Continue crossplane migration
This commit is contained in:
Ricardo Katz
parent
0f29850c98
commit
94b15b36da
8 changed files with 2079 additions and 252 deletions
3
go.mod
3
go.mod
|
|
@ -14,6 +14,7 @@ require (
|
|||
github.com/mitchellh/mapstructure v1.5.0
|
||||
github.com/moul/pb v0.0.0-20220425114252-bca18df4138c
|
||||
github.com/ncabatoff/process-exporter v0.8.3
|
||||
github.com/nginxinc/nginx-go-crossplane v0.4.63
|
||||
github.com/onsi/ginkgo/v2 v2.20.2
|
||||
github.com/opencontainers/runc v1.1.14
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
|
||||
|
|
@ -47,7 +48,9 @@ require (
|
|||
|
||||
require (
|
||||
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
|
||||
github.com/jstemmer/go-junit-report v1.0.0 // indirect
|
||||
github.com/klauspost/compress v1.17.9 // indirect
|
||||
github.com/maxbrunsfeld/counterfeiter/v6 v6.8.1 // indirect
|
||||
github.com/x448/float16 v0.8.4 // indirect
|
||||
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
|
||||
)
|
||||
|
|
|
|||
8
go.sum
8
go.sum
|
|
@ -109,6 +109,8 @@ github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8Hm
|
|||
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
|
||||
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
|
||||
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
|
||||
github.com/jstemmer/go-junit-report v1.0.0 h1:8X1gzZpR+nVQLAht+L/foqOeX2l9DTZoaIPbEQHxsds=
|
||||
github.com/jstemmer/go-junit-report v1.0.0/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
|
||||
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
|
||||
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
||||
github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=
|
||||
|
|
@ -131,6 +133,8 @@ github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovk
|
|||
github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
|
||||
github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
|
||||
github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
|
||||
github.com/maxbrunsfeld/counterfeiter/v6 v6.8.1 h1:NicmruxkeqHjDv03SfSxqmaLuisddudfP3h5wdXFbhM=
|
||||
github.com/maxbrunsfeld/counterfeiter/v6 v6.8.1/go.mod h1:eyp4DdUJAKkr9tvxR3jWhw2mDK7CWABMG5r9uyaKC7I=
|
||||
github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
|
||||
github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
|
||||
github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
|
||||
|
|
@ -158,6 +162,8 @@ github.com/ncabatoff/go-seq v0.0.0-20180805175032-b08ef85ed833 h1:t4WWQ9I797y7QU
|
|||
github.com/ncabatoff/go-seq v0.0.0-20180805175032-b08ef85ed833/go.mod h1:0CznHmXSjMEqs5Tezj/w2emQoM41wzYM9KpDKUHPYag=
|
||||
github.com/ncabatoff/process-exporter v0.8.3 h1:ZJpzWhRfwdBisIpr2BkitAlUR6dt45hpQn8/AYgToO8=
|
||||
github.com/ncabatoff/process-exporter v0.8.3/go.mod h1:MxEOWl740VK/hlWycJkq91VrA2mI+U9Bvc1wuyAaxA4=
|
||||
github.com/nginxinc/nginx-go-crossplane v0.4.63 h1:nx5e+EXzPepWVM3YsTEhcs8kp8XDTK1BCzPTTmdgK1E=
|
||||
github.com/nginxinc/nginx-go-crossplane v0.4.63/go.mod h1:b7L/JSru3rvbbxVJxBgkePkNvC+LXo/IWE4iJJJvUUw=
|
||||
github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
|
||||
github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
|
||||
github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
|
||||
|
|
@ -193,6 +199,8 @@ github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoG
|
|||
github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
|
||||
github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
|
||||
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
|
||||
github.com/sclevine/spec v1.4.0 h1:z/Q9idDcay5m5irkZ28M7PtQM4aOISzOpj4bUPkDee8=
|
||||
github.com/sclevine/spec v1.4.0/go.mod h1:LvpgJaFyvQzRvc1kaDs0bulYwzC70PbiYjC4QnFHkOM=
|
||||
github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
|
||||
github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
|
||||
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
|
||||
|
|
|
|||
156
go.work.sum
156
go.work.sum
|
|
@ -1 +1,157 @@
|
|||
dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
|
||||
dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
|
||||
github.com/Anddd7/pb v0.0.0-20240425032658-369b0f6a404c h1:uhBf0CHXi7nCFZXxHV7l1cBcYFEEVRK4FYxvm1l9lKg=
|
||||
github.com/Anddd7/pb v0.0.0-20240425032658-369b0f6a404c/go.mod h1:vYWKbnXd2KAZHUECLPzSE0Er3FgiEmOdPtxwSIRihck=
|
||||
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
|
||||
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
|
||||
github.com/armon/go-proxyproto v0.1.0 h1:TWWcSsjco7o2itn6r25/5AqKBiWmsiuzsUDLT/MTl7k=
|
||||
github.com/armon/go-proxyproto v0.1.0/go.mod h1:Xj90dce2VKbHzRAeiVQAMBtj4M5oidoXJ8lmgyW21mw=
|
||||
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
|
||||
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
|
||||
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
|
||||
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
|
||||
github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/eapache/channels v1.1.0 h1:F1taHcn7/F0i8DYqKXJnyhJcVpp2kgFcNePxXtnyu4k=
|
||||
github.com/eapache/channels v1.1.0/go.mod h1:jMm2qB5Ubtg9zLd+inMZd2/NUvXgzmWXsDaLyQIGfH0=
|
||||
github.com/eapache/queue v1.1.0 h1:YOEu7KNc61ntiQlcEeUIoDTJ2o8mQznoNvUhiigpIqc=
|
||||
github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
|
||||
github.com/emicklei/go-restful/v3 v3.12.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
|
||||
github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lShz4oaXpDTX2bLe7ls=
|
||||
github.com/evanphx/json-patch v5.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
|
||||
github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
|
||||
github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
|
||||
github.com/fullsailor/pkcs7 v0.0.0-20160414161337-2585af45975b/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
|
||||
github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa h1:RDBNVkRviHZtvDvId8XSGPu3rmpmSe+wKRcEWNgsfWU=
|
||||
github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
|
||||
github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
|
||||
github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
|
||||
github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
|
||||
github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
|
||||
github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
|
||||
github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
|
||||
github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
|
||||
github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
|
||||
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
|
||||
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
|
||||
github.com/gomarkdown/markdown v0.0.0-20210514010506-3b9f47219fe7/go.mod h1:aii0r/K0ZnHv7G0KF7xy1v0A7s2Ljrb5byB7MO5p6TU=
|
||||
github.com/gomarkdown/markdown v0.0.0-20231222211730-1d6d20845b47/go.mod h1:JDGcbDT52eL4fju3sZ4TeHGsQwhG9nbDV21aMyhwPoA=
|
||||
github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
|
||||
github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
|
||||
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
