DevFW-CICD/ingress-nginx-helm
14
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Allow custom health checks

Browse source
This commit is contained in:
Manuel de Brito Fontes 2016-05-16 17:29:33 -03:00
parent a38fcda255
commit 675ce396ac
14 changed files with 340 additions and 41 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
controllers/nginx/Dockerfile
View file

@ -12,7 +12,7 @@
# See the License for the specific language governing permissions and
# limitations under the License.
FROM gcr.io/google_containers/nginx-slim:0.6
FROM gcr.io/google_containers/nginx-slim:0.7
RUN apt-get update && apt-get install -y \
diffutils \

18
controllers/nginx/README.md
View file

@ -196,6 +196,23 @@ Use the [custom-template](examples/custom-template/README.md) example as a guide
**Please note the template is tied to the go code. Be sure to no change names in the variable `$cfg`**
### Custom NGINX upstream checks
NGINX exposes some flags in the [upstream configuration](http://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream) that enabled configuration of each server in the upstream. The ingress controller allows custom `max_fails` and `fail_timeout` parameters in a global context using `upstream-max-fails` or `upstream-fail-timeout` in the NGINX Configmap or in a particular Ingress rule. By default this values are 0. This means NGINX will respect the `livenessProbe`, if is defined. If there is no probe, NGINX will not mark a server inside an upstream down.
To use custom values in an Ingress rule define this annotations:
`ingress-nginx.kubernetes.io/upstream-max-fails`: number of unsuccessful attempts to communicate with the server that should happen in the duration set by the fail_timeout parameter to consider the server unavailable
`ingress-nginx.kubernetes.io/upstream-fail-timeout`: time in seconds during which the specified number of unsuccessful attempts to communicate with the server should happen to consider the server unavailable. Also the period of time the server will be considered unavailable.
**Important:**
The upstreams are shared. i.e. Ingress rule using the same service will use the same upstream.
This means only one of the rules should define annotations to configure the upstream servers
Please check the [auth](examples/custom-upstream-check/README.md) example
### NGINX status page
@ -209,7 +226,6 @@ Please check the example `example/rc-default.yaml`
To extract the information in JSON format the module provides a custom URL: `/nginx_status/format/json`
### Custom errors
In case of an error in a request the body of the response is obtained from the `default backend`. Each request to the default backend includes two headers:

33
controllers/nginx/controller.go
View file

@ -40,6 +40,7 @@ import (
"k8s.io/kubernetes/pkg/util/intstr"
"k8s.io/kubernetes/pkg/watch"
"k8s.io/contrib/ingress/controllers/nginx/healthcheck"
"k8s.io/contrib/ingress/controllers/nginx/nginx"
)
@ -327,9 +328,6 @@ func (lbc *loadBalancerController) sync(key string) {
return
}
ings := lbc.ingLister.Store.List()
upstreams, servers := lbc.getUpstreamServers(ings)
var cfg *api.ConfigMap
ns, name, _ := parseNsName(lbc.nxgConfigMap)
@ -339,6 +337,10 @@ func (lbc *loadBalancerController) sync(key string) {
}
ngxConfig := lbc.nginx.ReadConfig(cfg)
ings := lbc.ingLister.Store.List()
upstreams, servers := lbc.getUpstreamServers(ngxConfig, ings)
lbc.nginx.CheckAndReload(ngxConfig, nginx.IngressConfig{
Upstreams: upstreams,
Servers: servers,
@ -489,7 +491,7 @@ func (lbc *loadBalancerController) getStreamServices(data map[string]string, pro
if err != nil {
for _, sp := range svc.Spec.Ports {
if sp.Name == svcPort {
endps = lbc.getEndpoints(svc, sp.TargetPort, proto)
endps = lbc.getEndpoints(svc, sp.TargetPort, proto, &healthcheck.Upstream{})
break
}
}
@ -497,7 +499,7 @@ func (lbc *loadBalancerController) getStreamServices(data map[string]string, pro
// we need to use the TargetPort (where the endpoints are running)
for _, sp := range svc.Spec.Ports {
if sp.Port == int32(targetPort) {
endps = lbc.getEndpoints(svc, sp.TargetPort, proto)
endps = lbc.getEndpoints(svc, sp.TargetPort, proto, &healthcheck.Upstream{})
break
}
}
@ -542,7 +544,7 @@ func (lbc *loadBalancerController) getDefaultUpstream() *nginx.Upstream {
svc := svcObj.(*api.Service)
endps := lbc.getEndpoints(svc, svc.Spec.Ports[0].TargetPort, api.ProtocolTCP)
endps := lbc.getEndpoints(svc, svc.Spec.Ports[0].TargetPort, api.ProtocolTCP, &healthcheck.Upstream{})
if len(endps) == 0 {
glog.Warningf("service %v does no have any active endpoints", svcKey)
upstream.Backends = append(upstream.Backends, nginx.NewDefaultServer())
@ -553,8 +555,8 @@ func (lbc *loadBalancerController) getDefaultUpstream() *nginx.Upstream {
return upstream
}
func (lbc *loadBalancerController) getUpstreamServers(data []interface{}) ([]*nginx.Upstream, []*nginx.Server) {
upstreams := lbc.createUpstreams(data)
func (lbc *loadBalancerController) getUpstreamServers(ngxCfg nginx.NginxConfiguration, data []interface{}) ([]*nginx.Upstream, []*nginx.Server) {
upstreams := lbc.createUpstreams(ngxCfg, data)
upstreams[defUpstreamName] = lbc.getDefaultUpstream()
servers := lbc.createServers(data)
@ -655,12 +657,14 @@ func (lbc *loadBalancerController) getUpstreamServers(data []interface{}) ([]*ng
// createUpstreams creates the NGINX upstreams for each service referenced in
// Ingress rules. The servers inside the upstream are endpoints.
