From 5992ce24ad8ac8ed663938f4156cb07504c1fbaf Mon Sep 17 00:00:00 2001 From: SaumyaBhushan Date: Wed, 15 Mar 2023 20:41:44 +0530 Subject: [PATCH] report-e2e-test-suite.xml --- test/junitreports/report-e2e-test-suite.xml | 1287 ------------------- 1 file changed, 1287 deletions(-) delete mode 100644 test/junitreports/report-e2e-test-suite.xml diff --git a/test/junitreports/report-e2e-test-suite.xml b/test/junitreports/report-e2e-test-suite.xml deleted file mode 100644 index 9ee1d5d0c..000000000 --- a/test/junitreports/report-e2e-test-suite.xml +++ /dev/null @@ -1,1287 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:51:52.973 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:52:00.623 (7.65s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 03/15/23 07:52:00.623 [FAILED] Failure recorded during attempt 1: Error Trace: /go/src/k8s.io/ingress-nginx/test/e2e/framework/deployment.go:129 /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:44 /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/node.go:463 /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/suite.go:863 /usr/local/go/src/runtime/asm_amd64.s:1598 Error: Expected nil, but got: &errors.errorString{s:"timed out waiting for the condition"} Test: [Setting] [Security] no-auth-locations should return status code 401 when accessing '/' unauthentication Messages: waiting for endpoints to become ready In [BeforeEach] at: /go/src/k8s.io/ingress-nginx/test/e2e/framework/deployment.go:129 @ 03/15/23 07:53:30.65 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 03/15/23 07:53:30.65 (1m30.027s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:53:30.65 STEP: Dumping NGINX configuration after failure - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:172 @ 03/15/23 07:53:30.835 Mar 15 07:53:30.835: INFO: # Configuration checksum: 6250658035090589176 # setup custom paths that do not require root access pid /tmp/nginx/nginx.pid; daemon off; worker_processes 1; worker_rlimit_nofile 1047552; worker_shutdown_timeout 240s ; events { multi_accept on; worker_connections 16384; use epoll; } http { lua_package_path "/etc/nginx/lua/?.lua;;"; lua_shared_dict balancer_ewma 10M; lua_shared_dict balancer_ewma_last_touched_at 10M; lua_shared_dict balancer_ewma_locks 1M; lua_shared_dict certificate_data 20M; lua_shared_dict certificate_servers 5M; lua_shared_dict configuration_data 20M; lua_shared_dict global_throttle_cache 10M; lua_shared_dict ocsp_response_cache 5M; init_by_lua_block { collectgarbage("collect") -- init modules local ok, res ok, res = pcall(require, "lua_ingress") if not ok then error("require failed: " .. tostring(res)) else lua_ingress = res lua_ingress.set_config({ use_forwarded_headers = false, use_proxy_protocol = false, is_ssl_passthrough_enabled = false, http_redirect_code = 308, listen_ports = { ssl_proxy = "442", https = "443" }, hsts = true, hsts_max_age = 15724800, hsts_include_subdomains = true, hsts_preload = false, global_throttle = { memcached = { host = "", port = 11211, connect_timeout = 50, max_idle_timeout = 10000, pool_size = 50, }, status_code = 429, } }) end ok, res = pcall(require, "configuration") if not ok then error("require failed: " .. tostring(res)) else configuration = res configuration.prohibited_localhost_port = '10246' end ok, res = pcall(require, "balancer") if not ok then error("require failed: " .. tostring(res)) else balancer = res end ok, res = pcall(require, "monitor") if not ok then error("require failed: " .. tostring(res)) else monitor = res end ok, res = pcall(require, "certificate") if not ok then error("require failed: " .. tostring(res)) else certificate = res certificate.is_ocsp_stapling_enabled = false end ok, res = pcall(require, "plugins") if not ok then error("require failed: " .. tostring(res)) else plugins = res end -- load all plugins that'll be used here plugins.init({ }) } init_worker_by_lua_block { lua_ingress.init_worker() balancer.init_worker() monitor.init_worker(10000) plugins.run() } geoip_country /etc/nginx/geoip/GeoIP.dat; geoip_city /etc/nginx/geoip/GeoLiteCity.dat; geoip_org /etc/nginx/geoip/GeoIPASNum.dat; geoip_proxy_recursive on; aio threads; aio_write on; tcp_nopush on; tcp_nodelay on; log_subrequest on; reset_timedout_connection on; keepalive_timeout 75s; keepalive_requests 1000; client_body_temp_path /tmp/nginx/client-body; fastcgi_temp_path /tmp/nginx/fastcgi-temp; proxy_temp_path /tmp/nginx/proxy-temp; ajp_temp_path /tmp/nginx/ajp-temp; client_header_buffer_size 1k; client_header_timeout 60s; large_client_header_buffers 4 8k; client_body_buffer_size 8k; client_body_timeout 60s; http2_max_field_size 4k; http2_max_header_size 16k; http2_max_requests 1000; http2_max_concurrent_streams 128; types_hash_max_size 2048; server_names_hash_max_size 1024; server_names_hash_bucket_size 32; map_hash_bucket_size 64; proxy_headers_hash_max_size 512; proxy_headers_hash_bucket_size 64; variables_hash_bucket_size 256; variables_hash_max_size 2048; underscores_in_headers off; ignore_invalid_headers on; limit_req_status 503; limit_conn_status 503; include /etc/nginx/mime.types; default_type text/html; # Custom headers for response server_tokens off; more_clear_headers Server; # disable warnings uninitialized_variable_warn off; # Additional available variables: # $namespace # $ingress_name # $service_name # $service_port log_format upstreaminfo '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id'; map $request_uri $loggable { default 1; } access_log /var/log/nginx/access.log upstreaminfo if=$loggable; error_log /var/log/nginx/error.log notice; resolver 10.96.0.10 valid=30s; # See https://www.nginx.com/blog/websocket-nginx map $http_upgrade $connection_upgrade { default upgrade; # See http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive '' ''; } # Reverse proxies can detect if a client provides a X-Request-ID header, and pass it on to the backend server. # If no such header is provided, it can provide a random value. map $http_x_request_id $req_id { default $http_x_request_id; "" $request_id; } # Create a variable that contains the literal $ character. # This works because the geo module will not resolve variables. geo $literal_dollar { default "$"; } server_name_in_redirect off; port_in_redirect off; ssl_protocols TLSv1.2 TLSv1.3; ssl_early_data off; # turn on session caching to drastically improve performance ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; # allow configuring ssl session tickets ssl_session_tickets off; # slightly reduce the time-to-first-byte ssl_buffer_size 4k; # allow configuring custom ssl ciphers ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384'; ssl_prefer_server_ciphers on; ssl_ecdh_curve auto; # PEM sha: a0eb83a5e6aba6aeb05f687aaf76c49ffb2b717a ssl_certificate /etc/ingress-controller/ssl/default-fake-certificate.pem; ssl_certificate_key /etc/ingress-controller/ssl/default-fake-certificate.pem; proxy_ssl_session_reuse on; upstream upstream_balancer { ### Attention!!! # # We no longer create "upstream" section for every backend. # Backends are handled dynamically using Lua. If you would like to debug # and see what backends ingress-nginx has in its memory you can # install our kubectl plugin https://kubernetes.github.io/ingress-nginx/kubectl-plugin. # Once you have the plugin you can use "kubectl ingress-nginx backends" command to # inspect current backends. # ### server 0.0.0.1; # placeholder balancer_by_lua_block { balancer.balance() } keepalive 320; keepalive_time 1h; keepalive_timeout 60s; keepalive_requests 10000; } # Cache for internal auth checks proxy_cache_path /tmp/nginx/nginx-cache-auth levels=1:2 keys_zone=auth_cache:10m max_size=128m inactive=30m use_temp_path=off; # Global filters ## start server _ server { server_name _ ; listen 80 default_server reuseport backlog=4096 ; listen [::]:80 default_server reuseport backlog=4096 ; listen 443 default_server reuseport backlog=4096 ssl http2 ; listen [::]:443 default_server reuseport backlog=4096 ssl http2 ; set $proxy_upstream_name "-"; ssl_reject_handshake off; ssl_certificate_by_lua_block { certificate.call() } location / { set $namespace ""; set $ingress_name ""; set $service_name ""; set $service_port ""; set $location_path ""; set $global_rate_limit_exceeding n; rewrite_by_lua_block { lua_ingress.rewrite({ force_ssl_redirect = false, ssl_redirect = false, force_no_ssl_redirect = false, preserve_trailing_slash = false, use_port_in_redirects = false, global_throttle = { namespace = "", limit = 0, window_size = 0, key = { }, ignored_cidrs = { } }, }) balancer.rewrite() plugins.run() } # be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any # will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)` # other authentication method such as basic auth or external auth useless - all requests will be allowed. #access_by_lua_block { #} header_filter_by_lua_block { lua_ingress.header() plugins.run() } body_filter_by_lua_block { plugins.run() } log_by_lua_block { balancer.log() monitor.call() plugins.run() } access_log off; port_in_redirect off; set $balancer_ewma_score -1; set $proxy_upstream_name "upstream-default-backend"; set $proxy_host $proxy_upstream_name; set $pass_access_scheme $scheme; set $pass_server_port $server_port; set $best_http_host $http_host; set $pass_port $pass_server_port; set $proxy_alternative_upstream_name ""; client_max_body_size 1m; proxy_set_header Host $best_http_host; # Pass the extracted client certificate to the backend # Allow websocket connections proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header X-Request-ID $req_id; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-Host $best_http_host; proxy_set_header X-Forwarded-Port $pass_port; proxy_set_header X-Forwarded-Proto $pass_access_scheme; proxy_set_header X-Forwarded-Scheme $pass_access_scheme; proxy_set_header X-Scheme $pass_access_scheme; # Pass the original X-Forwarded-For proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for; # mitigate HTTPoxy Vulnerability # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/ proxy_set_header Proxy ""; # Custom headers to proxied server proxy_connect_timeout 5s; proxy_send_timeout 60s; proxy_read_timeout 60s; proxy_buffering off; proxy_buffer_size 4k; proxy_buffers 4 4k; proxy_max_temp_file_size 1024m; proxy_request_buffering on; proxy_http_version 1.1; proxy_cookie_domain off; proxy_cookie_path off; # In case of errors try the next upstream server before returning an error proxy_next_upstream error timeout; proxy_next_upstream_timeout 0; proxy_next_upstream_tries 3; proxy_pass http://upstream_balancer; proxy_redirect off; } # health checks in cloud providers require the use of port 80 location /healthz { access_log off; return 200; } # this is required to avoid error if nginx is being monitored # with an external software (like sysdig) location /nginx_status { allow 127.0.0.1; allow ::1; deny all; access_log off; stub_status on; } } ## end server _ # backend for when default-backend-service is not configured or it does not have endpoints server { listen 8181 default_server reuseport backlog=4096; listen [::]:8181 default_server reuseport backlog=4096; set $proxy_upstream_name "internal"; access_log off; location / { return 404; } } # default server, used for NGINX healthcheck and access to nginx stats server { listen 127.0.0.1:10246; set $proxy_upstream_name "internal"; keepalive_timeout 0; gzip off; access_log off; location /healthz { return 200; } location /is-dynamic-lb-initialized { content_by_lua_block { local configuration = require("configuration") local backend_data = configuration.get_backends_data() if not backend_data then ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR) return end ngx.say("OK") ngx.exit(ngx.HTTP_OK) } } location /nginx_status { stub_status on; } location /configuration { client_max_body_size 21M; client_body_buffer_size 21M; proxy_buffering off; content_by_lua_block { configuration.call() } } location / { content_by_lua_block { ngx.exit(ngx.HTTP_NOT_FOUND) } } } } stream { lua_package_path "/etc/nginx/lua/?.lua;/etc/nginx/lua/vendor/?.lua;;"; lua_shared_dict tcp_udp_configuration_data 5M; resolver 10.96.0.10 valid=30s; init_by_lua_block { collectgarbage("collect") -- init modules local ok, res ok, res = pcall(require, "configuration") if not ok then error("require failed: " .. tostring(res)) else configuration = res end ok, res = pcall(require, "tcp_udp_configuration") if not ok then error("require failed: " .. tostring(res)) else tcp_udp_configuration = res tcp_udp_configuration.prohibited_localhost_port = '10246' end ok, res = pcall(require, "tcp_udp_balancer") if not ok then error("require failed: " .. tostring(res)) else tcp_udp_balancer = res end } init_worker_by_lua_block { tcp_udp_balancer.init_worker() } lua_add_variable $proxy_upstream_name; log_format log_stream '[$remote_addr] [$time_local] $protocol $status $bytes_sent $bytes_received $session_time'; access_log /var/log/nginx/access.log log_stream ; error_log /var/log/nginx/error.log notice; upstream upstream_balancer { server 0.0.0.1:1234; # placeholder balancer_by_lua_block { tcp_udp_balancer.balance() } } server { listen 127.0.0.1:10247; access_log off; content_by_lua_block { tcp_udp_configuration.call() } } # TCP services # UDP services # Stream Snippets } STEP: Dumping NGINX logs - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:181 @ 03/15/23 07:53:33.849 Mar 15 07:53:33.849: INFO: ------------------------------------------------------------------------------- NGINX Ingress controller Release: 1.0.0-dev Build: git-78e9edbad Repository: git@github.com:SaumyaBhushan/ingress-nginx.git nginx version: nginx/1.21.6 ------------------------------------------------------------------------------- W0315 07:51:56.782050 13 client_config.go:618] Neither --kubeconfig nor --master was specified. Using the inClusterConfig. This might not work. I0315 07:51:56.782196 13 main.go:209] "Creating API client" host="https://10.96.0.1:443" I0315 07:51:56.790918 13 main.go:253] "Running in Kubernetes cluster" major="1" minor="25" git="v1.25.2" state="clean" commit="5835544ca568b757a8ecae5c153f317e5736700e" platform="linux/amd64" I0315 07:51:57.133006 13 main.go:104] "SSL fake certificate created" file="/etc/ingress-controller/ssl/default-fake-certificate.pem" W0315 07:51:57.140716 13 main.go:125] Unable to get NODE information: nodes "ingress-nginx-dev-worker" is forbidden: User "system:serviceaccount:e2e-tests-no-auth-locations-1678866712973864745-fztfm:nginx-ingress" cannot get resource "nodes" in API group "" at the cluster scope W0315 07:51:57.150156 13 nginx.go:154] Update of Ingress status is disabled (flag --update-status) I0315 07:51:57.152517 13 nginx.go:261] "Starting NGINX Ingress controller" I0315 07:51:57.156024 13 event.go:285] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"e2e-tests-no-auth-locations-1678866712973864745-fztfm", Name:"nginx-ingress-controller", UID:"92f6b0de-1447-4eed-b176-e32e16ac44eb", APIVersion:"v1", ResourceVersion:"822", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap e2e-tests-no-auth-locations-1678866712973864745-fztfm/nginx-ingress-controller I0315 07:51:57.158027 13 event.go:285] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"e2e-tests-no-auth-locations-1678866712973864745-fztfm", Name:"tcp-services", UID:"a6b55605-374b-4d67-be1d-2aac8543ad56", APIVersion:"v1", ResourceVersion:"811", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap e2e-tests-no-auth-locations-1678866712973864745-fztfm/tcp-services I0315 07:51:58.353621 13 nginx.go:304] "Starting NGINX process" I0315 07:51:58.353666 13 leaderelection.go:248] attempting to acquire leader lease e2e-tests-no-auth-locations-1678866712973864745-fztfm/ingress-controller-leader... I0315 07:51:58.354044 13 controller.go:188] "Configuration changes detected, backend reload required" I0315 07:51:58.357734 13 leaderelection.go:258] successfully acquired lease e2e-tests-no-auth-locations-1678866712973864745-fztfm/ingress-controller-leader I0315 07:51:58.357801 13 status.go:84] "New leader elected" identity="nginx-ingress-controller-d74f4cfdc-c8s4t" I0315 07:51:58.417836 13 controller.go:205] "Backend successfully reloaded" I0315 07:51:58.417911 13 controller.go:216] "Initial sync, sleeping for 1 second" I0315 07:51:58.417963 13 event.go:285] Event(v1.ObjectReference{Kind:"Pod", Namespace:"e2e-tests-no-auth-locations-1678866712973864745-fztfm", Name:"nginx-ingress-controller-d74f4cfdc-c8s4t", UID:"fc048747-f5c5-4eae-ac59-f2e085daa46b", APIVersion:"v1", ResourceVersion:"911", FieldPath:""}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration STEP: Dumping namespace content - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:190 @ 03/15/23 07:53:33.94 Mar 15 07:53:33.940: INFO: NAME READY STATUS RESTARTS AGE pod/echo-5f68dc79f7-f6ffb 0/1 ContainerCreating 0 93s pod/nginx-ingress-controller-d74f4cfdc-c8s4t 1/1 Running 0 97s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/echo ClusterIP 10.96.169.231 <none> 80/TCP 93s service/nginx-ingress-controller NodePort 10.96.252.217 <none> 80:32627/TCP,443:30633/TCP 97s NAME ENDPOINTS AGE endpoints/echo <none> 93s endpoints/nginx-ingress-controller 10.244.1.3:443,10.244.1.3:80 97s NAME READY UP-TO-DATE AVAILABLE AGE deployment.apps/echo 0/1 1 0 93s deployment.apps/nginx-ingress-controller 1/1 1 1 97s < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:53:34.411 (3.761s) Attempt #1 Failed. Retrying ↺ @ 03/15/23 07:53:34.411 > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:53:34.411 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:53:42.015 (7.604s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 03/15/23 07:53:42.015 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 03/15/23 07:54:01.264 (19.248s) > Enter [It] should return status code 401 when accessing '/' unauthentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:54 @ 03/15/23 07:54:01.264 < Exit [It] should return status code 401 when accessing '/' unauthentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:54 @ 03/15/23 07:54:04.359 (3.095s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:54:04.359 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:54:04.565 (206ms) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:51:52.971 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:52:00.633 (7.662s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 03/15/23 07:52:00.633 [FAILED] Failure recorded during attempt 1: Error Trace: /go/src/k8s.io/ingress-nginx/test/e2e/framework/deployment.go:129 /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:44 /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/node.go:463 /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/suite.go:863 /usr/local/go/src/runtime/asm_amd64.s:1598 Error: Expected nil, but got: &errors.errorString{s:"timed out waiting for the condition"} Test: [Setting] [Security] no-auth-locations should return status code 200 when accessing '/' authentication Messages: waiting for endpoints to become ready In [BeforeEach] at: /go/src/k8s.io/ingress-nginx/test/e2e/framework/deployment.go:129 @ 03/15/23 07:53:30.673 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 03/15/23 07:53:30.673 (1m30.041s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:53:30.673 STEP: Dumping NGINX configuration after failure - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:172 @ 03/15/23 07:53:30.837 Mar 15 07:53:30.837: INFO: # Configuration checksum: 5104487142878058070 # setup custom paths that do not require root access pid /tmp/nginx/nginx.pid; daemon off; worker_processes 1; worker_rlimit_nofile 1047552; worker_shutdown_timeout 240s ; events { multi_accept on; worker_connections 16384; use epoll; } http { lua_package_path "/etc/nginx/lua/?.lua;;"; lua_shared_dict balancer_ewma 10M; lua_shared_dict balancer_ewma_last_touched_at 10M; lua_shared_dict balancer_ewma_locks 1M; lua_shared_dict certificate_data 20M; lua_shared_dict certificate_servers 5M; lua_shared_dict configuration_data 20M; lua_shared_dict global_throttle_cache 10M; lua_shared_dict ocsp_response_cache 5M; init_by_lua_block { collectgarbage("collect") -- init modules local ok, res ok, res = pcall(require, "lua_ingress") if not ok then error("require failed: " .. tostring(res)) else lua_ingress = res lua_ingress.set_config({ use_forwarded_headers = false, use_proxy_protocol = false, is_ssl_passthrough_enabled = false, http_redirect_code = 308, listen_ports = { ssl_proxy = "442", https = "443" }, hsts = true, hsts_max_age = 15724800, hsts_include_subdomains = true, hsts_preload = false, global_throttle = { memcached = { host = "", port = 11211, connect_timeout = 50, max_idle_timeout = 10000, pool_size = 50, }, status_code = 429, } }) end ok, res = pcall(require, "configuration") if not ok then error("require failed: " .. tostring(res)) else configuration = res configuration.prohibited_localhost_port = '10246' end ok, res = pcall(require, "balancer") if not ok then error("require failed: " .. tostring(res)) else balancer = res end ok, res = pcall(require, "monitor") if not ok then error("require failed: " .. tostring(res)) else monitor = res end ok, res = pcall(require, "certificate") if not ok then error("require failed: " .. tostring(res)) else certificate = res certificate.is_ocsp_stapling_enabled = false end ok, res = pcall(require, "plugins") if not ok then error("require failed: " .. tostring(res)) else plugins = res end -- load all plugins that'll be used here plugins.init({ }) } init_worker_by_lua_block { lua_ingress.init_worker() balancer.init_worker() monitor.init_worker(10000) plugins.run() } geoip_country /etc/nginx/geoip/GeoIP.dat; geoip_city /etc/nginx/geoip/GeoLiteCity.dat; geoip_org /etc/nginx/geoip/GeoIPASNum.dat; geoip_proxy_recursive on; aio threads; aio_write on; tcp_nopush on; tcp_nodelay on; log_subrequest on; reset_timedout_connection on; keepalive_timeout 75s; keepalive_requests 1000; client_body_temp_path /tmp/nginx/client-body; fastcgi_temp_path /tmp/nginx/fastcgi-temp; proxy_temp_path /tmp/nginx/proxy-temp; ajp_temp_path /tmp/nginx/ajp-temp; client_header_buffer_size 1k; client_header_timeout 60s; large_client_header_buffers 4 8k; client_body_buffer_size 8k; client_body_timeout 60s; http2_max_field_size 4k; http2_max_header_size 16k; http2_max_requests 1000; http2_max_concurrent_streams 128; types_hash_max_size 2048; server_names_hash_max_size 1024; server_names_hash_bucket_size 32; map_hash_bucket_size 64; proxy_headers_hash_max_size 512; proxy_headers_hash_bucket_size 64; variables_hash_bucket_size 256; variables_hash_max_size 2048; underscores_in_headers off; ignore_invalid_headers on; limit_req_status 503; limit_conn_status 503; include /etc/nginx/mime.types; default_type text/html; # Custom headers for response server_tokens off; more_clear_headers Server; # disable warnings uninitialized_variable_warn off; # Additional available variables: # $namespace # $ingress_name # $service_name # $service_port log_format upstreaminfo '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id'; map $request_uri $loggable { default 1; } access_log /var/log/nginx/access.log upstreaminfo if=$loggable; error_log /var/log/nginx/error.log notice; resolver 10.96.0.10 valid=30s; # See https://www.nginx.com/blog/websocket-nginx map $http_upgrade $connection_upgrade { default upgrade; # See http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive '' ''; } # Reverse proxies can detect if a client provides a X-Request-ID header, and pass it on to the backend server. # If no such header is provided, it can provide a random value. map $http_x_request_id $req_id { default $http_x_request_id; "" $request_id; } # Create a variable that contains the literal $ character. # This works because the geo module will not resolve variables. geo $literal_dollar { default "$"; } server_name_in_redirect off; port_in_redirect off; ssl_protocols TLSv1.2 TLSv1.3; ssl_early_data off; # turn on session caching to drastically improve performance ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; # allow configuring ssl session tickets ssl_session_tickets off; # slightly reduce the time-to-first-byte ssl_buffer_size 4k; # allow configuring custom ssl ciphers ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384'; ssl_prefer_server_ciphers on; ssl_ecdh_curve auto; # PEM sha: 6a4cffb21fd93f69f00e54bfff588f228e9e6ed6 ssl_certificate /etc/ingress-controller/ssl/default-fake-certificate.pem; ssl_certificate_key /etc/ingress-controller/ssl/default-fake-certificate.pem; proxy_ssl_session_reuse on; upstream upstream_balancer { ### Attention!!! # # We no longer create "upstream" section for every backend. # Backends are handled dynamically using Lua. If you would like to debug # and see what backends ingress-nginx has in its memory you can # install our kubectl plugin https://kubernetes.github.io/ingress-nginx/kubectl-plugin. # Once you have the plugin you can use "kubectl ingress-nginx backends" command to # inspect current backends. # ### server 0.0.0.1; # placeholder balancer_by_lua_block { balancer.balance() } keepalive 320; keepalive_time 1h; keepalive_timeout 60s; keepalive_requests 10000; } # Cache for internal auth checks proxy_cache_path /tmp/nginx/nginx-cache-auth levels=1:2 keys_zone=auth_cache:10m max_size=128m inactive=30m use_temp_path=off; # Global filters ## start server _ server { server_name _ ; listen 80 default_server reuseport backlog=4096 ; listen [::]:80 default_server reuseport backlog=4096 ; listen 443 default_server reuseport backlog=4096 ssl http2 ; listen [::]:443 default_server reuseport backlog=4096 ssl http2 ; set $proxy_upstream_name "-"; ssl_reject_handshake off; ssl_certificate_by_lua_block { certificate.call() } location / { set $namespace ""; set $ingress_name ""; set $service_name ""; set $service_port ""; set $location_path ""; set $global_rate_limit_exceeding n; rewrite_by_lua_block { lua_ingress.rewrite({ force_ssl_redirect = false, ssl_redirect = false, force_no_ssl_redirect = false, preserve_trailing_slash = false, use_port_in_redirects = false, global_throttle = { namespace = "", limit = 0, window_size = 0, key = { }, ignored_cidrs = { } }, }) balancer.rewrite() plugins.run() } # be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any # will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)` # other authentication method such as basic auth or external auth useless - all requests will be allowed. #access_by_lua_block { #} header_filter_by_lua_block { lua_ingress.header() plugins.run() } body_filter_by_lua_block { plugins.run() } log_by_lua_block { balancer.log() monitor.call() plugins.run() } access_log off; port_in_redirect off; set $balancer_ewma_score -1; set $proxy_upstream_name "upstream-default-backend"; set $proxy_host $proxy_upstream_name; set $pass_access_scheme $scheme; set $pass_server_port $server_port; set $best_http_host $http_host; set $pass_port $pass_server_port; set $proxy_alternative_upstream_name ""; client_max_body_size 1m; proxy_set_header Host $best_http_host; # Pass the extracted client certificate to the backend # Allow websocket connections proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header X-Request-ID $req_id; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-Host $best_http_host; proxy_set_header X-Forwarded-Port $pass_port; proxy_set_header X-Forwarded-Proto $pass_access_scheme; proxy_set_header X-Forwarded-Scheme $pass_access_scheme; proxy_set_header X-Scheme $pass_access_scheme; # Pass the original X-Forwarded-For proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for; # mitigate HTTPoxy Vulnerability # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/ proxy_set_header Proxy ""; # Custom headers to proxied server proxy_connect_timeout 5s; proxy_send_timeout 60s; proxy_read_timeout 60s; proxy_buffering off; proxy_buffer_size 4k; proxy_buffers 4 4k; proxy_max_temp_file_size 1024m; proxy_request_buffering on; proxy_http_version 1.1; proxy_cookie_domain off; proxy_cookie_path off; # In case of errors try the next upstream server before returning an error proxy_next_upstream error timeout; proxy_next_upstream_timeout 0; proxy_next_upstream_tries 3; proxy_pass http://upstream_balancer; proxy_redirect off; } # health checks in cloud providers require the use of port 80 location /healthz { access_log off; return 200; } # this is required to avoid error if nginx is being monitored # with an external software (like sysdig) location /nginx_status { allow 127.0.0.1; allow ::1; deny all; access_log off; stub_status on; } } ## end server _ # backend for when default-backend-service is not configured or it does not have endpoints server { listen 8181 default_server reuseport backlog=4096; listen [::]:8181 default_server reuseport backlog=4096; set $proxy_upstream_name "internal"; access_log off; location / { return 404; } } # default server, used for NGINX healthcheck and access to nginx stats server { listen 127.0.0.1:10246; set $proxy_upstream_name "internal"; keepalive_timeout 0; gzip off; access_log off; location /healthz { return 200; } location /is-dynamic-lb-initialized { content_by_lua_block { local configuration = require("configuration") local backend_data = configuration.get_backends_data() if not backend_data then ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR) return end ngx.say("OK") ngx.exit(ngx.HTTP_OK) } } location /nginx_status { stub_status on; } location /configuration { client_max_body_size 21M; client_body_buffer_size 21M; proxy_buffering off; content_by_lua_block { configuration.call() } } location / { content_by_lua_block { ngx.exit(ngx.HTTP_NOT_FOUND) } } } } stream { lua_package_path "/etc/nginx/lua/?.lua;/etc/nginx/lua/vendor/?.lua;;"; lua_shared_dict tcp_udp_configuration_data 5M; resolver 10.96.0.10 valid=30s; init_by_lua_block { collectgarbage("collect") -- init modules local ok, res ok, res = pcall(require, "configuration") if not ok then error("require failed: " .. tostring(res)) else configuration = res end ok, res = pcall(require, "tcp_udp_configuration") if not ok then error("require failed: " .. tostring(res)) else tcp_udp_configuration = res tcp_udp_configuration.prohibited_localhost_port = '10246' end ok, res = pcall(require, "tcp_udp_balancer") if not ok then error("require failed: " .. tostring(res)) else tcp_udp_balancer = res end } init_worker_by_lua_block { tcp_udp_balancer.init_worker() } lua_add_variable $proxy_upstream_name; log_format log_stream '[$remote_addr] [$time_local] $protocol $status $bytes_sent $bytes_received $session_time'; access_log /var/log/nginx/access.log log_stream ; error_log /var/log/nginx/error.log notice; upstream upstream_balancer { server 0.0.0.1:1234; # placeholder balancer_by_lua_block { tcp_udp_balancer.balance() } } server { listen 127.0.0.1:10247; access_log off; content_by_lua_block { tcp_udp_configuration.call() } } # TCP services # UDP services # Stream Snippets } STEP: Dumping NGINX logs - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:181 @ 03/15/23 07:53:33.849 Mar 15 07:53:33.849: INFO: ------------------------------------------------------------------------------- NGINX Ingress controller Release: 1.0.0-dev Build: git-78e9edbad Repository: git@github.com:SaumyaBhushan/ingress-nginx.git nginx version: nginx/1.21.6 ------------------------------------------------------------------------------- W0315 07:51:56.782054 13 client_config.go:618] Neither --kubeconfig nor --master was specified. Using the inClusterConfig. This might not work. I0315 07:51:56.782199 13 main.go:209] "Creating API client" host="https://10.96.0.1:443" I0315 07:51:56.788488 13 main.go:253] "Running in Kubernetes cluster" major="1" minor="25" git="v1.25.2" state="clean" commit="5835544ca568b757a8ecae5c153f317e5736700e" platform="linux/amd64" I0315 07:51:56.851866 13 main.go:104] "SSL fake certificate created" file="/etc/ingress-controller/ssl/default-fake-certificate.pem" W0315 07:51:56.861438 13 main.go:125] Unable to get NODE information: nodes "ingress-nginx-dev-worker" is forbidden: User "system:serviceaccount:e2e-tests-no-auth-locations-1678866712972780414-2sffx:nginx-ingress" cannot get resource "nodes" in API group "" at the cluster scope W0315 07:51:56.873056 13 nginx.go:154] Update of Ingress status is disabled (flag --update-status) I0315 07:51:56.875608 13 nginx.go:261] "Starting NGINX Ingress controller" I0315 07:51:56.885269 13 event.go:285] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"e2e-tests-no-auth-locations-1678866712972780414-2sffx", Name:"tcp-services", UID:"b67e765b-3222-4717-9e16-ccbac3acf80f", APIVersion:"v1", ResourceVersion:"809", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap e2e-tests-no-auth-locations-1678866712972780414-2sffx/tcp-services I0315 07:51:56.885316 13 event.go:285] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"e2e-tests-no-auth-locations-1678866712972780414-2sffx", Name:"nginx-ingress-controller", UID:"0bfc0e28-32bd-47e1-8b90-f586ee6128a4", APIVersion:"v1", ResourceVersion:"823", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap e2e-tests-no-auth-locations-1678866712972780414-2sffx/nginx-ingress-controller I0315 07:51:58.078572 13 leaderelection.go:248] attempting to acquire leader lease e2e-tests-no-auth-locations-1678866712972780414-2sffx/ingress-controller-leader... I0315 07:51:58.078544 13 nginx.go:304] "Starting NGINX process" I0315 07:51:58.078981 13 controller.go:188] "Configuration changes detected, backend reload required" I0315 07:51:58.083082 13 leaderelection.go:258] successfully acquired lease e2e-tests-no-auth-locations-1678866712972780414-2sffx/ingress-controller-leader I0315 07:51:58.083158 13 status.go:84] "New leader elected" identity="nginx-ingress-controller-5d855d8c4d-xjfzn" I0315 07:51:58.135021 13 controller.go:205] "Backend successfully reloaded" I0315 07:51:58.135118 13 controller.go:216] "Initial sync, sleeping for 1 second" I0315 07:51:58.135162 13 event.go:285] Event(v1.ObjectReference{Kind:"Pod", Namespace:"e2e-tests-no-auth-locations-1678866712972780414-2sffx", Name:"nginx-ingress-controller-5d855d8c4d-xjfzn", UID:"b238bdb0-bf9e-4af9-9264-88f978bc234d", APIVersion:"v1", ResourceVersion:"902", FieldPath:""}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration STEP: Dumping namespace content - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:190 @ 03/15/23 07:53:33.945 Mar 15 07:53:33.945: INFO: NAME READY STATUS RESTARTS AGE pod/echo-5f68dc79f7-94lcg 1/1 Running 0 93s pod/nginx-ingress-controller-5d855d8c4d-xjfzn 1/1 Running 0 97s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/echo ClusterIP 10.96.145.64 <none> 80/TCP 93s service/nginx-ingress-controller NodePort 10.96.86.208 <none> 80:32531/TCP,443:31531/TCP 98s NAME ENDPOINTS AGE endpoints/echo 10.244.2.5:80 93s endpoints/nginx-ingress-controller 10.244.1.2:443,10.244.1.2:80 97s NAME READY UP-TO-DATE AVAILABLE AGE deployment.apps/echo 1/1 1 1 93s deployment.apps/nginx-ingress-controller 1/1 1 1 97s < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:53:34.427 (3.753s) Attempt #1 Failed. Retrying ↺ @ 03/15/23 07:53:34.427 > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:53:34.427 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:53:41.904 (7.477s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 03/15/23 07:53:41.904 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 03/15/23 07:54:01.133 (19.229s) > Enter [It] should return status code 200 when accessing '/' authentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:68 @ 03/15/23 07:54:01.133 < Exit [It] should return status code 200 when accessing '/' authentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:68 @ 03/15/23 07:54:05.309 (4.176s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:54:05.309 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:54:05.475 (166ms) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:51:52.982 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:52:00.702 (7.719s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 03/15/23 07:52:00.702 [FAILED] Failure recorded during attempt 1: Error Trace: /go/src/k8s.io/ingress-nginx/test/e2e/framework/deployment.go:129 /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:44 /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/node.go:463 /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/suite.go:863 /usr/local/go/src/runtime/asm_amd64.s:1598 Error: Expected nil, but got: &errors.errorString{s:"timed out waiting for the condition"} Test: [Setting] [Security] no-auth-locations should return status code 200 when accessing '/noauth' unauthenticated Messages: waiting for endpoints to become ready In [BeforeEach] at: /go/src/k8s.io/ingress-nginx/test/e2e/framework/deployment.go:129 @ 03/15/23 07:53:30.732 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 03/15/23 07:53:30.732 (1m30.031s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:53:30.732 STEP: Dumping NGINX configuration after failure - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:172 @ 03/15/23 07:53:30.839 Mar 15 07:53:30.839: INFO: # Configuration checksum: 3508775551273608921 # setup custom paths that do not require root access pid /tmp/nginx/nginx.pid; daemon off; worker_processes 1; worker_rlimit_nofile 1047552; worker_shutdown_timeout 240s ; events { multi_accept on; worker_connections 16384; use epoll; } http { lua_package_path "/etc/nginx/lua/?.lua;;"; lua_shared_dict balancer_ewma 10M; lua_shared_dict balancer_ewma_last_touched_at 10M; lua_shared_dict balancer_ewma_locks 1M; lua_shared_dict certificate_data 20M; lua_shared_dict certificate_servers 5M; lua_shared_dict configuration_data 20M; lua_shared_dict global_throttle_cache 10M; lua_shared_dict ocsp_response_cache 5M; init_by_lua_block { collectgarbage("collect") -- init modules local ok, res ok, res = pcall(require, "lua_ingress") if not ok then error("require failed: " .. tostring(res)) else lua_ingress = res lua_ingress.set_config({ use_forwarded_headers = false, use_proxy_protocol = false, is_ssl_passthrough_enabled = false, http_redirect_code = 308, listen_ports = { ssl_proxy = "442", https = "443" }, hsts = true, hsts_max_age = 15724800, hsts_include_subdomains = true, hsts_preload = false, global_throttle = { memcached = { host = "", port = 11211, connect_timeout = 50, max_idle_timeout = 10000, pool_size = 50, }, status_code = 429, } }) end ok, res = pcall(require, "configuration") if not ok then error("require failed: " .. tostring(res)) else configuration = res configuration.prohibited_localhost_port = '10246' end ok, res = pcall(require, "balancer") if not ok then error("require failed: " .. tostring(res)) else balancer = res end ok, res = pcall(require, "monitor") if not ok then error("require failed: " .. tostring(res)) else monitor = res end ok, res = pcall(require, "certificate") if not ok then error("require failed: " .. tostring(res)) else certificate = res certificate.is_ocsp_stapling_enabled = false end ok, res = pcall(require, "plugins") if not ok then error("require failed: " .. tostring(res)) else plugins = res end -- load all plugins that'll be used here plugins.init({ }) } init_worker_by_lua_block { lua_ingress.init_worker() balancer.init_worker() monitor.init_worker(10000) plugins.run() } geoip_country /etc/nginx/geoip/GeoIP.dat; geoip_city /etc/nginx/geoip/GeoLiteCity.dat; geoip_org /etc/nginx/geoip/GeoIPASNum.dat; geoip_proxy_recursive on; aio threads; aio_write on; tcp_nopush on; tcp_nodelay on; log_subrequest on; reset_timedout_connection on; keepalive_timeout 75s; keepalive_requests 1000; client_body_temp_path /tmp/nginx/client-body; fastcgi_temp_path /tmp/nginx/fastcgi-temp; proxy_temp_path /tmp/nginx/proxy-temp; ajp_temp_path /tmp/nginx/ajp-temp; client_header_buffer_size 1k; client_header_timeout 60s; large_client_header_buffers 4 8k; client_body_buffer_size 8k; client_body_timeout 60s; http2_max_field_size 4k; http2_max_header_size 16k; http2_max_requests 1000; http2_max_concurrent_streams 128; types_hash_max_size 2048; server_names_hash_max_size 1024; server_names_hash_bucket_size 32; map_hash_bucket_size 64; proxy_headers_hash_max_size 512; proxy_headers_hash_bucket_size 64; variables_hash_bucket_size 256; variables_hash_max_size 2048; underscores_in_headers off; ignore_invalid_headers on; limit_req_status 503; limit_conn_status 503; include /etc/nginx/mime.types; default_type text/html; # Custom headers for response server_tokens off; more_clear_headers Server; # disable warnings uninitialized_variable_warn off; # Additional available variables: # $namespace # $ingress_name # $service_name # $service_port log_format upstreaminfo '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id'; map $request_uri $loggable { default 1; } access_log /var/log/nginx/access.log upstreaminfo if=$loggable; error_log /var/log/nginx/error.log notice; resolver 10.96.0.10 valid=30s; # See https://www.nginx.com/blog/websocket-nginx map $http_upgrade $connection_upgrade { default upgrade; # See http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive '' ''; } # Reverse proxies can detect if a client provides a X-Request-ID header, and pass it on to the backend server. # If no such header is provided, it can provide a random value. map $http_x_request_id $req_id { default $http_x_request_id; "" $request_id; } # Create a variable that contains the literal $ character. # This works because the geo module will not resolve variables. geo $literal_dollar { default "$"; } server_name_in_redirect off; port_in_redirect off; ssl_protocols TLSv1.2 TLSv1.3; ssl_early_data off; # turn on session caching to drastically improve performance ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; # allow configuring ssl session tickets ssl_session_tickets off; # slightly reduce the time-to-first-byte ssl_buffer_size 4k; # allow configuring custom ssl ciphers ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384'; ssl_prefer_server_ciphers on; ssl_ecdh_curve auto; # PEM sha: aae2d0ff5f7a242982148c453d0c854db2133495 ssl_certificate /etc/ingress-controller/ssl/default-fake-certificate.pem; ssl_certificate_key /etc/ingress-controller/ssl/default-fake-certificate.pem; proxy_ssl_session_reuse on; upstream upstream_balancer { ### Attention!!! # # We no longer create "upstream" section for every backend. # Backends are handled dynamically using Lua. If you would like to debug # and see what backends ingress-nginx has in its memory you can # install our kubectl plugin https://kubernetes.github.io/ingress-nginx/kubectl-plugin. # Once you have the plugin you can use "kubectl ingress-nginx backends" command to # inspect current backends. # ### server 0.0.0.1; # placeholder balancer_by_lua_block { balancer.balance() } keepalive 320; keepalive_time 1h; keepalive_timeout 60s; keepalive_requests 10000; } # Cache for internal auth checks proxy_cache_path /tmp/nginx/nginx-cache-auth levels=1:2 keys_zone=auth_cache:10m max_size=128m inactive=30m use_temp_path=off; # Global filters ## start server _ server { server_name _ ; listen 80 default_server reuseport backlog=4096 ; listen [::]:80 default_server reuseport backlog=4096 ; listen 443 default_server reuseport backlog=4096 ssl http2 ; listen [::]:443 default_server reuseport backlog=4096 ssl http2 ; set $proxy_upstream_name "-"; ssl_reject_handshake off; ssl_certificate_by_lua_block { certificate.call() } location / { set $namespace ""; set $ingress_name ""; set $service_name ""; set $service_port ""; set $location_path ""; set $global_rate_limit_exceeding n; rewrite_by_lua_block { lua_ingress.rewrite({ force_ssl_redirect = false, ssl_redirect = false, force_no_ssl_redirect = false, preserve_trailing_slash = false, use_port_in_redirects = false, global_throttle = { namespace = "", limit = 0, window_size = 0, key = { }, ignored_cidrs = { } }, }) balancer.rewrite() plugins.run() } # be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any # will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)` # other authentication method such as basic auth or external auth useless - all requests will be allowed. #access_by_lua_block { #} header_filter_by_lua_block { lua_ingress.header() plugins.run() } body_filter_by_lua_block { plugins.run() } log_by_lua_block { balancer.log() monitor.call() plugins.run() } access_log off; port_in_redirect off; set $balancer_ewma_score -1; set $proxy_upstream_name "upstream-default-backend"; set $proxy_host $proxy_upstream_name; set $pass_access_scheme $scheme; set $pass_server_port $server_port; set $best_http_host $http_host; set $pass_port $pass_server_port; set $proxy_alternative_upstream_name ""; client_max_body_size 1m; proxy_set_header Host $best_http_host; # Pass the extracted client certificate to the backend # Allow websocket connections proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header X-Request-ID $req_id; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-Host $best_http_host; proxy_set_header