|
||||
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
|
||||
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
|
||||
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
|
||||
github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=
|
||||
github.com/klauspost/compress v1.17.9/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
|
||||
github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
|
||||
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
|
||||
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
|
||||
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
|
||||
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
|
||||
github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
|
||||
github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
|
||||
github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
|
||||
github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
|
||||
github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
|
||||
github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
|
||||
github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
|
||||
github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
|
||||
github.com/mmarkdown/mmark v2.0.40+incompatible/go.mod h1:Uvmoz7tvsWpr7bMVxIpqZPyN3FbOtzDmnsJDFp7ltJs=
|
||||
github.com/moby/sys/mountinfo v0.7.1/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
|
||||
github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
|
||||
github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
|
||||
github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
|
||||
github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
|
||||
github.com/moul/pb v0.0.0-20220425114252-bca18df4138c h1:1STmblv9zmHLDpru4dbnf1PNL6wrrZNf7yBH+SfQU+s=
|
||||
github.com/moul/pb v0.0.0-20220425114252-bca18df4138c/go.mod h1:jE2HT8eoucYyUPBFJMreiVlC3KPHkDMtN8wn+ef7Y64=
|
||||
github.com/ncabatoff/go-seq v0.0.0-20180805175032-b08ef85ed833 h1:t4WWQ9I797y7QUgeEjeXnVb+oYuEDQc6gLvrZJTYo94=
|
||||
github.com/ncabatoff/go-seq v0.0.0-20180805175032-b08ef85ed833/go.mod h1:0CznHmXSjMEqs5Tezj/w2emQoM41wzYM9KpDKUHPYag=
|
||||
github.com/ncabatoff/process-exporter v0.8.3 h1:ZJpzWhRfwdBisIpr2BkitAlUR6dt45hpQn8/AYgToO8=
|
||||
github.com/ncabatoff/process-exporter v0.8.3/go.mod h1:MxEOWl740VK/hlWycJkq91VrA2mI+U9Bvc1wuyAaxA4=
|
||||
github.com/nginxinc/nginx-go-crossplane v0.4.63 h1:nx5e+EXzPepWVM3YsTEhcs8kp8XDTK1BCzPTTmdgK1E=
|
||||
github.com/nginxinc/nginx-go-crossplane v0.4.63/go.mod h1:b7L/JSru3rvbbxVJxBgkePkNvC+LXo/IWE4iJJJvUUw=
|
||||
github.com/opencontainers/runc v1.1.14/go.mod h1:E4C2z+7BxR7GHXp0hAY53mek+x49X1LjPNeMTfRGvOA=
|
||||
github.com/opencontainers/runtime-spec v1.2.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
|
||||
github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
|
||||
github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/prometheus/client_golang v1.20.3 h1:oPksm4K8B+Vt35tUhw6GbSNSgVlVSBH0qELP/7u83l4=
|
||||
github.com/prometheus/client_golang v1.20.3/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
|
||||
github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
|
||||
github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
|
||||
github.com/prometheus/common v0.59.1 h1:LXb1quJHWm1P6wq/U824uxYi4Sg0oGvNeUm1z5dJoX0=
|
||||
github.com/prometheus/common v0.59.1/go.mod h1:GpWM7dewqmVYcd7SmRaiWVe9SSqjf0UrwnYnpEZNuT0=
|
||||
github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
|
||||
github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
|
||||
github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
|
||||
github.com/stretchr/testify v1.1.3/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
|
||||
github.com/urfave/cli v1.17.1-0.20160602030128-01a33823596e/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
|
||||
github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
|
||||
github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
|
||||
github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
|
||||
github.com/yudai/gojsondiff v1.0.0 h1:27cbfqXLVEJ1o8I6v3y9lg8Ydm53EKqHXAOMxEGlCOA=
|
||||
github.com/yudai/gojsondiff v1.0.0/go.mod h1:AY32+k2cwILAkW1fbgxQ5mUmMiZFgLIV+FBNExI05xg=
|
||||
github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82 h1:BHyfKlQyqbsFN5p3IfnEUduWvb9is428/nNb5L3U01M=
|
||||
github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82/go.mod h1:lgjkn3NuSvDfVJdfcVVdX+jpBxNmX4rDAzaS45IcYoM=
|
||||
github.com/yudai/pp v2.0.1+incompatible/go.mod h1:PuxR/8QJ7cyCkFp/aUDS+JY727OFEZkTdatxwunjIkc=
|
||||
github.com/zakjan/cert-chain-resolver v0.0.0-20221221105603-fcedb00c5b30 h1:rzHvkiukOVYcf840FqAsHqBMhfLofvQIxWtczkGRklU=
|
||||
github.com/zakjan/cert-chain-resolver v0.0.0-20221221105603-fcedb00c5b30/go.mod h1:/Hzu8ych2oXCs1iNI+MeASyFzWTncQ6nlu/wgqbqC2A=
|
||||
go.starlark.net v0.0.0-20240123142251-f86470692795 h1:LmbG8Pq7KDGkglKVn8VpZOZj6vb9b8nKEGcg9l03epM=
|
||||
go.starlark.net v0.0.0-20240123142251-f86470692795/go.mod h1:LcLNIzVOMp4oV+uusnpk+VU+SzXaJakUuBjoCSWH5dM=
|
||||
go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
|
||||
golang.org/dl v0.0.0-20190829154251-82a15e2f2ead/go.mod h1:IUMfjQLJQd4UTqG1Z90tenwKoCX93Gn3MAQJMOSBsDQ=
|
||||
golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
|
||||
golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
|
||||
golang.org/x/oauth2 v0.22.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
|
||||
golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
|
||||
golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
|
||||
golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=
|
||||
golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
|
||||
google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 h1:KAeGQVN3M9nD0/bQXnr/ClcEMJ968gUXJQ9pwfSynuQ=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 h1:BwIjyKYGsK9dMCBOorzRri8MQwmi7mT9rGHsCEinZkA=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
|
||||
google.golang.org/grpc v1.66.0 h1:DibZuoBznOxbDQxRINckZcUvnCEvrW9pcWIE2yF9r1c=
|
||||
google.golang.org/grpc v1.66.0/go.mod h1:s3/l6xSSCURdVfAnL+TqCNMyTDAGN6+lZeVxnZR128Y=
|
||||
google.golang.org/grpc/examples v0.0.0-20240223204917-5ccf176a08ab h1:tg8hvIl5RmFBuXlcJMuL0h4Psh1gx5Q5xEMwzBZIzWA=
|
||||
google.golang.org/grpc/examples v0.0.0-20240223204917-5ccf176a08ab/go.mod h1:liVNnGuZDITxuksuZ+BBvdy7FcJfeNk+efF9qgqNUmc=
|
||||
google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
|
||||
gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
|
||||
gopkg.in/evanphx/json-patch.v5 v5.9.0 h1:hx1VU2SGj4F8r9b8GUwJLdc8DNO8sy79ZGui0G05GLo=
|
||||
gopkg.in/evanphx/json-patch.v5 v5.9.0/go.mod h1:/kvTRh1TVm5wuM6OkHxqXtE/1nUZZpihg29RtuIyfvk=
|
||||
gopkg.in/go-playground/assert.v1 v1.2.1/go.mod h1:9RXL0bg/zibRAgZUYszZSwO/z8Y/a8bDuhia5mkpMnE=
|
||||
gopkg.in/go-playground/pool.v3 v3.1.1 h1:4Qcj91IsYTpIeRhe/eo6Fz+w6uKWPEghx8vHFTYMfhw=
|
||||
gopkg.in/go-playground/pool.v3 v3.1.1/go.mod h1:pUAGBximS/hccTTSzEop6wvvQhVa3QPDFFW+8REdutg=
|
||||
gopkg.in/mcuadros/go-syslog.v2 v2.3.0 h1:kcsiS+WsTKyIEPABJBJtoG0KkOS6yzvJ+/eZlhD79kk=