func (lbc *loadBalancerController) createUpstreams(data []interface{}) map[string]*nginx.Upstream {
func (lbc *loadBalancerController) createUpstreams(ngxCfg nginx.NginxConfiguration, data []interface{}) map[string]*nginx.Upstream {
upstreams := make(map[string]*nginx.Upstream)
for _, ingIf := range data {
ing := ingIf.(*extensions.Ingress)
hz := healthcheck.ParseAnnotations(ngxCfg, ing)
for _, rule := range ing.Spec.Rules {
if rule.IngressRuleValue.HTTP == nil {
continue
@ -693,7 +697,7 @@ func (lbc *loadBalancerController) createUpstreams(data []interface{}) map[strin
for _, servicePort := range svc.Spec.Ports {
// targetPort could be a string, use the name or the port (int)
if strconv.Itoa(int(servicePort.Port)) == bp || servicePort.TargetPort.String() == bp || servicePort.Name == bp {
endps := lbc.getEndpoints(svc, servicePort.TargetPort, api.ProtocolTCP)
endps := lbc.getEndpoints(svc, servicePort.TargetPort, api.ProtocolTCP, hz)
if len(endps) == 0 {
glog.Warningf("service %v does no have any active endpoints", svcKey)
}
@ -801,7 +805,7 @@ func (lbc *loadBalancerController) getPemsFromIngress(data []interface{}) map[st
}
// getEndpoints returns a list of <endpoint ip>:<port> for a given service/target port combination.
func (lbc *loadBalancerController) getEndpoints(s *api.Service, servicePort intstr.IntOrString, proto api.Protocol) []nginx.UpstreamServer {
func (lbc *loadBalancerController) getEndpoints(s *api.Service, servicePort intstr.IntOrString, proto api.Protocol, hz *healthcheck.Upstream) []nginx.UpstreamServer {
glog.V(3).Infof("getting endpoints for service %v/%v and port %v", s.Namespace, s.Name, servicePort.String())
ep, err := lbc.endpLister.GetServiceEndpoints(s)
if err != nil {
@ -859,7 +863,12 @@ func (lbc *loadBalancerController) getEndpoints(s *api.Service, servicePort ints
}
for _, epAddress := range ss.Addresses {
ups := nginx.UpstreamServer{Address: epAddress.IP, Port: fmt.Sprintf("%v", targetPort)}
ups := nginx.UpstreamServer{
Address: epAddress.IP,
Port: fmt.Sprintf("%v", targetPort),
MaxFails: hz.MaxFails,
FailTimeout: hz.FailTimeout,
}
upsServers = append(upsServers, ups)
}
}

45
controllers/nginx/examples/custom-upstream-check/README.md Normal file
View file

@ -0,0 +1,45 @@
This example shows how is possible to create a custom configuration for a particular upstream associated with an Ingress rule.
echo "
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: echoheaders
annotations:
ingress-nginx.kubernetes.io/upstream-fail-timeout: "30"
spec:
rules:
- host: foo.bar.com
http:
paths:
- path: /
backend:
serviceName: echoheaders
servicePort: 80
" | kubectl create -f -
Check the annotation is present in the Ingress rule:
```
kubectl get ingress echoheaders -o yaml
``
Check the NGINX configuration is updated using kubectl or the status page:
```
$ kubectl exec nginx-ingress-controller-v1ppm cat /etc/nginx/nginx.conf
```
```
....
upstream default-echoheaders-x-80 {
least_conn;
server 10.2.92.2:8080 max_fails=5 fail_timeout=30;
}
....
```
![nginx-module-vts](contrib/ingress/controllers/nginx/examples/custom-upstream-check/custom-upstream.png "screenshot with custom configuration")

BIN
controllers/nginx/examples/custom-upstream-check/custom-upstream.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 59 KiB

101
controllers/nginx/healthcheck/main.go Normal file
View file

@ -0,0 +1,101 @@
/*
Copyright 2016 The Kubernetes Authors All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package healthcheck
import (
"errors"
"strconv"
"k8s.io/kubernetes/pkg/apis/extensions"
"k8s.io/contrib/ingress/controllers/nginx/nginx"
)
const (
upsMaxFails = "ingress-nginx.kubernetes.io/upstream-max-fails"
upsFailTimeout = "ingress-nginx.kubernetes.io/upstream-fail-timeout"
)
var (
// ErrMissingMaxFails returned error when the ingress does not contains the
// max-fails annotation
ErrMissingMaxFails = errors.New("max-fails annotations is missing")
// ErrMissingFailTimeout returned error when the ingress does not contains
// the fail-timeout annotation
ErrMissingFailTimeout = errors.New("fail-timeout annotations is missing")
// ErrInvalidNumber returned
ErrInvalidNumber = errors.New("the annotation does not contains a number")
)
// Upstream returns the URL and method to use check the status of
// the upstream server/s
type Upstream struct {
MaxFails int
FailTimeout int
}
type ingAnnotations map[string]string
func (a ingAnnotations) maxFails() (int, error) {
val, ok := a[upsMaxFails]
if !ok {
return 0, ErrMissingMaxFails
}
mf, err := strconv.Atoi(val)
if err != nil {
return 0, ErrInvalidNumber
}
return mf, nil
}
func (a ingAnnotations) failTimeout() (int, error) {
val, ok := a[upsFailTimeout]
if !ok {
return 0, ErrMissingFailTimeout
}
ft, err := strconv.Atoi(val)
if err != nil {
return 0, ErrInvalidNumber
}
return ft, nil
}
// ParseAnnotations parses the annotations contained in the ingress
// rule used to configure upstream check parameters
func ParseAnnotations(cfg nginx.NginxConfiguration, ing *extensions.Ingress) *Upstream {
if ing.GetAnnotations() == nil {
return &Upstream{cfg.UpstreamMaxFails, cfg.UpstreamFailTimeout}
}
mf, err := ingAnnotations(ing.GetAnnotations()).maxFails()
if err != nil {
mf = cfg.UpstreamMaxFails
}
ft, err := ingAnnotations(ing.GetAnnotations()).failTimeout()
if err != nil {
ft = cfg.UpstreamFailTimeout
}
return &Upstream{mf, ft}
}

112
controllers/nginx/healthcheck/main_test.go Normal file
View file

@ -0,0 +1,112 @@
/*
Copyright 2016 The Kubernetes Authors All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package healthcheck
import (
"testing"
"k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/apis/extensions"
"k8s.io/kubernetes/pkg/util/intstr"
"k8s.io/contrib/ingress/controllers/nginx/nginx"
)
func buildIngress() *extensions.Ingress {
defaultBackend := extensions.IngressBackend{
ServiceName: "default-backend",
ServicePort: intstr.FromInt(80),
}
return &extensions.Ingress{
ObjectMeta: api.ObjectMeta{
Name: "foo",
Namespace: api.NamespaceDefault,
},
Spec: extensions.IngressSpec{
Backend: &extensions.IngressBackend{
ServiceName: "default-backend",
ServicePort: intstr.FromInt(80),
},
Rules: []extensions.IngressRule{
{
Host: "foo.bar.com",
IngressRuleValue: extensions.IngressRuleValue{
HTTP: &extensions.HTTPIngressRuleValue{
Paths: []extensions.HTTPIngressPath{
{
Path: "/foo",
Backend: defaultBackend,
},
},
},
},
},
},
},
}
}
func TestAnnotations(t *testing.T) {
ing := buildIngress()
_, err := ingAnnotations(ing.GetAnnotations()).maxFails()
if err == nil {
t.Error("Expected a validation error")
}
_, err = ingAnnotations(ing.GetAnnotations()).failTimeout()
if err == nil {
t.Error("Expected a validation error")
}
data := map[string]string{}
data[upsMaxFails] = "1"
data[upsFailTimeout] = "1"
ing.SetAnnotations(data)
mf, err := ingAnnotations(ing.GetAnnotations()).maxFails()
if mf != 1 {
t.Errorf("Expected 1 but returned %s", mf)
}
ft, err := ingAnnotations(ing.GetAnnotations()).failTimeout()
if ft != 1 {
t.Errorf("Expected 1 but returned %s", ft)
}
}
func TestIngressHealthCheck(t *testing.T) {
ing := buildIngress()
data := map[string]string{}
data[upsMaxFails] = "2"
ing.SetAnnotations(data)
cfg := nginx.NginxConfiguration{}
cfg.UpstreamFailTimeout = 1
nginxHz := ParseAnnotations(cfg, ing)
if nginxHz.MaxFails != 2 {
t.Errorf("Expected 2 as max-fails but returned %v", nginxHz.MaxFails)
}
if nginxHz.FailTimeout != 1 {
t.Errorf("Expected 0 as fail-timeout but returned %v", nginxHz.FailTimeout)
}
}

31
controllers/nginx/nginx.tmpl
View file

@ -41,22 +41,21 @@ http {
include /etc/nginx/mime.types;
default_type text/html;
{{ if $cfg.useGzip }}
{{ if $cfg.useGzip -}}
gzip on;
gzip_comp_level 5;
gzip_http_version 1.1;
gzip_min_length 256;
gzip_types {{ $cfg.gzipTypes }};
gzip_proxied any;
gzip_vary on;
{{ end }}
{{- end }}
client_max_body_size "{{ $cfg.bodySize }}";
{{ if $cfg.useProxyProtocol }}
{{ if $cfg.useProxyProtocol -}}
set_real_ip_from {{ $cfg.proxyRealIpCidr }};
real_ip_header proxy_protocol;
{{ end }}
{{ end -}}
log_format upstreaminfo '{{ if $cfg.useProxyProtocol }}$proxy_protocol_addr{{ else }}$remote_addr{{ end }} - '
'[$proxy_add_x_forwarded_for] - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" '
@ -137,15 +136,16 @@ http {
{{range $name, $upstream := .upstreams}}
upstream {{$upstream.Name}} {
{{ if $cfg.enableStickySessions }}
{{ if $cfg.enableStickySessions -}}
sticky hash=sha1 httponly;
{{ else }}
{{ else -}}
least_conn;
{{ end }}
{{ range $server := $upstream.Backends }}server {{ $server.Address }}:{{ $server.Port }};
{{- end }}
{{ range $server := $upstream.Backends }}server {{ $server.Address }}:{{ $server.Port }} max_fails={{ $server.MaxFails }} fail_timeout={{ $server.FailTimeout }};
{{ end }}
}
{{end}}
{{ end }}
{{ range $server := .servers }}
server {
@ -155,15 +155,16 @@ http {
{{/* comment PEM sha is required to detect changes in the generated configuration and force a reload */}}
# PEM sha: {{ $server.SSLPemChecksum }}
ssl_certificate {{ $server.SSLCertificate }};
ssl_certificate_key {{ $server.SSLCertificateKey }};{{ end }}
ssl_certificate_key {{ $server.SSLCertificateKey }};
{{ end }}
{{ if (and $server.SSL $cfg.hsts) }}
{{ if (and $server.SSL $cfg.hsts) -}}
if ($scheme = http) {
return 301 https://$host$request_uri;
}
more_set_headers "Strict-Transport-Security: max-age={{ $cfg.hstsMaxAge }}{{ if $cfg.hstsIncludeSubdomains }}; includeSubDomains{{ end }}; preload";
{{ end }}
{{ end -}}
{{ range $location := $server.Locations }}
location {{ $location.Path }} {
@ -219,13 +220,13 @@ http {
}
location /nginx_status {
{{ if $cfg.enableVtsStatus }}
{{ if $cfg.enableVtsStatus -}}
vhost_traffic_status_display;
vhost_traffic_status_display_format html;
{{ else }}
access_log off;
stub_status on;
{{ end }}
{{- end }}
}
location / {

2
controllers/nginx/nginx/command.go
View file

@ -54,7 +54,7 @@ func (ngx *Manager) Start() {
// shut down, stop accepting new connections and continue to service current requests
// until all such requests are serviced. After that, the old worker processes exit.
// http://nginx.org/en/docs/beginners_guide.html#control
func (ngx *Manager) CheckAndReload(cfg nginxConfiguration, ingressCfg IngressConfig) {
func (ngx *Manager) CheckAndReload(cfg NginxConfiguration, ingressCfg IngressConfig) {
ngx.reloadRateLimiter.Accept()
ngx.reloadLock.Lock()

21
controllers/nginx/nginx/main.go
View file

@ -84,7 +84,8 @@ var (
sslDirectory = "/etc/nginx-ssl"
)
type nginxConfiguration struct {
// NginxConfiguration ...
type NginxConfiguration struct {
// http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
// Sets the maximum allowed size of the client request body
BodySize string `structs:"body-size,omitempty"`
@ -210,6 +211,18 @@ type nginxConfiguration struct {
// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_timeout
SSLSessionTimeout string `structs:"ssl-session-timeout,omitempty"`
// Number of unsuccessful attempts to communicate with the server that should happen in the
// duration set by the fail_timeout parameter to consider the server unavailable
// http://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream
// Default: 0, ie use platform liveness probe
UpstreamMaxFails int `structs:"upstream-max-fails,omitempty"`
// Time during which the specified number of unsuccessful attempts to communicate with
// the server should happen to consider the server unavailable
// http://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream
// Default: 0, ie use platform liveness probe
UpstreamFailTimeout int `structs:"upstream-fail-timeout,omitempty"`
// Enables or disables the use of the PROXY protocol to receive client connection
// (real IP address) information passed through proxy servers and load balancers
// such as HAproxy and Amazon Elastic Load Balancer (ELB).
@ -238,7 +251,7 @@ type nginxConfiguration struct {
type Manager struct {
ConfigFile string
defCfg nginxConfiguration
defCfg NginxConfiguration
defResolver string
@ -254,8 +267,8 @@ type Manager struct {
// defaultConfiguration returns the default configuration contained
// in the file default-conf.json
func newDefaultNginxCfg() nginxConfiguration {
cfg := nginxConfiguration{
func newDefaultNginxCfg() NginxConfiguration {
cfg := NginxConfiguration{
BodySize: bodySize,
ErrorLogLevel: errorLevel,
HSTS: true,

6
controllers/nginx/nginx/nginx.go
View file

@ -41,8 +41,10 @@ func (c UpstreamByNameServers) Less(i, j int) bool {
// UpstreamServer describes a server in an NGINX upstream
type UpstreamServer struct {
Address string
Port string
Address string
Port string
MaxFails int
FailTimeout int
}
// UpstreamServerByAddrPort sorts upstream servers by address and port

2
controllers/nginx/nginx/template.go
View file

@ -48,7 +48,7 @@ func (ngx *Manager) loadTemplate() {
ngx.template = tmpl
}
func (ngx *Manager) writeCfg(cfg nginxConfiguration, ingressCfg IngressConfig) (bool, error) {
func (ngx *Manager) writeCfg(cfg NginxConfiguration, ingressCfg IngressConfig) (bool, error) {
conf := make(map[string]interface{})
conf["upstreams"] = ingressCfg.Upstreams
conf["servers"] = ingressCfg.Servers

6
controllers/nginx/nginx/utils.go
View file

@ -67,7 +67,7 @@ func getDNSServers() []string {
// getConfigKeyToStructKeyMap returns a map with the ConfigMapKey as key and the StructName as value.
func getConfigKeyToStructKeyMap() map[string]string {
keyMap := map[string]string{}
n := &nginxConfiguration{}
n := &NginxConfiguration{}
val := reflect.Indirect(reflect.ValueOf(n))
for i := 0; i < val.Type().NumField(); i++ {
fieldSt := val.Type().Field(i)
@ -79,12 +79,12 @@ func getConfigKeyToStructKeyMap() map[string]string {
}
// ReadConfig obtains the configuration defined by the user merged with the defaults.
func (ngx *Manager) ReadConfig(config *api.ConfigMap) nginxConfiguration {
func (ngx *Manager) ReadConfig(config *api.ConfigMap) NginxConfiguration {
if len(config.Data) == 0 {
return newDefaultNginxCfg()
}
cfgCM := nginxConfiguration{}
cfgCM := NginxConfiguration{}
cfgDefault := newDefaultNginxCfg()
metadata := &mapstructure.Metadata{}

2
controllers/nginx/nginx/utils_test.go
View file

@ -22,7 +22,7 @@ import (
"k8s.io/kubernetes/pkg/api"
)
func getConfigNginxBool(data map[string]string) nginxConfiguration {
func getConfigNginxBool(data map[string]string) NginxConfiguration {
manager := &Manager{}
configMap := &api.ConfigMap{
Data: data,