Merge branch 'main' into allow-any-protocol-cors
This commit is contained in:
Ricardo Katz
GitHub
commit
728e48c1a2
87 changed files with 642 additions and 1823 deletions
21
.github/workflows/ci.yaml
vendored
21
.github/workflows/ci.yaml
vendored
|
|
@ -258,7 +258,7 @@ jobs:
|
|||
|
||||
strategy:
|
||||
matrix:
|
||||
k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
|
||||
k8s: [v1.28.13, v1.29.8, v1.30.4, v1.31.0]
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
|
|
@ -309,26 +309,11 @@ jobs:
|
|||
(needs.changes.outputs.go == 'true') || (needs.changes.outputs.baseimage == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
|
||||
strategy:
|
||||
matrix:
|
||||
k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
|
||||
k8s: [v1.28.13, v1.29.8, v1.30.4, v1.31.0]
|
||||
uses: ./.github/workflows/zz-tmpl-k8s-e2e.yaml
|
||||
with:
|
||||
k8s-version: ${{ matrix.k8s }}
|
||||
|
||||
kubernetes-validations:
|
||||
name: Kubernetes with Validations
|
||||
needs:
|
||||
- changes
|
||||
- build
|
||||
if: |
|
||||
(needs.changes.outputs.go == 'true') || (needs.changes.outputs.baseimage == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
|
||||
strategy:
|
||||
matrix:
|
||||
k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
|
||||
uses: ./.github/workflows/zz-tmpl-k8s-e2e.yaml
|
||||
with:
|
||||
k8s-version: ${{ matrix.k8s }}
|
||||
variation: "VALIDATIONS"
|
||||
|
||||
kubernetes-chroot:
|
||||
name: Kubernetes chroot
|
||||
needs:
|
||||
|
|
@ -338,7 +323,7 @@ jobs:
|
|||
(needs.changes.outputs.go == 'true') || (needs.changes.outputs.baseimage == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
|
||||
strategy:
|
||||
matrix:
|
||||
k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
|
||||
k8s: [v1.28.13, v1.29.8, v1.30.4, v1.31.0]
|
||||
uses: ./.github/workflows/zz-tmpl-k8s-e2e.yaml
|
||||
with:
|
||||
k8s-version: ${{ matrix.k8s }}
|
||||
|
|
|
|||
2
.github/workflows/images.yaml
vendored
2
.github/workflows/images.yaml
vendored
|
|
@ -141,7 +141,7 @@ jobs:
|
|||
(needs.changes.outputs.kube-webhook-certgen == 'true')
|
||||
strategy:
|
||||
matrix:
|
||||
k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
|
||||
k8s: [v1.28.13, v1.29.8, v1.30.4, v1.31.0]
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
|
||||
|
|
|
|||
4
.github/workflows/junit-reports.yaml
vendored
4
.github/workflows/junit-reports.yaml
vendored
|
|
@ -5,6 +5,10 @@ on:
|
|||
workflows: ['CI'] # runs after CI workflow
|
||||
types:
|
||||
- completed
|
||||
|
||||
permissions:
|
||||
checks: write
|
||||
|
||||
jobs:
|
||||
report:
|
||||
runs-on: ubuntu-latest
|
||||
|
|
|
|||
2
.github/workflows/scorecards.yml
vendored
2
.github/workflows/scorecards.yml
vendored
|
|
@ -59,6 +59,6 @@ jobs:
|
|||
|
||||
# Upload the results to GitHub's code scanning dashboard.
|
||||
- name: "Upload to code-scanning"
|
||||
uses: github/codeql-action/upload-sarif@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2
|
||||
uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
|
||||
with:
|
||||
sarif_file: results.sarif
|
||||
|
|
|
|||
2
.github/workflows/vulnerability-scans.yaml
vendored
2
.github/workflows/vulnerability-scans.yaml
vendored
|
|
@ -75,7 +75,7 @@ jobs:
|
|||
|
||||
# This step checks out a copy of your repository.
|
||||
- name: Upload SARIF file
|
||||
uses: github/codeql-action/upload-sarif@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2
|
||||
uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
|
||||
with:
|
||||
token: ${{ github.token }}
|
||||
# Path to SARIF file relative to the root of the repository
|
||||
|
|
|
|||
1
.github/workflows/zz-tmpl-k8s-e2e.yaml
vendored
1
.github/workflows/zz-tmpl-k8s-e2e.yaml
vendored
|
|
@ -43,7 +43,6 @@ jobs:
|
|||
SKIP_CLUSTER_CREATION: true
|
||||
SKIP_INGRESS_IMAGE_CREATION: true
|
||||
SKIP_E2E_IMAGE_CREATION: true
|
||||
ENABLE_VALIDATIONS: ${{ inputs.variation == 'VALIDATIONS' }}
|
||||
IS_CHROOT: ${{ inputs.variation == 'CHROOT' }}
|
||||
run: |
|
||||
kind get kubeconfig > $HOME/.kube/kind-config-kind
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
std = 'ngx_lua'
|
||||
max_line_length = 100
|
||||
exclude_files = {'./rootfs/etc/nginx/lua/test/**/*.lua', './rootfs/etc/nginx/lua/plugins/**/test/**/*.lua'}
|
||||
exclude_files = {'./rootfs/etc/nginx/lua/test/**/*.lua'}
|
||||
files["rootfs/etc/nginx/lua/lua_ingress.lua"] = {
|
||||
ignore = { "122" },
|
||||
-- TODO(elvinefendi) figure out why this does not work
|
||||
|
|
|
|||
|
|
@ -2057,7 +2057,7 @@ _Breaking Changes:_
|
|||
|
||||
```
|
||||
Due to upcoming data privacy regulations, we are making significant changes to how you access free GeoLite2 databases starting December 30, 2019.
|
||||
Learn more on our blog https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases/
|
||||
Learn more on our blog https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geolite2-databases/
|
||||
```
|
||||
|
||||
Because of this change, it is not clear we can provide the databases directly from the docker image.
|
||||
|
|
|
|||
|
|
@ -44,7 +44,7 @@ function cleanup {
|
|||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20240812-3f0129aa@sha256:95c2aaf2a66e8cbbf7a7453046f3b024383c273a0988efab841cd96116afd1a9}
|
||||
E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20240829-2c421762@sha256:5b7809bfe9cbd9cd6bcb8033ca27576ca704f05ce729fe4dcb574810f7a25785}
|
||||
|
||||
if [[ "$RUNTIME" == podman ]]; then
|
||||
# Podman does not support both tag and digest
|
||||
|
|
@ -82,7 +82,7 @@ if [[ "$DOCKER_IN_DOCKER_ENABLED" == "true" ]]; then
|
|||
echo "..reached DIND check TRUE block, inside run-in-docker.sh"
|
||||
echo "FLAGS=$FLAGS"
|
||||
#go env
|
||||
go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo@v2.20.0
|
||||
go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo@v2.20.2
|
||||
find / -type f -name ginkgo 2>/dev/null
|
||||
which ginkgo
|
||||
/bin/bash -c "${FLAGS}"
|
||||
|
|
|
|||
|
|
@ -304,7 +304,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
|||
| controller.dnsPolicy | string | `"ClusterFirst"` | Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. |
|
||||
| controller.electionID | string | `""` | Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' |
|
||||
| controller.electionTTL | string | `""` | Duration a leader election is valid before it's getting re-elected, e.g. `15s`, `10m` or `1h`. (Default: 30s) |
|
||||
| controller.enableAnnotationValidations | bool | `false` | |
|
||||
| controller.enableAnnotationValidations | bool | `true` | |
|
||||
| controller.enableMimalloc | bool | `true` | Enable mimalloc as a drop-in replacement for malloc. # ref: https://github.com/microsoft/mimalloc # |
|
||||
| controller.enableTopologyAwareRouting | bool | `false` | This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto" Defaults to false |
|
||||
| controller.existingPsp | string | `""` | Use an existing PSP instead of creating one |
|
||||
|
|
@ -367,11 +367,12 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
|||
| controller.livenessProbe.periodSeconds | int | `10` | |
|
||||
| controller.livenessProbe.successThreshold | int | `1` | |
|
||||
| controller.livenessProbe.timeoutSeconds | int | `1` | |
|
||||
| controller.maxmindLicenseKey | string | `""` | Maxmind license key to download GeoLite2 Databases. # https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases |
|
||||
| controller.maxmindLicenseKey | string | `""` | Maxmind license key to download GeoLite2 Databases. # https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geolite2-databases/ |
|
||||
| controller.metrics.enabled | bool | `false` | |
|
||||
| controller.metrics.port | int | `10254` | |
|
||||
| controller.metrics.portName | string | `"metrics"` | |
|
||||
| controller.metrics.prometheusRule.additionalLabels | object | `{}` | |
|
||||
| controller.metrics.prometheusRule.annotations | object | `{}` | Annotations to be added to the PrometheusRule. |
|
||||
| controller.metrics.prometheusRule.enabled | bool | `false` | |
|
||||
| controller.metrics.prometheusRule.rules | list | `[]` | |
|
||||
| controller.metrics.service.annotations | object | `{}` | |
|
||||
|
|
@ -381,7 +382,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
|||
| controller.metrics.service.servicePort | int | `10254` | |
|
||||
| controller.metrics.service.type | string | `"ClusterIP"` | |
|
||||
| controller.metrics.serviceMonitor.additionalLabels | object | `{}` | |
|
||||
| controller.metrics.serviceMonitor.annotations | object | `{}` | |
|
||||
| controller.metrics.serviceMonitor.annotations | object | `{}` | Annotations to be added to the ServiceMonitor. |
|
||||
| controller.metrics.serviceMonitor.enabled | bool | `false` | |
|
||||
| controller.metrics.serviceMonitor.metricRelabelings | list | `[]` | |
|
||||
| controller.metrics.serviceMonitor.namespace | string | `""` | |
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{{- define "ingress-nginx.params" -}}
|
||||
- /nginx-ingress-controller
|
||||
{{- if .Values.controller.enableAnnotationValidations }}
|
||||
- --enable-annotation-validation=true
|
||||
{{- if not .Values.controller.enableAnnotationValidations }}
|
||||
- --enable-annotation-validation=false
|
||||
{{- end }}
|
||||
{{- if .Values.defaultBackend.enabled }}
|
||||
- --default-backend-service=$(POD_NAMESPACE)/{{ include "ingress-nginx.defaultBackend.fullname" . }}
|
||||
|
|
|
|||
|
|
@ -13,7 +13,9 @@ metadata:
|
|||
name: {{ include "ingress-nginx.controller.fullname" . }}
|
||||
namespace: {{ include "ingress-nginx.namespace" . }}
|
||||
data:
|
||||
allow-snippet-annotations: "{{ .Values.controller.allowSnippetAnnotations }}"
|
||||
{{- if .Values.controller.allowSnippetAnnotations }}
|
||||
allow-snippet-annotations: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.controller.addHeaders }}
|
||||
add-headers: {{ include "ingress-nginx.namespace" . }}/{{ include "ingress-nginx.fullname" . }}-custom-add-headers
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -14,6 +14,9 @@ metadata:
|
|||
{{- if .Values.controller.metrics.prometheusRule.additionalLabels }}
|
||||
{{- toYaml .Values.controller.metrics.prometheusRule.additionalLabels | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.metrics.prometheusRule.annotations }}
|
||||
annotations: {{ toYaml .Values.controller.metrics.prometheusRule.annotations | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.controller.metrics.prometheusRule.rules }}
|
||||
groups:
|
||||
|
|
@ -16,16 +16,16 @@ tests:
|
|||
- it: should create a ConfigMap with templated values if `controller.config` contains templates
|
||||
set:
|
||||
controller.config:
|
||||
global-rate-limit-memcached-host: "memcached.{{ .Release.Namespace }}.svc.kubernetes.local"
|
||||
global-rate-limit-memcached-port: 11211
|
||||
use-gzip: true
|
||||
template: "test.{{ .Release.Namespace }}.svc.kubernetes.local"
|
||||
integer: 12345
|
||||
boolean: true
|
||||
asserts:
|
||||
- equal:
|
||||
path: data.global-rate-limit-memcached-host
|
||||
value: memcached.NAMESPACE.svc.kubernetes.local
|
||||
path: data.template
|
||||
value: test.NAMESPACE.svc.kubernetes.local
|
||||
- equal:
|
||||
path: data.global-rate-limit-memcached-port
|
||||
value: "11211"
|
||||
path: data.integer
|
||||
value: "12345"
|
||||
- equal:
|
||||
path: data.use-gzip
|
||||
path: data.boolean
|
||||
value: "true"
|
||||
|
|
|
|||
|
|
@ -0,0 +1,29 @@
|
|||
suite: Controller > PrometheusRule
|
||||
templates:
|
||||
- controller-prometheusrule.yaml
|
||||
|
||||
tests:
|
||||
- it: should create a PrometheusRule if `controller.metrics.prometheusRule.enabled` is true
|
||||
set:
|
||||
controller.metrics.enabled: true
|
||||
controller.metrics.prometheusRule.enabled: true
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- isKind:
|
||||
of: PrometheusRule
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-ingress-nginx-controller
|
||||
|
||||
- it: should create a PrometheusRule with annotations if `controller.metrics.prometheusRule.annotations` is set
|
||||
set:
|
||||
controller.metrics.enabled: true
|
||||
controller.metrics.prometheusRule.enabled: true
|
||||
controller.metrics.prometheusRule.annotations:
|
||||
my-little-annotation: test-value
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.annotations
|
||||
value:
|
||||
my-little-annotation: test-value
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
suite: Controller > ServiceMonitor
|
||||
templates:
|
||||
- controller-servicemonitor.yaml
|
||||
|
||||
tests:
|
||||
- it: should create a ServiceMonitor if `controller.metrics.serviceMonitor.enabled` is true
|
||||
set:
|
||||
controller.metrics.enabled: true
|
||||
controller.metrics.serviceMonitor.enabled: true
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- isKind:
|
||||
of: ServiceMonitor
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-ingress-nginx-controller
|
||||
|
||||
- it: should create a ServiceMonitor with annotations if `controller.metrics.serviceMonitor.annotations` is set
|
||||
set:
|
||||
controller.metrics.enabled: true
|
||||
controller.metrics.serviceMonitor.enabled: true
|
||||
controller.metrics.serviceMonitor.annotations:
|
||||
my-little-annotation: test-value
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.annotations
|
||||
value:
|
||||
my-little-annotation: test-value
|
||||
|
|
@ -17,7 +17,7 @@ commonLabels: {}
|
|||
|
||||
controller:
|
||||
name: controller
|
||||
enableAnnotationValidations: false
|
||||
enableAnnotationValidations: true
|
||||
image:
|
||||
## Keep false as default for now!
|
||||
chroot: false
|
||||
|
|
@ -198,7 +198,7 @@ controller:
|
|||
# -- Annotations to be added to the udp config configmap
|
||||
annotations: {}
|
||||
# -- Maxmind license key to download GeoLite2 Databases.
|
||||
## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases
|
||||
## https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geolite2-databases/
|
||||
maxmindLicenseKey: ""
|
||||
# -- Additional command line arguments to pass to Ingress-Nginx Controller
|
||||
# E.g. to specify the default SSL certificate you can use
|
||||
|
|
@ -881,6 +881,7 @@ controller:
|
|||
serviceMonitor:
|
||||
enabled: false
|
||||
additionalLabels: {}
|
||||
# -- Annotations to be added to the ServiceMonitor.
|
||||
annotations: {}
|
||||
## The label to use to retrieve the job name from.
|
||||
## jobLabel: "app.kubernetes.io/name"
|
||||
|
|
@ -898,6 +899,8 @@ controller:
|
|||
prometheusRule:
|
||||
enabled: false
|
||||
additionalLabels: {}
|
||||
# -- Annotations to be added to the PrometheusRule.
|
||||
annotations: {}
|
||||
# namespace: ""
|
||||
rules: []
|
||||
# # These are just examples rules, please adapt them to your needs
|
||||
|
|
|
|||
|
|
@ -66,7 +66,7 @@ func main() {
|
|||
mc := metric.NewDummyCollector()
|
||||
if conf.EnableMetrics {
|
||||
// TODO: Ingress class is not a part of dataplane anymore
|
||||
mc, err = metric.NewCollector(conf.MetricsPerHost, conf.ReportStatusClasses, reg, conf.IngressClassConfiguration.Controller, *conf.MetricsBuckets, conf.ExcludeSocketMetrics)
|
||||
mc, err = metric.NewCollector(conf.MetricsPerHost, conf.MetricsPerUndefinedHost, conf.ReportStatusClasses, reg, conf.IngressClassConfiguration.Controller, *conf.MetricsBuckets, conf.MetricsBucketFactor, conf.MetricsMaxBuckets, conf.ExcludeSocketMetrics)
|
||||
if err != nil {
|
||||
klog.Fatalf("Error creating prometheus collector: %v", err)
|
||||
}
|
||||
|
|
|
|||
|
|
@ -130,7 +130,7 @@ func main() {
|
|||
|
||||
mc := metric.NewDummyCollector()
|
||||
if conf.EnableMetrics {
|
||||
mc, err = metric.NewCollector(conf.MetricsPerHost, conf.ReportStatusClasses, reg, conf.IngressClassConfiguration.Controller, *conf.MetricsBuckets, conf.ExcludeSocketMetrics)
|
||||
mc, err = metric.NewCollector(conf.MetricsPerHost, conf.MetricsPerUndefinedHost, conf.ReportStatusClasses, reg, conf.IngressClassConfiguration.Controller, *conf.MetricsBuckets, conf.MetricsBucketFactor, conf.MetricsMaxBuckets, conf.ExcludeSocketMetrics)
|
||||
if err != nil {
|
||||
klog.Fatalf("Error creating prometheus collector: %v", err)
|
||||
}
|
||||
|
|
|
|||
|
|
@ -893,104 +893,6 @@
|
|||
],
|
||||
"title": "Average Response Size by Method and Path",
|
||||
"type": "timeseries"
|
||||
},
|
||||
{
|
||||
"datasource": {
|
||||
"type": "prometheus",
|
||||
"uid": "${DS_PROMETHEUS}"
|
||||
},
|
||||
"fieldConfig": {
|
||||
"defaults": {
|
||||
"color": {
|
||||
"mode": "palette-classic"
|
||||
},
|
||||
"custom": {
|
||||
"axisBorderShow": false,
|
||||
"axisCenteredZero": false,
|
||||
"axisColorMode": "text",
|
||||
"axisLabel": "",
|
||||
"axisPlacement": "auto",
|
||||
"barAlignment": 0,
|
||||
"drawStyle": "line",
|
||||
"fillOpacity": 10,
|
||||
"gradientMode": "none",
|
||||
"hideFrom": {
|
||||
"legend": false,
|
||||
"tooltip": false,
|
||||
"viz": false
|
||||
},
|
||||
"insertNulls": false,
|
||||
"lineInterpolation": "linear",
|
||||
"lineWidth": 1,
|
||||
"pointSize": 5,
|
||||
"scaleDistribution": {
|
||||
"type": "linear"
|
||||
},
|
||||
"showPoints": "never",
|
||||
"spanNulls": false,
|
||||
"stacking": {
|
||||
"group": "A",
|
||||
"mode": "none"
|
||||
},
|
||||
"thresholdsStyle": {
|
||||
"mode": "off"
|
||||
}
|
||||
},
|
||||
"links": [],
|
||||
"mappings": [],
|
||||
"thresholds": {
|
||||
"mode": "absolute",
|
||||
"steps": [
|
||||
{
|
||||
"color": "green"
|
||||
},
|
||||
{
|
||||
"color": "red",
|
||||
"value": 80
|
||||
}
|
||||
]
|
||||
},
|
||||
"unit": "s"
|
||||
},
|
||||
"overrides": []
|
||||
},
|
||||
"gridPos": {
|
||||
"h": 8,
|
||||
"w": 12,
|
||||
"x": 0,
|
||||
"y": 32
|
||||
},
|
||||
"id": 96,
|
||||
"options": {
|
||||
"legend": {
|
||||
"calcs": [],
|
||||
"displayMode": "list",
|
||||
"placement": "bottom",
|
||||
"showLegend": true
|
||||
},
|
||||
"tooltip": {
|
||||
"mode": "multi",
|
||||
"sort": "desc"
|
||||
}
|
||||
},
|
||||
"pluginVersion": "10.4.3",
|
||||
"targets": [
|
||||
{
|
||||
"datasource": {
|
||||
"type": "prometheus",
|
||||
"uid": "${DS_PROMETHEUS}"
|
||||
},
|
||||
"expr": "sum (\n rate(\n nginx_ingress_controller_ingress_upstream_latency_seconds_sum {\n ingress =~ \"$ingress\",\n }[5m]\n)) / sum (\n rate(\n nginx_ingress_controller_ingress_upstream_latency_seconds_count {\n ingress =~ \"$ingress\",\n }[5m]\n )\n)\n",
|
||||
"hide": false,
|
||||
"instant": false,
|
||||
"interval": "",
|
||||
"intervalFactor": 1,
|
||||
"legendFormat": "average",
|
||||
"refId": "B"
|
||||
}
|
||||
],
|
||||
"title": "Upstream Service Latency",
|
||||
"type": "timeseries"
|
||||
}
|
||||
],
|
||||
"refresh": "30s",
|
||||
|
|
|
|||
|
|
@ -7,7 +7,6 @@ Do not try to edit it manually.
|
|||
|
||||
|
||||
### [[Admission] admission controller](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L39)
|
||||
- [reject ingress with global-rate-limit annotations when memcached is not configured](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L47)
|
||||
- [should not allow overlaps of host and paths without canary annotations](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L74)
|
||||
- [should allow overlaps of host and paths with canary annotation](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L91)
|
||||
- [should block ingress with invalid path](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L112)
|
||||
|
|
@ -173,8 +172,6 @@ Do not try to edit it manually.
|
|||
### [from-to-www-redirect](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/fromtowwwredirect.go#L31)
|
||||
- [should redirect from www HTTP to HTTP](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/fromtowwwredirect.go#L38)
|
||||
- [should redirect from www HTTPS to HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/fromtowwwredirect.go#L64)
|
||||
### [annotation-global-rate-limit](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/globalratelimit.go#L30)
|
||||
- [generates correct configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/globalratelimit.go#L38)
|
||||
### [backend-protocol - GRPC](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/grpc.go#L45)
|
||||
- [should use grpc_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/grpc.go#L48)
|
||||
- [should return OK for service with backend protocol GRPC](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/grpc.go#L71)
|
||||
|
|
@ -420,8 +417,6 @@ Do not try to edit it manually.
|
|||
### [global-options](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_options.go#L28)
|
||||
- [should have worker_rlimit_nofile option](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_options.go#L31)
|
||||
- [should have worker_rlimit_nofile option and be independent on amount of worker processes](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_options.go#L37)
|
||||
### [settings-global-rate-limit](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/globalratelimit.go#L30)
|
||||
- [generates correct NGINX configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/globalratelimit.go#L38)
|
||||
### [GRPC](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/grpc.go#L39)
|
||||
- [should set the correct GRPC Buffer Size](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/grpc.go#L42)
|
||||
### [gzip](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/gzip.go#L30)
|
||||
|
|
@ -500,8 +495,6 @@ Do not try to edit it manually.
|
|||
- [should include opentelemetry_trust_incoming_spans on directive when enabled](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentelemetry.go#L76)
|
||||
- [should not exists opentelemetry_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentelemetry.go#L91)
|
||||
- [should exists opentelemetry_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentelemetry.go#L106)
|
||||
### [plugins](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/plugins.go#L28)
|
||||
- [should exist a x-hello-world header](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/plugins.go#L35)
|
||||
### [proxy-connect-timeout](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_connect_timeout.go#L29)
|
||||
- [should set valid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_connect_timeout.go#L37)
|
||||
- [should not set invalid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_connect_timeout.go#L53)
|
||||
|
|
|
|||
|
|
@ -8,6 +8,7 @@ They are set in the container spec of the `ingress-nginx-controller` Deployment
|
|||
|----------|-------------|
|
||||
| `--annotations-prefix` | Prefix of the Ingress annotations specific to the NGINX controller. (default "nginx.ingress.kubernetes.io") |
|
||||
| `--apiserver-host` | Address of the Kubernetes API server. Takes the form "protocol://address:port". If not specified, it is assumed the program runs inside a Kubernetes cluster and local discovery is attempted. |
|
||||
| `--bucket-factor` | Bucket factor for native histograms. Value must be > 1 for enabling native histograms. (default 0) |
|
||||
| `--certificate-authority` | Path to a cert file for the certificate authority. This certificate is used only when the flag --apiserver-host is specified. |
|
||||
| `--configmap` | Name of the ConfigMap containing custom global configurations for the controller. |
|
||||
| `--controller-class` | Ingress Class Controller value this Ingress satisfies. The class of an Ingress object is set using the field IngressClassName in Kubernetes clusters version v1.19.0 or higher. The .spec.controller value of the IngressClass referenced in an Ingress Object should be the same value specified here to make this object be watched. |
|
||||
|
|
@ -15,7 +16,7 @@ They are set in the container spec of the `ingress-nginx-controller` Deployment
|
|||
| `--default-backend-service` | Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form "namespace/name". The controller configures NGINX to forward requests to the first port of this Service. |
|
||||
| `--default-server-port` | Port to use for exposing the default server (catch-all). (default 8181) |
|
||||
| `--default-ssl-certificate` | Secret containing a SSL certificate to be used by the default HTTPS server (catch-all). Takes the form "namespace/name". |
|
||||
| `--enable-annotation-validation` | If true, will enable the annotation validation feature. This value will be defaulted to true on a future release. |
|
||||
| `--enable-annotation-validation` | If true, will enable the annotation validation feature. Defaults to true |
|
||||
| `--disable-catch-all` | Disable support for catch-all Ingresses. (default false) |
|
||||
| `--disable-full-test` | Disable full test of all merged ingresses at the admission stage and tests the template of the ingress being created or updated (full test of all ingresses is enabled by default). |
|
||||
| `--disable-svc-external-name` | Disable support for Services of type ExternalName. (default false) |
|
||||
|
|
@ -40,12 +41,14 @@ They are set in the container spec of the `ingress-nginx-controller` Deployment
|
|||
| `--internal-logger-address` | Address to be used when binding internal syslogger. (default 127.0.0.1:11514) |
|
||||
| `--kubeconfig` | Path to a kubeconfig file containing authorization and API server information. |
|
||||
| `--length-buckets` | Set of buckets which will be used for prometheus histogram metrics such as RequestLength, ResponseLength. (default `[10, 20, 30, 40, 50, 60, 70, 80, 90, 100]`) |
|
||||
| `--max-buckets` | Maximum number of buckets for native histograms. (default 100) |
|
||||
| `--maxmind-edition-ids` | Maxmind edition ids to download GeoLite2 Databases. (default "GeoLite2-City,GeoLite2-ASN") |
|
||||
| `--maxmind-retries-timeout` | Maxmind downloading delay between 1st and 2nd attempt, 0s - do not retry to download if something went wrong. (default 0s) |
|
||||
| `--maxmind-retries-count` | Number of attempts to download the GeoIP DB. (default 1) |
|
||||
| `--maxmind-license-key` | Maxmind license key to download GeoLite2 Databases. https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases . |
|
||||
| `--maxmind-license-key` | Maxmind license key to download GeoLite2 Databases. https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geolite2-databases/ . |
|
||||
| `--maxmind-mirror` | Maxmind mirror url (example: http://geoip.local/databases. |
|
||||
| `--metrics-per-host` | Export metrics per-host. (default true) |
|
||||
| `--metrics-per-undefined-host` | Export metrics per-host even if the host is not defined in an ingress. Requires --metrics-per-host to be set to true. (default false) |
|
||||
| `--monitor-max-batch-size` | Max batch size of NGINX metrics. (default 10000)|
|
||||
| `--post-shutdown-grace-period` | Additional delay in seconds before controller container exits. (default 10) |
|
||||
| `--profiler-port` | Port to use for expose the ingress controller Go profiler when it is enabled. (default 10245) |
|
||||
|
|
|
|||
|
|
@ -166,7 +166,9 @@ According to the above example, this URL will be http://10.192.0.3:31086
|
|||
|
||||
#### Wildcard ingresses
|
||||
|
||||
- By default request metrics are labeled with the hostname. When you have a wildcard domain ingress, then there will be no metrics for that ingress (to prevent the metrics from exploding in cardinality). To get metrics in this case you need to run the ingress controller with `--metrics-per-host=false` (you will lose labeling by hostname, but still have labeling by ingress).