X-Forwarded-Port $pass_port; proxy_set_header X-Forwarded-Proto $pass_access_scheme; proxy_set_header X-Forwarded-Scheme $pass_access_scheme; proxy_set_header X-Scheme $pass_access_scheme; # Pass the original X-Forwarded-For proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for; # mitigate HTTPoxy Vulnerability # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/ proxy_set_header Proxy ""; # Custom headers to proxied server proxy_connect_timeout 5s; proxy_send_timeout 60s; proxy_read_timeout 60s; proxy_buffering off; proxy_buffer_size 4k; proxy_buffers 4 4k; proxy_max_temp_file_size 1024m; proxy_request_buffering on; proxy_http_version 1.1; proxy_cookie_domain off; proxy_cookie_path off; # In case of errors try the next upstream server before returning an error proxy_next_upstream error timeout; proxy_next_upstream_timeout 0; proxy_next_upstream_tries 3; proxy_pass http://upstream_balancer; proxy_redirect off; } # health checks in cloud providers require the use of port 80 location /healthz { access_log off; return 200; } # this is required to avoid error if nginx is being monitored # with an external software (like sysdig) location /nginx_status { allow 127.0.0.1; allow ::1; deny all; access_log off; stub_status on; } } ## end server _ # backend for when default-backend-service is not configured or it does not have endpoints server { listen 8181 default_server reuseport backlog=4096; listen [::]:8181 default_server reuseport backlog=4096; set $proxy_upstream_name "internal"; access_log off; location / { return 404; } } # default server, used for NGINX healthcheck and access to nginx stats server { listen 127.0.0.1:10246; set $proxy_upstream_name "internal"; keepalive_timeout 0; gzip off; access_log off; location /healthz { return 200; } location /is-dynamic-lb-initialized { content_by_lua_block { local configuration = require("configuration") local backend_data = configuration.get_backends_data() if not backend_data then ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR) return end ngx.say("OK") ngx.exit(ngx.HTTP_OK) } } location /nginx_status { stub_status on; } location /configuration { client_max_body_size 21M; client_body_buffer_size 21M; proxy_buffering off; content_by_lua_block { configuration.call() } } location / { content_by_lua_block { ngx.exit(ngx.HTTP_NOT_FOUND) } } } } stream { lua_package_path "/etc/nginx/lua/?.lua;/etc/nginx/lua/vendor/?.lua;;"; lua_shared_dict tcp_udp_configuration_data 5M; resolver 10.96.0.10 valid=30s; init_by_lua_block { collectgarbage("collect") -- init modules local ok, res ok, res = pcall(require, "configuration") if not ok then error("require failed: " .. tostring(res)) else configuration = res end ok, res = pcall(require, "tcp_udp_configuration") if not ok then error("require failed: " .. tostring(res)) else tcp_udp_configuration = res tcp_udp_configuration.prohibited_localhost_port = '10246' end ok, res = pcall(require, "tcp_udp_balancer") if not ok then error("require failed: " .. tostring(res)) else tcp_udp_balancer = res end } init_worker_by_lua_block { tcp_udp_balancer.init_worker() } lua_add_variable $proxy_upstream_name; log_format log_stream '[$remote_addr] [$time_local] $protocol $status $bytes_sent $bytes_received $session_time'; access_log /var/log/nginx/access.log log_stream ; error_log /var/log/nginx/error.log notice; upstream upstream_balancer { server 0.0.0.1:1234; # placeholder balancer_by_lua_block { tcp_udp_balancer.balance() } } server { listen 127.0.0.1:10247; access_log off; content_by_lua_block { tcp_udp_configuration.call() } } # TCP services # UDP services # Stream Snippets } STEP: Dumping NGINX logs - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:181 @ 03/15/23 07:53:33.852 Mar 15 07:53:33.852: INFO: ------------------------------------------------------------------------------- NGINX Ingress controller Release: 1.0.0-dev Build: git-78e9edbad Repository: git@github.com:SaumyaBhushan/ingress-nginx.git nginx version: nginx/1.21.6 ------------------------------------------------------------------------------- W0315 07:51:56.763281 13 client_config.go:618] Neither --kubeconfig nor --master was specified. Using the inClusterConfig. This might not work. I0315 07:51:56.763459 13 main.go:209] "Creating API client" host="https://10.96.0.1:443" I0315 07:51:56.772184 13 main.go:253] "Running in Kubernetes cluster" major="1" minor="25" git="v1.25.2" state="clean" commit="5835544ca568b757a8ecae5c153f317e5736700e" platform="linux/amd64" I0315 07:51:56.968865 13 main.go:104] "SSL fake certificate created" file="/etc/ingress-controller/ssl/default-fake-certificate.pem" W0315 07:51:56.977724 13 main.go:125] Unable to get NODE information: nodes "ingress-nginx-dev-worker2" is forbidden: User "system:serviceaccount:e2e-tests-no-auth-locations-1678866712983415165-nnt8g:nginx-ingress" cannot get resource "nodes" in API group "" at the cluster scope W0315 07:51:56.987065 13 nginx.go:154] Update of Ingress status is disabled (flag --update-status) I0315 07:51:56.989835 13 nginx.go:261] "Starting NGINX Ingress controller" I0315 07:51:56.994181 13 event.go:285] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"e2e-tests-no-auth-locations-1678866712983415165-nnt8g", Name:"nginx-ingress-controller", UID:"b6eee9a1-b293-4c74-85f6-f2a021513fd7", APIVersion:"v1", ResourceVersion:"828", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap e2e-tests-no-auth-locations-1678866712983415165-nnt8g/nginx-ingress-controller I0315 07:51:56.998274 13 event.go:285] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"e2e-tests-no-auth-locations-1678866712983415165-nnt8g", Name:"tcp-services", UID:"c51d545a-e508-4fe1-908b-1bc601da4c31", APIVersion:"v1", ResourceVersion:"810", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap e2e-tests-no-auth-locations-1678866712983415165-nnt8g/tcp-services I0315 07:51:58.191261 13 nginx.go:304] "Starting NGINX process" I0315 07:51:58.191351 13 leaderelection.go:248] attempting to acquire leader lease e2e-tests-no-auth-locations-1678866712983415165-nnt8g/ingress-controller-leader... I0315 07:51:58.191611 13 controller.go:188] "Configuration changes detected, backend reload required" I0315 07:51:58.196416 13 leaderelection.go:258] successfully acquired lease e2e-tests-no-auth-locations-1678866712983415165-nnt8g/ingress-controller-leader I0315 07:51:58.196673 13 status.go:84] "New leader elected" identity="nginx-ingress-controller-6f45678cb6-478c8" I0315 07:51:58.261056 13 controller.go:205] "Backend successfully reloaded" I0315 07:51:58.261129 13 controller.go:216] "Initial sync, sleeping for 1 second" I0315 07:51:58.261178 13 event.go:285] Event(v1.ObjectReference{Kind:"Pod", Namespace:"e2e-tests-no-auth-locations-1678866712983415165-nnt8g", Name:"nginx-ingress-controller-6f45678cb6-478c8", UID:"ca0024c3-8ee0-4a44-ad47-17209c177ebf", APIVersion:"v1", ResourceVersion:"910", FieldPath:""}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration STEP: Dumping namespace content - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:190 @ 03/15/23 07:53:33.945 Mar 15 07:53:33.945: INFO: NAME READY STATUS RESTARTS AGE pod/echo-5f68dc79f7-sdhdk 0/1 Running 0 93s pod/nginx-ingress-controller-6f45678cb6-478c8 1/1 Running 0 97s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/echo ClusterIP 10.96.193.249 <none> 80/TCP 93s service/nginx-ingress-controller NodePort 10.96.212.111 <none> 80:30184/TCP,443:30346/TCP 97s NAME ENDPOINTS AGE endpoints/echo 93s endpoints/nginx-ingress-controller 10.244.2.4:443,10.244.2.4:80 97s NAME READY UP-TO-DATE AVAILABLE AGE deployment.apps/echo 0/1 1 0 93s deployment.apps/nginx-ingress-controller 1/1 1 1 97s < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:53:34.398 (3.666s) Attempt #1 Failed. Retrying ↺ @ 03/15/23 07:53:34.398 > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:53:34.399 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:53:42.548 (8.149s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 03/15/23 07:53:42.548 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 03/15/23 07:54:23.647 (41.099s) > Enter [It] should return status code 200 when accessing '/noauth' unauthenticated - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:82 @ 03/15/23 07:54:23.647 < Exit [It] should return status code 200 when accessing '/noauth' unauthenticated - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:82 @ 03/15/23 07:54:26.754 (3.107s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:54:26.754 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:54:26.939 (186ms) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:51:52.989 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:52:00.654 (7.665s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 03/15/23 07:52:00.654 [FAILED] Failure recorded during attempt 1: Error Trace: /go/src/k8s.io/ingress-nginx/test/e2e/framework/deployment.go:129 /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:52 /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/node.go:463 /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/suite.go:863 /usr/local/go/src/runtime/asm_amd64.s:1598 Error: Expected nil, but got: &errors.errorString{s:"timed out waiting for the condition"} Test: [Setting] [Security] global-auth-url when global external authentication is configured should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service Messages: waiting for endpoints to become ready In [BeforeEach] at: /go/src/k8s.io/ingress-nginx/test/e2e/framework/deployment.go:129 @ 03/15/23 07:53:30.691 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 03/15/23 07:53:30.691 (1m30.037s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:53:30.691 STEP: Dumping NGINX configuration after failure - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:172 @ 03/15/23 07:53:30.843 Mar 15 07:53:30.843: INFO: # Configuration checksum: 11418618122717333097 # setup custom paths that do not require root access pid /tmp/nginx/nginx.pid; daemon off; worker_processes 1; worker_rlimit_nofile 1047552; worker_shutdown_timeout 240s ; events { multi_accept on; worker_connections 16384; use epoll; } http { lua_package_path "/etc/nginx/lua/?.lua;;"; lua_shared_dict balancer_ewma 10M; lua_shared_dict balancer_ewma_last_touched_at 10M; lua_shared_dict balancer_ewma_locks 1M; lua_shared_dict certificate_data 20M; lua_shared_dict certificate_servers 5M; lua_shared_dict configuration_data 20M; lua_shared_dict global_throttle_cache 10M; lua_shared_dict ocsp_response_cache 5M; init_by_lua_block { collectgarbage("collect") -- init modules local ok, res ok, res = pcall(require, "lua_ingress") if not ok then error("require failed: " .. tostring(res)) else lua_ingress = res lua_ingress.set_config({ use_forwarded_headers = false, use_proxy_protocol = false, is_ssl_passthrough_enabled = false, http_redirect_code = 308, listen_ports = { ssl_proxy = "442", https = "443" }, hsts = true, hsts_max_age = 15724800, hsts_include_subdomains = true, hsts_preload = false, global_throttle = { memcached = { host = "", port = 11211, connect_timeout = 50, max_idle_timeout = 10000, pool_size = 50, }, status_code = 429, } }) end ok, res = pcall(require, "configuration") if not ok then error("require failed: " .. tostring(res)) else configuration = res configuration.prohibited_localhost_port = '10246' end ok, res = pcall(require, "balancer") if not ok then error("require failed: " .. tostring(res)) else balancer = res end ok, res = pcall(require, "monitor") if not ok then error("require failed: " .. tostring(res)) else monitor = res end ok, res = pcall(require, "certificate") if not ok then error("require failed: " .. tostring(res)) else certificate = res certificate.is_ocsp_stapling_enabled = false end ok, res = pcall(require, "plugins") if not ok then error("require failed: " .. tostring(res)) else plugins = res end -- load all plugins that'll be used here plugins.init({ }) } init_worker_by_lua_block { lua_ingress.init_worker() balancer.init_worker() monitor.init_worker(10000) plugins.run() } geoip_country /etc/nginx/geoip/GeoIP.dat; geoip_city /etc/nginx/geoip/GeoLiteCity.dat; geoip_org /etc/nginx/geoip/GeoIPASNum.dat; geoip_proxy_recursive on; aio threads; aio_write on; tcp_nopush on; tcp_nodelay on; log_subrequest on; reset_timedout_connection on; keepalive_timeout 75s; keepalive_requests 1000; client_body_temp_path /tmp/nginx/client-body; fastcgi_temp_path /tmp/nginx/fastcgi-temp; proxy_temp_path /tmp/nginx/proxy-temp; ajp_temp_path /tmp/nginx/ajp-temp; client_header_buffer_size 1k; client_header_timeout 60s; large_client_header_buffers 4 8k; client_body_buffer_size 8k; client_body_timeout 60s; http2_max_field_size 4k; http2_max_header_size 16k; http2_max_requests 1000; http2_max_concurrent_streams 128; types_hash_max_size 2048; server_names_hash_max_size 1024; server_names_hash_bucket_size 32; map_hash_bucket_size 64; proxy_headers_hash_max_size 512; proxy_headers_hash_bucket_size 64; variables_hash_bucket_size 256; variables_hash_max_size 2048; underscores_in_headers off; ignore_invalid_headers on; limit_req_status 503; limit_conn_status 503; include /etc/nginx/mime.types; default_type text/html; # Custom headers for response server_tokens off; more_clear_headers Server; # disable warnings uninitialized_variable_warn off; # Additional available variables: # $namespace # $ingress_name # $service_name # $service_port log_format upstreaminfo '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id'; map $request_uri $loggable { default 1; } access_log /var/log/nginx/access.log upstreaminfo if=$loggable; error_log /var/log/nginx/error.log notice; resolver 10.96.0.10 valid=30s; # See https://www.nginx.com/blog/websocket-nginx map $http_upgrade $connection_upgrade { default upgrade; # See http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive '' ''; } # Reverse proxies can detect if a client provides a X-Request-ID header, and pass it on to the backend server. # If no such header is provided, it can provide a random value. map $http_x_request_id $req_id { default $http_x_request_id; "" $request_id; } # Create a variable that contains the literal $ character. # This works because the geo module will not resolve variables. geo $literal_dollar { default "$"; } server_name_in_redirect off; port_in_redirect off; ssl_protocols TLSv1.2 TLSv1.3; ssl_early_data off; # turn on session caching to drastically improve performance ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; # allow configuring ssl session tickets ssl_session_tickets off; # slightly reduce the time-to-first-byte ssl_buffer_size 4k; # allow configuring custom ssl ciphers ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384'; ssl_prefer_server_ciphers on; ssl_ecdh_curve auto; # PEM sha: 2754bc180af7e5ab278bc456cfdc3e17e73976d6 ssl_certificate /etc/ingress-controller/ssl/default-fake-certificate.pem; ssl_certificate_key /etc/ingress-controller/ssl/default-fake-certificate.pem; proxy_ssl_session_reuse on; upstream upstream_balancer { ### Attention!!! # # We no longer create "upstream" section for every backend. # Backends are handled dynamically using Lua. If you would like to debug # and see what backends ingress-nginx has in its memory you can # install our kubectl plugin https://kubernetes.github.io/ingress-nginx/kubectl-plugin. # Once you have the plugin you can use "kubectl ingress-nginx backends" command to # inspect current backends. # ### server 0.0.0.1; # placeholder balancer_by_lua_block { balancer.balance() } keepalive 320; keepalive_time 1h; keepalive_timeout 60s; keepalive_requests 10000; } # Cache for internal auth checks proxy_cache_path /tmp/nginx/nginx-cache-auth levels=1:2 keys_zone=auth_cache:10m max_size=128m inactive=30m use_temp_path=off; # Global filters ## start server _ server { server_name _ ; listen 80 default_server reuseport backlog=4096 ; listen [::]:80 default_server reuseport backlog=4096 ; listen 443 default_server reuseport backlog=4096 ssl http2 ; listen [::]:443 default_server reuseport backlog=4096 ssl http2 ; set $proxy_upstream_name "-"; ssl_reject_handshake off; ssl_certificate_by_lua_block { certificate.call() } location / { set $namespace ""; set $ingress_name ""; set $service_name ""; set $service_port ""; set $location_path ""; set $global_rate_limit_exceeding n; rewrite_by_lua_block { lua_ingress.rewrite({ force_ssl_redirect = false, ssl_redirect = false, force_no_ssl_redirect = false, preserve_trailing_slash = false, use_port_in_redirects = false, global_throttle = { namespace = "", limit = 0, window_size = 0, key = { }, ignored_cidrs = { } }, }) balancer.rewrite() plugins.run() } # be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any # will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)` # other authentication method such as basic auth or external auth useless - all requests will be allowed. #access_by_lua_block { #} header_filter_by_lua_block { lua_ingress.header() plugins.run() } body_filter_by_lua_block { plugins.run() } log_by_lua_block { balancer.log() monitor.call() plugins.run() } access_log off; port_in_redirect off; set $balancer_ewma_score -1; set $proxy_upstream_name "upstream-default-backend"; set $proxy_host $proxy_upstream_name; set $pass_access_scheme $scheme; set $pass_server_port $server_port; set $best_http_host $http_host; set $pass_port $pass_server_port; set $proxy_alternative_upstream_name ""; client_max_body_size 1m; proxy_set_header Host $best_http_host; # Pass the extracted client certificate to the backend # Allow websocket connections proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header X-Request-ID $req_id; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-Host $best_http_host; proxy_set_header X-Forwarded-Port $pass_port; proxy_set_header X-Forwarded-Proto $pass_access_scheme; proxy_set_header X-Forwarded-Scheme $pass_access_scheme; proxy_set_header X-Scheme $pass_access_scheme; # Pass the original X-Forwarded-For proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for; # mitigate