|
||||
gopkg.in/mcuadros/go-syslog.v2 v2.3.0/go.mod h1:l5LPIyOOyIdQquNg+oU6Z3524YwrcqEm0aKH+5zpt2U=
|
||||
k8s.io/api v0.31.0/go.mod h1:0YiFF+JfFxMM6+1hQei8FY8M7s1Mth+z/q7eF1aJkTE=
|
||||
k8s.io/apiextensions-apiserver v0.31.0 h1:fZgCVhGwsclj3qCw1buVXCV6khjRzKC5eCFt24kyLSk=
|
||||
k8s.io/apiextensions-apiserver v0.31.0/go.mod h1:b9aMDEYaEe5sdK+1T0KU78ApR/5ZVp4i56VacZYEHxk=
|
||||
k8s.io/apimachinery v0.31.0/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
|
||||
k8s.io/apiserver v0.31.0 h1:p+2dgJjy+bk+B1Csz+mc2wl5gHwvNkC9QJV+w55LVrY=
|
||||
k8s.io/apiserver v0.31.0/go.mod h1:KI9ox5Yu902iBnnyMmy7ajonhKnkeZYJhTZ/YI+WEMk=
|
||||
k8s.io/cli-runtime v0.30.0 h1:0vn6/XhOvn1RJ2KJOC6IRR2CGqrpT6QQF4+8pYpWQ48=
|
||||
k8s.io/cli-runtime v0.30.0/go.mod h1:vATpDMATVTMA79sZ0YUCzlMelf6rUjoBzlp+RnoM+cg=
|
||||
k8s.io/client-go v0.31.0/go.mod h1:Y9wvC76g4fLjmU0BA+rV+h2cncoadjvjjkkIGoTLcGU=
|
||||
k8s.io/code-generator v0.31.0/go.mod h1:84y4w3es8rOJOUUP1rLsIiGlO1JuEaPFXQPA9e/K6U0=
|
||||
k8s.io/component-base v0.31.0 h1:/KIzGM5EvPNQcYgwq5NwoQBaOlVFrghoVGr8lG6vNRs=
|
||||
k8s.io/component-base v0.31.0/go.mod h1:TYVuzI1QmN4L5ItVdMSXKvH7/DtvIuas5/mm8YT3rTo=
|
||||
k8s.io/gengo/v2 v2.0.0-20240404160639-a0386bf69313/go.mod h1:VH3AT8AaQOqiGjMF9p0/IM1Dj+82ZwjfxUP1IxaHE+8=
|
||||
k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
|
||||
k8s.io/kube-openapi v0.0.0-20240430033511-f0e62f92d13f/go.mod h1:S9tOR0FxgyusSNR+MboCuiDpVWkAifZvaYI1Q2ubgro=
|
||||
k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
|
||||
pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 h1:SAElp8THCfmBdM+4lmWX5gebiSSkEr7PAYDVF91qpfg=
|
||||
pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732/go.mod h1:lpvCfhqEHNJSSpG5R5A2EgsVzG8RTt4RfPoQuRAcDmg=
|
||||
sigs.k8s.io/controller-runtime v0.19.0 h1:nWVM7aq+Il2ABxwiCizrVDSlmDcshi9llbaFbC0ji/Q=
|
||||
sigs.k8s.io/controller-runtime v0.19.0/go.mod h1:iRmWllt8IlaLjvTTDLhRBXIEtkCK6hwVBJJsYS9Ajf4=
|
||||
sigs.k8s.io/kustomize/api v0.16.0 h1:/zAR4FOQDCkgSDmVzV2uiFbuy9bhu3jEzthrHCuvm1g=
|
||||
sigs.k8s.io/kustomize/api v0.16.0/go.mod h1:MnFZ7IP2YqVyVwMWoRxPtgl/5hpA+eCCrQR/866cm5c=
|
||||
sigs.k8s.io/kustomize/kyaml v0.16.0 h1:6J33uKSoATlKZH16unr2XOhDI+otoe2sR3M8PDzW3K0=
|
||||
sigs.k8s.io/kustomize/kyaml v0.16.0/go.mod h1:xOK/7i+vmE14N2FdFyugIshB8eF6ALpy7jI87Q2nRh4=
|
||||
sigs.k8s.io/mdtoc v1.1.0/go.mod h1:QZLVEdHH2iNIR4uHAZyvFRtjloHgVItk8lo/mzCtq3w=
|
||||
|
|
|
|||
|
|
@ -44,5 +44,19 @@ func (c *Template) buildConfig() {
|
|||
)
|
||||
}
|
||||
|
||||
if shouldLoadAuthDigestModule(c.tplConfig.Servers) {
|
||||
config.Parsed = append(config.Parsed, buildDirective("load_module", "/etc/nginx/modules/ngx_http_auth_digest_module.so"))
|
||||
}
|
||||
|
||||
if c.tplConfig.Cfg.EnableOpentelemetry || shouldLoadOpentelemetryModule(c.tplConfig.Servers) {
|
||||
config.Parsed = append(config.Parsed, buildDirective("load_module", "/etc/nginx/modules/otel_ngx_module.so"))
|
||||
}
|
||||
|
||||
if c.tplConfig.Cfg.UseGeoIP2 {
|
||||
config.Parsed = append(config.Parsed,
|
||||
buildDirective("load_module", "/etc/nginx/modules/ngx_http_geoip2_module.so"),
|
||||
)
|
||||
}
|
||||
|
||||
c.config = config
|
||||
}
|
||||
|
|
|
|||
|
|
@ -53,7 +53,7 @@ func TestCrossplaneTemplate(t *testing.T) {
|
|||
IgnoreDirectives: []string{"more_clear_headers", "more_set_headers"}, // TODO: Add more_set_headers
|
||||
DirectiveSources: []ngx_crossplane.MatchFunc{
|
||||
ngx_crossplane.DefaultDirectivesMatchFunc,
|
||||
ngx_crossplane.LuaDirectivesMatchFn,
|
||||
ngx_crossplane.MatchLuaLatest,
|
||||
extramodules.BrotliMatchFn,
|
||||
},
|
||||
LexOptions: ngx_crossplane.LexOptions{
|
||||
|
|
|
|||
|
|
@ -7,11 +7,16 @@
|
|||
{{ $proxyHeaders := .ProxySetHeaders }}
|
||||
{{ $addHeaders := .AddHeaders }}
|
||||
|
||||
# MIGRATED
|
||||
pid {{ .PID }};
|
||||
# Configuration checksum: {{ $all.Cfg.Checksum }}
|
||||
|
||||
# MODULES ARE NOT MIGRATED YET!
|
||||
{{ if $cfg.EnableBrotli }}
|
||||
# setup custom paths that do not require root access
|
||||
pid {{ .PID }}; # OK
|
||||
|
||||
{{ if $cfg.UseGeoIP2 }} #OK
|
||||
load_module /etc/nginx/modules/ngx_http_geoip2_module.so;
|
||||
{{ end }}
|
||||
|
||||
{{ if $cfg.EnableBrotli }} #OK
|
||||
load_module /etc/nginx/modules/ngx_http_brotli_filter_module.so;
|
||||
load_module /etc/nginx/modules/ngx_http_brotli_static_module.so;
|
||||
{{ end }}
|
||||
|
|
@ -20,114 +25,56 @@ load_module /etc/nginx/modules/ngx_http_brotli_static_module.so;
|
|||
load_module /etc/nginx/modules/ngx_http_auth_digest_module.so;
|
||||
{{ end }}
|
||||
|
||||
{{ if (shouldLoadModSecurityModule $cfg $servers) }}
|
||||
load_module /etc/nginx/modules/ngx_http_modsecurity_module.so;
|
||||
{{ end }}
|
||||
|
||||
{{ if (shouldLoadOpentelemetryModule $cfg $servers) }}
|
||||
load_module /etc/nginx/modules/otel_ngx_module.so;
|
||||
{{ end }}
|
||||
|
||||
# MIGRATED 1
|
||||
daemon off;
|
||||
daemon off; # OK
|
||||
|
||||
worker_processes {{ $cfg.WorkerProcesses }};
|
||||
{{ if gt (len $cfg.WorkerCPUAffinity) 0 }}
|
||||
worker_processes {{ $cfg.WorkerProcesses }}; # OK
|
||||
{{ if gt (len $cfg.WorkerCPUAffinity) 0 }} # OK
|
||||
worker_cpu_affinity {{ $cfg.WorkerCPUAffinity }};
|
||||
{{ end }}
|
||||
|
||||
worker_rlimit_nofile {{ $cfg.MaxWorkerOpenFiles }};
|
||||
worker_rlimit_nofile {{ $cfg.MaxWorkerOpenFiles }}; # OK
|
||||
|
||||
{{/* http://nginx.org/en/docs/ngx_core_module.html#worker_shutdown_timeout */}}
|
||||
{{/* avoid waiting too long during a reload */}}
|
||||
worker_shutdown_timeout {{ $cfg.WorkerShutdownTimeout }} ;
|
||||
worker_shutdown_timeout {{ $cfg.WorkerShutdownTimeout }} ; # OK
|
||||
|
||||
# REMOVED
|
||||
# {{ if not (empty $cfg.MainSnippet) }}
|
||||
# {{ $cfg.MainSnippet }}
|
||||
# {{ end }}
|
||||
|
||||
events {
|
||||
multi_accept {{ if $cfg.EnableMultiAccept }}on{{ else }}off{{ end }};
|
||||
worker_connections {{ $cfg.MaxWorkerConnections }};
|
||||
use epoll;
|
||||
{{ range $index , $v := $cfg.DebugConnections }}
|
||||
debug_connection {{ $v }};
|
||||
multi_accept {{ if $cfg.EnableMultiAccept }}on{{ else }}off{{ end }}; # OK
|
||||
worker_connections {{ $cfg.MaxWorkerConnections }}; # OK
|
||||
use epoll; # OK
|
||||
{{ range $index , $v := $cfg.DebugConnections }} # OK
|
||||
debug_connection {{ $v }}; # OK
|
||||
{{ end }}
|
||||
}
|
||||
|
||||
# END MIGRATED 1
|
||||
|
||||
http {
|
||||
{{ if (shouldLoadOpentelemetryModule $cfg $servers) }}
|
||||
opentelemetry_config {{ $cfg.OpentelemetryConfig }};
|
||||
{{ end }}
|
||||
|
||||
# MIGRATED
|
||||
lua_package_path "/etc/nginx/lua/?.lua;;";
|
||||
lua_package_path "/etc/nginx/lua/?.lua;;"; # OK
|
||||
|
||||
# MIGRATED
|
||||
{{ buildLuaSharedDictionaries $cfg $servers }}
|
||||
{{ buildLuaSharedDictionaries $cfg $servers }} # OK
|
||||
|
||||
# NOT MIGRATED
|
||||
init_by_lua_block {
|
||||
collectgarbage("collect")
|
||||
lua_shared_dict luaconfig 5m; # OK
|
||||
|
||||
-- init modules
|
||||
local ok, res
|
||||
init_by_lua_file /etc/nginx/lua/ngx_conf_init.lua; # OK
|
||||
|
||||
ok, res = pcall(require, "lua_ingress")
|
||||
if not ok then
|
||||
error("require failed: " .. tostring(res))
|
||||
else
|
||||
lua_ingress = res
|
||||
lua_ingress.set_config({{ configForLua $all }})
|
||||
end
|
||||
init_worker_by_lua_file /etc/nginx/lua/ngx_conf_init_worker.lua; # OK
|
||||
|
||||
ok, res = pcall(require, "configuration")
|
||||
if not ok then
|
||||
error("require failed: " .. tostring(res))
|
||||
else
|
||||
configuration = res
|
||||
configuration.prohibited_localhost_port = '{{ .StatusPort }}'
|
||||
end
|
||||
|
||||
ok, res = pcall(require, "balancer")
|
||||
if not ok then
|
||||
error("require failed: " .. tostring(res))
|
||||
else
|
||||
balancer = res
|
||||
end
|
||||
|
||||
{{ if $all.EnableMetrics }}
|
||||
ok, res = pcall(require, "monitor")
|
||||
if not ok then
|
||||
error("require failed: " .. tostring(res))
|
||||
else
|
||||
monitor = res
|
||||
end
|
||||
{{ end }}
|
||||
|
||||
ok, res = pcall(require, "certificate")
|
||||
if not ok then
|
||||
error("require failed: " .. tostring(res))
|
||||
else
|
||||
certificate = res
|
||||
certificate.is_ocsp_stapling_enabled = {{ $cfg.EnableOCSP }}
|
||||
end
|
||||
|
||||
ok, res = pcall(require, "plugins")
|
||||
if not ok then
|
||||
error("require failed: " .. tostring(res))
|
||||
else
|
||||
plugins = res
|
||||
end
|
||||
-- load all plugins that'll be used here
|
||||
plugins.init({ {{ range $idx, $plugin := $cfg.Plugins }}{{ if $idx }},{{ end }}{{ $plugin | quote }}{{ end }} })
|
||||
}
|
||||
|
||||
init_worker_by_lua_block {
|
||||
lua_ingress.init_worker()
|
||||
balancer.init_worker()
|
||||
{{ if $all.EnableMetrics }}
|
||||
monitor.init_worker({{ $all.MonitorMaxBatchSize }})
|
||||
{{ end }}
|
||||
|
||||
plugins.run()
|
||||
}
|
||||
|
||||
# MIGRATED VARIOUS 1
|
||||
{{/* Enable the real_ip module only if we use either X-Forwarded headers or Proxy Protocol. */}}
|
||||
{{/* we use the value of the real IP for the geo_ip module */}}
|
||||
{{ if or (or $cfg.UseForwardedHeaders $cfg.UseProxyProtocol) $cfg.EnableRealIP }}
|
||||
|
|
@ -143,6 +90,162 @@ http {
|
|||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{ if $all.Cfg.EnableModsecurity }}
|
||||
modsecurity on;
|
||||
|
||||
{{ if (not (empty $all.Cfg.ModsecuritySnippet)) }}
|
||||
modsecurity_rules '
|
||||
{{ $all.Cfg.ModsecuritySnippet }}
|
||||
';
|
||||
{{ else }}
|
||||
modsecurity_rules_file /etc/nginx/modsecurity/modsecurity.conf;
|
||||
{{ end }}
|
||||
|
||||
{{ if $all.Cfg.EnableOWASPCoreRules }}
|
||||
modsecurity_rules_file /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf;
|
||||
{{ end }}
|
||||
|
||||
{{ end }}
|
||||
|
||||
{{ if $cfg.UseGeoIP2 }}
|
||||
# https://github.com/leev/ngx_http_geoip2_module#example-usage
|
||||
|
||||
{{ range $index, $file := $all.MaxmindEditionFiles }}
|
||||
{{ if eq $file "GeoLite2-Country.mmdb" }}
|
||||
geoip2 /etc/ingress-controller/geoip/GeoLite2-Country.mmdb {
|
||||
{{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
|
||||
auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
|
||||
{{ end }}
|
||||
$geoip2_country_code source=$remote_addr country iso_code;
|
||||
$geoip2_country_name source=$remote_addr country names en;
|
||||
$geoip2_country_geoname_id source=$remote_addr country geoname_id;
|
||||
$geoip2_continent_code source=$remote_addr continent code;
|
||||
$geoip2_continent_name source=$remote_addr continent names en;
|
||||
$geoip2_continent_geoname_id source=$remote_addr continent geoname_id;
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
{{ if eq $file "GeoIP2-Country.mmdb" }}
|
||||
geoip2 /etc/ingress-controller/geoip/GeoIP2-Country.mmdb {
|
||||
{{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
|
||||
auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
|
||||
{{ end }}
|
||||
$geoip2_country_code source=$remote_addr country iso_code;
|
||||
$geoip2_country_name source=$remote_addr country names en;
|
||||
$geoip2_country_geoname_id source=$remote_addr country geoname_id;
|
||||
$geoip2_continent_code source=$remote_addr continent code;
|
||||
$geoip2_continent_name source=$remote_addr continent names en;
|
||||
$geoip2_continent_geoname_id source=$remote_addr continent geoname_id;
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
{{ if eq $file "GeoLite2-City.mmdb" }}
|
||||
geoip2 /etc/ingress-controller/geoip/GeoLite2-City.mmdb {
|
||||
{{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
|
||||
auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
|
||||
{{ end }}
|
||||
$geoip2_city_country_code source=$remote_addr country iso_code;
|
||||
$geoip2_city_country_name source=$remote_addr country names en;
|
||||
$geoip2_city_country_geoname_id source=$remote_addr country geoname_id;
|
||||
$geoip2_city source=$remote_addr city names en;
|
||||
$geoip2_city_geoname_id source=$remote_addr city geoname_id;
|
||||
$geoip2_postal_code source=$remote_addr postal code;
|
||||
$geoip2_dma_code source=$remote_addr location metro_code;
|
||||
$geoip2_latitude source=$remote_addr location latitude;
|
||||
$geoip2_longitude source=$remote_addr location longitude;
|
||||
$geoip2_time_zone source=$remote_addr location time_zone;
|
||||
$geoip2_region_code source=$remote_addr subdivisions 0 iso_code;
|
||||
$geoip2_region_name source=$remote_addr subdivisions 0 names en;
|
||||
$geoip2_region_geoname_id source=$remote_addr subdivisions 0 geoname_id;
|
||||
$geoip2_subregion_code source=$remote_addr subdivisions 1 iso_code;
|
||||
$geoip2_subregion_name source=$remote_addr subdivisions 1 names en;
|
||||
$geoip2_subregion_geoname_id source=$remote_addr subdivisions 1 geoname_id;
|
||||
$geoip2_city_continent_code source=$remote_addr continent code;
|
||||
$geoip2_city_continent_name source=$remote_addr continent names en;
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
{{ if eq $file "GeoIP2-City.mmdb" }}
|
||||
geoip2 /etc/ingress-controller/geoip/GeoIP2-City.mmdb {
|
||||
{{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
|
||||
auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
|
||||
{{ end }}
|
||||
$geoip2_city_country_code source=$remote_addr country iso_code;
|
||||
$geoip2_city_country_name source=$remote_addr country names en;
|
||||
$geoip2_city_country_geoname_id source=$remote_addr country geoname_id;
|
||||
$geoip2_city source=$remote_addr city names en;
|
||||
$geoip2_city_geoname_id source=$remote_addr city geoname_id;
|
||||
$geoip2_postal_code source=$remote_addr postal code;
|
||||
$geoip2_dma_code source=$remote_addr location metro_code;
|
||||
$geoip2_latitude source=$remote_addr location latitude;
|
||||
$geoip2_longitude source=$remote_addr location longitude;
|
||||
$geoip2_time_zone source=$remote_addr location time_zone;
|
||||
$geoip2_region_code source=$remote_addr subdivisions 0 iso_code;
|
||||
$geoip2_region_name source=$remote_addr subdivisions 0 names en;
|
||||
$geoip2_region_geoname_id source=$remote_addr subdivisions 0 geoname_id;
|
||||
$geoip2_subregion_code source=$remote_addr subdivisions 1 iso_code;
|
||||
$geoip2_subregion_name source=$remote_addr subdivisions 1 names en;
|
||||
$geoip2_subregion_geoname_id source=$remote_addr subdivisions 1 geoname_id;
|
||||
$geoip2_city_continent_code source=$remote_addr continent code;
|
||||
$geoip2_city_continent_name source=$remote_addr continent names en;
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
{{ if eq $file "GeoLite2-ASN.mmdb" }}
|
||||
geoip2 /etc/ingress-controller/geoip/GeoLite2-ASN.mmdb {
|
||||
{{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
|
||||
auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
|
||||
{{ end }}
|
||||
$geoip2_asn source=$remote_addr autonomous_system_number;
|
||||
$geoip2_org source=$remote_addr autonomous_system_organization;
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
{{ if eq $file "GeoIP2-ASN.mmdb" }}
|
||||
geoip2 /etc/ingress-controller/geoip/GeoIP2-ASN.mmdb {
|
||||
{{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
|
||||
auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
|
||||
{{ end }}
|
||||
$geoip2_asn source=$remote_addr autonomous_system_number;
|
||||
$geoip2_org source=$remote_addr autonomous_system_organization;
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
{{ if eq $file "GeoIP2-ISP.mmdb" }}
|
||||
geoip2 /etc/ingress-controller/geoip/GeoIP2-ISP.mmdb {
|
||||
{{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
|
||||
auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
|
||||
{{ end }}
|
||||
$geoip2_isp source=$remote_addr isp;
|
||||
$geoip2_isp_org source=$remote_addr organization;
|
||||
$geoip2_asn source=$remote_addr default=0 autonomous_system_number;
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
{{ if eq $file "GeoIP2-Connection-Type.mmdb" }}
|
||||
geoip2 /etc/ingress-controller/geoip/GeoIP2-Connection-Type.mmdb {
|
||||
$geoip2_connection_type connection_type;
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
{{ if eq $file "GeoIP2-Anonymous-IP.mmdb" }}
|
||||
geoip2 /etc/ingress-controller/geoip/GeoIP2-Anonymous-IP.mmdb {
|
||||
{{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
|
||||
auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
|
||||
{{ end }}
|
||||
$geoip2_is_anon source=$remote_addr is_anonymous;
|
||||
$geoip2_is_anonymous source=$remote_addr default=0 is_anonymous;
|
||||
$geoip2_is_anonymous_vpn source=$remote_addr default=0 is_anonymous_vpn;
|
||||
$geoip2_is_hosting_provider source=$remote_addr default=0 is_hosting_provider;
|
||||
$geoip2_is_public_proxy source=$remote_addr default=0 is_public_proxy;
|
||||
$geoip2_is_tor_exit_node source=$remote_addr default=0 is_tor_exit_node;
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
{{ end }}
|
||||
|
||||
{{ end }}
|
||||
|
||||
aio threads;
|
||||
|
||||
{{ if $cfg.EnableAioWrite }}
|
||||
|
|
@ -201,9 +304,18 @@ http {
|
|||
limit_req_status {{ $cfg.LimitReqStatusCode }};
|
||||
limit_conn_status {{ $cfg.LimitConnStatusCode }};
|
||||
|
||||
{{ buildOpentelemetry $cfg $servers }}
|
||||
|
||||
include /etc/nginx/mime.types;
|
||||
default_type {{ $cfg.DefaultType }};
|
||||
|
||||
{{ if $cfg.EnableBrotli }}
|
||||
brotli on;
|
||||
brotli_comp_level {{ $cfg.BrotliLevel }};
|
||||
brotli_min_length {{ $cfg.BrotliMinLength }};
|
||||
brotli_types {{ $cfg.BrotliTypes }};
|
||||
{{ end }}
|
||||
|
||||
{{ if $cfg.UseGzip }}
|
||||
gzip on;
|
||||
gzip_comp_level {{ $cfg.GzipLevel }};
|
||||
|
|
@ -263,26 +375,6 @@ http {
|
|||
|
||||
{{ buildResolvers $cfg.Resolver $cfg.DisableIpv6DNS }}
|
||||
|
||||
server_name_in_redirect off;
|
||||
port_in_redirect off;
|
||||
|
||||
ssl_protocols {{ $cfg.SSLProtocols }};
|
||||
|
||||
ssl_early_data {{ if $cfg.SSLEarlyData }}on{{ else }}off{{ end }};
|
||||
|
||||
# allow configuring ssl session tickets
|
||||
ssl_session_tickets {{ if $cfg.SSLSessionTickets }}on{{ else }}off{{ end }};
|
||||
|
||||
# slightly reduce the time-to-first-byte
|
||||
ssl_buffer_size {{ $cfg.SSLBufferSize }};
|
||||
|
||||
ssl_ecdh_curve {{ $cfg.SSLECDHCurve }};
|
||||
# PEM sha: {{ $cfg.DefaultSSLCertificate.PemSHA }}
|
||||
ssl_certificate {{ $cfg.DefaultSSLCertificate.PemFileName }};
|
||||
ssl_certificate_key {{ $cfg.DefaultSSLCertificate.PemFileName }};
|
||||
|
||||
proxy_ssl_session_reuse on;
|
||||
|
||||
# See https://www.nginx.com/blog/websocket-nginx
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
|
|
@ -303,9 +395,6 @@ http {
|
|||
{{ end }}
|
||||
}
|
||||
|
||||
# Cache for internal auth checks
|
||||
proxy_cache_path /tmp/nginx/nginx-cache-auth levels=1:2 keys_zone=auth_cache:10m max_size=128m inactive=30m use_temp_path=off;
|
||||
|
||||
{{ if and $cfg.UseForwardedHeaders $cfg.ComputeFullForwardedFor }}
|
||||
# We can't use $proxy_add_x_forwarded_for because the realip module
|
||||
# replaces the remote_addr too soon
|
||||
|
|
@ -321,16 +410,35 @@ http {
|
|||
|
||||
{{ end }}
|
||||
|
||||
# Create a variable that contains the literal $ character.
|
||||
# This works because the geo module will not resolve variables.
|
||||
geo $literal_dollar {
|
||||
default "$";
|
||||
}
|
||||
|
||||
server_name_in_redirect off;
|
||||
port_in_redirect off;
|
||||
|
||||
ssl_protocols {{ $cfg.SSLProtocols }};
|
||||
|
||||
ssl_early_data {{ if $cfg.SSLEarlyData }}on{{ else }}off{{ end }};
|
||||
|
||||
# turn on session caching to drastically improve performance
|
||||
{{ if $cfg.SSLSessionCache }}
|
||||
ssl_session_cache shared:SSL:{{ $cfg.SSLSessionCacheSize }};
|
||||
ssl_session_timeout {{ $cfg.SSLSessionTimeout }};
|
||||
{{ end }}
|
||||
|
||||
# allow configuring ssl session tickets
|
||||
ssl_session_tickets {{ if $cfg.SSLSessionTickets }}on{{ else }}off{{ end }};
|
||||
|
||||
{{ if not (empty $cfg.SSLSessionTicketKey ) }}
|
||||
ssl_session_ticket_key /etc/ingress-controller/tickets.key;
|
||||
{{ end }}
|
||||
|
||||
# slightly reduce the time-to-first-byte
|
||||
ssl_buffer_size {{ $cfg.SSLBufferSize }};
|
||||
|
||||
{{ if not (empty $cfg.SSLCiphers) }}
|
||||
# allow configuring custom ssl ciphers
|
||||
ssl_ciphers '{{ $cfg.SSLCiphers }}';
|
||||
|
|
@ -342,16 +450,20 @@ http {
|
|||
ssl_dhparam {{ $cfg.SSLDHParam }};
|
||||
{{ end }}
|
||||
|
||||
ssl_ecdh_curve {{ $cfg.SSLECDHCurve }};
|
||||
|
||||
# PEM sha: {{ $cfg.DefaultSSLCertificate.PemSHA }}
|
||||
ssl_certificate {{ $cfg.DefaultSSLCertificate.PemFileName }};
|
||||
ssl_certificate_key {{ $cfg.DefaultSSLCertificate.PemFileName }};
|
||||
|
||||
{{ if and $cfg.CustomHTTPErrors (not $cfg.DisableProxyInterceptErrors) }}
|
||||
proxy_intercept_errors on;
|
||||
{{ end }}
|
||||
|
||||
{{ if $cfg.EnableBrotli }}
|
||||
brotli on;
|
||||
brotli_comp_level {{ $cfg.BrotliLevel }};
|
||||
brotli_min_length {{ $cfg.BrotliMinLength }};
|
||||
brotli_types {{ $cfg.BrotliTypes }};
|
||||
{{ end }}
|
||||
{{ range $errCode := $cfg.CustomHTTPErrors }}
|
||||
error_page {{ $errCode }} = @custom_upstream-default-backend_{{ $errCode }};{{ end }}
|
||||
|
||||
proxy_ssl_session_reuse on;
|
||||
|
||||
{{ if $cfg.AllowBackendServerHeader }}
|
||||
proxy_pass_header Server;
|
||||
|
|
@ -360,6 +472,59 @@ http {
|
|||
{{ range $header := $cfg.HideHeaders }}proxy_hide_header {{ $header }};