|
||||
- By default request metrics are labeled with the hostname. When you have a wildcard domain ingress, then there will be no metrics for that ingress (to prevent the metrics from exploding in cardinality). To get metrics in this case you have two options:
|
||||
- Run the ingress controller with `--metrics-per-host=false`. You will lose labeling by hostname, but still have labeling by ingress.
|
||||
- Run the ingress controller with `--metrics-per-undefined-host=true --metrics-per-host=true`. You will get labeling by hostname even if the hostname is not explicitly defined on an ingress. Be warned that cardinality could explode due to many hostnames.
|
||||
|
||||
### Grafana dashboard using ingress resource
|
||||
- If you want to expose the dashboard for grafana using an ingress resource, then you can :
|
||||
|
|
|
|||
|
|
@ -55,10 +55,6 @@
|
|||
| ExternalAuth | auth-url | High | location |
|
||||
| FastCGI | fastcgi-index | Medium | location |
|
||||
| FastCGI | fastcgi-params-configmap | Medium | location |
|
||||
| GlobalRateLimit | global-rate-limit | Low | ingress |
|
||||
| GlobalRateLimit | global-rate-limit-ignored-cidrs | Medium | ingress |
|
||||
| GlobalRateLimit | global-rate-limit-key | High | ingress |
|
||||
| GlobalRateLimit | global-rate-limit-window | Low | ingress |
|
||||
| HTTP2PushPreload | http2-push-preload | Low | location |
|
||||
| LoadBalancing | load-balance | Low | location |
|
||||
| Logs | enable-access-log | Low | location |
|
||||
|
|
@ -108,6 +104,7 @@
|
|||
| Redirect | permanent-redirect | Medium | location |
|
||||
| Redirect | permanent-redirect-code | Low | location |
|
||||
| Redirect | temporal-redirect | Medium | location |
|
||||
| Redirect | temporal-redirect-code | Low | location |
|
||||
| Rewrite | app-root | Medium | location |
|
||||
| Rewrite | force-ssl-redirect | Medium | location |
|
||||
| Rewrite | preserve-trailing-slash | Medium | location |
|
||||
|
|
|
|||
|
|
@ -64,13 +64,10 @@ You can add these Kubernetes annotations to specific Ingress objects to customiz
|
|||
|[nginx.ingress.kubernetes.io/http2-push-preload](#http2-push-preload)|"true" or "false"|
|
||||
|[nginx.ingress.kubernetes.io/limit-connections](#rate-limiting)|number|
|
||||
|[nginx.ingress.kubernetes.io/limit-rps](#rate-limiting)|number|
|
||||
|[nginx.ingress.kubernetes.io/global-rate-limit](#global-rate-limiting)|number|
|
||||
|[nginx.ingress.kubernetes.io/global-rate-limit-window](#global-rate-limiting)|duration|
|
||||
|[nginx.ingress.kubernetes.io/global-rate-limit-key](#global-rate-limiting)|string|
|
||||
|[nginx.ingress.kubernetes.io/global-rate-limit-ignored-cidrs](#global-rate-limiting)|string|
|
||||
|[nginx.ingress.kubernetes.io/permanent-redirect](#permanent-redirect)|string|
|
||||
|[nginx.ingress.kubernetes.io/permanent-redirect-code](#permanent-redirect-code)|number|
|
||||
|[nginx.ingress.kubernetes.io/temporal-redirect](#temporal-redirect)|string|
|
||||
|[nginx.ingress.kubernetes.io/temporal-redirect-code](#temporal-redirect-code)|number|
|
||||
|[nginx.ingress.kubernetes.io/preserve-trailing-slash](#server-side-https-enforcement-through-redirect)|"true" or "false"|
|
||||
|[nginx.ingress.kubernetes.io/proxy-body-size](#custom-max-body-size)|string|
|
||||
|[nginx.ingress.kubernetes.io/proxy-cookie-domain](#proxy-cookie-domain)|string|
|
||||
|
|
@ -559,46 +556,6 @@ To configure settings globally for all Ingress rules, the `limit-rate-after` and
|
|||
|
||||
The client IP address will be set based on the use of [PROXY protocol](./configmap.md#use-proxy-protocol) or from the `X-Forwarded-For` header value when [use-forwarded-headers](./configmap.md#use-forwarded-headers) is enabled.
|
||||
|
||||
### Global Rate Limiting
|
||||
|
||||
**Note:** Be careful when configuring both (Local) Rate Limiting and Global Rate Limiting at the same time.
|
||||
They are two completely different rate limiting implementations. Whichever limit exceeds first will reject the
|
||||
requests. It might be a good idea to configure both of them to ease load on Global Rate Limiting backend
|
||||
in cases of spike in traffic.
|
||||
|
||||
The stock NGINX rate limiting does not share its counters among different NGINX instances.
|
||||
Given that most ingress-nginx deployments are elastic and number of replicas can change any day
|
||||
it is impossible to configure a proper rate limit using stock NGINX functionalities.
|
||||
Global Rate Limiting overcome this by using [lua-resty-global-throttle](https://github.com/ElvinEfendi/lua-resty-global-throttle). `lua-resty-global-throttle` shares its counters via a central store such as `memcached`.
|
||||
The obvious shortcoming of this is users have to deploy and operate a `memcached` instance
|
||||
in order to benefit from this functionality. Configure the `memcached`
|
||||
using [these configmap settings](./configmap.md#global-rate-limit).
|
||||
|
||||
**Here are a few remarks for ingress-nginx integration of `lua-resty-global-throttle`:**
|
||||
|
||||
1. We minimize `memcached` access by caching exceeding limit decisions. The expiry of
|
||||
cache entry is the desired delay `lua-resty-global-throttle` calculates for us.
|
||||
The Lua Shared Dictionary used for that is `global_throttle_cache`. Currently its size defaults to 10M.
|
||||
Customize it as per your needs using [lua-shared-dicts](./configmap.md#lua-shared-dicts).
|
||||
When we fail to cache the exceeding limit decision then we log an NGINX error. You can monitor
|
||||
for that error to decide if you need to bump the cache size. Without cache the cost of processing a
|
||||
request is two memcached commands: `GET`, and `INCR`. With the cache it is only `INCR`.
|
||||
1. Log NGINX variable `$global_rate_limit_exceeding`'s value to have some visibility into
|
||||
what portion of requests are rejected (value `y`), whether they are rejected using cached decision (value `c`),
|
||||
or if they are not rejected (default value `n`). You can use [log-format-upstream](./configmap.md#log-format-upstream)
|
||||
to include that in access logs.
|
||||
1. In case of an error it will log the error message and **fail open**.
|
||||
1. The annotations below creates Global Rate Limiting instance per ingress.
|
||||
That means if there are multiple paths configured under the same ingress,
|
||||
the Global Rate Limiting will count requests to all the paths under the same counter.
|
||||
Extract a path out into its own ingress if you need to isolate a certain path.
|
||||
|
||||
|
||||
* `nginx.ingress.kubernetes.io/global-rate-limit`: Configures maximum allowed number of requests per window. Required.
|
||||
* `nginx.ingress.kubernetes.io/global-rate-limit-window`: Configures a time window (i.e `1m`) that the limit is applied. Required.
|
||||
* `nginx.ingress.kubernetes.io/global-rate-limit-key`: Configures a key for counting the samples. Defaults to `$remote_addr`. You can also combine multiple NGINX variables here, like `${remote_addr}-${http_x_api_client}` which would mean the limit will be applied to requests coming from the same API client (indicated by `X-API-Client` HTTP request header) with the same source IP address.
|
||||
* `nginx.ingress.kubernetes.io/global-rate-limit-ignored-cidrs`: comma separated list of IPs and CIDRs to match client IP against. When there's a match request is not considered for rate limiting.
|
||||
|
||||
### Permanent Redirect
|
||||
|
||||
This annotation allows to return a permanent redirect (Return Code 301) instead of sending data to the upstream. For example `nginx.ingress.kubernetes.io/permanent-redirect: https://www.google.com` would redirect everything to Google.
|
||||
|
|
@ -610,6 +567,10 @@ This annotation allows you to modify the status code used for permanent redirect
|
|||
### Temporal Redirect
|
||||
This annotation allows you to return a temporal redirect (Return Code 302) instead of sending data to the upstream. For example `nginx.ingress.kubernetes.io/temporal-redirect: https://www.google.com` would redirect everything to Google with a Return Code of 302 (Moved Temporarily)
|
||||
|
||||
### Temporal Redirect Code
|
||||
|
||||
This annotation allows you to modify the status code used for temporal redirects. For example `nginx.ingress.kubernetes.io/temporal-redirect-code: '307'` would return your temporal-redirect with a 307.
|
||||
|
||||
### SSL Passthrough
|
||||
|
||||
The annotation `nginx.ingress.kubernetes.io/ssl-passthrough` instructs the controller to send TLS connections directly
|
||||
|
|
|
|||
|
|
@ -29,9 +29,9 @@ The following table shows a configuration option's name, type, and the default v
|
|||
|:--------------------------------------------------------------------------------|:-------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------------------------------------------|
|
||||
| [add-headers](#add-headers) | string | "" | |
|
||||
| [allow-backend-server-header](#allow-backend-server-header) | bool | "false" | |
|
||||
| [allow-cross-namespace-resources](#allow-cross-namespace-resources) | bool | "true" | |
|
||||
| [allow-cross-namespace-resources](#allow-cross-namespace-resources) | bool | "false" | |
|
||||
| [allow-snippet-annotations](#allow-snippet-annotations) | bool | "false" | |
|
||||
| [annotations-risk-level](#annotations-risk-level) | string | Critical | |
|
||||
| [annotations-risk-level](#annotations-risk-level) | string | High | |
|
||||
| [annotation-value-word-blocklist](#annotation-value-word-blocklist) | string array | "" | |
|
||||
| [hide-headers](#hide-headers) | string array | empty | |
|
||||
| [access-log-params](#access-log-params) | string | "" | |
|
||||
|
|
@ -218,16 +218,10 @@ The following table shows a configuration option's name, type, and the default v
|
|||
| [block-referers](#block-referers) | []string | "" | |
|
||||
| [proxy-ssl-location-only](#proxy-ssl-location-only) | bool | "false" | |
|
||||
| [default-type](#default-type) | string | "text/html" | |
|
||||
| [global-rate-limit-memcached-host](#global-rate-limit) | string | "" | |
|
||||
| [global-rate-limit-memcached-port](#global-rate-limit) | int | 11211 | |
|
||||
| [global-rate-limit-memcached-connect-timeout](#global-rate-limit) | int | 50 | |
|
||||
| [global-rate-limit-memcached-max-idle-timeout](#global-rate-limit) | int | 10000 | |
|
||||
| [global-rate-limit-memcached-pool-size](#global-rate-limit) | int | 50 | |
|
||||
| [global-rate-limit-status-code](#global-rate-limit) | int | 429 | |
|
||||
| [service-upstream](#service-upstream) | bool | "false" | |
|
||||
| [ssl-reject-handshake](#ssl-reject-handshake) | bool | "false" | |
|
||||
| [debug-connections](#debug-connections) | []string | "127.0.0.1,1.1.1.1/24" | |
|
||||
| [strict-validate-path-type](#strict-validate-path-type) | bool | "false" (v1.7.x) | |
|
||||
| [strict-validate-path-type](#strict-validate-path-type) | bool | "true" | |
|
||||
| [grpc-buffer-size-kb](#grpc-buffer-size-kb) | int | 0 | |
|
||||
|
||||
## add-headers
|
||||
|
|
@ -240,18 +234,16 @@ Enables the return of the header Server from the backend instead of the generic
|
|||
|
||||
## allow-cross-namespace-resources
|
||||
|
||||
Enables users to consume cross namespace resource on annotations, when was previously enabled . _**default:**_ true
|
||||
Enables users to consume cross namespace resource on annotations, when was previously enabled . _**default:**_ false
|
||||
|
||||
**Annotations that may be impacted with this change**:
|
||||
|
||||
* `auth-secret`
|
||||
* `auth-proxy-set-header`
|
||||
* `auth-tls-secret`
|
||||
* `fastcgi-params-configmap`
|
||||
* `proxy-ssl-secret`
|
||||
|
||||
|
||||
**This option will be defaulted to false in the next major release**
|
||||
|
||||
## allow-snippet-annotations
|
||||
|
||||
Enables Ingress to parse and add *-snippet annotations/directives created by the user. _**default:**_ `false`
|
||||
|
|
@ -259,15 +251,13 @@ Enables Ingress to parse and add *-snippet annotations/directives created by the
|
|||
Warning: We recommend enabling this option only if you TRUST users with permission to create Ingress objects, as this
|
||||
may allow a user to add restricted configurations to the final nginx.conf file
|
||||
|
||||
**This option will be defaulted to false in the next major release**
|
||||
|
||||
## annotations-risk-level
|
||||
|
||||
Represents the risk accepted on an annotation. If the risk is, for instance `Medium`, annotations with risk High and Critical will not be accepted.
|
||||
|
||||
Accepted values are `Critical`, `High`, `Medium` and `Low`.
|
||||
|
||||
Defaults to `Critical` but will be changed to `High` on the next minor release
|
||||
_**default:**_ `High`
|
||||
|
||||
## annotation-value-word-blocklist
|
||||
|
||||
|
|
@ -720,7 +710,7 @@ _**default:**_ true
|
|||
## use-geoip2
|
||||
|
||||
Enables the [geoip2 module](https://github.com/leev/ngx_http_geoip2_module) for NGINX.
|
||||
Since `0.27.0` and due to a [change in the MaxMind databases](https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases) a license is required to have access to the databases.
|
||||
Since `0.27.0` and due to a [change in the MaxMind databases](https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geolite2-databases/) a license is required to have access to the databases.
|
||||
For this reason, it is required to define a new flag `--maxmind-license-key` in the ingress controller deployment to download the databases needed during the initialization of the ingress controller.
|
||||
Alternatively, it is possible to use a volume to mount the files `/etc/ingress-controller/geoip/GeoLite2-City.mmdb` and `/etc/ingress-controller/geoip/GeoLite2-ASN.mmdb`, avoiding the overhead of the download.
|
||||
|
||||
|
|
@ -1349,22 +1339,6 @@ _**default:**_ text/html
|
|||
_References:_
|
||||
[https://nginx.org/en/docs/http/ngx_http_core_module.html#default_type](https://nginx.org/en/docs/http/ngx_http_core_module.html#default_type)
|
||||
|
||||
## global-rate-limit
|
||||
|
||||
* `global-rate-limit-status-code`: configure HTTP status code to return when rejecting requests. Defaults to 429.
|
||||
|
||||
Configure `memcached` client for [Global Rate Limiting](https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md#global-rate-limiting).
|
||||
|
||||
* `global-rate-limit-memcached-host`: IP/FQDN of memcached server to use. Required to enable Global Rate Limiting.
|
||||
* `global-rate-limit-memcached-port`: port of memcached server to use. Defaults default memcached port of `11211`.
|
||||
* `global-rate-limit-memcached-connect-timeout`: configure timeout for connect, send and receive operations. Unit is millisecond. Defaults to 50ms.
|
||||
* `global-rate-limit-memcached-max-idle-timeout`: configure timeout for cleaning idle connections. Unit is millisecond. Defaults to 50ms.
|
||||
* `global-rate-limit-memcached-pool-size`: configure number of max connections to keep alive. Make sure your `memcached` server can handle
|
||||
`global-rate-limit-memcached-pool-size * worker-processes * <number of ingress-nginx replicas>` simultaneous connections.
|
||||
|
||||
These settings get used by [lua-resty-global-throttle](https://github.com/ElvinEfendi/lua-resty-global-throttle)
|
||||
that ingress-nginx includes. Refer to the link to learn more about `lua-resty-global-throttle`.
|
||||
|
||||
## service-upstream
|
||||
|
||||
Set if the service's Cluster IP and port should be used instead of a list of all endpoints. This can be overwritten by an annotation on an Ingress rule.
|
||||
|
|
@ -1386,6 +1360,7 @@ _References:_
|
|||
[http://nginx.org/en/docs/ngx_core_module.html#debug_connection](http://nginx.org/en/docs/ngx_core_module.html#debug_connection)
|
||||
|
||||
## strict-validate-path-type
|
||||
|
||||
Ingress objects contains a field called pathType that defines the proxy behavior. It can be `Exact`, `Prefix` and `ImplementationSpecific`.
|
||||
|
||||
When pathType is configured as `Exact` or `Prefix`, there should be a more strict validation, allowing only paths starting with "/" and
|
||||
|
|
@ -1399,6 +1374,8 @@ This means that Ingress objects that rely on paths containing regex characters s
|
|||
The cluster admin should establish validation rules using mechanisms like [Open Policy Agent](https://www.openpolicyagent.org/) to
|
||||
validate that only authorized users can use `ImplementationSpecific` pathType and that only the authorized characters can be used.
|
||||
|
||||
_**default:**_ "true"
|
||||
|
||||
## grpc-buffer-size-kb
|
||||
|
||||
Sets the configuration for the GRPC Buffer Size parameter. If not set it will use the default from NGINX.