HTTPoxy Vulnerability # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/ proxy_set_header Proxy ""; # Custom headers to proxied server proxy_connect_timeout 5s; proxy_send_timeout 60s; proxy_read_timeout 60s; proxy_buffering off; proxy_buffer_size 4k; proxy_buffers 4 4k; proxy_max_temp_file_size 1024m; proxy_request_buffering on; proxy_http_version 1.1; proxy_cookie_domain off; proxy_cookie_path off; # In case of errors try the next upstream server before returning an error proxy_next_upstream error timeout; proxy_next_upstream_timeout 0; proxy_next_upstream_tries 3; proxy_pass http://upstream_balancer; proxy_redirect off; } # health checks in cloud providers require the use of port 80 location /healthz { access_log off; return 200; } # this is required to avoid error if nginx is being monitored # with an external software (like sysdig) location /nginx_status { allow 127.0.0.1; allow ::1; deny all; access_log off; stub_status on; } } ## end server _ # backend for when default-backend-service is not configured or it does not have endpoints server { listen 8181 default_server reuseport backlog=4096; listen [::]:8181 default_server reuseport backlog=4096; set $proxy_upstream_name "internal"; access_log off; location / { return 404; } } # default server, used for NGINX healthcheck and access to nginx stats server { listen 127.0.0.1:10246; set $proxy_upstream_name "internal"; keepalive_timeout 0; gzip off; access_log off; location /healthz { return 200; } location /is-dynamic-lb-initialized { content_by_lua_block { local configuration = require("configuration") local backend_data = configuration.get_backends_data() if not backend_data then ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR) return end ngx.say("OK") ngx.exit(ngx.HTTP_OK) } } location /nginx_status { stub_status on; } location /configuration { client_max_body_size 21M; client_body_buffer_size 21M; proxy_buffering off; content_by_lua_block { configuration.call() } } location / { content_by_lua_block { ngx.exit(ngx.HTTP_NOT_FOUND) } } } } stream { lua_package_path "/etc/nginx/lua/?.lua;/etc/nginx/lua/vendor/?.lua;;"; lua_shared_dict tcp_udp_configuration_data 5M; resolver 10.96.0.10 valid=30s; init_by_lua_block { collectgarbage("collect") -- init modules local ok, res ok, res = pcall(require, "configuration") if not ok then error("require failed: " .. tostring(res)) else configuration = res end ok, res = pcall(require, "tcp_udp_configuration") if not ok then error("require failed: " .. tostring(res)) else tcp_udp_configuration = res tcp_udp_configuration.prohibited_localhost_port = '10246' end ok, res = pcall(require, "tcp_udp_balancer") if not ok then error("require failed: " .. tostring(res)) else tcp_udp_balancer = res end } init_worker_by_lua_block { tcp_udp_balancer.init_worker() } lua_add_variable $proxy_upstream_name; log_format log_stream '[$remote_addr] [$time_local] $protocol $status $bytes_sent $bytes_received $session_time'; access_log /var/log/nginx/access.log log_stream ; error_log /var/log/nginx/error.log notice; upstream upstream_balancer { server 0.0.0.1:1234; # placeholder balancer_by_lua_block { tcp_udp_balancer.balance() } } server { listen 127.0.0.1:10247; access_log off; content_by_lua_block { tcp_udp_configuration.call() } } # TCP services # UDP services # Stream Snippets } STEP: Dumping NGINX logs - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:181 @ 03/15/23 07:53:33.857 Mar 15 07:53:33.857: INFO: ------------------------------------------------------------------------------- NGINX Ingress controller Release: 1.0.0-dev Build: git-78e9edbad Repository: git@github.com:SaumyaBhushan/ingress-nginx.git nginx version: nginx/1.21.6 ------------------------------------------------------------------------------- W0315 07:51:56.767000 14 client_config.go:618] Neither --kubeconfig nor --master was specified. Using the inClusterConfig. This might not work. I0315 07:51:56.767176 14 main.go:209] "Creating API client" host="https://10.96.0.1:443" I0315 07:51:56.774428 14 main.go:253] "Running in Kubernetes cluster" major="1" minor="25" git="v1.25.2" state="clean" commit="5835544ca568b757a8ecae5c153f317e5736700e" platform="linux/amd64" I0315 07:51:57.032947 14 main.go:104] "SSL fake certificate created" file="/etc/ingress-controller/ssl/default-fake-certificate.pem" W0315 07:51:57.042018 14 main.go:125] Unable to get NODE information: nodes "ingress-nginx-dev-worker2" is forbidden: User "system:serviceaccount:e2e-tests-global-external-auth-1678866712990090764-b7zlp:nginx-ingress" cannot get resource "nodes" in API group "" at the cluster scope W0315 07:51:57.052996 14 nginx.go:154] Update of Ingress status is disabled (flag --update-status) I0315 07:51:57.055731 14 nginx.go:261] "Starting NGINX Ingress controller" I0315 07:51:57.058557 14 event.go:285] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"e2e-tests-global-external-auth-1678866712990090764-b7zlp", Name:"tcp-services", UID:"0db00a11-f3e3-4086-ab84-642ccf8783eb", APIVersion:"v1", ResourceVersion:"812", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap e2e-tests-global-external-auth-1678866712990090764-b7zlp/tcp-services I0315 07:51:57.058740 14 event.go:285] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"e2e-tests-global-external-auth-1678866712990090764-b7zlp", Name:"nginx-ingress-controller", UID:"4504b63e-35ff-4da9-ab78-3ca7ed729354", APIVersion:"v1", ResourceVersion:"817", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap e2e-tests-global-external-auth-1678866712990090764-b7zlp/nginx-ingress-controller I0315 07:51:58.258401 14 nginx.go:304] "Starting NGINX process" I0315 07:51:58.258497 14 leaderelection.go:248] attempting to acquire leader lease e2e-tests-global-external-auth-1678866712990090764-b7zlp/ingress-controller-leader... I0315 07:51:58.259043 14 controller.go:188] "Configuration changes detected, backend reload required" I0315 07:51:58.264830 14 leaderelection.go:258] successfully acquired lease e2e-tests-global-external-auth-1678866712990090764-b7zlp/ingress-controller-leader I0315 07:51:58.264893 14 status.go:84] "New leader elected" identity="nginx-ingress-controller-545fd86d77-7ql7q" I0315 07:51:58.331531 14 controller.go:205] "Backend successfully reloaded" I0315 07:51:58.331620 14 controller.go:216] "Initial sync, sleeping for 1 second" I0315 07:51:58.331686 14 event.go:285] Event(v1.ObjectReference{Kind:"Pod", Namespace:"e2e-tests-global-external-auth-1678866712990090764-b7zlp", Name:"nginx-ingress-controller-545fd86d77-7ql7q", UID:"d3ba5d86-b583-4027-b320-162cb96d7a3e", APIVersion:"v1", ResourceVersion:"892", FieldPath:""}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration STEP: Dumping namespace content - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:190 @ 03/15/23 07:53:33.951 Mar 15 07:53:33.951: INFO: NAME READY STATUS RESTARTS AGE pod/echo-5f68dc79f7-mhljq 0/1 ContainerCreating 0 93s pod/nginx-ingress-controller-545fd86d77-7ql7q 1/1 Running 0 97s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/echo ClusterIP 10.96.196.130 <none> 80/TCP 93s service/nginx-ingress-controller NodePort 10.96.177.179 <none> 80:30355/TCP,443:31751/TCP 98s NAME ENDPOINTS AGE endpoints/echo <none> 93s endpoints/nginx-ingress-controller 10.244.2.3:443,10.244.2.3:80 97s NAME READY UP-TO-DATE AVAILABLE AGE deployment.apps/echo 0/1 1 0 93s deployment.apps/nginx-ingress-controller 1/1 1 1 97s < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:53:34.415 (3.724s) Attempt #1 Failed. Retrying ↺ @ 03/15/23 07:53:34.415 > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:53:34.415 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 03/15/23 07:53:42.72 (8.305s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 03/15/23 07:53:42.72 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 03/15/23 07:55:06.761 (1m24.04s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 03/15/23 07:55:06.761 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 03/15/23 07:55:06.761 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 03/15/23 07:55:16.876 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 03/15/23 07:55:26.995 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 03/15/23 07:55:37.121 (30.36s) > Enter [It] should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:102 @ 03/15/23 07:55:37.121 STEP: Adding a no-auth-locations for /bar to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:104 @ 03/15/23 07:55:37.122 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:111 @ 03/15/23 07:55:47.244 STEP: Sending a request to whitelisted service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:118 @ 03/15/23 07:55:47.252 < Exit [It] should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:102 @ 03/15/23 07:55:47.254 (10.133s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:55:47.254 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 03/15/23 07:55:47.41 (156ms) - - - \ No newline at end of file