|
||||
{{ end }}
|
||||
|
||||
{{ if not (empty $cfg.HTTPSnippet) }}
|
||||
# Custom code snippet configured in the configuration configmap
|
||||
{{ $cfg.HTTPSnippet }}
|
||||
{{ end }}
|
||||
|
||||
upstream upstream_balancer {
|
||||
### Attention!!!
|
||||
#
|
||||
# We no longer create "upstream" section for every backend.
|
||||
# Backends are handled dynamically using Lua. If you would like to debug
|
||||
# and see what backends ingress-nginx has in its memory you can
|
||||
# install our kubectl plugin https://kubernetes.github.io/ingress-nginx/kubectl-plugin.
|
||||
# Once you have the plugin you can use "kubectl ingress-nginx backends" command to
|
||||
# inspect current backends.
|
||||
#
|
||||
###
|
||||
|
||||
server 0.0.0.1; # placeholder
|
||||
|
||||
balancer_by_lua_file /etc/nginx/lua/nginx/ngx_conf_balancer.lua;
|
||||
|
||||
{{ if (gt $cfg.UpstreamKeepaliveConnections 0) }}
|
||||
keepalive {{ $cfg.UpstreamKeepaliveConnections }};
|
||||
keepalive_time {{ $cfg.UpstreamKeepaliveTime }};
|
||||
keepalive_timeout {{ $cfg.UpstreamKeepaliveTimeout }}s;
|
||||
keepalive_requests {{ $cfg.UpstreamKeepaliveRequests }};
|
||||
{{ end }}
|
||||
}
|
||||
|
||||
{{ range $rl := (filterRateLimits $servers ) }}
|
||||
# Ratelimit {{ $rl.Name }}
|
||||
geo $remote_addr $allowlist_{{ $rl.ID }} {
|
||||
default 0;
|
||||
{{ range $ip := $rl.Allowlist }}
|
||||
{{ $ip }} 1;{{ end }}
|
||||
}
|
||||
|
||||
# Ratelimit {{ $rl.Name }}
|
||||
map $allowlist_{{ $rl.ID }} $limit_{{ $rl.ID }} {
|
||||
0 {{ $cfg.LimitConnZoneVariable }};
|
||||
1 "";
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
{{/* build all the required rate limit zones. Each annotation requires a dedicated zone */}}
|
||||
{{/* 1MB -> 16 thousand 64-byte states or about 8 thousand 128-byte states */}}
|
||||
{{ range $zone := (buildRateLimitZones $servers) }}
|
||||
{{ $zone }}
|
||||
{{ end }}
|
||||
|
||||
# Cache for internal auth checks
|
||||
proxy_cache_path /tmp/nginx/nginx-cache-auth levels=1:2 keys_zone=auth_cache:10m max_size=128m inactive=30m use_temp_path=off;
|
||||
|
||||
# Global filters
|
||||
{{ range $ip := $cfg.BlockCIDRs }}deny {{ trimSpace $ip }};
|
||||
{{ end }}
|
||||
|
|
@ -382,57 +547,6 @@ http {
|
|||
}
|
||||
{{ end }}
|
||||
|
||||
upstream upstream_balancer {
|
||||
server 0.0.0.1; # placeholder
|
||||
|
||||
balancer_by_lua_block {
|
||||
balancer.balance()
|
||||
}
|
||||
|
||||
{{ if (gt $cfg.UpstreamKeepaliveConnections 0) }}
|
||||
keepalive {{ $cfg.UpstreamKeepaliveConnections }};
|
||||
keepalive_time {{ $cfg.UpstreamKeepaliveTime }};
|
||||
keepalive_timeout {{ $cfg.UpstreamKeepaliveTimeout }}s;
|
||||
keepalive_requests {{ $cfg.UpstreamKeepaliveRequests }};
|
||||
{{ end }}
|
||||
}
|
||||
|
||||
# END MIGRATED VARIOUS 1
|
||||
|
||||
{{ buildOpentelemetry $cfg $servers }}
|
||||
|
||||
# Create a variable that contains the literal $ character.
|
||||
# This works because the geo module will not resolve variables.
|
||||
geo $literal_dollar {
|
||||
default "$";
|
||||
}
|
||||
|
||||
# MIGRATED
|
||||
{{ range $errCode := $cfg.CustomHTTPErrors }}
|
||||
error_page {{ $errCode }} = @custom_upstream-default-backend_{{ $errCode }};{{ end }}
|
||||
|
||||
{{ range $rl := (filterRateLimits $servers ) }}
|
||||
# Ratelimit {{ $rl.Name }}
|
||||
geo $remote_addr $allowlist_{{ $rl.ID }} {
|
||||
default 0;
|
||||
{{ range $ip := $rl.Allowlist }}
|
||||
{{ $ip }} 1;{{ end }}
|
||||
}
|
||||
|
||||
# Ratelimit {{ $rl.Name }}
|
||||
map $allowlist_{{ $rl.ID }} $limit_{{ $rl.ID }} {
|
||||
0 {{ $cfg.LimitConnZoneVariable }};
|
||||
1 "";
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
{{/* build all the required rate limit zones. Each annotation requires a dedicated zone */}}
|
||||
{{/* 1MB -> 16 thousand 64-byte states or about 8 thousand 128-byte states */}}
|
||||
{{ range $zone := (buildRateLimitZones $servers) }}
|
||||
{{ $zone }}
|
||||
{{ end }}
|
||||
|
||||
|
||||
{{/* Build server redirects (from/to www) */}}
|
||||
{{ range $redirect := .RedirectServers }}
|
||||
## start server {{ $redirect.From }}
|
||||
|
|
@ -442,9 +556,7 @@ http {
|
|||
{{ buildHTTPListener $all $redirect.From }}
|
||||
{{ buildHTTPSListener $all $redirect.From }}
|
||||
|
||||
ssl_certificate_by_lua_block {
|
||||
certificate.call()
|
||||
}
|
||||
ssl_certificate_by_lua_file /etc/nginx/lua/nginx/ngx_conf_certificate.lua;
|
||||
|
||||
{{ if gt (len $cfg.BlockUserAgents) 0 }}
|
||||
if ($block_ua) {
|
||||
|
|
@ -457,30 +569,7 @@ http {
|
|||
}
|
||||
{{ end }}
|
||||
|
||||
set_by_lua_block $redirect_to {
|
||||
local request_uri = ngx.var.request_uri
|
||||
if string.sub(request_uri, -1) == "/" then
|
||||
request_uri = string.sub(request_uri, 1, -2)
|
||||
end
|
||||
|
||||
{{ if $cfg.UseForwardedHeaders }}
|
||||
local redirectScheme
|
||||
if not ngx.var.http_x_forwarded_proto then
|
||||
redirectScheme = ngx.var.scheme
|
||||
else
|
||||
redirectScheme = ngx.var.http_x_forwarded_proto
|
||||
end
|
||||
{{ else }}
|
||||
local redirectScheme = ngx.var.scheme
|
||||
{{ end }}
|
||||
|
||||
{{ if ne $all.ListenPorts.HTTPS 443 }}
|
||||
{{ $redirect_port := (printf ":%v" $all.ListenPorts.HTTPS) }}
|
||||
return string.format("%s://%s%s%s", redirectScheme, "{{ $redirect.To }}", "{{ $redirect_port }}", request_uri)
|
||||
{{ else }}
|
||||
return string.format("%s://%s%s", redirectScheme, "{{ $redirect.To }}", request_uri)
|
||||
{{ end }}
|
||||
}
|
||||
set_by_lua_file $redirect_to /etc/nginx/lua/nginx/ngx_srv_redirect.lua {{ $redirect.To }};
|
||||
|
||||
return {{ $all.Cfg.HTTPRedirectCode }} $redirect_to;
|
||||
}
|
||||
|
|
@ -528,7 +617,12 @@ http {
|
|||
|
||||
{{ template "SERVER" serverConfig $all $server }}
|
||||
|
||||
{{ template "CUSTOM_ERRORS" (buildCustomErrorDeps "upstream-default-backend" $cfg.CustomHTTPErrors $all.EnableMetrics) }}
|
||||
{{ if not (empty $cfg.ServerSnippet) }}
|
||||
# Custom code snippet configured in the configuration configmap
|
||||
{{ $cfg.ServerSnippet }}
|
||||
{{ end }}
|
||||
|
||||
{{ template "CUSTOM_ERRORS" (buildCustomErrorDeps "upstream-default-backend" $cfg.CustomHTTPErrors $all.EnableMetrics $cfg.EnableModsecurity) }}
|
||||
}
|
||||
## end server {{ $server.Hostname }}
|
||||
|
||||
|
|
@ -549,6 +643,11 @@ http {
|
|||
|
||||
# default server, used for NGINX healthcheck and access to nginx stats
|
||||
server {
|
||||
# Ensure that modsecurity will not run on an internal location as this is not accessible from outside
|
||||
{{ if $all.Cfg.EnableModsecurity }}
|
||||
modsecurity off;
|
||||
{{ end }}
|
||||
|
||||
listen 127.0.0.1:{{ .StatusPort }};
|
||||
set $proxy_upstream_name "internal";
|
||||
|
||||
|
|
@ -565,17 +664,7 @@ http {
|
|||
}
|
||||
|
||||
location /is-dynamic-lb-initialized {
|
||||
content_by_lua_block {
|
||||
local configuration = require("configuration")
|
||||
local backend_data = configuration.get_backends_data()
|
||||
if not backend_data then
|
||||
ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR)
|
||||
return
|
||||
end
|
||||
|
||||
ngx.say("OK")
|
||||
ngx.exit(ngx.HTTP_OK)
|
||||
}
|
||||
content_by_lua_file /etc/nginx/lua/nginx/ngx_conf_is_dynamic_lb_initialized.lua;
|
||||
}
|
||||
|
||||
location {{ .StatusPath }} {
|
||||
|
|
@ -587,27 +676,136 @@ http {
|
|||
client_body_buffer_size {{ luaConfigurationRequestBodySize $cfg }};
|
||||
proxy_buffering off;
|
||||
|
||||
content_by_lua_block {
|
||||
configuration.call()
|
||||
}
|
||||
content_by_lua_file /etc/nginx/lua/nginx/ngx_conf_configuration.lua;
|
||||
}
|
||||
|
||||
location / {
|
||||
content_by_lua_block {
|
||||
ngx.exit(ngx.HTTP_NOT_FOUND)
|
||||
return 404;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
stream {
|
||||
lua_package_path "/etc/nginx/lua/?.lua;/etc/nginx/lua/vendor/?.lua;;";
|
||||
|
||||
lua_shared_dict tcp_udp_configuration_data 5M;
|
||||
|
||||
{{ buildResolvers $cfg.Resolver $cfg.DisableIpv6DNS }}
|
||||
|
||||
init_by_lua_file /etc/nginx/lua/ngx_conf_init_stream.lua;
|
||||
|
||||
init_worker_by_lua_file /etc/nginx/lua/nginx/ngx_conf_init_tcp_udp.lua;
|
||||
|
||||
lua_add_variable $proxy_upstream_name;
|
||||
|
||||
log_format log_stream '{{ $cfg.LogFormatStream }}';
|
||||
|
||||
{{ if or $cfg.DisableAccessLog $cfg.DisableStreamAccessLog }}
|
||||
access_log off;
|
||||
{{ else }}
|
||||
access_log {{ or $cfg.StreamAccessLogPath $cfg.AccessLogPath }} log_stream {{ $cfg.AccessLogParams }};
|
||||
{{ end }}
|
||||
|
||||
|
||||
error_log {{ $cfg.ErrorLogPath }} {{ $cfg.ErrorLogLevel }};
|
||||
{{ if $cfg.EnableRealIP }}
|
||||
{{ range $trusted_ip := $cfg.ProxyRealIPCIDR }}
|
||||
set_real_ip_from {{ $trusted_ip }};
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
upstream upstream_balancer {
|
||||
server 0.0.0.1:1234; # placeholder
|
||||
balancer_by_lua_file /etc/nginx/lua/nginx/ngx_conf_balancer_tcp_udp.lua;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 127.0.0.1:{{ .StreamPort }};
|
||||
|
||||
access_log off;
|
||||
|
||||
content_by_lua_file /etc/nginx/lua/nginx/ngx_conf_content_tcp_udp.lua;
|
||||
}
|
||||
|
||||
# TCP services
|
||||
{{ range $tcpServer := .TCPBackends }}
|
||||
server {
|
||||
preread_by_lua_block {
|
||||
ngx.var.proxy_upstream_name="tcp-{{ $tcpServer.Backend.Namespace }}-{{ $tcpServer.Backend.Name }}-{{ $tcpServer.Backend.Port }}";
|
||||
}
|
||||
|
||||
{{ range $address := $all.Cfg.BindAddressIpv4 }}
|
||||
listen {{ $address }}:{{ $tcpServer.Port }}{{ if $tcpServer.Backend.ProxyProtocol.Decode }} proxy_protocol{{ end }};
|
||||
{{ else }}
|
||||
listen {{ $tcpServer.Port }}{{ if $tcpServer.Backend.ProxyProtocol.Decode }} proxy_protocol{{ end }};
|
||||
{{ end }}
|
||||
{{ if $IsIPV6Enabled }}
|
||||
{{ range $address := $all.Cfg.BindAddressIpv6 }}
|
||||
listen {{ $address }}:{{ $tcpServer.Port }}{{ if $tcpServer.Backend.ProxyProtocol.Decode }} proxy_protocol{{ end }};
|
||||
{{ else }}
|
||||
listen [::]:{{ $tcpServer.Port }}{{ if $tcpServer.Backend.ProxyProtocol.Decode }} proxy_protocol{{ end }};
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
proxy_timeout {{ $cfg.ProxyStreamTimeout }};
|
||||
proxy_next_upstream {{ if $cfg.ProxyStreamNextUpstream }}on{{ else }}off{{ end }};
|
||||
proxy_next_upstream_timeout {{ $cfg.ProxyStreamNextUpstreamTimeout }};
|
||||
proxy_next_upstream_tries {{ $cfg.ProxyStreamNextUpstreamTries }};
|
||||
|
||||
proxy_pass upstream_balancer;
|
||||
{{ if $tcpServer.Backend.ProxyProtocol.Encode }}
|
||||
proxy_protocol on;
|
||||
{{ end }}
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
# UDP services
|
||||
{{ range $udpServer := .UDPBackends }}
|
||||
server {
|
||||
preread_by_lua_block {
|
||||
ngx.var.proxy_upstream_name="udp-{{ $udpServer.Backend.Namespace }}-{{ $udpServer.Backend.Name }}-{{ $udpServer.Backend.Port }}";
|
||||
}
|
||||
|
||||
{{ range $address := $all.Cfg.BindAddressIpv4 }}
|
||||
listen {{ $address }}:{{ $udpServer.Port }} udp;
|
||||
{{ else }}
|
||||
listen {{ $udpServer.Port }} udp;
|
||||
{{ end }}
|
||||
{{ if $IsIPV6Enabled }}
|
||||
{{ range $address := $all.Cfg.BindAddressIpv6 }}
|
||||
listen {{ $address }}:{{ $udpServer.Port }} udp;
|
||||
{{ else }}
|
||||
listen [::]:{{ $udpServer.Port }} udp;
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
proxy_responses {{ $cfg.ProxyStreamResponses }};
|
||||
proxy_timeout {{ $cfg.ProxyStreamTimeout }};
|
||||
proxy_next_upstream {{ if $cfg.ProxyStreamNextUpstream }}on{{ else }}off{{ end }};
|
||||
proxy_next_upstream_timeout {{ $cfg.ProxyStreamNextUpstreamTimeout }};
|
||||
proxy_next_upstream_tries {{ $cfg.ProxyStreamNextUpstreamTries }};
|
||||
proxy_pass upstream_balancer;
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
# Stream Snippets
|
||||
{{ range $snippet := .StreamSnippets }}
|
||||
{{ $snippet }}
|
||||
{{ end }}
|
||||
}
|
||||
|
||||
{{/* definition of templates to avoid repetitions */}}
|
||||
{{ define "CUSTOM_ERRORS" }}
|
||||
{{ $enableMetrics := .EnableMetrics }}
|
||||
{{ $modsecurityEnabled := .ModsecurityEnabled }}
|
||||
{{ $upstreamName := .UpstreamName }}
|
||||
{{ range $errCode := .ErrorCodes }}
|
||||
location @custom_{{ $upstreamName }}_{{ $errCode }} {
|
||||
internal;
|
||||
|
||||
# Ensure that modsecurity will not run on custom error pages or they might be blocked
|
||||
{{ if $modsecurityEnabled }}
|
||||
modsecurity off;
|
||||
{{ end }}
|
||||
|
||||
proxy_intercept_errors off;
|
||||
|
||||
proxy_set_header X-Code {{ $errCode }};
|
||||
|
|
@ -626,12 +824,10 @@ http {
|
|||
rewrite (.*) / break;
|
||||
|
||||
proxy_pass http://upstream_balancer;
|
||||
log_by_lua_block {
|
||||
{{ if $enableMetrics }}
|
||||
monitor.call()
|
||||
log_by_lua_file /etc/nginx/lua/nginx/ngx_conf_log.lua;
|
||||
{{ end }}
|
||||
}
|
||||
}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
|
|
@ -690,9 +886,7 @@ http {
|
|||
ssl_reject_handshake {{ if $all.Cfg.SSLRejectHandshake }}on{{ else }}off{{ end }};
|
||||
{{ end }}
|
||||
|
||||
ssl_certificate_by_lua_block {
|
||||
certificate.call()