|
||||
|
|
|
|||
12
go.mod
12
go.mod
|
|
@ -14,12 +14,12 @@ require (
|
|||
github.com/mitchellh/mapstructure v1.5.0
|
||||
github.com/moul/pb v0.0.0-20220425114252-bca18df4138c
|
||||
github.com/ncabatoff/process-exporter v0.8.3
|
||||
github.com/onsi/ginkgo/v2 v2.20.0
|
||||
github.com/onsi/ginkgo/v2 v2.20.2
|
||||
github.com/opencontainers/runc v1.1.13
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
|
||||
github.com/prometheus/client_golang v1.20.1
|
||||
github.com/prometheus/client_golang v1.20.2
|
||||
github.com/prometheus/client_model v0.6.1
|
||||
github.com/prometheus/common v0.55.0
|
||||
github.com/prometheus/common v0.57.0
|
||||
github.com/spf13/cobra v1.8.1
|
||||
github.com/spf13/pflag v1.0.5
|
||||
github.com/stretchr/testify v1.9.0
|
||||
|
|
@ -27,7 +27,7 @@ require (
|
|||
github.com/zakjan/cert-chain-resolver v0.0.0-20221221105603-fcedb00c5b30
|
||||
golang.org/x/crypto v0.26.0
|
||||
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
|
||||
google.golang.org/grpc v1.65.0
|
||||
google.golang.org/grpc v1.66.0
|
||||
google.golang.org/grpc/examples v0.0.0-20240223204917-5ccf176a08ab
|
||||
gopkg.in/go-playground/pool.v3 v3.1.1
|
||||
gopkg.in/mcuadros/go-syslog.v2 v2.3.0
|
||||
|
|
@ -82,7 +82,7 @@ require (
|
|||
github.com/google/gnostic-models v0.6.8 // indirect
|
||||
github.com/google/go-cmp v0.6.0 // indirect
|
||||
github.com/google/gofuzz v1.2.0 // indirect
|
||||
github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 // indirect
|
||||
github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5 // indirect
|
||||
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
|
||||
github.com/google/uuid v1.6.0 // indirect
|
||||
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
|
||||
|
|
@ -117,7 +117,7 @@ require (
|
|||
golang.org/x/net v0.28.0 // indirect
|
||||
golang.org/x/oauth2 v0.21.0 // indirect
|
||||
golang.org/x/sync v0.8.0 // indirect
|
||||
golang.org/x/sys v0.23.0 // indirect
|
||||
golang.org/x/sys v0.24.0 // indirect
|
||||
golang.org/x/term v0.23.0 // indirect
|
||||
golang.org/x/text v0.17.0 // indirect
|
||||
golang.org/x/time v0.5.0 // indirect
|
||||
|
|
|
|||
24
go.sum
24
go.sum
|
|
@ -92,8 +92,8 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
|
|||
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
|
||||
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 h1:FKHo8hFI3A+7w0aUQuYXQ+6EN5stWmeY/AZqtM8xk9k=
|
||||
github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
|
||||
github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5 h1:5iH8iuqE5apketRbSFBy+X1V0o+l+8NF1avt4HWl7cA=
|
||||
github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
|
||||
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
|
||||
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
|
||||
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||
|
|
@ -165,8 +165,8 @@ github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W
|
|||
github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
|
||||
github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
|
||||
github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
|
||||
github.com/onsi/ginkgo/v2 v2.20.0 h1:PE84V2mHqoT1sglvHc8ZdQtPcwmvvt29WLEEO3xmdZw=
|
||||
github.com/onsi/ginkgo/v2 v2.20.0/go.mod h1:lG9ey2Z29hR41WMVthyJBGUBcBhGOtoPF2VFMvBXFCI=
|
||||
github.com/onsi/ginkgo/v2 v2.20.2 h1:7NVCeyIWROIAheY21RLS+3j2bb52W0W82tkberYytp4=
|
||||
github.com/onsi/ginkgo/v2 v2.20.2/go.mod h1:K9gyxPIlb+aIvnZ8bd9Ak+YP18w3APlR+5coaZoE2ag=
|
||||
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
|
||||
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
|
||||
github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
|
||||
|
|
@ -182,12 +182,12 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
|
|||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/prometheus/client_golang v1.20.1 h1:IMJXHOD6eARkQpxo8KkhgEVFlBNm+nkrFUyGlIu7Na8=
|
||||
github.com/prometheus/client_golang v1.20.1/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
|
||||
github.com/prometheus/client_golang v1.20.2 h1:5ctymQzZlyOON1666svgwn3s6IKWgfbjsejTMiXIyjg=
|
||||
github.com/prometheus/client_golang v1.20.2/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
|
||||
github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
|
||||
github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
|
||||
github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc=
|
||||
github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
|
||||
github.com/prometheus/common v0.57.0 h1:Ro/rKjwdq9mZn1K5QPctzh+MA4Lp0BuYk5ZZEVhoNcY=
|
||||
github.com/prometheus/common v0.57.0/go.mod h1:7uRPFSUTbfZWsJ7MHY56sqt7hLQu3bxXHDnNhl8E9qI=
|
||||
github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
|
||||
github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
|
||||
github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
|
||||
|
|
@ -276,8 +276,8 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
|
|||
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
|
||||
golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
|
||||
golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU=
|
||||
golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
|
|
@ -301,8 +301,8 @@ gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw
|
|||
gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 h1:BwIjyKYGsK9dMCBOorzRri8MQwmi7mT9rGHsCEinZkA=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
|
||||
google.golang.org/grpc v1.65.0 h1:bs/cUb4lp1G5iImFFd3u5ixQzweKizoZJAwBNLR42lc=
|
||||
google.golang.org/grpc v1.65.0/go.mod h1:WgYC2ypjlB0EiQi6wdKixMqukr6lBc0Vo+oOgjrM5ZQ=
|
||||
google.golang.org/grpc v1.66.0 h1:DibZuoBznOxbDQxRINckZcUvnCEvrW9pcWIE2yF9r1c=
|
||||
google.golang.org/grpc v1.66.0/go.mod h1:s3/l6xSSCURdVfAnL+TqCNMyTDAGN6+lZeVxnZR128Y=
|
||||
google.golang.org/grpc/examples v0.0.0-20240223204917-5ccf176a08ab h1:tg8hvIl5RmFBuXlcJMuL0h4Psh1gx5Q5xEMwzBZIzWA=
|
||||
google.golang.org/grpc/examples v0.0.0-20240223204917-5ccf176a08ab/go.mod h1:liVNnGuZDITxuksuZ+BBvdy7FcJfeNk+efF9qgqNUmc=
|
||||
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
|
||||
|
|
|
|||
75
go.work.sum
75
go.work.sum
|
|
@ -1,3 +1,4 @@
|
|||
cel.dev/expr v0.15.0 h1:O1jzfJCQBfL5BFoYktaxwIhuttaQPsVWerH9/EEKx0w=
|
||||
cel.dev/expr v0.15.0/go.mod h1:TRSuuV7DlVCE/uwv5QbAiW/v8l5O8C4eEPHeu7gf7Sg=
|
||||
cloud.google.com/go v0.110.2 h1:sdFPBr6xG9/wkBbfhmUz/JmZC7X6LavQgcrVINrKiVA=
|
||||
cloud.google.com/go v0.110.4/go.mod h1:+EYjdK8e5RME/VY/qLCAtuyALQ9q67dvuum8i+H5xsI=
|
||||
|
|
@ -123,6 +124,7 @@ cloud.google.com/go/cloudtasks v1.12.6/go.mod h1:b7c7fe4+TJsFZfDyzO51F7cjq7HLUlR
|
|||
cloud.google.com/go/compute v1.21.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
|
||||
cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
|
||||
cloud.google.com/go/compute v1.23.1/go.mod h1:CqB3xpmPKKt3OJpW2ndFIXnA9A4xAy/F3Xp1ixncW78=
|
||||
cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
|
||||
cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
|
||||
cloud.google.com/go/compute v1.24.0 h1:phWcR2eWzRJaL/kOiJwfFsPs4BaKq1j6vnpZrc1YlVg=
|
||||
cloud.google.com/go/compute v1.24.0/go.mod h1:kw1/T+h/+tK2LJK0wiPPx1intgdAM3j/g3hFDlscY40=
|
||||
|
|
@ -569,6 +571,8 @@ github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY
|
|||
github.com/antihax/optional v1.0.0 h1:xK2lYat7ZLaVVcIuj82J8kIro4V6kDe0AUDFboUCwcg=
|
||||
github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df h1:7RFfzj4SSt6nnvCPbCqijJi1nWCd+TqAT3bYCStRC18=
|
||||
github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df/go.mod h1:pSwJ0fSY5KhvocuWSx4fz3BA8OrA1bQn+K1Eli3BRwM=
|
||||
github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
|
||||
github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
|
||||
github.com/apache/arrow/go/v10 v10.0.1 h1:n9dERvixoC/1JjDmBcs9FPaEryoANa2sCgVFo6ez9cI=
|
||||
github.com/apache/arrow/go/v11 v11.0.0 h1:hqauxvFQxww+0mEU/2XHG6LT7eZternCZq+A5Yly2uM=
|
||||
github.com/apache/thrift v0.16.0 h1:qEy6UW60iVOlUy+b9ZR0d5WzUWYGOo4HfopoyBaNmoY=
|
||||
|
|
@ -583,6 +587,8 @@ github.com/bytedance/sonic v1.9.1 h1:6iJ6NqdoxCDr6mbY8h18oSO+cShGSMRGCEo7F2h0x8s
|
|||
github.com/bytedance/sonic v1.9.1/go.mod h1:i736AoUSYt75HyZLoJW9ERYxcy6eaN6h4BZXU064P/U=
|
||||
github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
|
||||
github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
|
||||
github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
|
||||
github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
|
||||
github.com/census-instrumentation/opencensus-proto v0.4.1 h1:iKLQ0xPNFxR/2hzXZMrBo8f1j86j5WHzznCCQxV/b8g=
|
||||
github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
|
||||
github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
|
||||
|
|
@ -615,6 +621,7 @@ github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101/go.mod h1:eXthEFrGJvWH
|
|||
github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa h1:jQCWAUqqlij9Pgj2i/PB79y4KOPYVyFYdROxgaCwdTQ=
|
||||
github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa/go.mod h1:x/1Gn8zydmfq8dk6e9PdstVsDgu9RuyIIJqAaF//0IM=
|
||||
github.com/cncf/xds/go v0.0.0-20240318125728-8a4994d93e50/go.mod h1:5e1+Vvlzido69INQaVO6d87Qn543Xr6nooe9Kz7oBFM=
|
||||
github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b h1:ga8SEFjZ60pxLcmhnThWgvH2wg8376yUJmPhEH4H3kw=
|
||||
github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
|
||||
github.com/containerd/console v1.0.3 h1:lIr7SlA5PxZyMV30bDW0MGbiOPXwc63yRuCP0ARubLw=
|
||||
github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U=
|
||||
|
|
@ -624,6 +631,7 @@ github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr
|
|||
github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
|
||||
github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e h1:Wf6HqHfScWJN9/ZjdUKyjop4mf3Qdd+1TvvltAvM3m8=
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.3 h1:qMCsGGgs+MAzDFyp9LpAe1Lqy/fY/qCovCm0qnXZOBM=
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.4 h1:wfIWP927BUkWJb2NmU/kNDYIBTh/ziUX91+lVfRxZq4=
|
||||
github.com/docker/go-units v0.4.0 h1:3uh0PgVws3nIA0Q+MwDC8yjEPf9zjRfZZWXZYDct3Tw=
|
||||
github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
|
||||
github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815 h1:bWDMxwH3px2JBh6AyO7hdCn/PkvCZXii8TGj7sbtEbQ=
|
||||
|
|
@ -636,12 +644,14 @@ github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRr
|
|||
github.com/envoyproxy/go-control-plane v0.11.1/go.mod h1:uhMcXKCQMEJHiAb0w+YGefQLaTEw+YhGluxZkrTmD0g=
|
||||
github.com/envoyproxy/go-control-plane v0.12.0 h1:4X+VP1GHd1Mhj6IB5mMeGbLCleqxjletLK6K0rbxyZI=
|
||||
github.com/envoyproxy/go-control-plane v0.12.0/go.mod h1:ZBTaoJ23lqITozF0M6G4/IragXCQKCnYbmlmtHvwRG0=
|
||||
github.com/envoyproxy/go-control-plane v0.12.1-0.20240621013728-1eb8caab5155/go.mod h1:5Wkq+JduFtdAXihLmeTJf+tRYIT4KBc2vPXDhwVo1pA=
|
||||
github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE=
|
||||
github.com/envoyproxy/protoc-gen-validate v1.0.4 h1:gVPz/FMfvh57HdSJQyvBtF00j8JU4zdyUgIUNhlgg0A=
|
||||
github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew=
|
||||
github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
|
||||
github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
|
||||
github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
|
||||
github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
|
||||
github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
|
||||
github.com/fogleman/gg v1.3.0 h1:/7zJX8F6AaYQc57WQCyN9cAIz+4bCJGO9B+dyW29am8=
|
||||
github.com/fxamacker/cbor/v2 v2.6.0 h1:sU6J2usfADwWlYDAFhZBQ6TnLFBHxgesMrQfQgk1tWA=
|
||||
|
|
@ -678,6 +688,7 @@ github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaL
|
|||
github.com/go-openapi/jsonreference v0.20.1/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
|
||||
github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
|
||||
github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
|
||||
github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
|
||||
github.com/go-openapi/swag v0.22.5/go.mod h1:Gl91UqO+btAM0plGGxHqJcQZ1ZTy6jbmridBTsDy8A0=
|
||||
github.com/go-openapi/swag v0.22.6/go.mod h1:Gl91UqO+btAM0plGGxHqJcQZ1ZTy6jbmridBTsDy8A0=
|
||||
github.com/go-pdf/fpdf v0.6.0 h1:MlgtGIfsdMEEQJr2le6b/HNr1ZlQwxyWr77r2aj2U/8=
|
||||
|
|
@ -703,6 +714,7 @@ github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 h1:DACJavvAHhabrF0
|
|||
github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
|
||||
github.com/golang/glog v1.2.0 h1:uCdmnmatrKCgMBlM4rMuJZWOkPDqdbZPnrMXDY4gI68=
|
||||
github.com/golang/glog v1.2.0/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
|
||||
github.com/golang/glog v1.2.1 h1:OptwRhECazUx5ix5TTWC3EZhsZEHWcYWY4FQHTIubm4=
|
||||
github.com/golang/glog v1.2.1/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
|
||||
github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
|
||||
github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||
|
|
@ -711,6 +723,8 @@ github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9
|
|||
github.com/google/cel-go v0.17.7/go.mod h1:HXZKzB0LXqer5lHHgfWAnlYwJaQBDKMjxjulNQzhwhY=
|
||||
github.com/google/cel-go v0.17.8 h1:j9m730pMZt1Fc4oKhCLUHfjj6527LuhYcYw0Rl8gqto=
|
||||
github.com/google/cel-go v0.17.8/go.mod h1:HXZKzB0LXqer5lHHgfWAnlYwJaQBDKMjxjulNQzhwhY=
|
||||
github.com/google/cel-go v0.20.1 h1:nDx9r8S3L4pE61eDdt8igGj8rf5kjYR3ILxWIpWNi84=
|
||||
github.com/google/cel-go v0.20.1/go.mod h1:kWcIzTsPX0zmQ+H3TirHstLLf9ep5QTsZBN9u4dOYLg=
|
||||
github.com/google/flatbuffers v2.0.8+incompatible h1:ivUb1cGomAB101ZM1T0nOiWz9pSrTMoa9+EiY7igmkM=
|
||||
github.com/google/go-pkcs11 v0.2.1-0.20230907215043-c6f79328ddf9/go.mod h1:6eQoGcuNJpa7jnd5pMGdkSaQpNDYvPlXWMcjXXThLlY=
|
||||
github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
|
|
@ -718,6 +732,8 @@ github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPg
|
|||
github.com/google/martian/v3 v3.3.2 h1:IqNFLAmvJOgVlpdEBiQbDc2EwKW77amAycfTuWKdfvw=
|
||||
github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||
github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw=
|
||||
github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
|
||||
github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA=
|
||||
github.com/google/s2a-go v0.1.4 h1:1kZ/sQM3srePvKs3tXAvQzo66XfcReoqFpIpIccE7Oc=
|
||||
github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
|
||||
|
|
@ -743,6 +759,8 @@ github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4
|
|||
github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
|
||||
github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU=
|
||||
github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
|
||||
github.com/iancoleman/strcase v0.2.0 h1:05I4QRnGpI0m37iZQRuskXh+w77mr6Z41lwQzuHLwW0=
|
||||
|
|
@ -795,6 +813,8 @@ github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8 h1:AMFGa4R4MiIpsp
|
|||
github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3 h1:+n/aFZefKZp7spd8DFdX7uMikMLXX4oubIzJF4kv/wI=
|
||||
github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=
|
||||
github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
|
||||
github.com/moby/spdystream v0.4.0 h1:Vy79D6mHeJJjiPdFEL2yku1kl0chZpJfZcPpb16BRl8=
|
||||
github.com/moby/spdystream v0.4.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
|
||||
github.com/mrunalp/fileutils v0.5.1 h1:F+S7ZlNKnrwHfSwdlgNSkKo67ReVf8o9fel6C3dkm/Q=
|
||||
github.com/mrunalp/fileutils v0.5.1/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
|
||||
github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
|
||||
|
|
@ -825,6 +845,7 @@ github.com/pierrec/lz4/v4 v4.1.15 h1:MO0/ucJhngq7299dKLwIMtgTfbkoSPF6AoMYDd8Q4q0
|
|||
github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e h1:aoZm08cpOy4WuID//EZDgcC4zIxODThtZNPirFr42+A=
|
||||
github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
|
||||
github.com/pkg/sftp v1.13.1 h1:I2qBYMChEhIjOgazfJmV3/mZM256btk6wkCDRmW7JYs=
|
||||
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
|
||||
github.com/pquerna/cachecontrol v0.1.0 h1:yJMy84ti9h/+OEWa752kBTKv4XC30OtVVHYv/8cTqKc=
|
||||
github.com/pquerna/cachecontrol v0.1.0/go.mod h1:NrUG3Z7Rdu85UNR3vm7SOsl1nFIeSiQnrHV5K9mBcUI=
|
||||
github.com/prometheus/exporter-toolkit v0.11.0 h1:yNTsuZ0aNCNFQ3aFTD2uhPOvr4iD7fdBvKPAEGkNf+g=
|
||||
|
|
@ -871,8 +892,6 @@ github.com/vishvananda/netlink v1.1.0 h1:1iyaYNBLmP6L0220aDnYQpo1QEV4t4hJ+xEEhhJ
|
|||
github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
|
||||
github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df h1:OviZH7qLw/7ZovXvuNyL3XQl8UFofeikI1NW1Gypu7k=
|
||||
github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
|
||||
github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
|
||||
github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
|
||||
github.com/xhit/go-str2duration v1.2.0 h1:BcV5u025cITWxEQKGWr1URRzrcXtu7uk8+luz3Yuhwc=
|
||||
github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
|
||||
github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
|
||||
|
|
@ -883,50 +902,84 @@ github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
|
|||
github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
|
||||
go.etcd.io/bbolt v1.3.8 h1:xs88BrvEv273UsB79e0hcVrlUWmS0a8upikMFhSyAtA=
|
||||
go.etcd.io/bbolt v1.3.8/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw=
|
||||
go.etcd.io/bbolt v1.3.9 h1:8x7aARPEXiXbHmtUwAIv7eV2fQFHrLLavdiJ3uzJXoI=
|
||||
go.etcd.io/bbolt v1.3.9/go.mod h1:zaO32+Ti0PK1ivdPtgMESzuzL2VPoIG1PCQNvOdo/dE=
|
||||
go.etcd.io/etcd/api/v3 v3.5.10 h1:szRajuUUbLyppkhs9K6BRtjY37l66XQQmw7oZRANE4k=
|
||||
go.etcd.io/etcd/api/v3 v3.5.10/go.mod h1:TidfmT4Uycad3NM/o25fG3J07odo4GBB9hoxaodFCtI=
|
||||
go.etcd.io/etcd/api/v3 v3.5.14 h1:vHObSCxyB9zlF60w7qzAdTcGaglbJOpSj1Xj9+WGxq0=
|
||||
go.etcd.io/etcd/api/v3 v3.5.14/go.mod h1:BmtWcRlQvwa1h3G2jvKYwIQy4PkHlDej5t7uLMUdJUU=
|
||||
go.etcd.io/etcd/client/pkg/v3 v3.5.10 h1:kfYIdQftBnbAq8pUWFXfpuuxFSKzlmM5cSn76JByiT0=
|
||||
go.etcd.io/etcd/client/pkg/v3 v3.5.10/go.mod h1:DYivfIviIuQ8+/lCq4vcxuseg2P2XbHygkKwFo9fc8U=
|
||||
go.etcd.io/etcd/client/pkg/v3 v3.5.14 h1:SaNH6Y+rVEdxfpA2Jr5wkEvN6Zykme5+YnbCkxvuWxQ=
|
||||
go.etcd.io/etcd/client/pkg/v3 v3.5.14/go.mod h1:8uMgAokyG1czCtIdsq+AGyYQMvpIKnSvPjFMunkgeZI=
|
||||
go.etcd.io/etcd/client/v2 v2.305.10 h1:MrmRktzv/XF8CvtQt+P6wLUlURaNpSDJHFZhe//2QE4=
|
||||
go.etcd.io/etcd/client/v2 v2.305.10/go.mod h1:m3CKZi69HzilhVqtPDcjhSGp+kA1OmbNn0qamH80xjA=
|
||||
go.etcd.io/etcd/client/v2 v2.305.13 h1:RWfV1SX5jTU0lbCvpVQe3iPQeAHETWdOTb6pxhd77C8=
|
||||
go.etcd.io/etcd/client/v2 v2.305.13/go.mod h1:iQnL7fepbiomdXMb3om1rHq96htNNGv2sJkEcZGDRRg=
|
||||
go.etcd.io/etcd/client/v3 v3.5.10 h1:W9TXNZ+oB3MCd/8UjxHTWK5J9Nquw9fQBLJd5ne5/Ao=
|
||||
go.etcd.io/etcd/client/v3 v3.5.10/go.mod h1:RVeBnDz2PUEZqTpgqwAtUd8nAPf5kjyFyND7P1VkOKc=
|
||||
go.etcd.io/etcd/client/v3 v3.5.14 h1:CWfRs4FDaDoSz81giL7zPpZH2Z35tbOrAJkkjMqOupg=
|
||||
go.etcd.io/etcd/client/v3 v3.5.14/go.mod h1:k3XfdV/VIHy/97rqWjoUzrj9tk7GgJGH9J8L4dNXmAk=
|
||||
go.etcd.io/etcd/pkg/v3 v3.5.10 h1:WPR8K0e9kWl1gAhB5A7gEa5ZBTNkT9NdNWrR8Qpo1CM=
|
||||
go.etcd.io/etcd/pkg/v3 v3.5.10/go.mod h1:TKTuCKKcF1zxmfKWDkfz5qqYaE3JncKKZPFf8c1nFUs=
|
||||
go.etcd.io/etcd/pkg/v3 v3.5.13 h1:st9bDWNsKkBNpP4PR1MvM/9NqUPfvYZx/YXegsYEH8M=
|
||||
go.etcd.io/etcd/pkg/v3 v3.5.13/go.mod h1:N+4PLrp7agI/Viy+dUYpX7iRtSPvKq+w8Y14d1vX+m0=
|
||||
go.etcd.io/etcd/raft/v3 v3.5.10 h1:cgNAYe7xrsrn/5kXMSaH8kM/Ky8mAdMqGOxyYwpP0LA=
|
||||
go.etcd.io/etcd/raft/v3 v3.5.10/go.mod h1:odD6kr8XQXTy9oQnyMPBOr0TVe+gT0neQhElQ6jbGRc=
|
||||
go.etcd.io/etcd/raft/v3 v3.5.13 h1:7r/NKAOups1YnKcfro2RvGGo2PTuizF/xh26Z2CTAzA=
|
||||
go.etcd.io/etcd/raft/v3 v3.5.13/go.mod h1:uUFibGLn2Ksm2URMxN1fICGhk8Wu96EfDQyuLhAcAmw=
|
||||
go.etcd.io/etcd/server/v3 v3.5.10 h1:4NOGyOwD5sUZ22PiWYKmfxqoeh72z6EhYjNosKGLmZg=
|
||||
go.etcd.io/etcd/server/v3 v3.5.10/go.mod h1:gBplPHfs6YI0L+RpGkTQO7buDbHv5HJGG/Bst0/zIPo=
|
||||
go.etcd.io/etcd/server/v3 v3.5.13 h1:V6KG+yMfMSqWt+lGnhFpP5z5dRUj1BDRJ5k1fQ9DFok=
|
||||
go.etcd.io/etcd/server/v3 v3.5.13/go.mod h1:K/8nbsGupHqmr5MkgaZpLlH1QdX1pcNQLAkODy44XcQ=
|
||||
go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
|
||||
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.42.0 h1:ZOLJc06r4CB42laIXg/7udr0pbZyuAihN10A/XuiQRY=
|
||||
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.42.0/go.mod h1:5z+/ZWJQKXa9YT34fQNx5K8Hd1EoIhvtUygUQPqEOgQ=
|
||||
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1/go.mod h1:4UoMYEZOC0yN/sPGH76KPkkU7zgiEWYWL9vwmbnTJPE=
|
||||
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0/go.mod h1:r9vWsPS/3AQItv3OSlEJ/E4mbrhUbbw18meOjArPtKQ=
|
||||
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0 h1:9G6E0TXzGFVfTnawRzrPl83iHOAV7L8NJiR8RSGYV1g=
|
||||
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0/go.mod h1:azvtTADFQJA8mX80jIH/akaE7h+dbm/sVuaHqN13w74=
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.44.0 h1:KfYpVmrjI7JuToy5k8XV3nkapjWx48k4E4JOtVstzQI=
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.44.0/go.mod h1:SeQhzAEccGVZVEy7aH87Nh0km+utSpo1pTv6eMMop48=
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1/go.mod h1:sEGXWArGqc3tVa+ekntsN65DmVbVeW+7lTKTjZF3/Fo=
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0/go.mod h1:SK2UL73Zy1quvRPonmOmRDiWk1KBV3LyIeeIxcEApWw=
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 h1:4K4tsIXefpVJtvA/8srF4V4y0akAoPHkIslgAkjixJA=
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0/go.mod h1:jjdQuTGVsXV4vSs+CJ2qYDeDPf9yIJV23qlIzBm73Vg=
|
||||
go.opentelemetry.io/otel v1.19.0 h1:MuS/TNf4/j4IXsZuJegVzI1cwut7Qc00344rgH7p8bs=
|
||||
go.opentelemetry.io/otel v1.19.0/go.mod h1:i0QyjOq3UPoTzff0PJB2N66fb4S0+rSbSB15/oyH9fY=
|
||||
go.opentelemetry.io/otel v1.21.0/go.mod h1:QZzNPQPm1zLX4gZK4cMi+71eaorMSGT3A4znnUvNNEo=
|
||||
go.opentelemetry.io/otel v1.22.0/go.mod h1:eoV4iAi3Ea8LkAEI9+GFT44O6T/D0GWAVFyZVCC6pMI=
|
||||
go.opentelemetry.io/otel v1.28.0 h1:/SqNcYk+idO0CxKEUOtKQClMK/MimZihKYMruSMViUo=
|
||||
go.opentelemetry.io/otel v1.28.0/go.mod h1:q68ijF8Fc8CnMHKyzqL6akLO46ePnjkgfIMIjUIX9z4=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 h1:Mne5On7VWdx7omSrSSZvM4Kw7cS7NQkOOmLcgscI51U=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0/go.mod h1:IPtUMKL4O3tH5y+iXVyAXqpAwMuzC1IrxVS81rummfE=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 h1:3Q/xZUyC1BBkualc9ROb4G8qkH90LXEIICcs5zv1OYY=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0/go.mod h1:s75jGIWA9OfCMzF0xr+ZgfrB5FEbbV7UuYo32ahUiFI=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0 h1:3d+S281UTjM+AbF31XSOYn1qXn3BgIdWl8HNEpx08Jk=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0/go.mod h1:0+KuTDyKL4gjKCF75pHOX4wuzYDUZYfAQdSu43o+Z2I=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 h1:qFffATk0X+HD+f1Z8lswGiOQYKHRlzfmdJm0wEaVrFA=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0/go.mod h1:MOiCmryaYtc+V0Ei+Tx9o5S1ZjA7kzLucuVuyzBZloQ=
|
||||
go.opentelemetry.io/otel/metric v1.19.0 h1:aTzpGtV0ar9wlV4Sna9sdJyII5jTVJEvKETPiOKwvpE=
|
||||
go.opentelemetry.io/otel/metric v1.19.0/go.mod h1:L5rUsV9kM1IxCj1MmSdS+JQAcVm319EUrDVLrt7jqt8=
|
||||
go.opentelemetry.io/otel/metric v1.21.0/go.mod h1:o1p3CA8nNHW8j5yuQLdc1eeqEaPfzug24uvsyIEJRWM=
|
||||
go.opentelemetry.io/otel/metric v1.22.0/go.mod h1:evJGjVpZv0mQ5QBRJoBF64yMuOf4xCWdXjK8pzFvliY=
|
||||
go.opentelemetry.io/otel/metric v1.28.0 h1:f0HGvSl1KRAU1DLgLGFjrwVyismPlnuU6JD6bOeuA5Q=
|
||||
go.opentelemetry.io/otel/metric v1.28.0/go.mod h1:Fb1eVBFZmLVTMb6PPohq3TO9IIhUisDsbJoL/+uQW4s=
|
||||
go.opentelemetry.io/otel/sdk v1.19.0 h1:6USY6zH+L8uMH8L3t1enZPR3WFEmSTADlqldyHtJi3o=
|
||||
go.opentelemetry.io/otel/sdk v1.19.0/go.mod h1:NedEbbS4w3C6zElbLdPJKOpJQOrGUJ+GfzpjUvI0v1A=
|
||||
go.opentelemetry.io/otel/sdk v1.21.0/go.mod h1:Nna6Yv7PWTdgJHVRD9hIYywQBRx7pbox6nwBnZIxl/E=
|
||||
go.opentelemetry.io/otel/sdk v1.28.0 h1:b9d7hIry8yZsgtbmM0DKyPWMMUMlK9NEKuIG4aBqWyE=
|
||||
go.opentelemetry.io/otel/sdk v1.28.0/go.mod h1:oYj7ClPUA7Iw3m+r7GeEjz0qckQRJK2B8zjcZEfu7Pg=
|
||||
go.opentelemetry.io/otel/trace v1.19.0 h1:DFVQmlVbfVeOuBRrwdtaehRrWiL1JoVs9CPIQ1Dzxpg=
|
||||
go.opentelemetry.io/otel/trace v1.19.0/go.mod h1:mfaSyvGyEJEI0nyV2I4qhNQnbBOUUmYZpYojqMnX2vo=
|
||||
go.opentelemetry.io/otel/trace v1.21.0/go.mod h1:LGbsEB0f9LGjN+OZaQQ26sohbOmiMR+BaslueVtS/qQ=
|
||||
go.opentelemetry.io/otel/trace v1.22.0/go.mod h1:RbbHXVqKES9QhzZq/fE5UnOSILqRt40a21sPw2He1xo=
|
||||
go.opentelemetry.io/otel/trace v1.28.0 h1:GhQ9cUuQGmNDd5BTCP2dAvv75RdMxEfTmYejp+lkx9g=
|
||||
go.opentelemetry.io/otel/trace v1.28.0/go.mod h1:jPyXzNPg6da9+38HEwElrQiHlVMTnVfM3/yv2OlIHaI=
|
||||
go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
|
||||
go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
|
||||
go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
|
||||
go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
|
||||
go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
|
||||
go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
|
||||
go.uber.org/goleak v1.2.0/go.mod h1:XJYK+MuIchqpmGmUSAzotztawfKvYLUIgg7guXrwVUo=
|
||||
|
|
@ -944,6 +997,7 @@ golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028 h1:4+4C/Iv2U4fMZBiMCc98MG
|
|||
golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
|
||||
golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
|
||||
golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
|
||||
golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
|
||||
golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
|
||||
|
|
@ -951,6 +1005,8 @@ golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
|
|||
golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
|
||||
golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
|
||||
golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
|
||||
golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
|
||||
golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE=
|
||||
golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
|
||||
golang.org/x/oauth2 v0.11.0/go.mod h1:LdF7O/8bLR/qWK9DrpXmbHLTouvRHK0SgJl0GmDBchk=
|
||||
golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
|
||||
|
|
@ -958,18 +1014,25 @@ golang.org/x/oauth2 v0.14.0/go.mod h1:lAtNWgaWfL4cm7j2OV8TxGi9Qb7ECORx8DktCY74Ow
|
|||
golang.org/x/oauth2 v0.15.0/go.mod h1:q48ptWNTY5XWf+JNten23lcvHpLJ0ZSxF5ttTHKVCAM=
|
||||
golang.org/x/oauth2 v0.17.0/go.mod h1:OzPDGQiuQMguemayvdylqddI7qcD9lnSDb+1FiwQ5HA=
|
||||
golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
|
||||
golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
|
||||
golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/telemetry v0.0.0-20240208230135-b75ee8823808/go.mod h1:KG1lNk5ZFNssSZLrpVb4sMXKMpGwGXOxSG3rnu2gZQQ=
|
||||
golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2 h1:IRJeR9r1pYWsHKTRe/IInb7lYvbBVIqOgsX/u0mbOWY=
|
||||
golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
|
||||
golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457 h1:zf5N6UOrA487eEFacMePxjXAJctxKmyjKUsjA11Uzuk=
|
||||
golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0=
|
||||
golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
|
||||
golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
|
||||
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
|
||||
golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
|
||||
golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
|
||||
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
|
||||
golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
|
||||
|
|
@ -977,6 +1040,8 @@ golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58
|
|||
golang.org/x/tools v0.16.1/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
|
||||
golang.org/x/tools v0.18.0/go.mod h1:GL7B4CwcLLeo59yx/9UWWuNOW1n3VZ4f5axWfML7Lcg=
|
||||
golang.org/x/tools v0.20.0/go.mod h1:WvitBU7JJf6A4jOdg4S1tviW9bhUxkgeCui/0JHctQg=
|
||||
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
|
||||
golang.org/x/tools v0.23.0/go.mod h1:pnu6ufv6vQkll6szChhK3C3L/ruaIv5eBeztNG8wtsI=
|
||||
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
|
||||
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
|
||||
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
|
||||
|
|
@ -1022,7 +1087,9 @@ google.golang.org/genproto/googleapis/api v0.0.0-20240213162025-012b6fc9bca9/go.
