100644 --- a/internal/ingress/controller/checker.go +++ b/internal/ingress/controller/checker.go @@ -44,15 +44,13 @@ func (n *NGINXController) Check(_ *http.Request) error { return fmt.Errorf("ingress controller is not healthy") } - if n.cfg.DynamicConfigurationEnabled { - res, err := http.Get(fmt.Sprintf("http://127.0.0.1:%v/is-dynamic-lb-initialized", n.cfg.ListenPorts.Status)) - if err != nil { - return err - } - defer res.Body.Close() - if res.StatusCode != 200 { - return fmt.Errorf("dynamic load balancer not started") - } + res, err = http.Get(fmt.Sprintf("http://127.0.0.1:%v/is-dynamic-lb-initialized", n.cfg.ListenPorts.Status)) + if err != nil { + return err + } + defer res.Body.Close() + if res.StatusCode != 200 { + return fmt.Errorf("dynamic load balancer not started") } // check the nginx master process is running diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index 5a0d8b332..67e04540b 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -685,26 +685,24 @@ func (cfg Configuration) BuildLogFormatUpstream() string { // TemplateConfig contains the nginx configuration to render the file nginx.conf type TemplateConfig struct { - ProxySetHeaders map[string]string - AddHeaders map[string]string - MaxOpenFiles int - BacklogSize int - Backends []*ingress.Backend - PassthroughBackends []*ingress.SSLPassthroughBackend - Servers []*ingress.Server - HealthzURI string - CustomErrors bool - Cfg Configuration - IsIPV6Enabled bool - IsSSLPassthroughEnabled bool - NginxStatusIpv4Whitelist []string - NginxStatusIpv6Whitelist []string - RedirectServers map[string]string - ListenPorts *ListenPorts - PublishService *apiv1.Service - DynamicConfigurationEnabled bool - DynamicCertificatesEnabled bool - DisableLua bool + ProxySetHeaders map[string]string + AddHeaders map[string]string + MaxOpenFiles int + BacklogSize int + Backends []*ingress.Backend + PassthroughBackends []*ingress.SSLPassthroughBackend + Servers []*ingress.Server + HealthzURI string + CustomErrors bool + Cfg Configuration + IsIPV6Enabled bool + IsSSLPassthroughEnabled bool + NginxStatusIpv4Whitelist []string + NginxStatusIpv6Whitelist []string + RedirectServers map[string]string + ListenPorts *ListenPorts + PublishService *apiv1.Service + DynamicCertificatesEnabled bool } // ListenPorts describe the ports required to run the diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index 719a89d6b..b2109bd6b 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -86,10 +86,6 @@ type Configuration struct { SyncRateLimit float32 - DynamicConfigurationEnabled bool - - DisableLua bool - DynamicCertificatesEnabled bool } @@ -162,9 +158,7 @@ func (n *NGINXController) syncIngress(interface{}) error { return nil } - if n.cfg.DynamicConfigurationEnabled && n.IsDynamicConfigurationEnough(pcfg) { - glog.Infof("Changes handled by the dynamic configuration, skipping backend reload.") - } else { + if !n.IsDynamicConfigurationEnough(pcfg) { glog.Infof("Configuration changes detected, backend reload required.") hash, _ := hashstructure.Hash(pcfg, &hashstructure.HashOptions{ @@ -189,23 +183,21 @@ func (n *NGINXController) syncIngress(interface{}) error { n.metricCollector.SetSSLExpireTime(servers) } - if n.cfg.DynamicConfigurationEnabled { - isFirstSync := n.runningConfig.Equal(&ingress.Configuration{}) - go func(isFirstSync bool) { - if isFirstSync { - glog.Infof("Initial synchronization of the NGINX configuration.") + isFirstSync := n.runningConfig.Equal(&ingress.Configuration{}) + go func(isFirstSync bool) { + if isFirstSync { + glog.Infof("Initial synchronization of the NGINX configuration.") - // it takes time for NGINX to start listening on the configured ports - time.Sleep(1 * time.Second) - } - err := configureDynamically(pcfg, n.cfg.ListenPorts.Status, n.cfg.DynamicCertificatesEnabled) - if err == nil { - glog.Infof("Dynamic reconfiguration succeeded.") - } else { - glog.Warningf("Dynamic reconfiguration failed: %v", err) - } - }(isFirstSync) - } + // it takes time for NGINX to start listening on the configured ports + time.Sleep(1 * time.Second) + } + err := configureDynamically(pcfg, n.cfg.ListenPorts.Status, n.cfg.DynamicCertificatesEnabled) + if err == nil { + glog.Infof("Dynamic reconfiguration succeeded.") + } else { + glog.Warningf("Dynamic reconfiguration failed: %v", err) + } + }(isFirstSync) ri := getRemovedIngresses(n.runningConfig, pcfg) re := getRemovedHosts(n.runningConfig, pcfg) diff --git a/internal/ingress/controller/nginx.go b/internal/ingress/controller/nginx.go index f3903ad93..935f8dcdd 100644 --- a/internal/ingress/controller/nginx.go +++ b/internal/ingress/controller/nginx.go @@ -571,26 +571,24 @@ func (n *NGINXController) OnUpdate(ingressCfg ingress.Configuration) error { cfg.SSLDHParam = sslDHParam tc := ngx_config.TemplateConfig{ - ProxySetHeaders: setHeaders, - AddHeaders: addHeaders, - MaxOpenFiles: maxOpenFiles, - BacklogSize: sysctlSomaxconn(), - Backends: ingressCfg.Backends, - PassthroughBackends: ingressCfg.PassthroughBackends, - Servers: ingressCfg.Servers, - HealthzURI: ngxHealthPath, - CustomErrors: len(cfg.CustomHTTPErrors) > 0, - Cfg: cfg, - IsIPV6Enabled: n.isIPV6Enabled && !cfg.DisableIpv6, - NginxStatusIpv4Whitelist: cfg.NginxStatusIpv4Whitelist, - NginxStatusIpv6Whitelist: cfg.NginxStatusIpv6Whitelist, - RedirectServers: redirectServers, - IsSSLPassthroughEnabled: n.cfg.EnableSSLPassthrough, - ListenPorts: n.cfg.ListenPorts, - PublishService: n.GetPublishService(), - DynamicConfigurationEnabled: n.cfg.DynamicConfigurationEnabled, - DynamicCertificatesEnabled: n.cfg.DynamicCertificatesEnabled, - DisableLua: n.cfg.DisableLua, + ProxySetHeaders: setHeaders, + AddHeaders: addHeaders, + MaxOpenFiles: maxOpenFiles, + BacklogSize: sysctlSomaxconn(), + Backends: ingressCfg.Backends, + PassthroughBackends: ingressCfg.PassthroughBackends, + Servers: ingressCfg.Servers, + HealthzURI: ngxHealthPath, + CustomErrors: len(cfg.CustomHTTPErrors) > 0, + Cfg: cfg, + IsIPV6Enabled: n.isIPV6Enabled && !cfg.DisableIpv6, + NginxStatusIpv4Whitelist: cfg.NginxStatusIpv4Whitelist, + NginxStatusIpv6Whitelist: cfg.NginxStatusIpv6Whitelist, + RedirectServers: redirectServers, + IsSSLPassthroughEnabled: n.cfg.EnableSSLPassthrough, + ListenPorts: n.cfg.ListenPorts, + PublishService: n.GetPublishService(), + DynamicCertificatesEnabled: n.cfg.DynamicCertificatesEnabled, } tc.Cfg.Checksum = ingressCfg.ConfigurationChecksum diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go index 24466e4fc..e6df56282 100644 --- a/internal/ingress/controller/template/template.go +++ b/internal/ingress/controller/template/template.go @@ -198,24 +198,20 @@ func shouldConfigureLuaRestyWAF(disableLuaRestyWAF bool, mode string) bool { return false } -func buildLuaSharedDictionaries(s interface{}, dynamicConfigurationEnabled bool, disableLuaRestyWAF bool) string { +func buildLuaSharedDictionaries(s interface{}, disableLuaRestyWAF bool) string { servers, ok := s.([]*ingress.Server) if !ok { glog.Errorf("expected an '[]*ingress.Server' type but %T was returned", s) return "" } - out := []string{} - - if dynamicConfigurationEnabled { - out = append(out, - "lua_shared_dict configuration_data 5M", - "lua_shared_dict certificate_data 16M", - "lua_shared_dict locks 512k", - "lua_shared_dict balancer_ewma 1M", - "lua_shared_dict balancer_ewma_last_touched_at 1M", - "lua_shared_dict sticky_sessions 1M", - ) + out := []string{ + "lua_shared_dict configuration_data 5M", + "lua_shared_dict certificate_data 16M", + "lua_shared_dict locks 512k", + "lua_shared_dict balancer_ewma 1M", + "lua_shared_dict balancer_ewma_last_touched_at 1M", + "lua_shared_dict sticky_sessions 1M", } if !disableLuaRestyWAF { @@ -439,7 +435,7 @@ func buildLoadBalancingConfig(b interface{}, fallbackLoadBalancing string) strin // (specified through the nginx.ingress.kubernetes.io/rewrite-target annotation) // If the annotation nginx.ingress.kubernetes.io/add-base-url:"true" is specified it will // add a base tag in the head of the response from the service -func buildProxyPass(host string, b interface{}, loc interface{}, dynamicConfigurationEnabled bool) string { +func buildProxyPass(host string, b interface{}, loc interface{}) string { backends, ok := b.([]*ingress.Backend) if !ok { glog.Errorf("expected an '[]*ingress.Backend' type but %T was returned", b) @@ -473,10 +469,6 @@ func buildProxyPass(host string, b interface{}, loc interface{}, dynamicConfigur upstreamName := "upstream_balancer" - if !dynamicConfigurationEnabled { - upstreamName = location.Backend - } - for _, backend := range backends { if backend.Name == location.Backend { if backend.SSLPassthrough { @@ -487,10 +479,6 @@ func buildProxyPass(host string, b interface{}, loc interface{}, dynamicConfigur } } - if !dynamicConfigurationEnabled && isSticky(host, location, backend.SessionAffinity.CookieSessionAffinity.Locations) { - upstreamName = fmt.Sprintf("sticky-%v", upstreamName) - } - break } } @@ -724,14 +712,7 @@ func buildDenyVariable(a interface{}) string { return fmt.Sprintf("$deny_%v", denyPathSlugMap[l]) } -func buildUpstreamName(host string, b interface{}, loc interface{}, dynamicConfigurationEnabled bool) string { - - backends, ok := b.([]*ingress.Backend) - if !ok { - glog.Errorf("expected an '[]*ingress.Backend' type but %T was returned", b) - return "" - } - +func buildUpstreamName(loc interface{}) string { location, ok := loc.(*ingress.Location) if !ok { glog.Errorf("expected a '*ingress.Location' type but %T was returned", loc) @@ -740,19 +721,6 @@ func buildUpstreamName(host string, b interface{}, loc interface{}, dynamicConfi upstreamName := location.Backend - if !dynamicConfigurationEnabled { - for _, backend := range backends { - if backend.Name == location.Backend { - if backend.SessionAffinity.AffinityType == "cookie" && - isSticky(host, location, backend.SessionAffinity.CookieSessionAffinity.Locations) { - upstreamName = fmt.Sprintf("sticky-%v", upstreamName) - } - - break - } - } - } - return upstreamName } diff --git a/internal/ingress/controller/template/template_test.go b/internal/ingress/controller/template/template_test.go index 7fcd43d41..2da1c25c6 100644 --- a/internal/ingress/controller/template/template_test.go +++ b/internal/ingress/controller/template/template_test.go @@ -40,41 +40,26 @@ import ( var ( // TODO: add tests for SSLPassthrough tmplFuncTestcases = map[string]struct { - Path string - Target string - Location string - ProxyPass string - AddBaseURL bool - BaseURLScheme string - Sticky bool - XForwardedPrefix bool - DynamicConfigurationEnabled bool - SecureBackend bool - enforceRegex bool + Path string + Target string + Location string + ProxyPass string + AddBaseURL bool + BaseURLScheme string + Sticky bool + XForwardedPrefix bool + SecureBackend bool + enforceRegex bool }{ "when secure backend enabled": { "/", "/", "/", - "proxy_pass https://upstream-name;", + "proxy_pass https://upstream_balancer;", false, "", false, false, - false, - true, - false, - }, - "when secure backend and stickeness enabled": { - "/", - "/", - "/", - "proxy_pass https://sticky-upstream-name;", - false, - "", - true, - false, - false, true, false, }, @@ -88,8 +73,8 @@ var ( false, false, true, - true, - false}, + false, + }, "when secure backend, stickeness and dynamic config enabled": { "/", "/", @@ -100,7 +85,6 @@ var ( true, false, true, - true, false, }, "invalid redirect / to / with dynamic config enabled": { @@ -112,7 +96,6 @@ var ( "", false, false, - true, false, false, }, @@ -120,14 +103,13 @@ var ( "/", "/", "/", - "proxy_pass http://upstream-name;", + "proxy_pass http://upstream_balancer;", false, "", false, false, false, false, - false, }, "redirect / to /jenkins": { "/", @@ -136,14 +118,13 @@ var ( ` rewrite "(?i)/(.*)" /jenkins/$1 break; rewrite "(?i)/$" /jenkins/ break; -proxy_pass http://upstream-name; +proxy_pass http://upstream_balancer; `, false, "", false, false, false, - false, true, }, "redirect /something to /": { @@ -153,14 +134,13 @@ proxy_pass http://upstream-name; ` rewrite "(?i)/something/(.*)" /$1 break; rewrite "(?i)/something$" / break; -proxy_pass http://upstream-name; +proxy_pass http://upstream_balancer; `, false, "", false, false, false, - false, true, }, "redirect /end-with-slash/ to /not-root": { @@ -170,14 +150,13 @@ proxy_pass http://upstream-name; ` rewrite "(?i)/end-with-slash/(.*)" /not-root/$1 break; rewrite "(?i)/end-with-slash/$" /not-root/ break; -proxy_pass http://upstream-name; +proxy_pass http://upstream_balancer; `, false, "", false, false, false, - false, true, }, "redirect /something-complex to /not-root": { @@ -187,14 +166,13 @@ proxy_pass http://upstream-name; ` rewrite "(?i)/something-complex/(.*)" /not-root/$1 break; rewrite "(?i)/something-complex$" /not-root/ break; -proxy_pass http://upstream-name; +proxy_pass http://upstream_balancer; `, false, "", false, false, false, - false, true, }, "redirect / to /jenkins and rewrite": { @@ -204,7 +182,7 @@ proxy_pass http://upstream-name; ` rewrite "(?i)/(.*)" /jenkins/$1 break; rewrite "(?i)/$" /jenkins/ break; -proxy_pass http://upstream-name; +proxy_pass http://upstream_balancer; set_escape_uri $escaped_base_uri $baseuri; subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1' ro; @@ -214,7 +192,6 @@ subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1' ro; @@ -234,7 +211,6 @@ subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1' ro; @@ -254,7 +230,6 @@ subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1' ro; @@ -274,7 +249,6 @@ subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1' ro; @@ -294,7 +268,6 @@ subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1]|"[^"]*")*>)' '$1