|
||||
}
|
||||
ssl_certificate_by_lua_file /etc/nginx/lua/nginx/ngx_conf_certificate.lua;
|
||||
|
||||
{{ if not (empty $server.AuthTLSError) }}
|
||||
# {{ $server.AuthTLSError }}
|
||||
|
|
@ -741,8 +935,13 @@ http {
|
|||
ssl_prefer_server_ciphers {{ $server.SSLPreferServerCiphers }};
|
||||
{{ end }}
|
||||
|
||||
{{ if not (empty $server.ServerSnippet) }}
|
||||
# Custom code snippet configured for host {{ $server.Hostname }}
|
||||
{{ $server.ServerSnippet }}
|
||||
{{ end }}
|
||||
|
||||
{{ range $errorLocation := (buildCustomErrorLocationsPerServer $server) }}
|
||||
{{ template "CUSTOM_ERRORS" (buildCustomErrorDeps $errorLocation.UpstreamName $errorLocation.Codes $all.EnableMetrics) }}
|
||||
{{ template "CUSTOM_ERRORS" (buildCustomErrorDeps $errorLocation.UpstreamName $errorLocation.Codes $all.EnableMetrics $all.Cfg.EnableModsecurity) }}
|
||||
{{ end }}
|
||||
|
||||
{{ buildMirrorLocations $server.Locations }}
|
||||
|
|
@ -779,13 +978,16 @@ http {
|
|||
access_log off;
|
||||
{{ end }}
|
||||
|
||||
# Ensure that modsecurity will not run on an internal location as this is not accessible from outside
|
||||
{{ if $all.Cfg.EnableModsecurity }}
|
||||
modsecurity off;
|
||||
{{ end }}
|
||||
|
||||
{{ if $externalAuth.AuthCacheKey }}
|
||||
set $tmp_cache_key '{{ $server.Hostname }}{{ $authPath }}{{ $externalAuth.AuthCacheKey }}';
|
||||
set $cache_key '';
|
||||
|
||||
rewrite_by_lua_block {
|
||||
ngx.var.cache_key = ngx.encode_base64(ngx.sha1_bin(ngx.var.tmp_cache_key))
|
||||
}
|
||||
rewrite_by_lua_file /etc/nginx/lua/nginx/ngx_conf_rewrite_auth.lua;
|
||||
|
||||
proxy_cache auth_cache;
|
||||
|
||||
|
|
@ -861,6 +1063,10 @@ http {
|
|||
{{ $line }}
|
||||
{{- end }}
|
||||
|
||||
{{ if not (empty $externalAuth.AuthSnippet) }}
|
||||
{{ $externalAuth.AuthSnippet }}
|
||||
{{ end }}
|
||||
|
||||
{{ if and (eq $applyAuthUpstream true) (eq $applyGlobalAuth false) }}
|
||||
{{ $authUpstreamName := buildAuthUpstreamName $location $server.Hostname }}
|
||||
# The target is an upstream with HTTP keepalive, that is why the
|
||||
|
|
@ -889,6 +1095,11 @@ http {
|
|||
{{ template "CORS" $location }}
|
||||
{{ end }}
|
||||
|
||||
# Ensure that modsecurity will not run on an internal location as this is not accessible from outside
|
||||
{{ if $all.Cfg.EnableModsecurity }}
|
||||
modsecurity off;
|
||||
{{ end }}
|
||||
|
||||
return 302 {{ buildAuthSignURL $externalAuth.SigninURL $externalAuth.SigninURLRedirectParam }};
|
||||
}
|
||||
{{ end }}
|
||||
|
|
@ -901,7 +1112,6 @@ http {
|
|||
set $service_name {{ $ing.Service | quote }};
|
||||
set $service_port {{ $ing.ServicePort | quote }};
|
||||
set $location_path {{ $ing.Path | escapeLiteralDollar | quote }};
|
||||
set $global_rate_limit_exceeding n;
|
||||
|
||||
{{ buildOpentelemetryForLocation $all.Cfg.EnableOpentelemetry $all.Cfg.OpentelemetryTrustIncomingSpan $location }}
|
||||
|
||||
|
|
@ -910,35 +1120,13 @@ http {
|
|||
mirror_request_body {{ $location.Mirror.RequestBody }};
|
||||
{{ end }}
|
||||
|
||||
rewrite_by_lua_block {
|
||||
lua_ingress.rewrite({{ locationConfigForLua $location $all }})
|
||||
balancer.rewrite()
|
||||
plugins.run()
|
||||
}
|
||||
{{ locationConfigForLua $location $all }}
|
||||
|
||||
# be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any
|
||||
# will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)`
|
||||
# other authentication method such as basic auth or external auth useless - all requests will be allowed.
|
||||
#access_by_lua_block {
|
||||
#}
|
||||
rewrite_by_lua_file /etc/nginx/lua/nginx/ngx_rewrite.lua;
|
||||
|
||||
header_filter_by_lua_block {
|
||||
lua_ingress.header()
|
||||
plugins.run()
|
||||
}
|
||||
header_filter_by_lua_file /etc/nginx/lua/nginx/ngx_conf_srv_hdr_filter.lua;
|
||||
|
||||
body_filter_by_lua_block {
|
||||
plugins.run()
|
||||
}
|
||||
|
||||
log_by_lua_block {
|
||||
balancer.log()
|
||||
{{ if $all.EnableMetrics }}
|
||||
monitor.call()
|
||||
{{ end }}
|
||||
|
||||
plugins.run()
|
||||
}
|
||||
log_by_lua_file /etc/nginx/lua/nginx/ngx_conf_log_block.lua;
|
||||
|
||||
{{ if not $location.Logs.Access }}
|
||||
access_log off;
|
||||
|
|
@ -970,6 +1158,8 @@ http {
|
|||
|
||||
set $proxy_alternative_upstream_name "";
|
||||
|
||||
{{ buildModSecurityForLocation $all.Cfg $location }}
|
||||
|
||||
{{ if isLocationAllowed $location }}
|
||||
{{ if gt (len $location.Denylist.CIDR) 0 }}
|
||||
{{ range $ip := $location.Denylist.CIDR }}
|
||||
|
|
@ -1134,6 +1324,14 @@ http {
|
|||
grpc_read_timeout {{ $location.Proxy.ReadTimeout }}s;
|
||||
{{ end }}
|
||||
|
||||
{{/* Add any additional configuration defined */}}
|
||||
{{ $location.ConfigurationSnippet }}
|
||||
|
||||
{{ if not (empty $all.Cfg.LocationSnippet) }}
|
||||
# Custom code snippet configured in the configuration configmap
|
||||
{{ $all.Cfg.LocationSnippet }}
|
||||
{{ end }}
|
||||
|
||||
{{ if $location.CustomHeaders }}
|
||||
# Custom Response Headers
|
||||
{{ range $k, $v := $location.CustomHeaders.Headers }}
|
||||
1419
internal/ingress/controller/template/crossplane/testdata/nginx-new.tmpl
vendored
Normal file
1419
internal/ingress/controller/template/crossplane/testdata/nginx-new.tmpl
vendored
Normal file
File diff suppressed because it is too large
Load diff
|
|
@ -25,6 +25,7 @@ import (
|
|||
|
||||
"k8s.io/ingress-nginx/internal/ingress/controller/config"
|
||||
ing_net "k8s.io/ingress-nginx/internal/net"
|
||||
"k8s.io/ingress-nginx/pkg/apis/ingress"
|
||||
)
|
||||
|
||||
type seconds int
|
||||
|
|
@ -112,3 +113,31 @@ func dictKbToStr(size int) string {
|
|||
}
|
||||
return fmt.Sprintf("%dK", size)
|
||||
}
|
||||
|
||||
func shouldLoadAuthDigestModule(servers []*ingress.Server) bool {
|
||||
for _, server := range servers {
|
||||
for _, location := range server.Locations {
|
||||
if !location.BasicDigestAuth.Secured {
|
||||
continue
|
||||
}
|
||||
|
||||
if location.BasicDigestAuth.Type == "digest" {
|
||||
return true
|
||||
}
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// shouldLoadOpentelemetryModule determines whether or not the Opentelemetry module needs to be loaded.
|
||||
// It checks if `enable-opentelemetry` is set in the ConfigMap.
|
||||
func shouldLoadOpentelemetryModule(servers []*ingress.Server) bool {
|
||||
for _, server := range servers {
|
||||
for _, location := range server.Locations {
|
||||
if location.Opentelemetry.Enabled {
|
||||
return true
|
||||
}
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue