Clean old code and move helper functions (#8946)
This commit is contained in:
parent
a98c637872
commit
4508493dfe
7 changed files with 374 additions and 292 deletions
|
@ -45,6 +45,7 @@ import (
|
||||||
"k8s.io/ingress-nginx/internal/k8s"
|
"k8s.io/ingress-nginx/internal/k8s"
|
||||||
"k8s.io/ingress-nginx/internal/nginx"
|
"k8s.io/ingress-nginx/internal/nginx"
|
||||||
"k8s.io/ingress-nginx/pkg/apis/ingress"
|
"k8s.io/ingress-nginx/pkg/apis/ingress"
|
||||||
|
utilingress "k8s.io/ingress-nginx/pkg/util/ingress"
|
||||||
"k8s.io/klog/v2"
|
"k8s.io/klog/v2"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
@ -163,7 +164,7 @@ func (n *NGINXController) syncIngress(interface{}) error {
|
||||||
|
|
||||||
n.metricCollector.SetHosts(hosts)
|
n.metricCollector.SetHosts(hosts)
|
||||||
|
|
||||||
if !n.IsDynamicConfigurationEnough(pcfg) {
|
if !utilingress.IsDynamicConfigurationEnough(pcfg, n.runningConfig) {
|
||||||
klog.InfoS("Configuration changes detected, backend reload required")
|
klog.InfoS("Configuration changes detected, backend reload required")
|
||||||
|
|
||||||
hash, _ := hashstructure.Hash(pcfg, &hashstructure.HashOptions{
|
hash, _ := hashstructure.Hash(pcfg, &hashstructure.HashOptions{
|
||||||
|
@ -223,9 +224,9 @@ func (n *NGINXController) syncIngress(interface{}) error {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
ri := getRemovedIngresses(n.runningConfig, pcfg)
|
ri := utilingress.GetRemovedIngresses(n.runningConfig, pcfg)
|
||||||
re := getRemovedHosts(n.runningConfig, pcfg)
|
re := utilingress.GetRemovedHosts(n.runningConfig, pcfg)
|
||||||
rc := getRemovedCertificateSerialNumbers(n.runningConfig, pcfg)
|
rc := utilingress.GetRemovedCertificateSerialNumbers(n.runningConfig, pcfg)
|
||||||
n.metricCollector.RemoveMetrics(ri, re, rc)
|
n.metricCollector.RemoveMetrics(ri, re, rc)
|
||||||
|
|
||||||
n.runningConfig = pcfg
|
n.runningConfig = pcfg
|
||||||
|
@ -1623,91 +1624,6 @@ func extractTLSSecretName(host string, ing *ingress.Ingress,
|
||||||
return ""
|
return ""
|
||||||
}
|
}
|
||||||
|
|
||||||
// getRemovedHosts returns a list of the hostnames
|
|
||||||
// that are not associated anymore to the NGINX configuration.
|
|
||||||
func getRemovedHosts(rucfg, newcfg *ingress.Configuration) []string {
|
|
||||||
old := sets.NewString()
|
|
||||||
new := sets.NewString()
|
|
||||||
|
|
||||||
for _, s := range rucfg.Servers {
|
|
||||||
if !old.Has(s.Hostname) {
|
|
||||||
old.Insert(s.Hostname)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, s := range newcfg.Servers {
|
|
||||||
if !new.Has(s.Hostname) {
|
|
||||||
new.Insert(s.Hostname)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return old.Difference(new).List()
|
|
||||||
}
|
|
||||||
|
|
||||||
func getRemovedCertificateSerialNumbers(rucfg, newcfg *ingress.Configuration) []string {
|
|
||||||
oldCertificates := sets.NewString()
|
|
||||||
newCertificates := sets.NewString()
|
|
||||||
|
|
||||||
for _, server := range rucfg.Servers {
|
|
||||||
if server.SSLCert == nil {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
identifier := server.SSLCert.Identifier()
|
|
||||||
if identifier != "" {
|
|
||||||
if !oldCertificates.Has(identifier) {
|
|
||||||
oldCertificates.Insert(identifier)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, server := range newcfg.Servers {
|
|
||||||
if server.SSLCert == nil {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
identifier := server.SSLCert.Identifier()
|
|
||||||
if identifier != "" {
|
|
||||||
if !newCertificates.Has(identifier) {
|
|
||||||
newCertificates.Insert(identifier)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return oldCertificates.Difference(newCertificates).List()
|
|
||||||
}
|
|
||||||
|
|
||||||
func getRemovedIngresses(rucfg, newcfg *ingress.Configuration) []string {
|
|
||||||
oldIngresses := sets.NewString()
|
|