|
|||
google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de h1:jFNzHPIeuzhdRwVhbZdiym9q0ory/xY3sA+v2wPg8I0=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de/go.mod h1:5iCWqnniDlqZHrd3neWVTOwvh/v6s3232omMecelax8=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237/go.mod h1:Z5Iiy3jtmioajWHDGFk7CeugTyHtPvMHA4UTmUkyalE=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157 h1:7whR9kGa5LUwFtpLm2ArCEejtnxlGeLbAyjFY8sGNFw=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157/go.mod h1:99sLkeliLXfdj2J75X3Ho+rrVCaJze0uwN7zDDkjPVU=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20240604185151-ef581f913117/go.mod h1:OimBR/bc1wPO9iV4NC2bpyjy3VnAwZh5EBPQdtaE5oo=
|
||||
google.golang.org/genproto/googleapis/bytestream v0.0.0-20230530153820-e85fd2cbaebc h1:g3hIDl0jRNd9PPTs2uBzYuaD5mQuwOkZY0vSc0LR32o=
|
||||
google.golang.org/genproto/googleapis/bytestream v0.0.0-20231030173426-d783a09b4405/go.mod h1:GRUCuLdzVqZte8+Dl/D4N25yLzcGqqWaYkeVOwulFqw=
|
||||
google.golang.org/genproto/googleapis/bytestream v0.0.0-20231212172506-995d672761c0/go.mod h1:guYXGPwC6jwxgWKW5Y405fKWOFNwlvUlUnzyp9i0uqo=
|
||||
|
|
@ -1064,6 +1131,8 @@ k8s.io/kms v0.29.3/go.mod h1:TBGbJKpRUMk59neTMDMddjIDL+D4HuFUbpuiuzmOPg0=
|
|||
k8s.io/kms v0.30.0 h1:ZlnD/ei5lpvUlPw6eLfVvH7d8i9qZ6HwUQgydNVks8g=
|
||||
k8s.io/kms v0.30.0/go.mod h1:GrMurD0qk3G4yNgGcsCEmepqf9KyyIrTXYR2lyUOJC4=
|
||||
k8s.io/kms v0.30.1/go.mod h1:GrMurD0qk3G4yNgGcsCEmepqf9KyyIrTXYR2lyUOJC4=
|
||||
k8s.io/kms v0.31.0 h1:KchILPfB1ZE+ka7223mpU5zeFNkmb45jl7RHnlImUaI=
|
||||
k8s.io/kms v0.31.0/go.mod h1:OZKwl1fan3n3N5FFxnW5C4V3ygrah/3YXeJWS3O6+94=
|
||||
k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
|
||||
k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
|
||||
k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
|
||||
|
|
@ -1088,6 +1157,8 @@ rsc.io/sampler v1.3.0 h1:7uVkIFmeBqHfdjD+gZwtXXI+RODJ2Wc4O7MPEh/QiW4=
|
|||
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.28.0/go.mod h1:VHVDI/KrK4fjnV61bE2g3sA7tiETLn8sooImelsCx3Y=
|
||||
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.29.0 h1:/U5vjBbQn3RChhv7P11uhYvCSm5G2GaIi5AIGBS6r4c=
|
||||
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.29.0/go.mod h1:z7+wmGM2dfIiLRfrC6jb5kV2Mq/sK1ZP303cxzkV5Y4=
|
||||
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 h1:2770sDpzrjjsAtVhSeUFseziht227YAWYHLGNM8QPwY=
|
||||
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
|
||||
sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
|
||||
sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
|
||||
sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
|
||||
|
|
|
|||
|
|
@ -33,14 +33,14 @@ require (
|
|||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
||||
github.com/modern-go/reflect2 v1.0.2 // indirect
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
||||
github.com/onsi/ginkgo/v2 v2.20.0 // indirect
|
||||
github.com/onsi/ginkgo/v2 v2.20.2 // indirect
|
||||
github.com/onsi/gomega v1.34.1 // indirect
|
||||
github.com/pkg/errors v0.9.1 // indirect
|
||||
github.com/spf13/pflag v1.0.5 // indirect
|
||||
github.com/stretchr/testify v1.9.0 // indirect
|
||||
golang.org/x/net v0.28.0 // indirect
|
||||
golang.org/x/oauth2 v0.18.0 // indirect
|
||||
golang.org/x/sys v0.23.0 // indirect
|
||||
golang.org/x/sys v0.24.0 // indirect
|
||||
golang.org/x/term v0.23.0 // indirect
|
||||
golang.org/x/text v0.17.0 // indirect
|
||||
golang.org/x/time v0.5.0 // indirect
|
||||
|
|
|
|||
|
|
@ -32,8 +32,8 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
|
|||
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
|
||||
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 h1:FKHo8hFI3A+7w0aUQuYXQ+6EN5stWmeY/AZqtM8xk9k=
|
||||
github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
|
||||
github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5 h1:5iH8iuqE5apketRbSFBy+X1V0o+l+8NF1avt4HWl7cA=
|
||||
github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
|
||||
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
|
||||
|
|
@ -61,8 +61,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
|
|||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
|
||||
github.com/onrik/logrus v0.11.0 h1:pu+BCaWL36t0yQaj/2UHK2erf88dwssAKOT51mxPUVs=
|
||||
github.com/onrik/logrus v0.11.0/go.mod h1:fO2vlZwIdti6PidD3gV5YKt9Lq5ptpnP293RAe1ITwk=
|
||||
github.com/onsi/ginkgo/v2 v2.20.0 h1:PE84V2mHqoT1sglvHc8ZdQtPcwmvvt29WLEEO3xmdZw=
|
||||
github.com/onsi/ginkgo/v2 v2.20.0/go.mod h1:lG9ey2Z29hR41WMVthyJBGUBcBhGOtoPF2VFMvBXFCI=
|
||||
github.com/onsi/ginkgo/v2 v2.20.2 h1:7NVCeyIWROIAheY21RLS+3j2bb52W0W82tkberYytp4=
|
||||
github.com/onsi/ginkgo/v2 v2.20.2/go.mod h1:K9gyxPIlb+aIvnZ8bd9Ak+YP18w3APlR+5coaZoE2ag=
|
||||
github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
|
||||
github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
|
||||
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
|
||||
|
|
@ -123,8 +123,8 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
|
|||
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
|
||||
golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
|
||||
golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU=
|
||||
|
|
|
|||
|
|
@ -98,9 +98,6 @@ export LUA_RESTY_REDIS_VERSION=8641b9f1b6f75cca50c90cf8ca5c502ad8950aa8
|
|||
# Check for recent changes: https://github.com/api7/lua-resty-ipmatcher/compare/v0.6.1...master
|
||||
export LUA_RESTY_IPMATCHER_VERSION=3e93c53eb8c9884efe939ef070486a0e507cc5be
|
||||
|
||||
# Check for recent changes: https://github.com/ElvinEfendi/lua-resty-global-throttle/compare/v0.2.0...main
|
||||
export LUA_RESTY_GLOBAL_THROTTLE_VERSION=v0.2.0
|
||||
|
||||
# Check for recent changes: https://github.com/microsoft/mimalloc/compare/v2.1.7...master
|
||||
export MIMALOC_VERSION=v2.1.7
|
||||
|
||||
|
|
@ -276,9 +273,6 @@ get_src c15aed1a01c88a3a6387d9af67a957dff670357f5fdb4ee182beb44635eef3f1 \
|
|||
get_src efb767487ea3f6031577b9b224467ddbda2ad51a41c5867a47582d4ad85d609e \
|
||||
"https://github.com/api7/lua-resty-ipmatcher/archive/$LUA_RESTY_IPMATCHER_VERSION.tar.gz" "lua-resty-ipmatcher"
|
||||
|
||||
get_src 0fb790e394510e73fdba1492e576aaec0b8ee9ef08e3e821ce253a07719cf7ea \
|
||||
"https://github.com/ElvinEfendi/lua-resty-global-throttle/archive/$LUA_RESTY_GLOBAL_THROTTLE_VERSION.tar.gz" "lua-resty-global-throttle"
|
||||
|
||||
get_src d74f86ada2329016068bc5a243268f1f555edd620b6a7d6ce89295e7d6cf18da \
|
||||
"https://github.com/microsoft/mimalloc/archive/${MIMALOC_VERSION}.tar.gz" "mimalloc"
|
||||
|
||||
|
|
@ -591,9 +585,6 @@ make install
|
|||
cd "$BUILD_PATH/lua-resty-ipmatcher"
|
||||
INST_LUADIR=/usr/local/lib/lua make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-global-throttle"
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/mimalloc"
|
||||
mkdir -p out/release
|
||||
cd out/release
|
||||
|
|
|
|||
|
|
@ -119,9 +119,6 @@ export LUA_RESTY_REDIS_VERSION=0.30
|
|||
# Check for recent changes: https://github.com/api7/lua-resty-ipmatcher/compare/v0.6.1...master
|
||||
export LUA_RESTY_IPMATCHER_VERSION=0.6.1
|
||||
|
||||
# Check for recent changes: https://github.com/ElvinEfendi/lua-resty-global-throttle/compare/v0.2.0...main
|
||||
export LUA_RESTY_GLOBAL_THROTTLE_VERSION=0.2.0
|
||||
|
||||
# Check for recent changes: https://github.com/microsoft/mimalloc/compare/v1.7.6...master
|
||||
export MIMALOC_VERSION=1.7.6
|
||||
|
||||
|
|
@ -309,9 +306,6 @@ get_src c15aed1a01c88a3a6387d9af67a957dff670357f5fdb4ee182beb44635eef3f1 \
|
|||
get_src efb767487ea3f6031577b9b224467ddbda2ad51a41c5867a47582d4ad85d609e \
|
||||
"https://github.com/api7/lua-resty-ipmatcher/archive/v$LUA_RESTY_IPMATCHER_VERSION.tar.gz"
|
||||
|
||||
get_src 0fb790e394510e73fdba1492e576aaec0b8ee9ef08e3e821ce253a07719cf7ea \
|
||||
"https://github.com/ElvinEfendi/lua-resty-global-throttle/archive/v$LUA_RESTY_GLOBAL_THROTTLE_VERSION.tar.gz"
|
||||
|
||||
get_src d74f86ada2329016068bc5a243268f1f555edd620b6a7d6ce89295e7d6cf18da \
|
||||
"https://github.com/microsoft/mimalloc/archive/refs/tags/v${MIMALOC_VERSION}.tar.gz"
|
||||
|
||||
|
|
@ -704,9 +698,6 @@ make install
|
|||
cd "$BUILD_PATH/lua-resty-ipmatcher-$LUA_RESTY_IPMATCHER_VERSION"
|
||||
INST_LUADIR=/usr/local/lib/lua make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-global-throttle-$LUA_RESTY_GLOBAL_THROTTLE_VERSION"
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/mimalloc-$MIMALOC_VERSION"
|
||||
mkdir -p out/release
|
||||
cd out/release
|
||||
|
|
|
|||
|
|
@ -59,7 +59,7 @@ image:
|
|||
--build-arg YAML_LINT_VERSION=1.33.0 \
|
||||
--build-arg YAMALE_VERSION=4.0.4 \
|
||||
--build-arg HELM_VERSION=3.14.4 \
|
||||
--build-arg GINKGO_VERSION=2.20.0 \
|
||||
--build-arg GINKGO_VERSION=2.20.2 \
|
||||
--build-arg GOLINT_VERSION=latest \
|
||||
-t ${IMAGE}:${TAG} rootfs
|
||||
|
||||
|
|
@ -80,7 +80,7 @@ build: ensure-buildx
|
|||
--build-arg YAML_LINT_VERSION=1.33.0 \
|
||||
--build-arg YAMALE_VERSION=4.0.4 \
|
||||
--build-arg HELM_VERSION=3.14.4 \
|
||||
--build-arg GINKGO_VERSION=2.20.0 \
|
||||
--build-arg GINKGO_VERSION=2.20.2 \
|
||||
--build-arg GOLINT_VERSION=latest \
|
||||
-t ${IMAGE}:${TAG} rootfs
|
||||
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
v0.0.9
|
||||
v1.0.0
|
||||
|
|
|
|||
|
|
@ -39,7 +39,6 @@ import (
|
|||
"k8s.io/ingress-nginx/internal/ingress/annotations/defaultbackend"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/disableproxyintercepterrors"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/fastcgi"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/globalratelimit"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/http2pushpreload"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/ipallowlist"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/ipdenylist"
|
||||
|
|
@ -98,7 +97,6 @@ type Ingress struct {
|
|||
Proxy proxy.Config
|
||||
ProxySSL proxyssl.Config
|
||||
RateLimit ratelimit.Config
|
||||
GlobalRateLimit globalratelimit.Config
|
||||
Redirect redirect.Config
|
||||
Rewrite rewrite.Config
|
||||
Satisfy string
|
||||
|
|
@ -147,7 +145,6 @@ func NewAnnotationFactory(cfg resolver.Resolver) map[string]parser.IngressAnnota
|
|||
"Proxy": proxy.NewParser(cfg),
|
||||
"ProxySSL": proxyssl.NewParser(cfg),
|
||||
"RateLimit": ratelimit.NewParser(cfg),
|
||||
"GlobalRateLimit": globalratelimit.NewParser(cfg),
|
||||
"Redirect": redirect.NewParser(cfg),
|
||||
"Rewrite": rewrite.NewParser(cfg),
|
||||
"Satisfy": satisfy.NewParser(cfg),
|
||||
|
|
|
|||
|
|
@ -1,179 +0,0 @@
|
|||
/*
|
||||
Copyright 2020 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package globalratelimit
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
networking "k8s.io/api/networking/v1"
|
||||
"k8s.io/klog/v2"
|
||||
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
|
||||
ing_errors "k8s.io/ingress-nginx/internal/ingress/errors"
|
||||
"k8s.io/ingress-nginx/internal/ingress/resolver"
|
||||
"k8s.io/ingress-nginx/internal/net"
|
||||
"k8s.io/ingress-nginx/pkg/util/sets"
|
||||
)
|
||||
|
||||
const defaultKey = "$remote_addr"
|
||||
|
||||
const (
|
||||
globalRateLimitAnnotation = "global-rate-limit"
|
||||
globalRateLimitWindowAnnotation = "global-rate-limit-window"
|
||||
globalRateLimitKeyAnnotation = "global-rate-limit-key"
|
||||
globalRateLimitIgnoredCidrsAnnotation = "global-rate-limit-ignored-cidrs"
|
||||
)
|
||||
|
||||
var globalRateLimitAnnotationConfig = parser.Annotation{
|
||||
Group: "ratelimit",
|
||||
Annotations: parser.AnnotationFields{
|
||||
globalRateLimitAnnotation: {
|
||||
Validator: parser.ValidateInt,
|
||||
Scope: parser.AnnotationScopeIngress,
|
||||
Risk: parser.AnnotationRiskLow,
|
||||
Documentation: `This annotation configures maximum allowed number of requests per window`,
|
||||
},
|
||||
globalRateLimitWindowAnnotation: {
|
||||
Validator: parser.ValidateDuration,
|
||||
Scope: parser.AnnotationScopeIngress,
|
||||
Risk: parser.AnnotationRiskLow,
|
||||
Documentation: `Configures a time window (i.e 1m) that the limit is applied`,
|
||||
},
|
||||
globalRateLimitKeyAnnotation: {
|
||||
Validator: parser.ValidateRegex(parser.NGINXVariable, true),
|
||||
Scope: parser.AnnotationScopeIngress,
|
||||
Risk: parser.AnnotationRiskHigh,
|
||||
Documentation: `This annotation Configures a key for counting the samples. Defaults to $remote_addr.
|
||||
You can also combine multiple NGINX variables here, like ${remote_addr}-${http_x_api_client} which would mean the limit will be applied to
|
||||
requests coming from the same API client (indicated by X-API-Client HTTP request header) with the same source IP address`,
|
||||
},
|
||||
globalRateLimitIgnoredCidrsAnnotation: {
|
||||
Validator: parser.ValidateCIDRs,
|
||||
Scope: parser.AnnotationScopeIngress,
|
||||
Risk: parser.AnnotationRiskMedium,
|
||||
Documentation: `This annotation defines a comma separated list of IPs and CIDRs to match client IP against.
|
||||
When there's a match request is not considered for rate limiting.`,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
// Config encapsulates all global rate limit attributes
|
||||
type Config struct {
|
||||
Namespace string `json:"namespace"`
|
||||
Limit int `json:"limit"`
|
||||
WindowSize int `json:"window-size"`
|
||||
Key string `json:"key"`
|
||||
IgnoredCIDRs []string `json:"ignored-cidrs"`
|
||||
}
|
||||
|
||||
// Equal tests for equality between two Config types
|
||||
func (l *Config) Equal(r *Config) bool {
|
||||
if l.Namespace != r.Namespace {
|
||||
return false
|
||||
}
|
||||
if l.Limit != r.Limit {
|
||||
return false
|
||||
}
|
||||
if l.WindowSize != r.WindowSize {
|
||||
return false
|
||||
}
|
||||
if l.Key != r.Key {
|
||||
return false
|
||||
}
|
||||
if len(l.IgnoredCIDRs) != len(r.IgnoredCIDRs) || !sets.StringElementsMatch(l.IgnoredCIDRs, r.IgnoredCIDRs) {
|
||||
return false
|
||||
}
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
type globalratelimit struct {
|
||||
r resolver.Resolver
|
||||
annotationConfig parser.Annotation
|
||||
}
|
||||
|
||||
// NewParser creates a new globalratelimit annotation parser
|
||||
func NewParser(r resolver.Resolver) parser.IngressAnnotation {
|
||||
return globalratelimit{
|
||||
r: r,
|
||||
annotationConfig: globalRateLimitAnnotationConfig,
|
||||
}
|
||||
}
|
||||
|
||||
// Parse extracts globalratelimit annotations from the given ingress
|
||||
// and returns them structured as Config type
|
||||
func (a globalratelimit) Parse(ing *networking.Ingress) (interface{}, error) {
|
||||
config := &Config{}
|
||||
|
||||
limit, err := parser.GetIntAnnotation(globalRateLimitAnnotation, ing, a.annotationConfig.Annotations)
|
||||
if err != nil && ing_errors.IsInvalidContent(err) {
|
||||
return nil, err
|
||||
}
|
||||
rawWindowSize, err := parser.GetStringAnnotation(globalRateLimitWindowAnnotation, ing, a.annotationConfig.Annotations)
|
||||
if err != nil && ing_errors.IsValidationError(err) {
|
||||
return config, ing_errors.LocationDeniedError{
|
||||
Reason: fmt.Errorf("failed to parse 'global-rate-limit-window' value: %w", err),
|
||||
}
|
||||
}
|
||||
|
||||
if limit == 0 || rawWindowSize == "" {
|
||||
return config, nil
|
||||
}
|
||||
|
||||
windowSize, err := time.ParseDuration(rawWindowSize)
|
||||
if err != nil {
|
||||
return config, ing_errors.LocationDeniedError{
|
||||
Reason: fmt.Errorf("failed to parse 'global-rate-limit-window' value: %w", err),
|
||||
}
|
||||
}
|
||||
|
||||
key, err := parser.GetStringAnnotation(globalRateLimitKeyAnnotation, ing, a.annotationConfig.Annotations)
|
||||
if err != nil {
|
||||
klog.Warningf("invalid %s, defaulting to %s", globalRateLimitKeyAnnotation, defaultKey)
|
||||
}
|
||||
if key == "" {
|
||||
key = defaultKey
|
||||
}
|
||||
|
||||
rawIgnoredCIDRs, err := parser.GetStringAnnotation(globalRateLimitIgnoredCidrsAnnotation, ing, a.annotationConfig.Annotations)
|
||||
if err != nil && ing_errors.IsInvalidContent(err) {
|
||||
return nil, err
|
||||
}
|
||||
ignoredCIDRs, err := net.ParseCIDRs(rawIgnoredCIDRs)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
config.Namespace = strings.ReplaceAll(string(ing.UID), "-", "")
|
||||
config.Limit = limit
|
||||
config.WindowSize = int(windowSize.Seconds())
|
||||
config.Key = key
|
||||
config.IgnoredCIDRs = ignoredCIDRs
|
||||
|
||||
return config, nil
|
||||
}
|
||||
|
||||
func (a globalratelimit) GetDocumentation() parser.AnnotationFields {
|
||||
return a.annotationConfig.Annotations
|
||||
}
|
||||
|
||||
func (a globalratelimit) Validate(anns map[string]string) error {
|
||||
maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel)
|
||||
return parser.CheckAnnotationRisk(anns, maxrisk, globalRateLimitAnnotationConfig.Annotations)
|
||||
}
|
||||
|
|
@ -1,211 +0,0 @@
|
|||
/*
|
||||
Copyright 2020 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package globalratelimit
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
api "k8s.io/api/core/v1"
|
||||
networking "k8s.io/api/networking/v1"
|
||||
meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
|
||||
ing_errors "k8s.io/ingress-nginx/internal/ingress/errors"
|
||||
"k8s.io/ingress-nginx/internal/ingress/resolver"
|
||||
)
|
||||
|
||||
const (
|
||||
UID = "31285d47-b150-4dcf-bd6f-12c46d769f6e"
|
||||
expectedUID = "31285d47b1504dcfbd6f12c46d769f6e"
|
||||
)
|
||||
|
||||
func buildIngress() *networking.Ingress {
|
||||
defaultBackend := networking.IngressBackend{
|
||||
Service: &networking.IngressServiceBackend{
|
||||
Name: "default-backend",
|
||||
Port: networking.ServiceBackendPort{
|
||||
Number: 80,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
return &networking.Ingress{
|
||||
ObjectMeta: meta_v1.ObjectMeta{
|
||||
Name: "foo",
|
||||
Namespace: api.NamespaceDefault,
|
||||
UID: UID,
|
||||
},
|
||||
Spec: networking.IngressSpec{
|
||||
DefaultBackend: &networking.IngressBackend{
|
||||
Service: &networking.IngressServiceBackend{
|
||||
Name: "default-backend",
|
||||
Port: networking.ServiceBackendPort{
|
||||
Number: 80,
|
||||
},
|
||||
},
|
||||
},
|
||||
Rules: []networking.IngressRule{
|
||||
{
|
||||
Host: "foo.bar.com",
|
||||
IngressRuleValue: networking.IngressRuleValue{
|
||||
HTTP: &networking.HTTPIngressRuleValue{
|
||||
Paths: []networking.HTTPIngressPath{
|
||||
{
|
||||
Path: "/foo",
|
||||
Backend: defaultBackend,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
type mockBackend struct {
|
||||
resolver.Mock
|
||||
}
|
||||
|
||||
func TestGlobalRateLimiting(t *testing.T) {
|
||||
ing := buildIngress()
|
||||
|
||||
annRateLimit := parser.GetAnnotationWithPrefix("global-rate-limit")
|
||||
annRateLimitWindow := parser.GetAnnotationWithPrefix("global-rate-limit-window")
|
||||
annRateLimitKey := parser.GetAnnotationWithPrefix("global-rate-limit-key")
|
||||
annRateLimitIgnoredCIDRs := parser.GetAnnotationWithPrefix("global-rate-limit-ignored-cidrs")
|
||||
|
||||
testCases := []struct {
|
||||
title string
|
||||
annotations map[string]string
|
||||
expectedConfig *Config
|
||||
expectedErr error
|
||||
}{
|
||||
{
|
||||
"no annotation",
|
||||
nil,
|
||||
&Config{},
|
||||
nil,
|
||||
},
|
||||
{
|
||||
"minimum required annotations",
|
||||
map[string]string{
|
||||
annRateLimit: "100",
|
||||
annRateLimitWindow: "2m",
|
||||
},
|
||||
&Config{
|
||||
Namespace: expectedUID,
|
||||
Limit: 100,
|
||||
WindowSize: 120,
|
||||
Key: "$remote_addr",
|
||||
IgnoredCIDRs: make([]string, 0),
|
||||
},
|
||||
nil,
|
||||
},
|
||||
{
|
||||
"global-rate-limit-key annotation",
|
||||
map[string]string{
|
||||
annRateLimit: "100",
|
||||
annRateLimitWindow: "2m",
|
||||
annRateLimitKey: "$http_x_api_user",
|
||||
},
|
||||
&Config{
|
||||
Namespace: expectedUID,
|
||||
Limit: 100,
|
||||
WindowSize: 120,
|
||||
Key: "$http_x_api_user",
|
||||
IgnoredCIDRs: make([]string, 0),
|
||||
},
|
||||
nil,
|
||||
},
|
||||
{
|
||||
"global-rate-limit-ignored-cidrs annotation",
|
||||
map[string]string{
|
||||
annRateLimit: "100",
|
||||
annRateLimitWindow: "2m",
|
||||
annRateLimitKey: "$http_x_api_user",
|
||||
annRateLimitIgnoredCIDRs: "127.0.0.1, 200.200.24.0/24",
|
||||
},
|
||||
&Config{
|
||||
Namespace: expectedUID,
|
||||
Limit: 100,
|
||||
WindowSize: 120,
|
||||
Key: "$http_x_api_user",
|
||||
IgnoredCIDRs: []string{"127.0.0.1", "200.200.24.0/24"},
|
||||
},
|
||||
nil,
|
||||
},
|
||||
{
|
||||
"global-rate-limit-complex-key",
|
||||
map[string]string{
|
||||
annRateLimit: "100",
|
||||
annRateLimitWindow: "2m",
|
||||
annRateLimitKey: "${http_x_api_user}${otherinfo}",
|
||||
},
|
||||
&Config{
|
||||
Namespace: expectedUID,
|
||||
Limit: 100,
|
||||
WindowSize: 120,
|
||||
Key: "${http_x_api_user}${otherinfo}",
|
||||
IgnoredCIDRs: make([]string, 0),
|
||||
},
|
||||
nil,
|
||||
},
|
||||
{
|
||||
"incorrect duration for window",
|
||||
map[string]string{
|
||||
annRateLimit: "100",
|
||||
annRateLimitWindow: "2mb",
|
||||
annRateLimitKey: "$http_x_api_user",
|
||||
},
|
||||
&Config{},
|
||||
ing_errors.ValidationError{
|
||||
Reason: fmt.Errorf("failed to parse 'global-rate-limit-window' value: annotation nginx.ingress.kubernetes.io/global-rate-limit-window contains invalid value"),
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, testCase := range testCases {
|
||||
ing.SetAnnotations(testCase.annotations)
|
||||
|
||||
i, actualErr := NewParser(mockBackend{}).Parse(ing)
|
||||
if (testCase.expectedErr == nil || actualErr == nil) && testCase.expectedErr != actualErr {
|
||||
t.Errorf("%s expected error '%v' but got '%v'", testCase.title, testCase.expectedErr, actualErr)
|
||||
} else if testCase.expectedErr != nil && actualErr != nil &&
|
||||
testCase.expectedErr.Error() != actualErr.Error() {
|
||||
t.Errorf("expected error '%v' but got '%v'", testCase.expectedErr, actualErr)
|
||||
}
|
||||
|
||||
actualConfig, ok := i.(*Config)
|
||||
if !ok {
|
||||
t.Errorf("expected Config type but got %T", i)
|
||||
}
|
||||
if !testCase.expectedConfig.Equal(actualConfig) {
|
||||
expectedJSON, err := json.Marshal(testCase.expectedConfig)
|
||||
if err != nil {
|
||||
t.Errorf("failed to marshal expected config: %v", err)
|
||||
}
|
||||
actualJSON, err := json.Marshal(actualConfig)
|
||||
if err != nil {
|
||||
t.Errorf("failed to marshal actual config: %v", err)
|
||||
}
|
||||
t.Errorf("%v: expected config '%s' but got '%s'", testCase.title, expectedJSON, actualJSON)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -44,7 +44,7 @@ var (
|
|||
alphaNumericChars = `\-\.\_\~a-zA-Z0-9\/:`
|
||||
extendedAlphaNumeric = alphaNumericChars + ", "
|
||||
regexEnabledChars = regexp.QuoteMeta(`^$[](){}*+?|&=\`)
|
||||
urlEnabledChars = regexp.QuoteMeta(`:?&=`)
|
||||
urlEnabledChars = regexp.QuoteMeta(`,:?&=`)
|
||||
)
|
||||
|
||||
// IsValidRegex checks if the tested string can be used as a regex, but without any weird character.