||||||
newIngresses := sets.NewString()
|
|
||||||
|
|
||||||
for _, server := range rucfg.Servers {
|
|
||||||
for _, location := range server.Locations {
|
|
||||||
if location.Ingress == nil {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
ingKey := k8s.MetaNamespaceKey(location.Ingress)
|
|
||||||
if !oldIngresses.Has(ingKey) {
|
|
||||||
oldIngresses.Insert(ingKey)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, server := range newcfg.Servers {
|
|
||||||
for _, location := range server.Locations {
|
|
||||||
if location.Ingress == nil {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
ingKey := k8s.MetaNamespaceKey(location.Ingress)
|
|
||||||
if !newIngresses.Has(ingKey) {
|
|
||||||
newIngresses.Insert(ingKey)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return oldIngresses.Difference(newIngresses).List()
|
|
||||||
}
|
|
||||||
|
|
||||||
// checks conditions for whether or not an upstream should be created for a custom default backend
|
// checks conditions for whether or not an upstream should be created for a custom default backend
|
||||||
func shouldCreateUpstreamForLocationDefaultBackend(upstream *ingress.Backend, location *ingress.Location) bool {
|
func shouldCreateUpstreamForLocationDefaultBackend(upstream *ingress.Backend, location *ingress.Location) bool {
|
||||||
return (upstream.Name == location.Backend) &&
|
return (upstream.Name == location.Backend) &&
|
||||||
|
|
|
@ -39,7 +39,6 @@ import (
|
||||||
"github.com/eapache/channels"
|
"github.com/eapache/channels"
|
||||||
apiv1 "k8s.io/api/core/v1"
|
apiv1 "k8s.io/api/core/v1"
|
||||||
"k8s.io/apimachinery/pkg/util/intstr"
|
"k8s.io/apimachinery/pkg/util/intstr"
|
||||||
"k8s.io/apimachinery/pkg/util/sets"
|
|
||||||
"k8s.io/client-go/kubernetes/scheme"
|
"k8s.io/client-go/kubernetes/scheme"
|
||||||
v1core "k8s.io/client-go/kubernetes/typed/core/v1"
|
v1core "k8s.io/client-go/kubernetes/typed/core/v1"
|
||||||
"k8s.io/client-go/tools/record"
|
"k8s.io/client-go/tools/record"
|
||||||
|
@ -61,6 +60,8 @@ import (
|
||||||
"k8s.io/ingress-nginx/pkg/apis/ingress"
|
"k8s.io/ingress-nginx/pkg/apis/ingress"
|
||||||
|
|
||||||
"k8s.io/ingress-nginx/pkg/util/file"
|
"k8s.io/ingress-nginx/pkg/util/file"
|
||||||
|
utilingress "k8s.io/ingress-nginx/pkg/util/ingress"
|
||||||
|
|
||||||
klog "k8s.io/klog/v2"
|
klog "k8s.io/klog/v2"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
@ -601,10 +602,9 @@ func (n NGINXController) generateTemplate(cfg ngx_config.Configuration, ingressC
|
||||||
IsIPV6Enabled: n.isIPV6Enabled && !cfg.DisableIpv6,
|
IsIPV6Enabled: n.isIPV6Enabled && !cfg.DisableIpv6,
|
||||||
NginxStatusIpv4Whitelist: cfg.NginxStatusIpv4Whitelist,
|
NginxStatusIpv4Whitelist: cfg.NginxStatusIpv4Whitelist,
|
||||||
NginxStatusIpv6Whitelist: cfg.NginxStatusIpv6Whitelist,
|
NginxStatusIpv6Whitelist: cfg.NginxStatusIpv6Whitelist,
|
||||||
RedirectServers: buildRedirects(ingressCfg.Servers),
|
RedirectServers: utilingress.BuildRedirects(ingressCfg.Servers),
|
||||||
IsSSLPassthroughEnabled: n.cfg.EnableSSLPassthrough,
|
IsSSLPassthroughEnabled: n.cfg.EnableSSLPassthrough,
|
||||||
ListenPorts: n.cfg.ListenPorts,
|
ListenPorts: n.cfg.ListenPorts,
|
||||||
PublishService: n.GetPublishService(),
|
|
||||||
EnableMetrics: n.cfg.EnableMetrics,
|
EnableMetrics: n.cfg.EnableMetrics,
|
||||||
MaxmindEditionFiles: n.cfg.MaxmindEditionFiles,
|
MaxmindEditionFiles: n.cfg.MaxmindEditionFiles,
|
||||||
HealthzURI: nginx.HealthPath,
|
HealthzURI: nginx.HealthPath,
|
||||||
|
@ -832,24 +832,6 @@ func clearL4serviceEndpoints(config *ingress.Configuration) {
|
||||||
config.UDPEndpoints = clearedUDPL4Services
|
config.UDPEndpoints = clearedUDPL4Services
|
||||||
}
|
}
|
||||||
|
|
||||||
// IsDynamicConfigurationEnough returns whether a Configuration can be
|
|
||||||
// dynamically applied, without reloading the backend.
|
|
||||||
func (n *NGINXController) IsDynamicConfigurationEnough(pcfg *ingress.Configuration) bool {
|
|
||||||
copyOfRunningConfig := *n.runningConfig
|
|
||||||
copyOfPcfg := *pcfg
|
|
||||||
|
|
||||||
copyOfRunningConfig.Backends = []*ingress.Backend{}
|
|
||||||
copyOfPcfg.Backends = []*ingress.Backend{}
|
|
||||||
|
|
||||||
clearL4serviceEndpoints(©OfRunningConfig)
|
|
||||||
clearL4serviceEndpoints(©OfPcfg)
|
|
||||||
|
|
||||||
clearCertificates(©OfRunningConfig)
|
|
||||||
clearCertificates(©OfPcfg)
|
|
||||||
|
|
||||||
return copyOfRunningConfig.Equal(©OfPcfg)
|
|
||||||
}
|
|
||||||
|
|
||||||
// configureDynamically encodes new Backends in JSON format and POSTs the
|
// configureDynamically encodes new Backends in JSON format and POSTs the
|
||||||
// payload to an internal HTTP endpoint handled by Lua.
|
// payload to an internal HTTP endpoint handled by Lua.
|
||||||
func (n *NGINXController) configureDynamically(pcfg *ingress.Configuration) error {
|
func (n *NGINXController) configureDynamically(pcfg *ingress.Configuration) error {
|
||||||
|
@ -1019,7 +1001,7 @@ func configureCertificates(rawServers []*ingress.Server) error {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
redirects := buildRedirects(rawServers)
|
redirects := utilingress.BuildRedirects(rawServers)
|
||||||
for _, redirect := range redirects {
|
for _, redirect := range redirects {
|
||||||
configure(redirect.From, redirect.SSLCert)
|
configure(redirect.From, redirect.SSLCert)
|
||||||
}
|
}
|
||||||
|
@ -1139,65 +1121,3 @@ func cleanTempNginxCfg() error {
|
||||||
|
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
type redirect struct {
|
|
||||||
From string
|
|
||||||
To string
|
|
||||||
SSLCert *ingress.SSLCert
|
|
||||||
}
|
|
||||||
|
|
||||||
func buildRedirects(servers []*ingress.Server) []*redirect {
|
|
||||||
names := sets.String{}
|
|
||||||
redirectServers := make([]*redirect, 0)
|
|
||||||
|
|
||||||
for _, srv := range servers {
|
|
||||||
if !srv.RedirectFromToWWW {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
to := srv.Hostname
|
|
||||||
|
|
||||||
var from string
|
|
||||||
if strings.HasPrefix(to, "www.") {
|
|
||||||
from = strings.TrimPrefix(to, "www.")
|
|
||||||
} else {
|
|
||||||
from = fmt.Sprintf("www.%v", to)
|
|
||||||
}
|
|
||||||
|
|
||||||
if names.Has(to) {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
klog.V(3).InfoS("Creating redirect", "from", from, "to", to)
|
|
||||||
found := false
|
|
||||||
for _, esrv := range servers {
|
|
||||||
if esrv.Hostname == from {
|
|
||||||
found = true
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if found {
|
|
||||||
klog.Warningf("Already exists an Ingress with %q hostname. Skipping creation of redirection from %q to %q.", from, from, to)
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
r := &redirect{
|
|
||||||
From: from,
|
|
||||||
To: to,
|
|
||||||
}
|
|
||||||
|
|
||||||
if srv.SSLCert != nil {
|
|
||||||
if ssl.IsValidHostname(from, srv.SSLCert.CN) {
|
|
||||||
r.SSLCert = srv.SSLCert
|
|
||||||
} else {
|
|
||||||
klog.Warningf("the server %v has SSL configured but the SSL certificate does not contains a CN for %v. Redirects will not work for HTTPS to HTTPS", from, to)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
redirectServers = append(redirectServers, r)
|
|
||||||
names.Insert(to)
|
|
||||||
}
|
|
||||||
|
|
||||||
return redirectServers
|
|
||||||
}
|
|
||||||
|
|
|
@ -36,118 +36,6 @@ import (
|
||||||
"k8s.io/ingress-nginx/pkg/apis/ingress"
|
"k8s.io/ingress-nginx/pkg/apis/ingress"
|
||||||
)
|
)
|
||||||
|
|
||||||
func TestIsDynamicConfigurationEnough(t *testing.T) {
|
|
||||||
backends := []*ingress.Backend{{
|
|
||||||
Name: "fakenamespace-myapp-80",
|
|
||||||
Endpoints: []ingress.Endpoint{
|
|
||||||
{
|
|
||||||
Address: "10.0.0.1",
|
|
||||||
Port: "8080",
|
|
||||||
},
|
|
||||||
{
|
|
||||||
Address: "10.0.0.2",
|
|
||||||
Port: "8080",
|
|
||||||
},
|
|
||||||
},
|
|
||||||
}}
|
|
||||||
|
|
||||||
servers := []*ingress.Server{{
|
|
||||||
Hostname: "myapp.fake",
|
|
||||||
Locations: []*ingress.Location{
|
|
||||||
{
|
|
||||||
Path: "/",
|
|
||||||
Backend: "fakenamespace-myapp-80",
|
|
||||||
},
|
|
||||||
},
|
|
||||||
SSLCert: &ingress.SSLCert{
|
|
||||||
PemCertKey: "fake-certificate",
|
|
||||||
},
|
|
||||||
}}
|
|
||||||
|
|
||||||
commonConfig := &ingress.Configuration{
|
|
||||||
Backends: backends,
|
|
||||||
Servers: servers,
|
|
||||||
}
|
|
||||||
|
|
||||||
n := &NGINXController{
|
|
||||||
runningConfig: &ingress.Configuration{
|
|
||||||
Backends: backends,
|
|
||||||
Servers: servers,
|
|
||||||
},
|
|
||||||
cfg: &Configuration{},
|
|
||||||
}
|
|
||||||
|
|
||||||
newConfig := commonConfig
|
|
||||||
if !n.IsDynamicConfigurationEnough(newConfig) {
|
|
||||||
t.Errorf("When new config is same as the running config it should be deemed as dynamically configurable")
|
|
||||||
}
|
|
||||||
|
|
||||||
newConfig = &ingress.Configuration{
|
|
||||||
Backends: []*ingress.Backend{{Name: "another-backend-8081"}},
|
|
||||||
Servers: []*ingress.Server{{Hostname: "myapp1.fake"}},
|
|
||||||
}
|
|
||||||
if n.IsDynamicConfigurationEnough(newConfig) {
|
|
||||||
t.Errorf("Expected to not be dynamically configurable when there's more than just backends change")
|
|
||||||
}
|
|
||||||
|
|
||||||
newConfig = &ingress.Configuration{
|
|
||||||
Backends: []*ingress.Backend{{Name: "a-backend-8080"}},
|
|
||||||
Servers: servers,
|
|
||||||
}
|
|
||||||
|
|
||||||
if !n.IsDynamicConfigurationEnough(newConfig) {
|
|
||||||
t.Errorf("Expected to be dynamically configurable when only backends change")
|
|
||||||
}
|
|
||||||
|
|
||||||
newServers := []*ingress.Server{{
|
|
||||||
Hostname: "myapp1.fake",
|
|
||||||
Locations: []*ingress.Location{
|
|
||||||
{
|
|
||||||
Path: "/",
|
|
||||||
Backend: "fakenamespace-myapp-80",
|
|
||||||
},
|
|
||||||
},
|
|
||||||
SSLCert: &ingress.SSLCert{
|
|
||||||
PemCertKey: "fake-certificate",
|
|
||||||
},
|
|
||||||
}}
|
|
||||||
|
|
||||||
newConfig = &ingress.Configuration{
|
|
||||||
Backends: backends,
|
|
||||||
Servers: newServers,
|
|
||||||
}
|
|
||||||
if n.IsDynamicConfigurationEnough(newConfig) {
|
|
||||||
t.Errorf("Expected to not be dynamically configurable when dynamic certificates is enabled and a non-certificate field in servers is updated")
|
|
||||||
}
|
|
||||||
|
|
||||||
newServers[0].Hostname = "myapp.fake"
|
|
||||||
newServers[0].SSLCert.PemCertKey = "new-fake-certificate"
|
|
||||||
|
|
||||||
newConfig = &ingress.Configuration{
|
|
||||||
Backends: backends,
|
|
||||||
Servers: newServers,
|
|
||||||
}
|
|
||||||
if !n.IsDynamicConfigurationEnough(newConfig) {
|
|
||||||
t.Errorf("Expected to be dynamically configurable when only SSLCert changes")
|
|
||||||
}
|
|
||||||
|
|
||||||
newConfig = &ingress.Configuration{
|
|
||||||
Backends: []*ingress.Backend{{Name: "a-backend-8080"}},
|
|
||||||
Servers: newServers,
|
|
||||||
}
|
|
||||||
if !n.IsDynamicConfigurationEnough(newConfig) {
|
|
||||||
t.Errorf("Expected to be dynamically configurable when backend and SSLCert changes")
|
|
||||||
}
|
|
||||||
|
|
||||||
if !n.runningConfig.Equal(commonConfig) {
|
|
||||||
t.Errorf("Expected running config to not change")
|
|
||||||
}
|
|
||||||
|
|
||||||
if !newConfig.Equal(&ingress.Configuration{Backends: []*ingress.Backend{{Name: "a-backend-8080"}}, Servers: newServers}) {
|
|
||||||
t.Errorf("Expected new config to not change")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestConfigureDynamically(t *testing.T) {
|
func TestConfigureDynamically(t *testing.T) {
|
||||||
listener, err := tryListen("tcp", fmt.Sprintf(":%v", nginx.StatusPort))
|
listener, err := tryListen("tcp", fmt.Sprintf(":%v", nginx.StatusPort))
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
|
|
@ -121,9 +121,6 @@ func MetaNamespaceKey(obj interface{}) string {
|
||||||
return key
|
return key
|
||||||
}
|
}
|
||||||
|
|
||||||
// IsIngressV1Ready indicates if the running Kubernetes version is at least v1.19.0
|
|
||||||
var IsIngressV1Ready bool
|
|
||||||
|
|
||||||
// IngressNGINXController defines the valid value of IngressClass
|
// IngressNGINXController defines the valid value of IngressClass
|
||||||
// Controller field for ingress-nginx
|
// Controller field for ingress-nginx
|
||||||
const IngressNGINXController = "k8s.io/ingress-nginx"
|
const IngressNGINXController = "k8s.io/ingress-nginx"
|
||||||
|
|
233
pkg/util/ingress/ingress.go
Normal file
233
pkg/util/ingress/ingress.go
Normal file
|
@ -0,0 +1,233 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Kubernetes Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package ingress
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"k8s.io/apimachinery/pkg/util/sets"
|
||||||
|
"k8s.io/ingress-nginx/internal/k8s"
|
||||||
|
"k8s.io/ingress-nginx/internal/net/ssl"
|
||||||
|
"k8s.io/ingress-nginx/pkg/apis/ingress"
|
||||||
|
"k8s.io/klog/v2"
|
||||||
|
)
|
||||||
|
|
||||||
|
func GetRemovedHosts(rucfg, newcfg *ingress.Configuration) []string {
|
||||||
|
oldSet := sets.NewString()
|
||||||
|
newSet := sets.NewString()
|
||||||
|
|
||||||
|
for _, s := range rucfg.Servers {
|
||||||
|
if !oldSet.Has(s.Hostname) {
|
||||||
|
oldSet.Insert(s.Hostname)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, s := range newcfg.Servers {
|
||||||
|
if !newSet.Has(s.Hostname) {
|
||||||
|
newSet.Insert(s.Hostname)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return oldSet.Difference(newSet).List()
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetRemovedCertificateSerialNumber extracts the difference of certificates between two configurations
|
||||||
|
func GetRemovedCertificateSerialNumbers(rucfg, newcfg *ingress.Configuration) []string {
|
||||||
|
oldCertificates := sets.NewString()
|
||||||
|
newCertificates := sets.NewString()
|
||||||
|
|
||||||
|
for _, server := range rucfg.Servers {
|
||||||
|
if server.SSLCert == nil {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
identifier := server.SSLCert.Identifier()
|
||||||
|
if identifier != "" {
|
||||||
|
if !oldCertificates.Has(identifier) {
|
||||||
|
oldCertificates.Insert(identifier)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, server := range newcfg.Servers {
|
||||||
|
if server.SSLCert == nil {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
identifier := server.SSLCert.Identifier()
|
||||||
|
if identifier != "" {
|
||||||
|
if !newCertificates.Has(identifier) {
|
||||||
|
newCertificates.Insert(identifier)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return oldCertificates.Difference(newCertificates).List()
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetRemovedIngresses extracts the difference of ingresses between two configurations
|
||||||
|
func GetRemovedIngresses(rucfg, newcfg *ingress.Configuration) []string {
|
||||||
|
oldIngresses := sets.NewString()
|
||||||
|
newIngresses := sets.NewString()
|
||||||
|
|
||||||
|
for _, server := range rucfg.Servers {
|
||||||
|
for _, location := range server.Locations {
|
||||||
|
if location.Ingress == nil {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
ingKey := k8s.MetaNamespaceKey(location.Ingress)
|
||||||
|
if !oldIngresses.Has(ingKey) {
|
||||||
|
oldIngresses.Insert(ingKey)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, server := range newcfg.Servers {
|
||||||
|
for _, location := range server.Locations {
|
||||||
|
if location.Ingress == nil {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
ingKey := k8s.MetaNamespaceKey(location.Ingress)
|
||||||
|
if !newIngresses.Has(ingKey) {
|
||||||
|
newIngresses.Insert(ingKey)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return oldIngresses.Difference(newIngresses).List()
|
||||||
|
}
|
||||||
|
|
||||||
|
// IsDynamicConfigurationEnough returns whether a Configuration can be
|
||||||
|
// dynamically applied, without reloading the backend.
|
||||||
|
func IsDynamicConfigurationEnough(newcfg *ingress.Configuration, oldcfg *ingress.Configuration) bool {
|
||||||
|
copyOfRunningConfig := *oldcfg
|
||||||
|
copyOfPcfg := *newcfg
|
||||||
|
|
||||||
|
copyOfRunningConfig.Backends = []*ingress.Backend{}
|
||||||
|
copyOfPcfg.Backends = []*ingress.Backend{}
|
||||||
|
|
||||||
|
clearL4serviceEndpoints(©OfRunningConfig)
|
||||||
|
clearL4serviceEndpoints(©OfPcfg)
|
||||||
|
|
||||||
|
clearCertificates(©OfRunningConfig)
|
||||||
|
clearCertificates(©OfPcfg)
|
||||||
|
|
||||||
|
return copyOfRunningConfig.Equal(©OfPcfg)
|
||||||
|
}
|
||||||
|
|
||||||
|
// clearL4serviceEndpoints is a helper function to clear endpoints from the ingress configuration since they should be ignored when
|
||||||
|
// checking if the new configuration changes can be applied dynamically.
|
||||||
|
func clearL4serviceEndpoints(config *ingress.Configuration) {
|
||||||
|
var clearedTCPL4Services []ingress.L4Service
|
||||||
|
var clearedUDPL4Services []ingress.L4Service
|
||||||
|
for _, service := range config.TCPEndpoints {
|
||||||
|
copyofService := ingress.L4Service{
|
||||||
|
Port: service.Port,
|
||||||
|
Backend: service.Backend,
|
||||||
|
Endpoints: []ingress.Endpoint{},
|
||||||
|
Service: nil,
|
||||||
|
}
|
||||||
|
clearedTCPL4Services = append(clearedTCPL4Services, copyofService)
|
||||||
|
}
|
||||||
|
for _, service := range config.UDPEndpoints {
|
||||||
|
copyofService := ingress.L4Service{
|
||||||
|
Port: service.Port,
|
||||||
|
Backend: service.Backend,
|
||||||
|
Endpoints: []ingress.Endpoint{},
|
||||||
|
Service: nil,
|
||||||
|
}
|
||||||
|
clearedUDPL4Services = append(clearedUDPL4Services, copyofService)
|
||||||
|
}
|
||||||
|
config.TCPEndpoints = clearedTCPL4Services
|
||||||
|
config.UDPEndpoints = clearedUDPL4Services
|
||||||
|
}
|
||||||
|
|
||||||
|
// clearCertificates is a helper function to clear Certificates from the ingress configuration since they should be ignored when
|
||||||
|
// checking if the new configuration changes can be applied dynamically if dynamic certificates is on
|
||||||
|
func clearCertificates(config *ingress.Configuration) {
|
||||||
|
var clearedServers []*ingress.Server
|
||||||
|
for _, server := range config.Servers {
|
||||||
|
copyOfServer := *server
|
||||||
|
copyOfServer.SSLCert = nil
|
||||||
|
clearedServers = append(clearedServers, ©OfServer)
|
||||||
|
}
|
||||||
|
config.Servers = clearedServers
|
||||||
|
}
|
||||||
|
|
||||||
|
type redirect struct {
|
||||||
|
From string
|
||||||
|
To string
|
||||||
|
SSLCert *ingress.SSLCert
|
||||||
|
}
|
||||||
|
|
||||||
|
// BuildRedirects build the redirects of servers based on configurations and certificates
|
||||||
|
func BuildRedirects(servers []*ingress.Server) []*redirect {
|
||||||
|
names := sets.String{}
|
||||||
|
redirectServers := make([]*redirect, 0)
|
||||||
|
|
||||||
|
for _, srv := range servers {
|
||||||
|
if !srv.RedirectFromToWWW {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
to := srv.Hostname
|
||||||
|
|
||||||
|
var from string
|
||||||
|
if strings.HasPrefix(to, "www.") {
|
||||||
|
from = strings.TrimPrefix(to, "www.")
|
||||||
|
} else {
|
||||||
|
from = fmt.Sprintf("www.%v", to)
|
||||||
|
}
|
||||||
|
|
||||||
|
if names.Has(to) {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
klog.V(3).InfoS("Creating redirect", "from", from, "to", to)
|
||||||
|
found := false
|
||||||
|
for _, esrv := range servers {
|
||||||
|
if esrv.Hostname == from {
|
||||||
|
found = true
|
||||||
|
break
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if found {
|
||||||
|
klog.Warningf("Already exists an Ingress with %q hostname. Skipping creation of redirection from %q to %q.", from, from, to)
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
r := &redirect{
|
||||||
|
From: from,
|
||||||
|
To: to,
|
||||||
|
}
|
||||||
|
|
||||||
|
if srv.SSLCert != nil {
|
||||||
|
if ssl.IsValidHostname(from, srv.SSLCert.CN) {
|
||||||
|
r.SSLCert = srv.SSLCert
|
||||||
|
} else {
|
||||||
|
klog.Warningf("the server %v has SSL configured but the SSL certificate does not contains a CN for %v. Redirects will not work for HTTPS to HTTPS", from, to)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
redirectServers = append(redirectServers, r)
|
||||||
|
names.Insert(to)
|
||||||
|
}
|
||||||
|
|
||||||
|
return redirectServers
|
||||||
|
}
|
132
pkg/util/ingress/ingress_test.go
Normal file
132
pkg/util/ingress/ingress_test.go
Normal file
|
@ -0,0 +1,132 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Kubernetes Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package ingress
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"k8s.io/ingress-nginx/pkg/apis/ingress"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestIsDynamicConfigurationEnough(t *testing.T) {
|
||||||
|
backends := []*ingress.Backend{{
|
||||||
|
Name: "fakenamespace-myapp-80",
|
||||||
|
Endpoints: []ingress.Endpoint{
|
||||||
|
{
|
||||||
|
Address: "10.0.0.1",
|
||||||
|
Port: "8080",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Address: "10.0.0.2",
|
||||||
|
Port: "8080",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}}
|
||||||
|
|
||||||
|
servers := []*ingress.Server{{
|
||||||
|
Hostname: "myapp.fake",
|
||||||
|
Locations: []*ingress.Location{
|
||||||
|
{
|
||||||
|
Path: "/",
|
||||||
|
Backend: "fakenamespace-myapp-80",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
SSLCert: &ingress.SSLCert{
|
||||||
|
PemCertKey: "fake-certificate",
|
||||||
|
},
|
||||||
|
}}
|
||||||
|
|
||||||
|
commonConfig := &ingress.Configuration{
|
||||||
|
Backends: backends,
|
||||||
|
Servers: servers,
|
||||||
|
}
|
||||||
|
|
||||||
|
runningConfig := &ingress.Configuration{
|
||||||
|
Backends: backends,
|
||||||
|
Servers: servers,
|
||||||
|
}
|
||||||
|
|
||||||
|
newConfig := commonConfig
|
||||||
|
if !IsDynamicConfigurationEnough(newConfig, runningConfig) {
|
||||||
|
t.Errorf("When new config is same as the running config it should be deemed as dynamically configurable")
|
||||||
|
}
|
||||||
|
|
||||||
|
newConfig = &ingress.Configuration{
|
||||||
|
Backends: []*ingress.Backend{{Name: "another-backend-8081"}},
|
||||||
|
Servers: []*ingress.Server{{Hostname: "myapp1.fake"}},
|
||||||
|
}
|
||||||
|
if IsDynamicConfigurationEnough(newConfig, runningConfig) {
|
||||||
|
t.Errorf("Expected to not be dynamically configurable when there's more than just backends change")
|
||||||
|
}
|
||||||
|
|
||||||
|
newConfig = &ingress.Configuration{
|
||||||
|
Backends: []*ingress.Backend{{Name: "a-backend-8080"}},
|
||||||
|
Servers: servers,
|
||||||
|
}
|
||||||
|
|
||||||
|
if !IsDynamicConfigurationEnough(newConfig, runningConfig) {
|
||||||
|
t.Errorf("Expected to be dynamically configurable when only backends change")
|
||||||
|
}
|
||||||
|
|
||||||
|
newServers := []*ingress.Server{{
|
||||||
|
Hostname: "myapp1.fake",
|
||||||
|
Locations: []*ingress.Location{
|
||||||
|
{
|
||||||
|
Path: "/",
|
||||||
|
Backend: "fakenamespace-myapp-80",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
SSLCert: &ingress.SSLCert{
|
||||||
|
PemCertKey: "fake-certificate",
|
||||||
|
},
|
||||||
|
}}
|
||||||
|
|
||||||
|
newConfig = &ingress.Configuration{
|
||||||
|
Backends: backends,
|
||||||
|
Servers: newServers,
|
||||||
|
}
|
||||||
|
if IsDynamicConfigurationEnough(newConfig, runningConfig) {
|
||||||
|
t.Errorf("Expected to not be dynamically configurable when dynamic certificates is enabled and a non-certificate field in servers is updated")
|
||||||
|
}
|
||||||
|
|
||||||
|
newServers[0].Hostname = "myapp.fake"
|
||||||
|
newServers[0].SSLCert.PemCertKey = "new-fake-certificate"
|
||||||
|
|
||||||
|
newConfig = &ingress.Configuration{
|
||||||
|
Backends: backends,
|
||||||
|
Servers: newServers,
|
||||||
|
}
|
||||||
|
if !IsDynamicConfigurationEnough(newConfig, runningConfig) {
|
||||||
|
t.Errorf("Expected to be dynamically configurable when only SSLCert changes")
|
||||||
|
}
|
||||||
|
|
||||||
|
newConfig = &ingress.Configuration{
|
||||||
|
Backends: []*ingress.Backend{{Name: "a-backend-8080"}},
|
||||||
|
Servers: newServers,
|
||||||
|
}
|
||||||
|
if !IsDynamicConfigurationEnough(newConfig, runningConfig) {
|
||||||
|
t.Errorf("Expected to be dynamically configurable when backend and SSLCert changes")
|
||||||
|
}
|
||||||
|
|
||||||
|
if !runningConfig.Equal(commonConfig) {
|
||||||
|
t.Errorf("Expected running config to not change")
|
||||||
|
}
|
||||||
|
|
||||||
|
if !newConfig.Equal(&ingress.Configuration{Backends: []*ingress.Backend{{Name: "a-backend-8080"}}, Servers: newServers}) {
|
||||||
|
t.Errorf("Expected new config to not change")
|
||||||
|
}
|
||||||
|
}
|
|
@ -38,7 +38,6 @@ import (
|
||||||
"k8s.io/client-go/kubernetes/scheme"
|
"k8s.io/client-go/kubernetes/scheme"
|
||||||
"k8s.io/client-go/rest"
|
"k8s.io/client-go/rest"
|
||||||
restclient "k8s.io/client-go/rest"
|
restclient "k8s.io/client-go/rest"
|
||||||
"k8s.io/ingress-nginx/internal/k8s"
|
|
||||||
"k8s.io/klog/v2"
|
"k8s.io/klog/v2"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
@ -60,8 +59,6 @@ var (
|
||||||
type Framework struct {
|
type Framework struct {
|
||||||
BaseName string
|
BaseName string
|
||||||
|
|
||||||
IsIngressV1Ready bool
|
|
||||||
|
|
||||||
// A Kubernetes and Service Catalog client
|
// A Kubernetes and Service Catalog client
|
||||||
KubeClientSet kubernetes.Interface
|
KubeClientSet kubernetes.Interface
|
||||||
KubeConfig *restclient.Config
|
KubeConfig *restclient.Config
|
||||||
|
@ -116,7 +113,6 @@ func (f *Framework) CreateEnvironment() {
|
||||||
f.KubeClientSet, err = kubernetes.NewForConfig(f.KubeConfig)
|
f.KubeClientSet, err = kubernetes.NewForConfig(f.KubeConfig)
|
||||||
assert.Nil(ginkgo.GinkgoT(), err, "creating a kubernetes client")
|
assert.Nil(ginkgo.GinkgoT(), err, "creating a kubernetes client")
|
||||||
|
|
||||||
f.IsIngressV1Ready = k8s.NetworkingIngressAvailable(f.KubeClientSet)
|
|
||||||
}
|
}
|
||||||
|
|
||||||
f.Namespace, err = CreateKubeNamespace(f.BaseName, f.KubeClientSet)
|
f.Namespace, err = CreateKubeNamespace(f.BaseName, f.KubeClientSet)
|
||||||
|
|
Loading…
Reference in a new issue