|
||||
|
|
|
|||
|
|
@ -55,6 +55,11 @@ func TestValidateArrayOfServerName(t *testing.T) {
|
|||
value: "*.so*mething.com,bla.com",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "should allow comma separated query params",
|
||||
value: "https://oauth.example/oauth2/auth?allowed_groups=gid1,gid2",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "should deny names with weird characters",
|
||||
value: "something.com,lolo;xpto.com,nothing.com",
|
||||
|
|
|
|||
|
|
@ -28,7 +28,10 @@ import (
|
|||
"k8s.io/ingress-nginx/internal/ingress/resolver"
|
||||
)
|
||||
|
||||
const defaultPermanentRedirectCode = http.StatusMovedPermanently
|
||||
const (
|
||||
defaultPermanentRedirectCode = http.StatusMovedPermanently
|
||||
defaultTemporalRedirectCode = http.StatusFound
|
||||
)
|
||||
|
||||
// Config returns the redirect configuration for an Ingress rule
|
||||
type Config struct {
|
||||
|
|
@ -40,6 +43,7 @@ type Config struct {
|
|||
const (
|
||||
fromToWWWRedirAnnotation = "from-to-www-redirect"
|
||||
temporalRedirectAnnotation = "temporal-redirect"
|
||||
temporalRedirectAnnotationCode = "temporal-redirect-code"
|
||||
permanentRedirectAnnotation = "permanent-redirect"
|
||||
permanentRedirectAnnotationCode = "permanent-redirect-code"
|
||||
)
|
||||
|
|
@ -60,6 +64,12 @@ var redirectAnnotations = parser.Annotation{
|
|||
Documentation: `This annotation allows you to return a temporal redirect (Return Code 302) instead of sending data to the upstream.
|
||||
For example setting this annotation to https://www.google.com would redirect everything to Google with a Return Code of 302 (Moved Temporarily).`,
|
||||
},
|
||||
temporalRedirectAnnotationCode: {
|
||||
Validator: parser.ValidateInt,
|
||||
Scope: parser.AnnotationScopeLocation,
|
||||
Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options
|
||||
Documentation: `This annotation allows you to modify the status code used for temporal redirects.`,
|
||||
},
|
||||
permanentRedirectAnnotation: {
|
||||
Validator: parser.ValidateRegex(parser.URLIsValidRegex, false),
|
||||
Scope: parser.AnnotationScopeLocation,
|
||||
|
|
@ -105,13 +115,22 @@ func (r redirect) Parse(ing *networking.Ingress) (interface{}, error) {
|
|||
}
|
||||
|
||||
if tr != "" {
|
||||
trc, err := parser.GetIntAnnotation(temporalRedirectAnnotationCode, ing, r.annotationConfig.Annotations)
|
||||
if err != nil && !errors.IsMissingAnnotations(err) {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if trc < http.StatusMultipleChoices || trc > http.StatusTemporaryRedirect {
|
||||
trc = defaultTemporalRedirectCode
|
||||
}
|
||||
|
||||
if err := isValidURL(tr); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return &Config{
|
||||
URL: tr,
|
||||
Code: http.StatusFound,
|
||||
Code: trc,
|
||||
FromToWWW: r3w,
|
||||
}, nil
|
||||
}
|
||||
|
|
|
|||
|
|
@ -103,7 +103,7 @@ func TestPermanentRedirectWithCustomCode(t *testing.T) {
|
|||
}
|
||||
}
|
||||
|
||||
func TestTemporalRedirect(t *testing.T) {
|
||||
func TestTemporalRedirectWithDefaultCode(t *testing.T) {
|
||||
rp := NewParser(resolver.Mock{})
|
||||
if rp == nil {
|
||||
t.Fatalf("Expected a parser.IngressAnnotation but returned nil")
|
||||
|
|
@ -128,10 +128,49 @@ func TestTemporalRedirect(t *testing.T) {
|
|||
t.Errorf("Expected %v as redirect but returned %s", defRedirectURL, redirect.URL)
|
||||
}
|
||||
if redirect.Code != http.StatusFound {
|
||||
t.Errorf("Expected %v as redirect to have a code %d but had %d", defRedirectURL, defaultPermanentRedirectCode, redirect.Code)
|
||||
t.Errorf("Expected %v as redirect to have a code %d but had %d", defRedirectURL, http.StatusFound, redirect.Code)
|
||||
}
|
||||
if redirect.FromToWWW != true {
|
||||
t.Errorf("Expected %v as redirect to have from-to-www as %v but got %v", defRedirectURL, true, redirect.FromToWWW)
|
||||
}
|
||||
|
||||
func TestTemporalRedirectWithCustomCode(t *testing.T) {
|
||||
rp := NewParser(resolver.Mock{})
|
||||
if rp == nil {
|
||||
t.Fatalf("Expected a parser.IngressAnnotation but returned nil")
|
||||
}
|
||||
|
||||
testCases := map[string]struct {
|
||||
input int
|
||||
expectOutput int
|
||||
}{
|
||||
"valid code": {http.StatusTemporaryRedirect, http.StatusTemporaryRedirect},
|
||||
"invalid code": {http.StatusTeapot, http.StatusFound},
|
||||
}
|
||||
|
||||
for n, tc := range testCases {
|
||||
t.Run(n, func(t *testing.T) {
|
||||
ing := new(networking.Ingress)
|
||||
|
||||
data := make(map[string]string, 2)
|
||||
data[parser.GetAnnotationWithPrefix(fromToWWWRedirAnnotation)] = "true"
|
||||
data[parser.GetAnnotationWithPrefix(temporalRedirectAnnotation)] = defRedirectURL
|
||||
data[parser.GetAnnotationWithPrefix(temporalRedirectAnnotationCode)] = strconv.Itoa(tc.input)
|
||||
ing.SetAnnotations(data)
|
||||
|
||||
i, err := rp.Parse(ing)
|
||||
if err != nil {
|
||||
t.Errorf("Unexpected error with ingress: %v", err)
|
||||
}
|
||||
redirect, ok := i.(*Config)
|
||||
if !ok {
|
||||
t.Errorf("Expected a Redirect type")
|
||||
}
|
||||
if redirect.URL != defRedirectURL {
|
||||
t.Errorf("Expected %v as redirect but returned %s", defRedirectURL, redirect.URL)
|
||||
}
|
||||
if redirect.Code != tc.expectOutput {
|
||||
t.Errorf("Expected %v as redirect to have a code %d but had %d", defRedirectURL, tc.expectOutput, redirect.Code)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -718,31 +718,6 @@ type Configuration struct {
|
|||
// Default: text/html
|
||||
DefaultType string `json:"default-type"`
|
||||
|
||||
// GlobalRateLimitMemcachedHost configures memcached host.
|
||||
GlobalRateLimitMemcachedHost string `json:"global-rate-limit-memcached-host"`
|
||||
|
||||
// GlobalRateLimitMemcachedPort configures memcached port.
|
||||
GlobalRateLimitMemcachedPort int `json:"global-rate-limit-memcached-port"`
|
||||
|
||||
// GlobalRateLimitMemcachedConnectTimeout configures timeout when connecting to memcached.
|
||||
// The unit is millisecond.
|
||||
GlobalRateLimitMemcachedConnectTimeout int `json:"global-rate-limit-memcached-connect-timeout"`
|
||||
|
||||
// GlobalRateLimitMemcachedMaxIdleTimeout configured how long connections
|
||||
// should be kept alive in idle state. The unit is millisecond.
|
||||
GlobalRateLimitMemcachedMaxIdleTimeout int `json:"global-rate-limit-memcached-max-idle-timeout"`
|
||||
|
||||
// GlobalRateLimitMemcachedPoolSize configures how many connections
|
||||
// should be kept alive in the pool.
|
||||
// Note that this is per NGINX worker. Make sure your memcached server can
|
||||
// handle `MemcachedPoolSize * <nginx worker count> * <nginx replica count>`
|
||||
// simultaneous connections.
|
||||
GlobalRateLimitMemcachedPoolSize int `json:"global-rate-limit-memcached-pool-size"`
|
||||
|
||||
// GlobalRateLimitStatusCode determines the HTTP status code to return
|
||||
// when limit is exceeding during global rate limiting.
|
||||
GlobalRateLimitStatusCode int `json:"global-rate-limit-status-code"`
|
||||
|
||||
// DebugConnections Enables debugging log for selected client connections
|
||||
// http://nginx.org/en/docs/ngx_core_module.html#debug_connection
|
||||
// Default: ""
|
||||
|
|
@ -776,10 +751,10 @@ func NewDefault() Configuration {
|
|||
|
||||
cfg := Configuration{
|
||||
AllowSnippetAnnotations: false,
|
||||
AllowCrossNamespaceResources: true,
|
||||
AllowCrossNamespaceResources: false,
|
||||
AllowBackendServerHeader: false,
|
||||
AnnotationValueWordBlocklist: "",
|
||||
AnnotationsRiskLevel: "Critical",
|
||||
AnnotationsRiskLevel: "High",
|
||||
AccessLogPath: "/var/log/nginx/access.log",
|
||||
AccessLogParams: "",
|
||||
EnableAccessLogForDefaultBackend: false,
|
||||
|
|
@ -893,39 +868,34 @@ func NewDefault() Configuration {
|
|||
ServiceUpstream: false,
|
||||
AllowedResponseHeaders: []string{},
|
||||
},
|
||||
UpstreamKeepaliveConnections: 320,
|
||||
UpstreamKeepaliveTime: "1h",
|
||||
UpstreamKeepaliveTimeout: 60,
|
||||
UpstreamKeepaliveRequests: 10000,
|
||||
LimitConnZoneVariable: defaultLimitConnZoneVariable,
|
||||
BindAddressIpv4: defBindAddress,
|
||||
BindAddressIpv6: defBindAddress,
|
||||
OpentelemetryTrustIncomingSpan: true,
|
||||
OpentelemetryConfig: "/etc/ingress-controller/telemetry/opentelemetry.toml",
|
||||
OtlpCollectorPort: "4317",
|
||||
OtelServiceName: "nginx",
|
||||
OtelSampler: "AlwaysOn",
|
||||
OtelSamplerRatio: 0.01,
|
||||
OtelSamplerParentBased: true,
|
||||
OtelScheduleDelayMillis: 5000,
|
||||
OtelMaxExportBatchSize: 512,
|
||||
OtelMaxQueueSize: 2048,
|
||||
LimitReqStatusCode: 503,
|
||||
LimitConnStatusCode: 503,
|
||||
SyslogPort: 514,
|
||||
NoTLSRedirectLocations: "/.well-known/acme-challenge",
|
||||
NoAuthLocations: "/.well-known/acme-challenge",
|
||||
GlobalExternalAuth: defGlobalExternalAuth,
|
||||
ProxySSLLocationOnly: false,
|
||||
DefaultType: "text/html",
|
||||
GlobalRateLimitMemcachedPort: 11211,
|
||||
GlobalRateLimitMemcachedConnectTimeout: 50,
|
||||
GlobalRateLimitMemcachedMaxIdleTimeout: 10000,
|
||||
GlobalRateLimitMemcachedPoolSize: 50,
|
||||
GlobalRateLimitStatusCode: 429,
|
||||
DebugConnections: []string{},
|
||||
StrictValidatePathType: false, // TODO: This will be true in future releases
|
||||
GRPCBufferSizeKb: 0,
|
||||
UpstreamKeepaliveConnections: 320,
|
||||
UpstreamKeepaliveTime: "1h",
|
||||
UpstreamKeepaliveTimeout: 60,
|
||||
UpstreamKeepaliveRequests: 10000,
|
||||
LimitConnZoneVariable: defaultLimitConnZoneVariable,
|
||||
BindAddressIpv4: defBindAddress,
|
||||
BindAddressIpv6: defBindAddress,
|
||||
OpentelemetryTrustIncomingSpan: true,
|
||||
OpentelemetryConfig: "/etc/ingress-controller/telemetry/opentelemetry.toml",
|
||||
OtlpCollectorPort: "4317",
|
||||
OtelServiceName: "nginx",
|
||||
OtelSampler: "AlwaysOn",
|
||||
OtelSamplerRatio: 0.01,
|
||||
OtelSamplerParentBased: true,
|
||||
OtelScheduleDelayMillis: 5000,
|
||||
OtelMaxExportBatchSize: 512,
|
||||
OtelMaxQueueSize: 2048,
|
||||
LimitReqStatusCode: 503,
|
||||
LimitConnStatusCode: 503,
|
||||
SyslogPort: 514,
|
||||
NoTLSRedirectLocations: "/.well-known/acme-challenge",
|
||||
NoAuthLocations: "/.well-known/acme-challenge",
|
||||
GlobalExternalAuth: defGlobalExternalAuth,
|
||||
ProxySSLLocationOnly: false,
|
||||
DefaultType: "text/html",
|
||||
DebugConnections: []string{},
|
||||
StrictValidatePathType: true,
|
||||
GRPCBufferSizeKb: 0,
|
||||
}
|
||||
|
||||
if klog.V(5).Enabled() {
|
||||
|
|
|
|||
|
|
@ -105,11 +105,14 @@ type Configuration struct {
|
|||
|
||||
EnableProfiling bool
|
||||
|
||||
EnableMetrics bool
|
||||
MetricsPerHost bool
|
||||
MetricsBuckets *collectors.HistogramBuckets
|
||||
ReportStatusClasses bool
|
||||
ExcludeSocketMetrics []string
|
||||
EnableMetrics bool
|
||||
MetricsPerHost bool
|
||||
MetricsPerUndefinedHost bool
|
||||
MetricsBuckets *collectors.HistogramBuckets
|
||||
MetricsBucketFactor float64
|
||||
MetricsMaxBuckets uint32
|
||||
ReportStatusClasses bool
|
||||
ExcludeSocketMetrics []string
|
||||
|
||||
FakeCertificate *ingress.SSLCert
|
||||
|
||||
|
|
@ -377,10 +380,6 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error {
|
|||
if !cfg.AllowSnippetAnnotations && strings.HasSuffix(key, "-snippet") {
|
||||
return fmt.Errorf("%s annotation cannot be used. Snippet directives are disabled by the Ingress administrator", key)
|
||||
}
|
||||
|
||||
if cfg.GlobalRateLimitMemcachedHost == "" && strings.HasPrefix(key, fmt.Sprintf("%s/%s", parser.AnnotationsPrefix, "global-rate-limit")) {
|
||||
return fmt.Errorf("'global-rate-limit*' annotations require 'global-rate-limit-memcached-host' settings configured in the global configmap")
|
||||
}
|
||||
}
|
||||
|
||||
k8s.SetDefaultNGINXPathType(ing)
|
||||
|
|
@ -1514,7 +1513,6 @@ func locationApplyAnnotations(loc *ingress.Location, anns *annotations.Ingress)
|
|||
loc.Proxy = anns.Proxy
|
||||
loc.ProxySSL = anns.ProxySSL
|
||||
loc.RateLimit = anns.RateLimit
|
||||
loc.GlobalRateLimit = anns.GlobalRateLimit
|
||||
loc.Redirect = anns.Redirect
|
||||
loc.Rewrite = anns.Rewrite
|
||||
loc.UpstreamVhost = anns.UpstreamVhost
|
||||
|
|
|
|||
|
|
@ -82,7 +82,6 @@ var (
|
|||
"balancer_ewma_locks": 1024,
|
||||
"certificate_servers": 5120,
|
||||
"ocsp_response_cache": 5120, // keep this same as certificate_servers
|
||||
"global_throttle_cache": 10240,
|
||||
}
|
||||
defaultGlobalAuthRedirectParam = "rd"
|
||||
)
|
||||
|
|
|
|||
|
|
@ -403,12 +403,6 @@ func configForLua(input interface{}) string {
|
|||
hsts_include_subdomains = %t,
|
||||
hsts_preload = %t,
|
||||
|
||||
global_throttle = {
|
||||
memcached = {
|
||||
host = "%v", port = %d, connect_timeout = %d, max_idle_timeout = %d, pool_size = %d,
|
||||
},
|
||||
status_code = %d,
|
||||
}
|
||||
}`,
|
||||
all.Cfg.UseForwardedHeaders,
|
||||
all.Cfg.UseProxyProtocol,
|
||||
|
|
@ -421,13 +415,6 @@ func configForLua(input interface{}) string {
|
|||
all.Cfg.HSTSMaxAge,
|
||||
all.Cfg.HSTSIncludeSubdomains,
|
||||
all.Cfg.HSTSPreload,
|
||||
|
||||
all.Cfg.GlobalRateLimitMemcachedHost,
|
||||
all.Cfg.GlobalRateLimitMemcachedPort,
|
||||
all.Cfg.GlobalRateLimitMemcachedConnectTimeout,
|
||||
all.Cfg.GlobalRateLimitMemcachedMaxIdleTimeout,
|
||||
all.Cfg.GlobalRateLimitMemcachedPoolSize,
|
||||
all.Cfg.GlobalRateLimitStatusCode,
|
||||
)
|
||||
}
|
||||
|
||||
|
|
@ -445,30 +432,18 @@ func locationConfigForLua(l, a interface{}) string {
|
|||
return "{}"
|
||||
}
|
||||
|
||||
ignoredCIDRs, err := convertGoSliceIntoLuaTable(location.GlobalRateLimit.IgnoredCIDRs, false)
|
||||
if err != nil {
|
||||
klog.Errorf("failed to convert %v into Lua table: %q", location.GlobalRateLimit.IgnoredCIDRs, err)
|
||||
ignoredCIDRs = "{}"
|
||||
}
|
||||
|
||||
return fmt.Sprintf(`{
|
||||
force_ssl_redirect = %t,
|
||||
ssl_redirect = %t,
|
||||
force_no_ssl_redirect = %t,
|
||||
preserve_trailing_slash = %t,
|
||||
use_port_in_redirects = %t,
|
||||
global_throttle = { namespace = "%v", limit = %d, window_size = %d, key = %v, ignored_cidrs = %v },
|
||||
}`,
|
||||
location.Rewrite.ForceSSLRedirect,
|
||||
location.Rewrite.SSLRedirect,
|
||||
isLocationInLocationList(l, all.Cfg.NoTLSRedirectLocations),
|
||||
location.Rewrite.PreserveTrailingSlash,
|
||||
location.UsePortInRedirects,
|
||||
location.GlobalRateLimit.Namespace,
|
||||
location.GlobalRateLimit.Limit,
|
||||
location.GlobalRateLimit.WindowSize,
|
||||
parseComplexNginxVarIntoLuaTable(location.GlobalRateLimit.Key),
|
||||
ignoredCIDRs,
|
||||
)
|
||||
}
|
||||
|
||||
|
|
@ -1690,54 +1665,6 @@ func buildServerName(hostname string) string {
|
|||
return `~^(?<subdomain>[\w-]+)\.` + strings.Join(parts, "\\.") + `$`
|
||||
}
|
||||
|
||||
// parseComplexNginxVarIntoLuaTable parses things like "$my${complex}ngx\$var" into
|
||||
// [["$var", "complex", "my", "ngx"]]. In other words, 2nd and 3rd elements
|
||||
// in the result are actual NGINX variable names, whereas first and 4th elements
|
||||
// are string literals.
|
||||
func parseComplexNginxVarIntoLuaTable(ngxVar string) string {
|
||||
r := regexp.MustCompile(`(\\\$[0-9a-zA-Z_]+)|\$\{([0-9a-zA-Z_]+)\}|\$([0-9a-zA-Z_]+)|(\$|[^$\\]+)`)
|
||||
matches := r.FindAllStringSubmatch(ngxVar, -1)
|
||||
components := make([][]string, len(matches))
|
||||
for i, match := range matches {
|
||||
components[i] = match[1:]
|
||||
}
|
||||
|
||||
luaTable, err := convertGoSliceIntoLuaTable(components, true)
|
||||
if err != nil {
|
||||
klog.Errorf("unexpected error: %v", err)
|
||||
luaTable = "{}"
|
||||
}
|
||||
return luaTable
|
||||
}
|
||||
|
||||
func convertGoSliceIntoLuaTable(goSliceInterface interface{}, emptyStringAsNil bool) (string, error) {
|
||||
goSlice := reflect.ValueOf(goSliceInterface)
|
||||
kind := goSlice.Kind()
|
||||
|
||||
switch kind {
|
||||
case reflect.String:
|
||||
if emptyStringAsNil && goSlice.Interface().(string) == "" {
|
||||
return "nil", nil
|
||||
}
|
||||
return fmt.Sprintf(`"%v"`, goSlice.Interface()), nil
|
||||
case reflect.Int, reflect.Bool:
|
||||
return fmt.Sprintf(`%v`, goSlice.Interface()), nil
|
||||
case reflect.Slice, reflect.Array:
|
||||
luaTable := "{ "
|
||||
for i := 0; i < goSlice.Len(); i++ {
|
||||
luaEl, err := convertGoSliceIntoLuaTable(goSlice.Index(i).Interface(), emptyStringAsNil)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
luaTable = luaTable + luaEl + ", "
|
||||
}
|
||||
luaTable += "}"
|
||||
return luaTable, nil
|
||||
default:
|
||||
return "", fmt.Errorf("could not process type: %s", kind)
|
||||
}
|
||||
}
|
||||
|
||||
func buildOriginRegex(origin string) string {
|
||||
origin = regexp.QuoteMeta(origin)
|
||||
origin = strings.Replace(origin, "\\*", `[A-Za-z0-9\-]+`, 1)
|
||||
|
|
|
|||
|
|
@ -1926,89 +1926,6 @@ func TestBuildServerName(t *testing.T) {
|
|||
}
|
||||
}
|
||||
|
||||
func TestParseComplexNginxVarIntoLuaTable(t *testing.T) {
|
||||
testCases := []struct {
|
||||
ngxVar string
|
||||
expectedLuaTable string
|
||||
}{
|
||||
{"foo", `{ { nil, nil, nil, "foo", }, }`},
|
||||
{"$foo", `{ { nil, nil, "foo", nil, }, }`},
|
||||
{"${foo}", `{ { nil, "foo", nil, nil, }, }`},
|
||||
{"\\$foo", `{ { "\$foo", nil, nil, nil, }, }`},
|
||||
{
|
||||
"foo\\$bar$baz${daz}xiyar$pomidor",
|
||||
`{ { nil, nil, nil, "foo", }, { "\$bar", nil, nil, nil, }, { nil, nil, "baz", nil, }, ` +
|
||||
`{ nil, "daz", nil, nil, }, { nil, nil, nil, "xiyar", }, { nil, nil, "pomidor", nil, }, }`,
|
||||
},
|
||||
}
|
||||
|
||||
for _, testCase := range testCases {
|
||||
actualLuaTable := parseComplexNginxVarIntoLuaTable(testCase.ngxVar)
|
||||
if actualLuaTable != testCase.expectedLuaTable {
|
||||
t.Errorf("expected %v but returned %v", testCase.expectedLuaTable, actualLuaTable)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestConvertGoSliceIntoLuaTablet(t *testing.T) {
|
||||
testCases := []struct {
|
||||
title string
|
||||
goSlice interface{}
|
||||
emptyStringAsNil bool
|
||||
expectedLuaTable string
|
||||
expectedErr error
|
||||
}{
|
||||
{
|
||||
"flat string slice",
|
||||
[]string{"one", "two", "three"},
|
||||
false,
|
||||
`{ "one", "two", "three", }`,
|
||||
nil,
|
||||
},
|
||||
{
|
||||
"nested string slice",
|
||||
[][]string{{"one", "", "three"}, {"foo", "bar"}},
|
||||
false,
|
||||
`{ { "one", "", "three", }, { "foo", "bar", }, }`,
|
||||
nil,
|
||||
},
|
||||
{
|
||||
"converts empty string to nil when enabled",
|
||||
[][]string{{"one", "", "three"}, {"foo", "bar"}},
|
||||
true,
|
||||
`{ { "one", nil, "three", }, { "foo", "bar", }, }`,
|
||||
nil,
|
||||
},
|
||||
{
|
||||
"boolean slice",
|
||||
[]bool{true, true, false},
|
||||
false,
|
||||
`{ true, true, false, }`,
|
||||
nil,
|
||||
},
|
||||
{
|
||||
"integer slice",
|
||||
[]int{4, 3, 6},
|
||||
false,
|
||||
`{ 4, 3, 6, }`,
|
||||
nil,
|
||||
},
|
||||
}
|
||||
|
||||
for _, testCase := range testCases {
|
||||
actualLuaTable, err := convertGoSliceIntoLuaTable(testCase.goSlice, testCase.emptyStringAsNil)
|
||||
if testCase.expectedErr != nil && err != nil && testCase.expectedErr.Error() != err.Error() {
|
||||
t.Errorf("expected error '%v' but returned '%v'", testCase.expectedErr, err)
|
||||
}
|
||||
if testCase.expectedErr == nil && err != nil {
|
||||
t.Errorf("expected error to be nil but returned '%v'", err)
|
||||
}
|
||||
if testCase.expectedLuaTable != actualLuaTable {
|
||||
t.Errorf("%v: expected '%v' but returned '%v'", testCase.title, testCase.expectedLuaTable, actualLuaTable)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestCleanConf(t *testing.T) {
|
||||
testDataDir, err := getTestDataDir()
|
||||
if err != nil {
|
||||
|
|
|
|||
|
|
@ -81,8 +81,9 @@ type SocketCollector struct {
|
|||
|
||||
hosts sets.Set[string]
|
||||
|
||||
metricsPerHost bool
|
||||
reportStatusClasses bool
|
||||
metricsPerHost bool
|
||||
metricsPerUndefinedHost bool
|
||||
reportStatusClasses bool
|
||||
}
|
||||
|
||||
var requestTags = []string{
|
||||
|
|
@ -99,7 +100,7 @@ var requestTags = []string{
|
|||
|
||||
// NewSocketCollector creates a new SocketCollector instance using
|
||||
// the ingress watch namespace and class used by the controller
|
||||
func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStatusClasses bool, buckets HistogramBuckets, excludeMetrics []string) (*SocketCollector, error) {
|
||||
func NewSocketCollector(pod, namespace, class string, metricsPerHost, metricsPerUndefinedHost, reportStatusClasses bool, buckets HistogramBuckets, bucketFactor float64, maxBuckets uint32, excludeMetrics []string) (*SocketCollector, error) {
|
||||
socket := "/tmp/nginx/prometheus-nginx.socket"
|
||||
// unix sockets must be unlink()ed before being used
|
||||
//nolint:errcheck // Ignore unlink error
|
||||
|
|
@ -139,16 +140,19 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat
|
|||
sc := &SocketCollector{
|
||||
listener: listener,
|
||||
|
||||
metricsPerHost: metricsPerHost,
|
||||
reportStatusClasses: reportStatusClasses,
|
||||
metricsPerHost: metricsPerHost,
|
||||
metricsPerUndefinedHost: metricsPerUndefinedHost,
|
||||
reportStatusClasses: reportStatusClasses,
|
||||
|
||||
connectTime: histogramMetric(
|
||||
&prometheus.HistogramOpts{
|
||||
Name: "connect_duration_seconds",
|
||||
Help: "The time spent on establishing a connection with the upstream server",
|
||||
Namespace: PrometheusNamespace,
|
||||
ConstLabels: constLabels,
|
||||
Buckets: buckets.TimeBuckets,
|
||||
Name: "connect_duration_seconds",
|
||||
Help: "The time spent on establishing a connection with the upstream server",
|
||||
Namespace: PrometheusNamespace,
|
||||
ConstLabels: constLabels,
|
||||
Buckets: buckets.TimeBuckets,
|
||||
NativeHistogramBucketFactor: bucketFactor,
|
||||
NativeHistogramMaxBucketNumber: maxBuckets,
|
||||
},
|
||||
requestTags,
|
||||
em,
|
||||
|
|
@ -157,11 +161,13 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat
|
|||
|
||||
headerTime: histogramMetric(
|
||||
&prometheus.HistogramOpts{
|
||||
Name: "header_duration_seconds",
|
||||
Help: "The time spent on receiving first header from the upstream server",
|
||||
Namespace: PrometheusNamespace,
|
||||
ConstLabels: constLabels,
|
||||
Buckets: buckets.TimeBuckets,
|
||||
Name: "header_duration_seconds",
|
||||
Help: "The time spent on receiving first header from the upstream server",
|
||||
Namespace: PrometheusNamespace,
|
||||
ConstLabels: constLabels,
|
||||
Buckets: buckets.TimeBuckets,
|
||||
NativeHistogramBucketFactor: bucketFactor,
|
||||
NativeHistogramMaxBucketNumber: maxBuckets,
|
||||
},
|
||||
requestTags,
|
||||
em,
|
||||
|
|
@ -169,11 +175,13 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat
|
|||
),
|
||||
responseTime: histogramMetric(
|
||||
&prometheus.HistogramOpts{
|
||||
Name: "response_duration_seconds",
|
||||
Help: "The time spent on receiving the response from the upstream server",
|
||||
Namespace: PrometheusNamespace,
|
||||
ConstLabels: constLabels,
|
||||
Buckets: buckets.TimeBuckets,
|
||||
Name: "response_duration_seconds",
|
||||
Help: "The time spent on receiving the response from the upstream server",
|
||||
Namespace: PrometheusNamespace,
|
||||
ConstLabels: constLabels,
|
||||
Buckets: buckets.TimeBuckets,
|
||||
NativeHistogramBucketFactor: bucketFactor,
|
||||
NativeHistogramMaxBucketNumber: maxBuckets,
|
||||
},
|
||||
requestTags,
|
||||
em,
|
||||
|
|
@ -182,11 +190,13 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat
|
|||
|
||||
requestTime: histogramMetric(
|
||||
&prometheus.HistogramOpts{
|
||||
Name: "request_duration_seconds",
|
||||
Help: "The request processing time in milliseconds",
|
||||
Namespace: PrometheusNamespace,
|
||||
ConstLabels: constLabels,
|
||||
Buckets: buckets.TimeBuckets,
|
||||
Name: "request_duration_seconds",
|
||||
Help: "The request processing time in milliseconds",
|
||||
Namespace: PrometheusNamespace,
|
||||
ConstLabels: constLabels,
|
||||
Buckets: buckets.TimeBuckets,
|
||||
NativeHistogramBucketFactor: bucketFactor,
|
||||
NativeHistogramMaxBucketNumber: maxBuckets,
|
||||
},
|
||||
requestTags,
|
||||
em,
|
||||
|
|
@ -195,11 +205,13 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat
|
|||
|
||||
responseLength: histogramMetric(
|
||||
&prometheus.HistogramOpts{
|
||||
Name: "response_size",
|
||||
Help: "The response length (including request line, header, and request body)",
|
||||
Namespace: PrometheusNamespace,
|
||||
ConstLabels: constLabels,
|
||||
Buckets: buckets.LengthBuckets,
|
||||
Name: "response_size",
|
||||
Help: "The response length (including request line, header, and request body)",
|
||||
Namespace: PrometheusNamespace,
|
||||
ConstLabels: constLabels,
|
||||
Buckets: buckets.LengthBuckets,
|
||||
NativeHistogramBucketFactor: bucketFactor,
|
||||
NativeHistogramMaxBucketNumber: maxBuckets,
|
||||
},
|
||||
requestTags,
|
||||
em,
|
||||
|
|
@ -208,11 +220,13 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat
|
|||
|
||||
requestLength: histogramMetric(
|
||||
&prometheus.HistogramOpts{
|
||||
Name: "request_size",
|
||||
Help: "The request length (including request line, header, and request body)",
|
||||
Namespace: PrometheusNamespace,
|
||||
ConstLabels: constLabels,
|
||||
Buckets: buckets.LengthBuckets,
|
||||
Name: "request_size",
|
||||
Help: "The request length (including request line, header, and request body)",
|
||||
Namespace: PrometheusNamespace,
|
||||
ConstLabels: constLabels,
|
||||
Buckets: buckets.LengthBuckets,
|
||||
NativeHistogramBucketFactor: bucketFactor,
|
||||
NativeHistogramMaxBucketNumber: maxBuckets,
|
||||
},
|
||||
requestTags,
|
||||
em,
|
||||
|
|
@ -294,8 +308,8 @@ func (sc *SocketCollector) handleMessage(msg []byte) {
|
|||
|
||||
for i := range statsBatch {
|
||||
stats := &statsBatch[i]
|
||||
if sc.metricsPerHost && !sc.hosts.Has(stats.Host) {
|
||||
klog.V(3).InfoS("Skipping metric for host not being served", "host", stats.Host)
|
||||
if sc.metricsPerHost && !sc.hosts.Has(stats.Host) && !sc.metricsPerUndefinedHost {
|
||||
klog.V(3).InfoS("Skipping metric for host not explicitly defined in an ingress", "host", stats.Host)
|
||||
continue
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -83,15 +83,19 @@ func TestCollector(t *testing.T) {
|
|||
prometheus.ExponentialBuckets(10, 10, 7),
|
||||
}
|
||||
|
||||
bucketFactor := 1.1
|
||||
maxBuckets := uint32(100)
|
||||
|
||||
cases := []struct {
|
||||
name string
|
||||
data []string
|
||||
metrics []string
|
||||
useStatusClasses bool
|
||||
excludeMetrics []string
|
||||
wantBefore string
|
||||
removeIngresses []string
|
||||
wantAfter string
|
||||
name string
|
||||
data []string
|
||||
metrics []string
|
||||
metricsPerUndefinedHost bool
|
||||
useStatusClasses bool
|
||||
excludeMetrics []string
|
||||
wantBefore string
|
||||
removeIngresses []string
|
||||
wantAfter string
|
||||
}{
|
||||
{
|
||||
name: "invalid metric object should not increase prometheus metrics",
|
||||
|
|
@ -588,13 +592,69 @@ func TestCollector(t *testing.T) {
|
|||
nginx_ingress_controller_response_duration_seconds_count{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx"} 1
|
||||
`,
|
||||
},
|
||||
{
|
||||
name: "metrics with a host should not be dropped when the host is not in the hosts slice but metricsPerUndefinedHost is true",
|
||||
data: []string{`[{
|
||||
"host":"wildcard.testshop.com",
|
||||
"status":"200",
|
||||
"bytesSent":150.0,
|
||||
"method":"GET",
|
||||
"path":"/admin",
|
||||
"requestLength":300.0,
|
||||
"requestTime":60.0,
|
||||
"upstreamLatency":1.0,
|
||||
"upstreamHeaderTime":5.0,
|
||||
"upstreamName":"test-upstream",
|
||||
"upstreamIP":"1.1.1.1:8080",
|
||||
"upstreamResponseTime":200,
|
||||
"upstreamStatus":"220",
|
||||
"namespace":"test-app-production",
|
||||
"ingress":"web-yml",
|
||||
"service":"test-app",
|
||||
"canary":""
|
||||
}]`},
|
||||
excludeMetrics: []string{"response_duration_seconds2", "test.*", "nginx_ingress_.*", "response_duration_secon"},
|
||||
metrics: []string{"nginx_ingress_controller_requests"},
|
||||
metricsPerUndefinedHost: true,
|
||||
useStatusClasses: true,
|
||||
wantBefore: `
|
||||
# HELP nginx_ingress_controller_requests The total number of client requests
|
||||
# TYPE nginx_ingress_controller_requests counter
|
||||
nginx_ingress_controller_requests{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="wildcard.testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx"} 1
|
||||
`,
|
||||
},
|
||||
{
|
||||
name: "metrics with a host should be dropped when the host is not in the hosts slice",
|
||||
data: []string{`[{
|
||||
"host":"wildcard.testshop.com",
|
||||
"status":"200",
|
||||
"bytesSent":150.0,
|
||||
"method":"GET",
|
||||
"path":"/admin",
|
||||
"requestLength":300.0,
|
||||
"requestTime":60.0,
|
||||
"upstreamLatency":1.0,
|
||||
"upstreamHeaderTime":5.0,
|
||||
"upstreamName":"test-upstream",
|
||||
"upstreamIP":"1.1.1.1:8080",
|
||||
"upstreamResponseTime":200,
|
||||
"upstreamStatus":"220",
|
||||
"namespace":"test-app-production",
|
||||
"ingress":"web-yml",
|
||||
"service":"test-app",
|
||||
"canary":""
|
||||
}]`},
|
||||
excludeMetrics: []string{"response_duration_seconds2", "test.*", "nginx_ingress_.*", "response_duration_secon"},
|
||||
metrics: []string{"nginx_ingress_controller_requests"},
|
||||
useStatusClasses: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, c := range cases {
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
registry := prometheus.NewPedanticRegistry()
|
||||
|
||||
sc, err := NewSocketCollector("pod", "default", "ingress", true, c.useStatusClasses, buckets, c.excludeMetrics)
|
||||
sc, err := NewSocketCollector("pod", "default", "ingress", true, c.metricsPerUndefinedHost, c.useStatusClasses, buckets, bucketFactor, maxBuckets, c.excludeMetrics)
|
||||
if err != nil {
|
||||
t.Errorf("%v: unexpected error creating new SocketCollector: %v", c.name, err)
|
||||
}
|
||||
|
|
|
|||
|
|
@ -71,7 +71,7 @@ type collector struct {
|
|||
}
|
||||
|
||||
// NewCollector creates a new metric collector the for ingress controller
|
||||
func NewCollector(metricsPerHost, reportStatusClasses bool, registry *prometheus.Registry, ingressclass string, buckets collectors.HistogramBuckets, excludedSocketMetrics []string) (Collector, error) {
|
||||
func NewCollector(metricsPerHost, metricsPerUndefinedHost, reportStatusClasses bool, registry *prometheus.Registry, ingressclass string, buckets collectors.HistogramBuckets, bucketFactor float64, maxBuckets uint32, excludedSocketMetrics []string) (Collector, error) {
|
||||
podNamespace := os.Getenv("POD_NAMESPACE")
|
||||
if podNamespace == "" {
|
||||
podNamespace = "default"
|
||||
|
|
@ -89,7 +89,7 @@ func NewCollector(metricsPerHost, reportStatusClasses bool, registry *prometheus
|
|||
return nil, err
|
||||
}
|
||||
|
||||
s, err := collectors.NewSocketCollector(podName, podNamespace, ingressclass, metricsPerHost, reportStatusClasses, buckets, excludedSocketMetrics)
|
||||
s, err := collectors.NewSocketCollector(podName, podNamespace, ingressclass, metricsPerHost, metricsPerUndefinedHost, reportStatusClasses, buckets, bucketFactor, maxBuckets, excludedSocketMetrics)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
|
|
|||
|
|
@ -39,7 +39,7 @@ func (m Mock) GetDefaultBackend() defaults.Backend {
|
|||
func (m Mock) GetSecurityConfiguration() defaults.SecurityConfiguration {
|
||||
defRisk := m.AnnotationsRiskLevel
|
||||
if defRisk == "" {
|
||||
defRisk = "Critical"
|
||||
defRisk = "High"
|
||||
}
|
||||
return defaults.SecurityConfiguration{
|
||||
AnnotationsRiskLevel: defRisk,
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@ var keyFunc = cache.DeletionHandlingMetaNamespaceKeyFunc
|
|||
// which timestamp is older than the last successful get operation.
|
||||
type Queue struct {
|
||||
// queue is the work queue the worker polls
|
||||
queue workqueue.RateLimitingInterface
|
||||
queue workqueue.TypedRateLimitingInterface[any]
|
||||
// sync is called for each item in the queue
|
||||
sync func(interface{}) error
|
||||
// workerDone is closed when the worker exits
|
||||
|
|
@ -172,7 +172,7 @@ func NewTaskQueue(syncFn func(interface{}) error) *Queue {
|
|||
// NewCustomTaskQueue creates a new custom task queue with the given sync function.
|
||||
func NewCustomTaskQueue(syncFn func(interface{}) error, fn func(interface{}) (interface{}, error)) *Queue {
|
||||
q := &Queue{
|
||||
queue: workqueue.NewRateLimitingQueue(workqueue.DefaultControllerRateLimiter()),
|
||||
queue: workqueue.NewTypedRateLimitingQueue(workqueue.DefaultTypedControllerRateLimiter[any]()),
|
||||
sync: syncFn,
|
||||
workerDone: make(chan bool),
|
||||
fn: fn,
|
||||
|
|
|
|||
|
|
@ -29,7 +29,6 @@ import (
|
|||
"k8s.io/ingress-nginx/internal/ingress/annotations/cors"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/customheaders"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/fastcgi"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/globalratelimit"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/ipallowlist"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/ipdenylist"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/log"
|
||||
|
|
@ -285,10 +284,6 @@ type Location struct {
|
|||
// The Redirect annotation precedes RateLimit
|
||||
// +optional
|
||||
RateLimit ratelimit.Config `json:"rateLimit,omitempty"`
|
||||
// GlobalRateLimit similar to RateLimit
|
||||
// but this is applied globally across multiple replicas.
|
||||
// +optional
|
||||
GlobalRateLimit globalratelimit.Config `json:"globalRateLimit,omitempty"`
|
||||
// Redirect describes a temporal o permanent redirection this location.
|
||||
// +optional
|
||||
Redirect redirect.Config `json:"redirect,omitempty"`
|
||||
|
|
|
|||
|
|
@ -390,9 +390,6 @@ func (l1 *Location) Equal(l2 *Location) bool {
|
|||
if !(&l1.RateLimit).Equal(&l2.RateLimit) {
|
||||
return false
|
||||
}
|
||||
if !(&l1.GlobalRateLimit).Equal(&l2.GlobalRateLimit) {
|
||||
return false
|
||||
}
|
||||
if !(&l1.Redirect).Equal(&l2.Redirect) {
|
||||
return false
|
||||
}
|
||||
|
|
|
|||
|
|
@ -17,6 +17,7 @@ limitations under the License.
|
|||
package flags
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"flag"
|
||||
"fmt"
|
||||
"net"
|
||||
|
|
@ -158,8 +159,8 @@ Requires the update-status parameter.`)
|
|||
annotationsPrefix = flags.String("annotations-prefix", parser.DefaultAnnotationsPrefix,
|
||||
`Prefix of the Ingress annotations specific to the NGINX controller.`)
|
||||
|
||||
enableAnnotationValidation = flags.Bool("enable-annotation-validation", false,
|
||||
`If true, will enable the annotation validation feature. This value will be defaulted to true on a future release`)
|
||||
enableAnnotationValidation = flags.Bool("enable-annotation-validation", true,
|
||||
`If true, will enable the annotation validation feature. Defaults to true`)
|
||||
|
||||
enableSSLChainCompletion = flags.Bool("enable-ssl-chain-completion", false,
|
||||
`Autocomplete SSL certificate chains with missing intermediate CA certificates.
|
||||
|
|
@ -177,12 +178,16 @@ Requires the update-status parameter.`)
|
|||
`Enables the collection of NGINX metrics.`)
|
||||
metricsPerHost = flags.Bool("metrics-per-host", true,
|
||||
`Export metrics per-host.`)
|
||||
metricsPerUndefinedHost = flags.Bool("metrics-per-undefined-host", false,
|
||||
`Export metrics per-host even if the host is not defined in an ingress. Requires --metrics-per-host to be set to true.`)
|
||||
reportStatusClasses = flags.Bool("report-status-classes", false,
|
||||
`Use status classes (2xx, 3xx, 4xx and 5xx) instead of status codes in metrics.`)
|
||||
|
||||
timeBuckets = flags.Float64Slice("time-buckets", prometheus.DefBuckets, "Set of buckets which will be used for prometheus histogram metrics such as RequestTime, ResponseTime.")
|
||||
lengthBuckets = flags.Float64Slice("length-buckets", prometheus.LinearBuckets(10, 10, 10), "Set of buckets which will be used for prometheus histogram metrics such as RequestLength, ResponseLength.")
|
||||
sizeBuckets = flags.Float64Slice("size-buckets", prometheus.ExponentialBuckets(10, 10, 7), "Set of buckets which will be used for prometheus histogram metrics such as BytesSent.")
|
||||
bucketFactor = flags.Float64("bucket-factor", 0, "Bucket factor for native histograms. Value must be > 1 for enabling native histograms.")
|
||||
maxBuckets = flags.Uint32("max-buckets", 100, "Maximum number of buckets for native histograms.")
|
||||
excludeSocketMetrics = flags.StringSlice("exclude-socket-metrics", []string{}, "et of socket request metrics to exclude which won't be exported nor being calculated. E.g. 'nginx_ingress_controller_success,nginx_ingress_controller_header_duration_seconds'.")
|
||||
monitorMaxBatchSize = flags.Int("monitor-max-batch-size", 10000, "Max batch size of NGINX metrics.")
|
||||
|
||||
|
|
@ -232,7 +237,7 @@ Takes the form "<host>:port". If not provided, no admission controller is starte
|
|||
|
||||
flags.StringVar(&nginx.MaxmindMirror, "maxmind-mirror", "", `Maxmind mirror url (example: http://geoip.local/databases.`)
|
||||
flags.StringVar(&nginx.MaxmindLicenseKey, "maxmind-license-key", "", `Maxmind license key to download GeoLite2 Databases.
|
||||
https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases .`)
|
||||
https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geolite2-databases/ .`)
|
||||
flags.StringVar(&nginx.MaxmindEditionIDs, "maxmind-edition-ids", "GeoLite2-City,GeoLite2-ASN", `Maxmind edition ids to download GeoLite2 Databases.`)
|
||||
flags.IntVar(&nginx.MaxmindRetriesCount, "maxmind-retries-count", 1, "Number of attempts to download the GeoIP DB.")
|
||||
flags.DurationVar(&nginx.MaxmindRetriesTimeout, "maxmind-retries-timeout", time.Second*0, "Maxmind downloading delay between 1st and 2nd attempt, 0s - do not retry to download if something went wrong.")
|
||||
|
|
@ -317,6 +322,10 @@ https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-g
|
|||
}
|
||||
}
|
||||
|
||||
if *metricsPerUndefinedHost && !*metricsPerHost {
|
||||
return false, nil, errors.New("--metrics-per-undefined-host=true must be passed with --metrics-per-host=true")
|
||||
}
|
||||
|
||||
if *electionTTL <= 0 {
|
||||
*electionTTL = 30 * time.Second
|
||||
}
|
||||
|
|
@ -338,7 +347,10 @@ https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-g
|
|||
EnableProfiling: *profiling,
|
||||
EnableMetrics: *enableMetrics,
|
||||
MetricsPerHost: *metricsPerHost,
|
||||
MetricsPerUndefinedHost: *metricsPerUndefinedHost,
|
||||
MetricsBuckets: histogramBuckets,
|
||||
MetricsBucketFactor: *bucketFactor,
|
||||
MetricsMaxBuckets: *maxBuckets,
|
||||
ReportStatusClasses: *reportStatusClasses,
|
||||
ExcludeSocketMetrics: *excludeSocketMetrics,
|
||||
MonitorMaxBatchSize: *monitorMaxBatchSize,
|
||||
|
|
|
|||
|
|
@ -212,3 +212,29 @@ func TestLeaderElectionTTLParseValueInHours(t *testing.T) {
|
|||
t.Fatalf("Expected --election-ttl and conf.ElectionTTL as 1h, but found: %v", conf.ElectionTTL)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMetricsPerUndefinedHost(t *testing.T) {
|
||||
ResetForTesting(func() { t.Fatal("Parsing failed") })
|
||||
|
||||
oldArgs := os.Args
|
||||
defer func() { os.Args = oldArgs }()
|
||||
os.Args = []string{"cmd", "--metrics-per-undefined-host=true"}
|
||||
|
||||
_, _, err := ParseFlags()
|
||||
if err != nil {
|
||||
t.Fatalf("Expected no error but got: %s", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMetricsPerUndefinedHostWithMetricsPerHostFalse(t *testing.T) {
|
||||
ResetForTesting(func() { t.Fatal("Parsing failed") })
|
||||
|
||||
oldArgs := os.Args
|
||||
defer func() { os.Args = oldArgs }()
|
||||
os.Args = []string{"cmd", "--metrics-per-host=false", "--metrics-per-undefined-host=true"}
|
||||
|
||||
_, _, err := ParseFlags()
|
||||
if err == nil {
|
||||
t.Fatalf("Expected an error parsing flags but none returned")
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,131 +0,0 @@
|
|||
local resty_global_throttle = require("resty.global_throttle")
|
||||
local resty_ipmatcher = require("resty.ipmatcher")
|
||||
local util = require("util")
|
||||
|
||||
local ngx = ngx
|
||||
local ngx_exit = ngx.exit
|
||||
local ngx_log = ngx.log
|
||||
local ngx_ERR = ngx.ERR
|
||||
local ngx_INFO = ngx.INFO
|
||||
|
||||
local _M = {}
|
||||
|
||||
local DECISION_CACHE = ngx.shared.global_throttle_cache
|
||||
|
||||
-- it does not make sense to cache decision for too little time
|
||||
-- the benefit of caching likely is negated if we cache for too little time
|
||||
-- Lua Shared Dict's time resolution for expiry is 0.001.
|
||||
local CACHE_THRESHOLD = 0.001
|
||||
|
||||
local DEFAULT_RAW_KEY = "remote_addr"
|
||||
|
||||
local function should_ignore_request(ignored_cidrs)
|
||||
if not ignored_cidrs or #ignored_cidrs == 0 then
|
||||
return false
|
||||
end
|
||||
|
||||
local ignored_cidrs_matcher, err = resty_ipmatcher.new(ignored_cidrs)
|
||||
if not ignored_cidrs_matcher then
|
||||
ngx_log(ngx_ERR, "failed to initialize resty-ipmatcher: ", err)
|
||||
return false
|
||||
end
|
||||
|
||||
local is_ignored
|
||||
is_ignored, err = ignored_cidrs_matcher:match(ngx.var.remote_addr)
|
||||
if err then
|
||||
ngx_log(ngx_ERR, "failed to match ip: '",
|
||||
ngx.var.remote_addr, "': ", err)
|
||||
return false
|
||||
end
|
||||
|
||||
return is_ignored
|
||||
end
|
||||
|
||||
local function is_enabled(config, location_config)
|
||||
if config.memcached.host == "" or config.memcached.port == 0 then
|
||||
return false
|
||||
end
|
||||
if location_config.limit == 0 or
|
||||
location_config.window_size == 0 then
|
||||
return false
|
||||
end
|
||||
|
||||
if should_ignore_request(location_config.ignored_cidrs) then
|
||||
return false
|
||||
end
|
||||
|
||||
return true
|
||||
end
|
||||
|
||||
local function get_namespaced_key_value(namespace, key_value)
|
||||
return namespace .. key_value
|
||||
end
|
||||
|
||||
function _M.throttle(config, location_config)
|
||||
if not is_enabled(config, location_config) then
|
||||
return
|
||||
end
|
||||
|
||||
local key_value = util.generate_var_value(location_config.key)
|
||||
if not key_value or key_value == "" then
|
||||
key_value = ngx.var[DEFAULT_RAW_KEY]
|
||||
end
|
||||
|
||||
local namespaced_key_value =
|
||||
get_namespaced_key_value(location_config.namespace, key_value)
|
||||
|
||||
local is_limit_exceeding = DECISION_CACHE:get(namespaced_key_value)
|
||||
if is_limit_exceeding then
|
||||
ngx.var.global_rate_limit_exceeding = "c"
|
||||
return ngx_exit(config.status_code)
|
||||
end
|
||||
|
||||
local my_throttle, err = resty_global_throttle.new(
|
||||
location_config.namespace,
|
||||
location_config.limit,
|
||||
location_config.window_size,
|
||||
{
|
||||
provider = "memcached",
|
||||
host = config.memcached.host,
|
||||
port = config.memcached.port,
|
||||
connect_timeout = config.memcached.connect_timeout,
|
||||
max_idle_timeout = config.memcached.max_idle_timeout,
|
||||
pool_size = config.memcached.pool_size,
|
||||
}
|
||||
)
|
||||
if err then
|
||||
ngx.log(ngx.ERR, "faled to initialize resty_global_throttle: ", err)
|
||||
-- fail open
|
||||
return
|
||||
end
|
||||
|
||||
local desired_delay, estimated_final_count
|
||||
estimated_final_count, desired_delay, err = my_throttle:process(key_value)
|
||||
if err then
|
||||
ngx.log(ngx.ERR, "error while processing key: ", err)
|
||||
-- fail open
|
||||
return
|
||||
end
|
||||
|
||||
if desired_delay then
|
||||
if desired_delay > CACHE_THRESHOLD then
|
||||
local ok
|
||||
ok, err =
|
||||
DECISION_CACHE:safe_add(namespaced_key_value, true, desired_delay)
|
||||
if not ok then
|
||||
if err ~= "exists" then
|
||||
ngx_log(ngx_ERR, "failed to cache decision: ", err)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
ngx.var.global_rate_limit_exceeding = "y"
|
||||
ngx_log(ngx_INFO, "limit is exceeding for ",
|
||||
location_config.namespace, "/", key_value,
|
||||
" with estimated_final_count: ", estimated_final_count)
|
||||
|
||||
return ngx_exit(config.status_code)
|
||||
end
|
||||
end
|
||||
|
||||
return _M
|
||||
|
|
@ -2,7 +2,6 @@ local ngx_re_split = require("ngx.re").split
|
|||
|
||||
local certificate_configured_for_current_request =
|
||||
require("certificate").configured_for_current_request
|
||||
local global_throttle = require("global_throttle")
|
||||
|
||||
local ngx = ngx
|
||||
local io = io
|
||||
|
|
@ -164,7 +163,6 @@ function _M.rewrite(location_config)
|
|||
return ngx_redirect(uri, config.http_redirect_code)
|
||||
end
|
||||
|
||||
global_throttle.throttle(config.global_throttle, location_config.global_throttle)
|
||||
end
|
||||
|
||||
function _M.header()
|
||||
|
|
|
|||
|
|
@ -1,258 +0,0 @@
|
|||
local util = require("util")
|
||||
|
||||
local function assert_request_rejected(config, location_config, opts)
|
||||
stub(ngx, "exit")
|
||||
|
||||
local global_throttle = require_without_cache("global_throttle")
|
||||
assert.has_no.errors(function()
|
||||
global_throttle.throttle(config, location_config)
|
||||
end)
|
||||
|
||||
assert.stub(ngx.exit).was_called_with(config.status_code)
|
||||
if opts.with_cache then
|
||||
assert.are.same("c", ngx.var.global_rate_limit_exceeding)
|
||||
else
|
||||
assert.are.same("y", ngx.var.global_rate_limit_exceeding)
|
||||
end
|
||||
end
|
||||
|
||||
local function assert_request_not_rejected(config, location_config)
|
||||
stub(ngx, "exit")
|
||||
local cache_safe_add_spy = spy.on(ngx.shared.global_throttle_cache, "safe_add")
|
||||
|
||||
local global_throttle = require_without_cache("global_throttle")
|
||||
assert.has_no.errors(function()
|
||||
global_throttle.throttle(config, location_config)
|
||||
end)
|
||||
|
||||
assert.stub(ngx.exit).was_not_called()
|
||||
assert.is_nil(ngx.var.global_rate_limit_exceeding)
|
||||
assert.spy(cache_safe_add_spy).was_not_called()
|
||||
end
|
||||
|
||||
local function assert_short_circuits(f)
|
||||
local cache_get_spy = spy.on(ngx.shared.global_throttle_cache, "get")
|
||||
|
||||
local resty_global_throttle = require_without_cache("resty.global_throttle")
|
||||
local resty_global_throttle_new_spy = spy.on(resty_global_throttle, "new")
|
||||
|
||||
local global_throttle = require_without_cache("global_throttle")
|
||||
|
||||
f(global_throttle)
|
||||
|
||||
assert.spy(resty_global_throttle_new_spy).was_not_called()
|
||||
assert.spy(cache_get_spy).was_not_called()
|
||||
end
|
||||
|
||||
local function assert_fails_open(config, location_config, ...)
|
||||
stub(ngx, "exit")
|
||||
stub(ngx, "log")
|
||||
|
||||
local global_throttle = require_without_cache("global_throttle")
|
||||
|
||||
assert.has_no.errors(function()
|
||||
global_throttle.throttle(config, location_config)
|
||||
end)
|
||||
|
||||
assert.stub(ngx.exit).was_not_called()
|
||||
assert.stub(ngx.log).was_called_with(ngx.ERR, ...)
|
||||
assert.is_nil(ngx.var.global_rate_limit_exceeding)
|
||||
end
|
||||
|
||||
local function stub_resty_global_throttle_process(ret1, ret2, ret3, f)
|
||||
local resty_global_throttle = require_without_cache("resty.global_throttle")
|
||||
local resty_global_throttle_mock = {
|
||||
process = function(self, key) return ret1, ret2, ret3 end
|
||||
}
|
||||
stub(resty_global_throttle, "new", resty_global_throttle_mock)
|
||||
|
||||
f()
|
||||
|
||||
assert.stub(resty_global_throttle.new).was_called()
|
||||
end
|
||||
|
||||
local function cache_rejection_decision(namespace, key_value, desired_delay)
|
||||
local namespaced_key_value = namespace .. key_value
|
||||
local ok, err = ngx.shared.global_throttle_cache:safe_add(namespaced_key_value, true, desired_delay)
|
||||
assert.is_nil(err)
|
||||
assert.is_true(ok)
|
||||
assert.is_true(ngx.shared.global_throttle_cache:get(namespaced_key_value))
|
||||
end
|
||||
|
||||
describe("global_throttle", function()
|
||||
local snapshot
|
||||
|
||||
local NAMESPACE = "31285d47b1504dcfbd6f12c46d769f6e"
|
||||
local LOCATION_CONFIG = {
|
||||
namespace = NAMESPACE,
|
||||
limit = 10,
|
||||
window_size = 60,
|
||||
key = {},
|
||||
ignored_cidrs = {},
|
||||
}
|
||||
local CONFIG = {
|
||||
memcached = {
|
||||
host = "memc.default.svc.cluster.local", port = 11211,
|
||||
connect_timeout = 50, max_idle_timeout = 10000, pool_size = 50,
|
||||
},
|
||||
status_code = 429,
|
||||
}
|
||||
|
||||
before_each(function()
|
||||
snapshot = assert:snapshot()
|
||||
|
||||
ngx.var = { remote_addr = "127.0.0.1", global_rate_limit_exceeding = nil }
|
||||
end)
|
||||
|
||||
after_each(function()
|
||||
snapshot:revert()
|
||||
|
||||
ngx.shared.global_throttle_cache:flush_all()
|
||||
reset_ngx()
|
||||
end)
|
||||
|
||||
it("short circuits when memcached is not configured", function()
|
||||
assert_short_circuits(function(global_throttle)
|
||||
assert.has_no.errors(function()
|
||||
global_throttle.throttle({ memcached = { host = "", port = 0 } }, LOCATION_CONFIG)
|
||||
end)
|
||||
end)
|
||||
end)
|
||||
|
||||
it("short circuits when limit or window_size is not configured", function()
|
||||
assert_short_circuits(function(global_throttle)
|
||||
local location_config_copy = util.deepcopy(LOCATION_CONFIG)
|
||||
location_config_copy.limit = 0
|
||||
assert.has_no.errors(function()
|
||||
global_throttle.throttle(CONFIG, location_config_copy)
|
||||
end)
|
||||
end)
|
||||
|
||||
assert_short_circuits(function(global_throttle)
|
||||
local location_config_copy = util.deepcopy(LOCATION_CONFIG)
|
||||
location_config_copy.window_size = 0
|
||||
assert.has_no.errors(function()
|
||||
global_throttle.throttle(CONFIG, location_config_copy)
|
||||
end)
|
||||
end)
|
||||
end)
|
||||
|
||||
it("short circuits when remote_addr is in ignored_cidrs", function()
|
||||
local global_throttle = require_without_cache("global_throttle")
|
||||
local location_config = util.deepcopy(LOCATION_CONFIG)
|
||||
location_config.ignored_cidrs = { ngx.var.remote_addr }
|
||||
assert_short_circuits(function(global_throttle)
|
||||
assert.has_no.errors(function()
|
||||
global_throttle.throttle(CONFIG, location_config)
|
||||
end)
|
||||
end)
|
||||
end)
|
||||
|
||||
it("rejects when exceeding limit has already been cached", function()
|
||||
local key_value = "foo"
|
||||
local location_config = util.deepcopy(LOCATION_CONFIG)
|
||||
location_config.key = { { nil, nil, nil, key_value } }
|
||||
cache_rejection_decision(NAMESPACE, key_value, 0.5)
|
||||
|
||||
assert_request_rejected(CONFIG, location_config, { with_cache = true })
|
||||
end)
|
||||
|
||||
describe("when resty_global_throttle fails", function()
|
||||
it("fails open in case of initialization error", function()
|
||||
local too_long_namespace = ""
|
||||
for i=1,36,1 do
|
||||
too_long_namespace = too_long_namespace .. "a"
|
||||
end
|
||||
|
||||
local location_config = util.deepcopy(LOCATION_CONFIG)
|
||||
location_config.namespace = too_long_namespace
|
||||
|
||||
assert_fails_open(CONFIG, location_config, "faled to initialize resty_global_throttle: ", "'namespace' can be at most 35 characters")
|
||||
end)
|
||||
|
||||
it("fails open in case of key processing error", function()
|
||||
stub_resty_global_throttle_process(nil, nil, "failed to process", function()
|
||||
assert_fails_open(CONFIG, LOCATION_CONFIG, "error while processing key: ", "failed to process")
|
||||
end)
|
||||
end)
|
||||
end)
|
||||
|
||||
it("initializes resty_global_throttle with the right parameters", function()
|
||||
local resty_global_throttle = require_without_cache("resty.global_throttle")
|
||||
local resty_global_throttle_original_new = resty_global_throttle.new
|
||||
resty_global_throttle.new = function(namespace, limit, window_size, store_opts)
|
||||
local o, err = resty_global_throttle_original_new(namespace, limit, window_size, store_opts)
|
||||
if not o then
|
||||
return nil, err
|
||||
end
|
||||
o.process = function(self, key) return 1, nil, nil end
|
||||
|
||||
local expected = LOCATION_CONFIG
|
||||
assert.are.same(expected.namespace, namespace)
|
||||
assert.are.same(expected.limit, limit)
|
||||
assert.are.same(expected.window_size, window_size)
|
||||
|
||||
assert.are.same("memcached", store_opts.provider)
|
||||
assert.are.same(CONFIG.memcached.host, store_opts.host)
|
||||
assert.are.same(CONFIG.memcached.port, store_opts.port)
|
||||
assert.are.same(CONFIG.memcached.connect_timeout, store_opts.connect_timeout)
|
||||
assert.are.same(CONFIG.memcached.max_idle_timeout, store_opts.max_idle_timeout)
|
||||
assert.are.same(CONFIG.memcached.pool_size, store_opts.pool_size)
|
||||
|
||||
return o, nil
|
||||
end
|
||||
local resty_global_throttle_new_spy = spy.on(resty_global_throttle, "new")
|
||||
|
||||
local global_throttle = require_without_cache("global_throttle")
|
||||
|
||||
assert.has_no.errors(function()
|
||||
global_throttle.throttle(CONFIG, LOCATION_CONFIG)
|
||||
end)
|
||||
|
||||
assert.spy(resty_global_throttle_new_spy).was_called()
|
||||
end)
|
||||
|
||||
it("rejects request and caches decision when limit is exceeding after processing a key", function()
|
||||
local desired_delay = 0.015
|
||||
|
||||
stub_resty_global_throttle_process(LOCATION_CONFIG.limit + 1, desired_delay, nil, function()
|
||||
assert_request_rejected(CONFIG, LOCATION_CONFIG, { with_cache = false })
|
||||
|
||||
local cache_key = LOCATION_CONFIG.namespace .. ngx.var.remote_addr
|
||||
assert.is_true(ngx.shared.global_throttle_cache:get(cache_key))
|
||||
|
||||
-- we assume it won't take more than this after caching
|
||||
-- until we execute the assertion below
|
||||
local delta = 0.001
|
||||
local ttl = ngx.shared.global_throttle_cache:ttl(cache_key)
|
||||
assert.is_true(ttl > desired_delay - delta)
|
||||
assert.is_true(ttl <= desired_delay)
|
||||
end)
|
||||
end)
|
||||
|
||||
it("rejects request and skip caching of decision when limit is exceeding after processing a key but desired delay is lower than the threshold", function()
|
||||
local desired_delay = 0.0009
|
||||
|
||||
stub_resty_global_throttle_process(LOCATION_CONFIG.limit, desired_delay, nil, function()
|
||||
assert_request_rejected(CONFIG, LOCATION_CONFIG, { with_cache = false })
|
||||
|
||||
local cache_key = LOCATION_CONFIG.namespace .. ngx.var.remote_addr
|
||||
assert.is_nil(ngx.shared.global_throttle_cache:get(cache_key))
|
||||
end)
|
||||
end)
|
||||
|
||||
it("allows the request when limit is not exceeding after processing a key", function()
|
||||
stub_resty_global_throttle_process(LOCATION_CONFIG.limit - 3, nil, nil,
|
||||
function()
|
||||
assert_request_not_rejected(CONFIG, LOCATION_CONFIG)
|
||||
end
|
||||
)
|
||||
end)
|
||||
|
||||
it("rejects with custom status code", function()
|
||||
cache_rejection_decision(NAMESPACE, ngx.var.remote_addr, 0.3)
|
||||
local config = util.deepcopy(CONFIG)
|
||||
config.status_code = 503
|
||||
assert_request_rejected(config, LOCATION_CONFIG, { with_cache = true })
|
||||
end)
|
||||
end)
|
||||
|
|
@ -1242,7 +1242,6 @@ stream {
|
|||
set $service_name {{ $ing.Service | quote }};
|
||||
set $service_port {{ $ing.ServicePort | quote }};
|
||||
set $location_path {{ $ing.Path | escapeLiteralDollar | quote }};
|
||||
set $global_rate_limit_exceeding n;
|
||||
|
||||
{{ buildOpentelemetryForLocation $all.Cfg.EnableOpentelemetry $all.Cfg.OpentelemetryTrustIncomingSpan $location }}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
|
||||
DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
|
||||
E2E_BASE_IMAGE ?= "registry.k8s.io/ingress-nginx/e2e-test-runner:v20240812-3f0129aa@sha256:95c2aaf2a66e8cbbf7a7453046f3b024383c273a0988efab841cd96116afd1a9"
|
||||
E2E_BASE_IMAGE ?= "registry.k8s.io/ingress-nginx/e2e-test-runner:v20240829-2c421762@sha256:5b7809bfe9cbd9cd6bcb8033ca27576ca704f05ce729fe4dcb574810f7a25785"
|
||||
|
||||
image:
|
||||
echo "..entered Makefile in /test/e2e-image"
|
||||
|
|
|
|||
|
|
@ -44,33 +44,6 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller",
|
|||
f.NewSlowEchoDeployment()
|
||||
})
|
||||
|
||||
ginkgo.It("reject ingress with global-rate-limit annotations when memcached is not configured", func() {
|
||||
host := admissionTestHost
|
||||
|
||||
annotations := map[string]string{
|
||||
"nginx.ingress.kubernetes.io/global-rate-limit": "100",
|
||||
"nginx.ingress.kubernetes.io/global-rate-limit-window": "1m",
|
||||
}
|
||||
ing := framework.NewSingleIngress("first-ingress", "/", host, f.Namespace, framework.EchoService, 80, annotations)
|
||||
|
||||
ginkgo.By("rejects ingress when memcached is not configured")
|
||||
|
||||
_, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), ing, metav1.CreateOptions{})
|
||||
assert.NotNil(ginkgo.GinkgoT(), err, "creating ingress with global throttle annotations when memcached is not configured")
|
||||
|
||||
ginkgo.By("accepts ingress when memcached is not configured")
|
||||
|
||||
f.UpdateNginxConfigMapData("global-rate-limit-memcached-host", "memc.default.svc.cluster.local")
|
||||
|
||||
_, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), ing, metav1.CreateOptions{})
|
||||
assert.Nil(ginkgo.GinkgoT(), err, "creating ingress with global throttle annotations when memcached is configured")
|
||||
|
||||
f.WaitForNginxServer(host,
|
||||
func(server string) bool {
|
||||
return strings.Contains(server, fmt.Sprintf("server_name %v", host))
|
||||
})
|
||||
})
|
||||
|
||||
ginkgo.It("should not allow overlaps of host and paths without canary annotations", func() {
|
||||
host := admissionTestHost
|
||||
|
||||
|
|
@ -127,14 +100,8 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller",
|
|||
})
|
||||
|
||||
ginkgo.It("should return an error if there is an error validating the ingress definition", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
host := admissionTestHost
|
||||
|
||||
|
|
@ -241,14 +208,8 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller",
|
|||
})
|
||||
|
||||
ginkgo.It("should return an error if the Ingress V1 definition contains invalid annotations", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
out, err := createIngress(f.Namespace, invalidV1Ingress)
|
||||
assert.Empty(ginkgo.GinkgoT(), out)
|
||||
|
|
@ -261,14 +222,8 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller",
|
|||
})
|
||||
|
||||
ginkgo.It("should not return an error for an invalid Ingress when it has unknown class", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
out, err := createIngress(f.Namespace, invalidV1IngressWithOtherClass)
|
||||
assert.Equal(ginkgo.GinkgoT(), "ingress.networking.k8s.io/extensions-invalid-other created\n", out)
|
||||
assert.Nil(ginkgo.GinkgoT(), err, "creating an invalid ingress with unknown class using kubectl")
|
||||
|
|
|
|||
|
|
@ -277,14 +277,8 @@ var _ = framework.DescribeAnnotation("auth-*", func() {
|
|||
"nginx.ingress.kubernetes.io/auth-snippet": `
|
||||
proxy_set_header My-Custom-Header 42;`,
|
||||
}
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations)
|
||||
f.EnsureIngress(ing)
|
||||
|
|
@ -297,15 +291,8 @@ var _ = framework.DescribeAnnotation("auth-*", func() {
|
|||
|
||||
ginkgo.It(`should not set snippet "proxy_set_header My-Custom-Header 42;" when external auth is not configured`, func() {
|
||||
host := authHost
|
||||
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
annotations := map[string]string{
|
||||
"nginx.ingress.kubernetes.io/auth-snippet": `
|
||||
|
|
|
|||
|
|
@ -62,14 +62,8 @@ var _ = framework.DescribeAnnotation("from-to-www-redirect", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("should redirect from www HTTPS to HTTPS", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
ginkgo.By("setting up server for redirect from www")
|
||||
|
||||
|
|
|
|||
|
|
@ -1,88 +0,0 @@
|
|||
/*
|
||||
Copyright 2020 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package annotations
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
"github.com/onsi/ginkgo/v2"
|
||||
"github.com/stretchr/testify/assert"
|
||||
|
||||
"k8s.io/ingress-nginx/test/e2e/framework"
|
||||
)
|
||||
|
||||
var _ = framework.DescribeAnnotation("annotation-global-rate-limit", func() {
|
||||
f := framework.NewDefaultFramework("global-rate-limit")
|
||||
host := "global-rate-limit-annotation"
|
||||
|
||||
ginkgo.BeforeEach(func() {
|
||||
f.NewEchoDeployment()
|
||||
})
|
||||
|
||||
ginkgo.It("generates correct configuration", func() {
|
||||
annotations := make(map[string]string)
|
||||
annotations["nginx.ingress.kubernetes.io/global-rate-limit"] = "5"
|
||||
annotations["nginx.ingress.kubernetes.io/global-rate-limit-window"] = "2m"
|
||||
|
||||
// We need to allow { and } characters for this annotation to work
|
||||
f.UpdateNginxConfigMapData("annotation-value-word-blocklist", "load_module, lua_package, _by_lua, location, root")
|
||||
// Sleep a while just to guarantee that the configmap is applied
|
||||
framework.Sleep()
|
||||
|
||||
ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations)
|
||||
ing = f.EnsureIngress(ing)
|
||||
namespace := strings.ReplaceAll(string(ing.UID), "-", "")
|
||||
|
||||
serverConfig := ""
|
||||
f.WaitForNginxServer(host, func(server string) bool {
|
||||
serverConfig = server
|
||||
return true
|
||||
})
|
||||
assert.Contains(ginkgo.GinkgoT(), serverConfig,
|
||||
fmt.Sprintf(`global_throttle = { namespace = "%v", `+
|
||||
`limit = 5, window_size = 120, key = { { nil, nil, "remote_addr", nil, }, }, `+
|
||||
`ignored_cidrs = { } }`,
|
||||
namespace))
|
||||
|
||||
f.HTTPTestClient().GET("/").WithHeader("Host", host).Expect().Status(http.StatusOK)
|
||||
|
||||
ginkgo.By("regenerating the correct configuration after update")
|
||||
annotations["nginx.ingress.kubernetes.io/global-rate-limit-key"] = "${remote_addr}${http_x_api_client}"
|
||||
annotations["nginx.ingress.kubernetes.io/global-rate-limit-ignored-cidrs"] = "192.168.1.1, 234.234.234.0/24"
|
||||
ing.SetAnnotations(annotations)
|
||||
|
||||
f.WaitForReload(func() {
|
||||
ing = f.UpdateIngress(ing)
|
||||
})
|
||||
|
||||
serverConfig = ""
|
||||
f.WaitForNginxServer(host, func(server string) bool {
|
||||
serverConfig = server
|
||||
return true
|
||||
})
|
||||
assert.Contains(ginkgo.GinkgoT(), serverConfig,
|
||||
fmt.Sprintf(`global_throttle = { namespace = "%v", `+
|
||||
`limit = 5, window_size = 120, `+
|
||||
`key = { { nil, "remote_addr", nil, nil, }, { nil, "http_x_api_client", nil, nil, }, }, `+
|
||||
`ignored_cidrs = { "192.168.1.1", "234.234.234.0/24", } }`,
|
||||
namespace))
|
||||
|
||||
f.HTTPTestClient().GET("/").WithHeader("Host", host).Expect().Status(http.StatusOK)
|
||||
})
|
||||
})
|
||||
|
|
@ -193,14 +193,8 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() {
|
|||
ginkgo.It("should return OK for service with backend protocol GRPCS", func() {
|
||||
f.NewGRPCBinDeployment()
|
||||
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
host := echoHost
|
||||
|
||||
|
|
|
|||
|
|
@ -100,14 +100,8 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("should enable modsecurity with snippet", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
host := modSecurityFooHost
|
||||
nameSpace := f.Namespace
|
||||
|
|
@ -173,14 +167,8 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("should enable modsecurity with snippet and block requests", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
host := modSecurityFooHost
|
||||
nameSpace := f.Namespace
|
||||
|
|
@ -212,14 +200,8 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("should enable modsecurity globally and with modsecurity-snippet block requests", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
host := modSecurityFooHost
|
||||
nameSpace := f.Namespace
|
||||
|
|
@ -251,16 +233,11 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("should enable modsecurity when enable-owasp-modsecurity-crs is set to true", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
"enable-modsecurity": "true",
|
||||
"enable-owasp-modsecurity-crs": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
f.UpdateNginxConfigMapData("enable-modsecurity", "true")
|
||||
f.UpdateNginxConfigMapData("enable-owasp-modsecurity-crs", "true")
|
||||
|
||||
host := modSecurityFooHost
|
||||
nameSpace := f.Namespace
|
||||
|
|
@ -290,6 +267,8 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("should enable modsecurity through the config map", func() {
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
host := modSecurityFooHost
|
||||
nameSpace := f.Namespace
|
||||
|
||||
|
|
@ -310,17 +289,9 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() {
|
|||
f.EnsureIngress(ing)
|
||||
|
||||
expectedComment := "SecRuleEngine On"
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
"enable-modsecurity": "true",
|
||||
"enable-owasp-modsecurity-crs": "true",
|
||||
"modsecurity-snippet": expectedComment,
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
f.UpdateNginxConfigMapData("enable-modsecurity", "true")
|
||||
f.UpdateNginxConfigMapData("enable-owasp-modsecurity-crs", "true")
|
||||
f.UpdateNginxConfigMapData("modsecurity-snippet", expectedComment)
|
||||
|
||||
f.WaitForNginxServer(host,
|
||||
func(server string) bool {
|
||||
|
|
@ -339,6 +310,9 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() {
|
|||
host := modSecurityFooHost
|
||||
nameSpace := f.Namespace
|
||||
|
||||
f.UpdateNginxConfigMapData("annotations-risk-level", "Critical") // To enable snippet configurations
|
||||
defer f.UpdateNginxConfigMapData("annotations-risk-level", "High")
|
||||
|
||||
snippet := `SecRequestBodyAccess On
|
||||
SecAuditEngine RelevantOnly
|
||||
SecAuditLogParts ABIJDEFHZ
|
||||
|
|
@ -378,14 +352,9 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("should disable default modsecurity conf setting when modsecurity-snippet is specified", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
host := modSecurityFooHost
|
||||
nameSpace := f.Namespace
|
||||
|
||||
|
|
|
|||
|
|
@ -33,14 +33,8 @@ var _ = framework.DescribeAnnotation("server-snippet", func() {
|
|||
})
|
||||
|
||||
ginkgo.It(`add valid directives to server via server snippet`, func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
host := "serversnippet.foo.com"
|
||||
annotations := map[string]string{
|
||||
|
|
@ -68,14 +62,8 @@ var _ = framework.DescribeAnnotation("server-snippet", func() {
|
|||
})
|
||||
|
||||
ginkgo.It(`drops server snippet if disabled by the administrator`, func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
f.UpdateNginxConfigMapData("annotations-risk-level", "Critical") // To enable snippet configurations
|
||||
defer f.UpdateNginxConfigMapData("annotations-risk-level", "High")
|
||||
|
||||
host := "noserversnippet.foo.com"
|
||||
annotations := map[string]string{
|
||||
|
|
@ -85,11 +73,6 @@ var _ = framework.DescribeAnnotation("server-snippet", func() {
|
|||
}
|
||||
|
||||
ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations)
|
||||
f.UpdateNginxConfigMapData("allow-snippet-annotations", "false")
|
||||
defer func() {
|
||||
// Return to the original value
|
||||
f.UpdateNginxConfigMapData("allow-snippet-annotations", "true")
|
||||
}()
|
||||
// Sleep a while just to guarantee that the configmap is applied
|
||||
framework.Sleep()
|
||||
f.EnsureIngress(ing)
|
||||
|
|
|
|||
|
|
@ -33,15 +33,8 @@ var _ = framework.DescribeAnnotation("configuration-snippet", func() {
|
|||
|
||||
ginkgo.It("set snippet more_set_headers in all locations", func() {
|
||||
host := "configurationsnippet.foo.com"
|
||||
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
annotations := map[string]string{
|
||||
"nginx.ingress.kubernetes.io/configuration-snippet": `more_set_headers "Foo1: Bar1";`,
|
||||
|
|
@ -71,6 +64,8 @@ var _ = framework.DescribeAnnotation("configuration-snippet", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("drops snippet more_set_header in all locations if disabled by admin", func() {
|
||||
f.UpdateNginxConfigMapData("annotations-risk-level", "Critical") // To enable snippet configurations
|
||||
defer f.UpdateNginxConfigMapData("annotations-risk-level", "High")
|
||||
host := "noconfigurationsnippet.foo.com"
|
||||
annotations := map[string]string{
|
||||
"nginx.ingress.kubernetes.io/configuration-snippet": `more_set_headers "Foo1: Bar1";`,
|
||||
|
|
|
|||
|
|
@ -39,14 +39,8 @@ var _ = framework.DescribeSetting("stream-snippet", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("should add value of stream-snippet to nginx config", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
host := "foo.com"
|
||||
|
||||
|
|
|
|||
|
|
@ -117,11 +117,7 @@ func (f *Framework) newIngressController(namespace, namespaceOverlay string) err
|
|||
isChroot = "false"
|
||||
}
|
||||
|
||||
enableAnnotationValidations, ok := os.LookupEnv("ENABLE_VALIDATIONS")
|
||||
if !ok {
|
||||
enableAnnotationValidations = "false"
|
||||
}
|
||||
cmd := exec.Command("./wait-for-nginx.sh", namespace, namespaceOverlay, isChroot, enableAnnotationValidations)
|
||||
cmd := exec.Command("./wait-for-nginx.sh", namespace, namespaceOverlay, isChroot)
|
||||
out, err := cmd.CombinedOutput()
|
||||
if err != nil {
|
||||
return fmt.Errorf("unexpected error waiting for ingress controller deployment: %v.\nLogs:\n%v", err, string(out))
|
||||
|
|
|
|||
|
|
@ -383,6 +383,20 @@ func (f *Framework) SetNginxConfigMapData(cmData map[string]string) {
|
|||
f.WaitForReload(fn)
|
||||
}
|
||||
|
||||
// SetNginxConfigMapData sets ingress-nginx's nginx-ingress-controller configMap data
|
||||
func (f *Framework) AllowSnippetConfiguration() func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
"annotations-risk-level": "Critical", // To enable snippet configurations
|
||||
})
|
||||
return func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
"annotations-risk-level": "High",
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// CreateConfigMap creates a new configmap in the current namespace
|
||||
func (f *Framework) CreateConfigMap(name string, data map[string]string) {
|
||||
_, err := f.KubeClientSet.CoreV1().ConfigMaps(f.Namespace).Create(context.TODO(), &v1.ConfigMap{
|
||||
|
|
|
|||
|
|
@ -36,14 +36,8 @@ var _ = framework.IngressNginxDescribe("single ingress - multiple hosts", func()
|
|||
})
|
||||
|
||||
ginkgo.It("should set the correct $service_name NGINX variable", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
annotations := map[string]string{
|
||||
"nginx.ingress.kubernetes.io/configuration-snippet": `more_set_input_headers "service-name: $service_name";`,
|
||||
|
|
|
|||
|
|
@ -35,14 +35,8 @@ var _ = framework.IngressNginxDescribe("[Ingress] [PathType] exact", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("should choose exact location for /exact", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
host := "exact.path"
|
||||
|
||||
|
|
|
|||
|
|
@ -37,14 +37,8 @@ var _ = framework.IngressNginxDescribe("[Ingress] [PathType] mix Exact and Prefi
|
|||
exactPathType := networking.PathTypeExact
|
||||
|
||||
ginkgo.It("should choose the correct location", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
host := "mixed.path"
|
||||
|
||||
|
|
|
|||
|
|
@ -36,6 +36,7 @@ const waitForMetrics = 2 * time.Second
|
|||
var _ = framework.IngressNginxDescribe("[metrics] exported prometheus metrics", func() {
|
||||
f := framework.NewDefaultFramework("metrics")
|
||||
host := "foo.com"
|
||||
wildcardHost := "wildcard." + host
|
||||
|
||||
ginkgo.BeforeEach(func() {
|
||||
f.NewEchoDeployment()
|
||||
|
|
@ -91,4 +92,50 @@ var _ = framework.IngressNginxDescribe("[metrics] exported prometheus metrics",
|
|||
assert.Nil(ginkgo.GinkgoT(), err)
|
||||
assert.NotNil(ginkgo.GinkgoT(), mf)
|
||||
})
|
||||
ginkgo.It("request metrics per undefined host are present when flag is set", func() {
|
||||
err := f.UpdateIngressControllerDeployment(func(deployment *appsv1.Deployment) error {
|
||||
args := deployment.Spec.Template.Spec.Containers[0].Args
|
||||
args = append(args, "--metrics-per-undefined-host=true")
|
||||
deployment.Spec.Template.Spec.Containers[0].Args = args
|
||||
_, err := f.KubeClientSet.AppsV1().Deployments(f.Namespace).Update(context.TODO(), deployment, metav1.UpdateOptions{})
|
||||
return err
|
||||
})
|
||||
assert.Nil(ginkgo.GinkgoT(), err, "updating deployment")
|
||||
|
||||
f.HTTPTestClient().
|
||||
GET("/").
|
||||
WithHeader("Host", wildcardHost).
|
||||
Expect().
|
||||
Status(http.StatusNotFound)
|
||||
time.Sleep(waitForMetrics)
|
||||
|
||||
ip := f.GetNginxPodIP()
|
||||
reqMetrics, err := f.GetMetric("nginx_ingress_controller_requests", ip)
|
||||
assert.Nil(ginkgo.GinkgoT(), err)
|
||||
assert.NotNil(ginkgo.GinkgoT(), reqMetrics.Metric)
|
||||
assert.Len(ginkgo.GinkgoT(), reqMetrics.Metric, 1)
|
||||
|
||||
containedLabel := false
|
||||
for _, label := range reqMetrics.Metric[0].Label {
|
||||
if *label.Name == "host" && *label.Value == wildcardHost {
|
||||
containedLabel = true
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
assert.Truef(ginkgo.GinkgoT(), containedLabel, "expected reqMetrics to contain label with \"name\"=\"host\" \"value\"=%q, but it did not: %s", wildcardHost, reqMetrics.String())
|
||||
})
|
||||
ginkgo.It("request metrics per undefined host are not present when flag is not set", func() {
|
||||
f.HTTPTestClient().
|
||||
GET("/").
|
||||
WithHeader("Host", wildcardHost).
|
||||
Expect().
|
||||
Status(http.StatusNotFound)
|
||||
time.Sleep(waitForMetrics)
|
||||
|
||||
ip := f.GetNginxPodIP()
|
||||
reqMetrics, err := f.GetMetric("nginx_ingress_controller_requests", ip)
|
||||
assert.EqualError(ginkgo.GinkgoT(), err, "there is no metric with name nginx_ingress_controller_requests")
|
||||
assert.Nil(ginkgo.GinkgoT(), reqMetrics)
|
||||
})
|
||||
})
|
||||
|
|
|
|||
|
|
@ -78,7 +78,7 @@ fi
|
|||
|
||||
if [ "${SKIP_IMAGE_CREATION:-false}" = "false" ]; then
|
||||
if ! command -v ginkgo &> /dev/null; then
|
||||
go install github.com/onsi/ginkgo/v2/ginkgo@v2.20.0
|
||||
go install github.com/onsi/ginkgo/v2/ginkgo@v2.20.2
|
||||
fi
|
||||
echo "[dev-env] building image"
|
||||
make -C ${DIR}/../../ clean-image build image
|
||||
|
|
@ -109,7 +109,7 @@ docker run --rm --interactive --network host \
|
|||
--volume $KUBECONFIG:/root/.kube/config \
|
||||
--volume "${DIR}/../../":/workdir \
|
||||
--workdir /workdir \
|
||||
registry.k8s.io/ingress-nginx/e2e-test-runner:v20240812-3f0129aa@sha256:95c2aaf2a66e8cbbf7a7453046f3b024383c273a0988efab841cd96116afd1a9 \
|
||||
registry.k8s.io/ingress-nginx/e2e-test-runner:v20240829-2c421762@sha256:5b7809bfe9cbd9cd6bcb8033ca27576ca704f05ce729fe4dcb574810f7a25785 \
|
||||
ct install \
|
||||
--charts charts/ingress-nginx \
|
||||
--helm-extra-args "--timeout 60s"
|
||||
|
|
|
|||
|
|
@ -78,7 +78,6 @@ kubectl run --rm \
|
|||
--env="E2E_NODES=${E2E_NODES}" \
|
||||
--env="FOCUS=${FOCUS}" \
|
||||
--env="IS_CHROOT=${IS_CHROOT:-false}"\
|
||||
--env="ENABLE_VALIDATIONS=${ENABLE_VALIDATIONS:-false}"\
|
||||
--env="SKIP_OPENTELEMETRY_TESTS=${SKIP_OPENTELEMETRY_TESTS:-false}"\
|
||||
--env="E2E_CHECK_LEAKS=${E2E_CHECK_LEAKS}" \
|
||||
--env="NGINX_BASE_IMAGE=${NGINX_BASE_IMAGE}" \
|
||||
|
|
|
|||
|
|
@ -39,7 +39,6 @@ fi
|
|||
|
||||
KIND_LOG_LEVEL="1"
|
||||
IS_CHROOT="${IS_CHROOT:-false}"
|
||||
ENABLE_VALIDATIONS="${ENABLE_VALIDATIONS:-false}"
|
||||
export KIND_CLUSTER_NAME=${KIND_CLUSTER_NAME:-ingress-nginx-dev}
|
||||
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
||||
# Use 1.0.0-dev to make sure we use the latest configuration in the helm template
|
||||
|
|
@ -96,7 +95,7 @@ fi
|
|||
|
||||
if [ "${SKIP_E2E_IMAGE_CREATION}" = "false" ]; then
|
||||
if ! command -v ginkgo &> /dev/null; then
|
||||
go install github.com/onsi/ginkgo/v2/ginkgo@v2.20.0
|
||||
go install github.com/onsi/ginkgo/v2/ginkgo@v2.20.2
|
||||
fi
|
||||
|
||||
echo "[dev-env] .. done building controller images"
|
||||
|
|
|
|||
|
|
@ -34,14 +34,8 @@ var _ = framework.DescribeAnnotation("Bad annotation values", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("[BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
host := "invalid-value-test"
|
||||
|
||||
annotations := map[string]string{
|
||||
|
|
@ -50,7 +44,6 @@ var _ = framework.DescribeAnnotation("Bad annotation values", func() {
|
|||
}
|
||||
|
||||
ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations)
|
||||
f.UpdateNginxConfigMapData("allow-snippet-annotations", "true")
|
||||
f.UpdateNginxConfigMapData("annotation-value-word-blocklist", "something_forbidden,otherthing_forbidden,{")
|
||||
|
||||
f.EnsureIngress(ing)
|
||||
|
|
@ -73,14 +66,8 @@ var _ = framework.DescribeAnnotation("Bad annotation values", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("[BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
host := "forbidden-value-test"
|
||||
|
||||
|
|
@ -93,7 +80,6 @@ var _ = framework.DescribeAnnotation("Bad annotation values", func() {
|
|||
}
|
||||
|
||||
ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations)
|
||||
f.UpdateNginxConfigMapData("allow-snippet-annotations", "true")
|
||||
f.UpdateNginxConfigMapData("annotation-value-word-blocklist", "something_forbidden,otherthing_forbidden,content_by_lua_block")
|
||||
// Sleep a while just to guarantee that the configmap is applied
|
||||
framework.Sleep()
|
||||
|
|
@ -117,14 +103,9 @@ var _ = framework.DescribeAnnotation("Bad annotation values", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("[BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
hostValid := "custom-allowed-value-test"
|
||||
annotationsValid := map[string]string{
|
||||
"nginx.ingress.kubernetes.io/configuration-snippet": `
|
||||
|
|
@ -155,14 +136,8 @@ var _ = framework.DescribeAnnotation("Bad annotation values", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("[BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
host := "custom-forbidden-value-test"
|
||||
|
||||
annotations := map[string]string{
|
||||
|
|
|
|||
|
|
@ -69,15 +69,9 @@ var _ = framework.DescribeSetting("Geoip2", func() {
|
|||
ginkgo.It("should only allow requests from specific countries", func() {
|
||||
ginkgo.Skip("GeoIP test are temporarily disabled")
|
||||
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
"use-geoip2": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
f.UpdateNginxConfigMapData("use-geoip2", "true")
|
||||
|
||||
httpSnippetAllowingOnlyAustralia := `map $geoip2_city_country_code $blocked_country {
|
||||
default 1;
|
||||
|
|
|
|||
|
|
@ -1,96 +0,0 @@
|
|||
/*
|
||||
Copyright 2020 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package settings
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"github.com/onsi/ginkgo/v2"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"k8s.io/ingress-nginx/test/e2e/framework"
|
||||
)
|
||||
|
||||
var _ = framework.DescribeSetting("settings-global-rate-limit", func() {
|
||||
f := framework.NewDefaultFramework("global-rate-limit")
|
||||
host := "global-rate-limit"
|
||||
|
||||
ginkgo.BeforeEach(func() {
|
||||
f.NewEchoDeployment()
|
||||
})
|
||||
|
||||
ginkgo.It("generates correct NGINX configuration", func() {
|
||||
annotations := make(map[string]string)
|
||||
ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations)
|
||||
f.EnsureIngress(ing)
|
||||
|
||||
ginkgo.By("generating correct defaults")
|
||||
|
||||
ngxCfg := ""
|
||||
f.WaitForNginxConfiguration(func(cfg string) bool {
|
||||
if strings.Contains(cfg, "global_throttle") {
|
||||
ngxCfg = cfg
|
||||
return true
|
||||
}
|
||||
return false
|
||||
})
|
||||
|
||||
assert.Contains(ginkgo.GinkgoT(), ngxCfg, fmt.Sprintf(`global_throttle = { `+
|
||||
`memcached = { host = "%v", port = %d, connect_timeout = %d, max_idle_timeout = %d, `+
|
||||
`pool_size = %d, }, status_code = %d, }`,
|
||||
"", 11211, 50, 10000, 50, 429))
|
||||
|
||||
f.HTTPTestClient().GET("/").WithHeader("Host", host).Expect().Status(http.StatusOK)
|
||||
|
||||
ginkgo.By("applying customizations")
|
||||
|
||||
memcachedHost := "memc.default.svc.cluster.local"
|
||||
memcachedPort := 11211
|
||||
memcachedConnectTimeout := 100
|
||||
memcachedMaxIdleTimeout := 5000
|
||||
memcachedPoolSize := 100
|
||||
statusCode := 503
|
||||
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"global-rate-limit-memcached-host": memcachedHost,
|
||||
"global-rate-limit-memcached-port": strconv.Itoa(memcachedPort),
|
||||
"global-rate-limit-memcached-connect-timeout": strconv.Itoa(memcachedConnectTimeout),
|
||||
"global-rate-limit-memcached-max-idle-timeout": strconv.Itoa(memcachedMaxIdleTimeout),
|
||||
"global-rate-limit-memcached-pool-size": strconv.Itoa(memcachedPoolSize),
|
||||
"global-rate-limit-status-code": strconv.Itoa(statusCode),
|
||||
})
|
||||
|
||||
ngxCfg = ""
|
||||
f.WaitForNginxConfiguration(func(cfg string) bool {
|
||||
if strings.Contains(cfg, "global_throttle") {
|
||||
ngxCfg = cfg
|
||||
return true
|
||||
}
|
||||
return false
|
||||
})
|
||||
|
||||
assert.Contains(ginkgo.GinkgoT(), ngxCfg, fmt.Sprintf(`global_throttle = { `+
|
||||
`memcached = { host = "%v", port = %d, connect_timeout = %d, max_idle_timeout = %d, `+
|
||||
`pool_size = %d, }, status_code = %d, }`,
|
||||
memcachedHost, memcachedPort, memcachedConnectTimeout, memcachedMaxIdleTimeout,
|
||||
memcachedPoolSize, statusCode))
|
||||
|
||||
f.HTTPTestClient().GET("/").WithHeader("Host", host).Expect().Status(http.StatusOK)
|
||||
})
|
||||
})
|
||||
|
|
@ -34,14 +34,9 @@ var _ = framework.IngressNginxDescribe("Dynamic $proxy_host", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("should exist a proxy_host", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
upstreamName := fmt.Sprintf("%v-%v-80", f.Namespace, framework.EchoService)
|
||||
annotations := map[string]string{
|
||||
"nginx.ingress.kubernetes.io/configuration-snippet": `more_set_headers "Custom-Header: $proxy_host"`,
|
||||
|
|
@ -63,14 +58,8 @@ var _ = framework.IngressNginxDescribe("Dynamic $proxy_host", func() {
|
|||
})
|
||||
|
||||
ginkgo.It("should exist a proxy_host using the upstream-vhost annotation value", func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
})
|
||||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
})
|
||||
}()
|
||||
disableSnippet := f.AllowSnippetConfiguration()
|
||||
defer disableSnippet()
|
||||
|
||||
upstreamName := fmt.Sprintf("%v-%v-80", f.Namespace, framework.EchoService)
|
||||
upstreamVHost := "different.host"
|
||||
|
|
|
|||
|
|
@ -38,6 +38,7 @@ var _ = framework.DescribeSetting("configmap server-snippet", func() {
|
|||
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "true",
|
||||
"annotations-risk-level": "Critical",
|
||||
"server-snippet": `
|
||||
more_set_headers "Globalfoo: Foooo";`,
|
||||
})
|
||||
|
|
@ -45,6 +46,7 @@ var _ = framework.DescribeSetting("configmap server-snippet", func() {
|
|||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
"annotations-risk-level": "High",
|
||||
})
|
||||
}()
|
||||
annotations := map[string]string{
|
||||
|
|
@ -101,6 +103,7 @@ var _ = framework.DescribeSetting("configmap server-snippet", func() {
|
|||
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
"annotations-risk-level": "Critical", // To allow Configuration Snippet
|
||||
"server-snippet": `
|
||||
more_set_headers "Globalfoo: Foooo";`,
|
||||
})
|
||||
|
|
@ -108,6 +111,7 @@ var _ = framework.DescribeSetting("configmap server-snippet", func() {
|
|||
defer func() {
|
||||
f.SetNginxConfigMapData(map[string]string{
|
||||
"allow-snippet-annotations": "false",
|
||||
"annotations-risk-level": "High",
|
||||
})
|
||||
}()
|
||||
annotations := map[string]string{
|
||||
|
|
|
|||
|
|
@ -48,8 +48,8 @@ var _ = framework.IngressNginxDescribeSerial("annotation validations", func() {
|
|||
framework.Sleep()
|
||||
|
||||
annotations := map[string]string{
|
||||
"nginx.ingress.kubernetes.io/default-backend": "default/bla", // low risk
|
||||
"nginx.ingress.kubernetes.io/denylist-source-range": "1.1.1.1/32", // medium risk
|
||||
"nginx.ingress.kubernetes.io/default-backend": "bla", // low risk
|
||||
"nginx.ingress.kubernetes.io/denylist-source-range": "1.1.1.1/32", // medium risk
|
||||
}
|
||||
|
||||
ginkgo.By("allow ingress with low/medium risk annotations")
|
||||
|
|
@ -82,8 +82,8 @@ var _ = framework.IngressNginxDescribeSerial("annotation validations", func() {
|
|||
framework.Sleep()
|
||||
|
||||
annotations := map[string]string{
|
||||
"nginx.ingress.kubernetes.io/default-backend": "default/bla", // low risk
|
||||
"nginx.ingress.kubernetes.io/denylist-source-range": "1.1.1.1/32", // medium risk
|
||||
"nginx.ingress.kubernetes.io/default-backend": "bla", // low risk
|
||||
"nginx.ingress.kubernetes.io/denylist-source-range": "1.1.1.1/32", // medium risk
|
||||
}
|
||||
|
||||
ginkgo.By("allow ingress with low/medium risk annotations")
|
||||
|
|
|
|||
|
|
@ -24,7 +24,6 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
|||
export NAMESPACE=$1
|
||||
export NAMESPACE_OVERLAY=$2
|
||||
export IS_CHROOT=$3
|
||||
export ENABLE_VALIDATIONS=$4
|
||||
|
||||
echo "deploying NGINX Ingress controller in namespace $NAMESPACE"
|
||||
|
||||
|
|
@ -59,7 +58,6 @@ else
|
|||
# TODO: remove the need to use fullnameOverride
|
||||
fullnameOverride: nginx-ingress
|
||||
controller:
|
||||
enableAnnotationValidations: ${ENABLE_VALIDATIONS}
|
||||
image:
|
||||
repository: ingress-controller/controller
|
||||
chroot: ${IS_CHROOT}
|
||||
|
|
|
|||
|
|
@ -36,7 +36,6 @@ SHDICT_ARGS=(
|
|||
"--shdict" "high_throughput_tracker 1M"
|
||||
"--shdict" "balancer_ewma_last_touched_at 1M"
|
||||
"--shdict" "balancer_ewma_locks 512k"
|
||||
"--shdict" "global_throttle_cache 5M"
|
||||
"./rootfs/etc/nginx/lua/test/run.lua"
|
||||
)
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue