DevFW-CICD/ingress-nginx-helm
16
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deploy GitHub Pages

Browse source
This commit is contained in:
Travis Bot 2018-04-29 15:47:17 +00:00
parent 89c9353364
commit db71e32e5f
19 changed files with 359 additions and 266 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
deploy/index.html
View file

@ -1481,7 +1481,7 @@ Then execute:</p>
<p>This example creates an ELB with just two listeners, one in port 80 and another in port 443</p> <p>This example creates an ELB with just two listeners, one in port 80 and another in port 443</p>
<p><img alt="Listeners" src="./../docs/images/elb-l7-listener.png" /></p> <p><img alt="Listeners" src="./../images/elb-l7-listener.png" /></p>
<p>If the ingress controller uses RBAC run:</p> <p>If the ingress controller uses RBAC run:</p>
<div class="codehilite"><pre><span></span><span class="go">kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/provider/patch-service-with-rbac.yaml</span> <div class="codehilite"><pre><span></span><span class="go">kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/provider/patch-service-with-rbac.yaml</span>
</pre></div> </pre></div>

5
development/index.html
View file

@ -1200,7 +1200,10 @@
It includes how to build, test, and release ingress controllers.</p> It includes how to build, test, and release ingress controllers.</p>
<h2 id="quick-start">Quick Start<a class="headerlink" href="#quick-start" title="Permanent link">&para;</a></h2> <h2 id="quick-start">Quick Start<a class="headerlink" href="#quick-start" title="Permanent link">&para;</a></h2>
<h3 id="initial-developer-environment-build">Initial developer environment build<a class="headerlink" href="#initial-developer-environment-build" title="Permanent link">&para;</a></h3> <h3 id="initial-developer-environment-build">Initial developer environment build<a class="headerlink" href="#initial-developer-environment-build" title="Permanent link">&para;</a></h3>
<p><strong>Prequisites</strong>: Minikube must be installed; See <a href="https://github.com/kubernetes/minikube/releases">releases</a> for installation instructions. </p> <blockquote>
<p><strong>Prequisites</strong>: Minikube must be installed.
See <a href="https://github.com/kubernetes/minikube/releases">releases</a> for installation instructions. </p>
</blockquote>
<p>If you are using <strong>MacOS</strong> and deploying to <strong>minikube</strong>, the following command will build the local nginx controller container image and deploy the ingress controller onto a minikube cluster with RBAC enabled in the namespace <code class="codehilite">ingress-nginx</code>:</p> <p>If you are using <strong>MacOS</strong> and deploying to <strong>minikube</strong>, the following command will build the local nginx controller container image and deploy the ingress controller onto a minikube cluster with RBAC enabled in the namespace <code class="codehilite">ingress-nginx</code>:</p>
<div class="codehilite"><pre><span></span>$ make dev-env <div class="codehilite"><pre><span></span>$ make dev-env
</pre></div> </pre></div>

4
examples/PREREQUISITES/index.html
View file

@ -1165,7 +1165,7 @@ key/cert pair with an arbitrarily chosen hostname, created as follows</p>
<h2 id="ca-authentication">CA Authentication<a class="headerlink" href="#ca-authentication" title="Permanent link">&para;</a></h2> <h2 id="ca-authentication">CA Authentication<a class="headerlink" href="#ca-authentication" title="Permanent link">&para;</a></h2>
<p>You can act as your very own CA, or use an existing one. As an exercise / learning, we're going to generate our <p>You can act as your very own CA, or use an existing one. As an exercise / learning, we're going to generate our
own CA, and also generate a client certificate.</p> own CA, and also generate a client certificate.</p>
<p>These instructions are based on CoreOS OpenSSL <a href="https://coreos.com/kubernetes/docs/latest/openssl.html">instructions</a></p> <p>These instructions are based on CoreOS OpenSSL. <a href="https://coreos.com/kubernetes/docs/latest/openssl.html">See live doc.</a></p>
<h3 id="generating-a-ca">Generating a CA<a class="headerlink" href="#generating-a-ca" title="Permanent link">&para;</a></h3> <h3 id="generating-a-ca">Generating a CA<a class="headerlink" href="#generating-a-ca" title="Permanent link">&para;</a></h3>
<p>First of all, you've to generate a CA. This is going to be the one who will sign your client certificates. <p>First of all, you've to generate a CA. This is going to be the one who will sign your client certificates.
In real production world, you may face CAs with intermediate certificates, as the following:</p> In real production world, you may face CAs with intermediate certificates, as the following:</p>
@ -1243,7 +1243,7 @@ the TLS Auth directive:</p>
</pre></div> </pre></div>
<p>Note: You can also generate the CA Authentication Secret along with the TLS Secret by using:</p> <p><strong>Note:</strong> You can also generate the CA Authentication Secret along with the TLS Secret by using:</p>
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create secret generic caingress --namespace<span class="o">=</span>default --from-file<span class="o">=</span>ca.crt<span class="o">=</span>&lt;ca.crt&gt; --from-file<span class="o">=</span>tls.crt<span class="o">=</span>&lt;tls.crt&gt; --from-file<span class="o">=</span>tls.key<span class="o">=</span>&lt;tls.key&gt; <div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create secret generic caingress --namespace<span class="o">=</span>default --from-file<span class="o">=</span>ca.crt<span class="o">=</span>&lt;ca.crt&gt; --from-file<span class="o">=</span>tls.crt<span class="o">=</span>&lt;tls.crt&gt; --from-file<span class="o">=</span>tls.key<span class="o">=</span>&lt;tls.key&gt;
</pre></div> </pre></div>

2
examples/customization/custom-errors/rc-custom-errors.yaml
View file

@ -16,7 +16,7 @@ spec:
spec: spec:
terminationGracePeriodSeconds: 60 terminationGracePeriodSeconds: 60
containers: containers:
- image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.13.0 - image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.14.0
name: nginx-ingress-lb name: nginx-ingress-lb
imagePullPolicy: Always imagePullPolicy: Always
readinessProbe: readinessProbe:

14
examples/docker-registry/README/index.html
View file

@ -1125,8 +1125,11 @@
</pre></div> </pre></div>
<p><strong>Important:</strong> DO NOT RUN THIS IN PRODUCTION. <div class="admonition important">
This deployment uses <code class="codehilite">emptyDir</code> in the <code class="codehilite">volumeMount</code> which means the contents of the registry will be deleted when the pod dies.</p> <p class="admonition-title">Important</p>
<p><strong>DO NOT RUN THIS IN PRODUCTION</strong></p>
<p>This deployment uses <code class="codehilite">emptyDir</code> in the <code class="codehilite">volumeMount</code> which means the contents of the registry will be deleted when the pod dies.</p>
</div>
<p>The next required step is creation of the ingress rules. To do this we have two options: with and without TLS</p> <p>The next required step is creation of the ingress rules. To do this we have two options: with and without TLS</p>
<h3 id="without-tls">Without TLS<a class="headerlink" href="#without-tls" title="Permanent link">&para;</a></h3> <h3 id="without-tls">Without TLS<a class="headerlink" href="#without-tls" title="Permanent link">&para;</a></h3>
<p>Download and edit the yaml deployment replacing <code class="codehilite">registry.&lt;your domain&gt;</code> with a valid DNS name pointing to the ingress controller:</p> <p>Download and edit the yaml deployment replacing <code class="codehilite">registry.&lt;your domain&gt;</code> with a valid DNS name pointing to the ingress controller:</p>
@ -1134,8 +1137,11 @@ This deployment uses <code class="codehilite">emptyDir</code> in the <code class
</pre></div> </pre></div>
<p><strong>Important:</strong> running a docker registry without TLS requires we configure our local docker daemon with the insecure registry flag. <div class="admonition important">
Please check <a href="https://docs.docker.com/registry/insecure/#deploy-a-plain-http-registry">deploy a plain http registry</a></p> <p class="admonition-title">Important</p>
<p>Running a docker registry without TLS requires we configure our local docker daemon with the insecure registry flag.</p>
<p>Please check <a href="https://docs.docker.com/registry/insecure/#deploy-a-plain-http-registry">deploy a plain http registry</a></p>
</div>
<h3 id="with-tls">With TLS<a class="headerlink" href="#with-tls" title="Permanent link">&para;</a></h3> <h3 id="with-tls">With TLS<a class="headerlink" href="#with-tls" title="Permanent link">&para;</a></h3>
<p>Download and edit the yaml deployment replacing <code class="codehilite">registry.&lt;your domain&gt;</code> with a valid DNS name pointing to the ingress controller:</p> <p>Download and edit the yaml deployment replacing <code class="codehilite">registry.&lt;your domain&gt;</code> with a valid DNS name pointing to the ingress controller:</p>
<div class="codehilite"><pre><span></span><span class="go">wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/docs/examples/docker-registry/ingress-with-tls.yaml</span> <div class="codehilite"><pre><span></span><span class="go">wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/docs/examples/docker-registry/ingress-with-tls.yaml</span>

7
examples/external-auth/README/index.html
View file

@ -1121,7 +1121,10 @@
<h3 id="overview">Overview<a class="headerlink" href="#overview" title="Permanent link">&para;</a></h3> <h3 id="overview">Overview<a class="headerlink" href="#overview" title="Permanent link">&para;</a></h3>
<p>The <code class="codehilite">auth-url</code> and <code class="codehilite">auth-signin</code> annotations allow you to use an external <p>The <code class="codehilite">auth-url</code> and <code class="codehilite">auth-signin</code> annotations allow you to use an external
authentication provider to protect your Ingress resources.</p> authentication provider to protect your Ingress resources.</p>
<p>(Note, this annotation requires <code class="codehilite">nginx-ingress-controller v0.9.0</code> or greater.)</p> <div class="admonition important">
<p class="admonition-title">Important</p>
<p>this annotation requires <code class="codehilite">nginx-ingress-controller v0.9.0</code> or greater.)</p>
</div>
<h3 id="key-detail">Key Detail<a class="headerlink" href="#key-detail" title="Permanent link">&para;</a></h3> <h3 id="key-detail">Key Detail<a class="headerlink" href="#key-detail" title="Permanent link">&para;</a></h3>
<p>This functionality is enabled by deploying multiple Ingress objects for a single host. <p>This functionality is enabled by deploying multiple Ingress objects for a single host.
One Ingress object has no special annotations and handles authentication.</p> One Ingress object has no special annotations and handles authentication.</p>
@ -1151,7 +1154,7 @@ into a Kubernetes cluster and use it to protect the Kubernetes Dashboard using g
<ol> <ol>
<li>Create a custom Github OAuth application https://github.com/settings/applications/new</li> <li>Create a <a href="https://github.com/settings/applications/new">custom Github OAuth application</a></li>
</ol> </ol>
<p><img alt="Register OAuth2 Application" src="../images/register-oauth-app.png" /></p> <p><img alt="Register OAuth2 Application" src="../images/register-oauth-app.png" /></p>
<ul> <ul>

2
examples/static-ip/README/index.html
View file

@ -1187,9 +1187,11 @@ already has it set to "nginx-ingress-lb").</p>
</pre></div> </pre></div>
<blockquote>
<p>Note that unlike the GCE Ingress, the same loadbalancer IP is shared amongst all <p>Note that unlike the GCE Ingress, the same loadbalancer IP is shared amongst all
Ingresses, because all requests are proxied through the same set of nginx Ingresses, because all requests are proxied through the same set of nginx
controllers.</p> controllers.</p>
</blockquote>
<h2 id="promote-ephemeral-to-static-ip">Promote ephemeral to static IP<a class="headerlink" href="#promote-ephemeral-to-static-ip" title="Permanent link">&para;</a></h2> <h2 id="promote-ephemeral-to-static-ip">Promote ephemeral to static IP<a class="headerlink" href="#promote-ephemeral-to-static-ip" title="Permanent link">&para;</a></h2>
<p>To promote the allocated IP to static, you can update the Service manifest</p> <p>To promote the allocated IP to static, you can update the Service manifest</p>
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl patch svc nginx-ingress-lb -p <span class="s1">&#39;{&quot;spec&quot;: {&quot;loadBalancerIP&quot;: &quot;104.154.109.191&quot;}}&#39;</span> <div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl patch svc nginx-ingress-lb -p <span class="s1">&#39;{&quot;spec&quot;: {&quot;loadBalancerIP&quot;: &quot;104.154.109.191&quot;}}&#39;</span>

2
examples/static-ip/nginx-ingress-controller.yaml
View file

@ -21,7 +21,7 @@ spec:
# hostNetwork: true # hostNetwork: true
terminationGracePeriodSeconds: 60 terminationGracePeriodSeconds: 60
containers: containers:
- image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.13.0 - image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.14.0
name: nginx-ingress-controller name: nginx-ingress-controller
readinessProbe: readinessProbe:
httpGet: httpGet:

2
extra.css
View file

@ -1,3 +1,3 @@
td{ td:nth-child(1){
white-space: nowrap; white-space: nowrap;
} }

213
search/search_index.json
View file

File diff suppressed because one or more lines are too long

46
sitemap.xml
View file

@ -4,7 +4,7 @@
<url> <url>
<loc>/</loc> <loc>/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
@ -13,13 +13,13 @@
<url> <url>
<loc>/deploy/</loc> <loc>/deploy/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/deploy/rbac/</loc> <loc>/deploy/rbac/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
@ -35,49 +35,49 @@
<url> <url>
<loc>/user-guide/cli-arguments/</loc> <loc>/user-guide/cli-arguments/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/user-guide/custom-errors/</loc> <loc>/user-guide/custom-errors/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/user-guide/exposing-tcp-udp-services/</loc> <loc>/user-guide/exposing-tcp-udp-services/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/user-guide/external-articles/</loc> <loc>/user-guide/external-articles/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/user-guide/miscellaneous/</loc> <loc>/user-guide/miscellaneous/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/user-guide/multiple-ingress/</loc> <loc>/user-guide/multiple-ingress/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/user-guide/nginx-status-page/</loc> <loc>/user-guide/nginx-status-page/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/user-guide/tls/</loc> <loc>/user-guide/tls/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
@ -93,19 +93,19 @@
<url> <url>
<loc>/examples/PREREQUISITES/</loc> <loc>/examples/PREREQUISITES/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/examples/README/</loc> <loc>/examples/README/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/examples/affinity/cookie/README/</loc> <loc>/examples/affinity/cookie/README/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
@ -123,37 +123,37 @@
<url> <url>
<loc>/examples/docker-registry/README/</loc> <loc>/examples/docker-registry/README/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/examples/external-auth/README/</loc> <loc>/examples/external-auth/README/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/examples/multi-tls/README/</loc> <loc>/examples/multi-tls/README/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/examples/rewrite/README/</loc> <loc>/examples/rewrite/README/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/examples/static-ip/README/</loc> <loc>/examples/static-ip/README/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
<url> <url>
<loc>/examples/tls-termination/README/</loc> <loc>/examples/tls-termination/README/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
@ -162,7 +162,7 @@
<url> <url>
<loc>/development/</loc> <loc>/development/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
@ -170,7 +170,7 @@
<url> <url>
<loc>/ingress-controller-catalog/</loc> <loc>/ingress-controller-catalog/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>
@ -178,7 +178,7 @@
<url> <url>
<loc>/troubleshooting/</loc> <loc>/troubleshooting/</loc>
<lastmod>2018-04-27</lastmod> <lastmod>2018-04-29</lastmod>
<changefreq>daily</changefreq> <changefreq>daily</changefreq>
</url> </url>

7
troubleshooting/index.html
View file

@ -1293,9 +1293,10 @@ delete it with <code class="codehilite">kubectl delete secret &lt;name&gt;</code
The API server will mount a volume containing this file, but only if the API server is configured to use The API server will mount a volume containing this file, but only if the API server is configured to use
the ServiceAccount admission controller. the ServiceAccount admission controller.
If you experience this error, verify that your API server is using the ServiceAccount admission controller. If you experience this error, verify that your API server is using the ServiceAccount admission controller.
If you are configuring the API server by hand, you can set this with the <code class="codehilite">--admission-control</code> parameter. If you are configuring the API server by hand, you can set this with the <code class="codehilite">--admission-control</code> parameter.</p>
Please note that you should use other admission controllers as well. Before configuring this option, you should <blockquote>
read about admission controllers.</p> <p>Note that you should use other admission controllers as well. Before configuring this option, you should read about admission controllers.</p>
</blockquote>
</li> </li>
</ol> </ol>
<p>More information:</p> <p>More information:</p>

5
user-guide/custom-errors/index.html
View file

@ -1025,7 +1025,10 @@ Each request to the default backend includes two headers:</p>
<li><code class="codehilite">X-Code</code> indicates the HTTP code to be returned to the client.</li> <li><code class="codehilite">X-Code</code> indicates the HTTP code to be returned to the client.</li>
<li><code class="codehilite">X-Format</code> the value of the <code class="codehilite">Accept</code> header.</li> <li><code class="codehilite">X-Format</code> the value of the <code class="codehilite">Accept</code> header.</li>
</ul> </ul>
<p><strong>Important:</strong> The custom backend must return the correct HTTP status code to be returned. NGINX does not change the response from the custom default backend.</p> <div class="admonition important">
<p class="admonition-title">Important</p>
<p>The custom backend must return the correct HTTP status code to be returned. NGINX does not change the response from the custom default backend.</p>
</div>
<p>Using these two headers it's possible to use a custom backend service like <a href="https://github.com/kubernetes/ingress-nginx/tree/master/images/custom-error-pages">this one</a> that inspects each request and returns a custom error page with the format expected by the client. Please check the example <a href="https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-errors">custom-errors</a>.</p> <p>Using these two headers it's possible to use a custom backend service like <a href="https://github.com/kubernetes/ingress-nginx/tree/master/images/custom-error-pages">this one</a> that inspects each request and returns a custom error page with the format expected by the client. Please check the example <a href="https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-errors">custom-errors</a>.</p>
<p>NGINX sends additional headers that can be used to build custom response:</p> <p>NGINX sends additional headers that can be used to build custom response:</p>
<ul> <ul>

5
user-guide/miscellaneous/index.html
View file

@ -1201,7 +1201,10 @@ Basically a default backend exposes two URLs:</p>
<p>The only requirement to avoid the close of connections is the increase of the values of <code class="codehilite">proxy-read-timeout</code> and <code class="codehilite">proxy-send-timeout</code>.</p> <p>The only requirement to avoid the close of connections is the increase of the values of <code class="codehilite">proxy-read-timeout</code> and <code class="codehilite">proxy-send-timeout</code>.</p>
<p>The default value of this settings is <code class="codehilite">60 seconds</code>.</p> <p>The default value of this settings is <code class="codehilite">60 seconds</code>.</p>
<p>A more adequate value to support websockets is a value higher than one hour (<code class="codehilite">3600</code>).</p> <p>A more adequate value to support websockets is a value higher than one hour (<code class="codehilite">3600</code>).</p>
<p><strong>Important:</strong> If the NGINX ingress controller is exposed with a service <code class="codehilite">type=LoadBalancer</code> make sure the protocol between the loadbalancer and NGINX is TCP.</p> <div class="admonition important">
<p class="admonition-title">Important</p>
<p>If the NGINX ingress controller is exposed with a service <code class="codehilite">type=LoadBalancer</code> make sure the protocol between the loadbalancer and NGINX is TCP.</p>
</div>
<h2 id="optimizing-tls-time-to-first-byte-tttfb">Optimizing TLS Time To First Byte (TTTFB)<a class="headerlink" href="#optimizing-tls-time-to-first-byte-tttfb" title="Permanent link">&para;</a></h2> <h2 id="optimizing-tls-time-to-first-byte-tttfb">Optimizing TLS Time To First Byte (TTTFB)<a class="headerlink" href="#optimizing-tls-time-to-first-byte-tttfb" title="Permanent link">&para;</a></h2>
<p>NGINX provides the configuration option <a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size">ssl_buffer_size</a> to allow the optimization of the TLS record size.</p> <p>NGINX provides the configuration option <a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size">ssl_buffer_size</a> to allow the optimization of the TLS record size.</p>
<p>This improves the <a href="https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/">TLS Time To First Byte</a> (TTTFB). <p>This improves the <a href="https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/">TLS Time To First Byte</a> (TTTFB).

3
user-guide/multiple-ingress/index.html
View file

@ -1093,7 +1093,8 @@
<h1 id="multiple-ingress-controllers">Multiple ingress controllers<a class="headerlink" href="#multiple-ingress-controllers" title="Permanent link">&para;</a></h1> <h1 id="multiple-ingress-controllers">Multiple ingress controllers<a class="headerlink" href="#multiple-ingress-controllers" title="Permanent link">&para;</a></h1>
<h2 id="running-multiple-ingress-controllers">Running multiple ingress controllers<a class="headerlink" href="#running-multiple-ingress-controllers" title="Permanent link">&para;</a></h2> <h2 id="running-multiple-ingress-controllers">Running multiple ingress controllers<a class="headerlink" href="#running-multiple-ingress-controllers" title="Permanent link">&para;</a></h2>
<p>If you're running multiple ingress controllers, or running on a cloud provider that natively handles ingress, you need to specify the annotation <code class="codehilite">kubernetes.io/ingress.class: &quot;nginx&quot;</code> in all ingresses that you would like this controller to claim. This mechanism also provides users the ability to run <em>multiple</em> NGINX ingress controllers (e.g. one which serves public traffic, one which serves "internal" traffic). When utilizing this functionality the option <code class="codehilite">--ingress-class</code> should be changed to a value unique for the cluster within the definition of the replication controller. Here is a partial example:</p> <p>If you're running multiple ingress controllers, or running on a cloud provider that natively handles ingress, you need to specify the annotation <code class="codehilite">kubernetes.io/ingress.class: &quot;nginx&quot;</code> in all ingresses that you would like this controller to claim.</p>
<p>This mechanism also provides users the ability to run <em>multiple</em> NGINX ingress controllers (e.g. one which serves public traffic, one which serves "internal" traffic). When utilizing this functionality the option <code class="codehilite">--ingress-class</code> should be changed to a value unique for the cluster within the definition of the replication controller. Here is a partial example:</p>
<div class="codehilite"><pre><span></span><span class="n">spec</span><span class="o">:</span> <div class="codehilite"><pre><span></span><span class="n">spec</span><span class="o">:</span>
<span class="n">template</span><span class="o">:</span> <span class="n">template</span><span class="o">:</span>
<span class="n">spec</span><span class="o">:</span> <span class="n">spec</span><span class="o">:</span>

100
user-guide/nginx-configuration/annotations/index.html
View file

@ -679,6 +679,13 @@
Enable Access Log Enable Access Log
</a> </a>
</li>
<li class="md-nav__item">
<a href="#enable-rewrite-log" title="Enable Rewrite Log" class="md-nav__link">
Enable Rewrite Log
</a>
</li> </li>
<li class="md-nav__item"> <li class="md-nav__item">
@ -1497,6 +1504,13 @@
Enable Access Log Enable Access Log
</a> </a>
</li>
<li class="md-nav__item">
<a href="#enable-rewrite-log" title="Enable Rewrite Log" class="md-nav__link">
Enable Rewrite Log
</a>
</li> </li>
<li class="md-nav__item"> <li class="md-nav__item">
@ -1686,6 +1700,10 @@ i.e. <code class="codehilite">&quot;true&quot;</code>, <code class="codehilite">
<td>string</td> <td>string</td>
</tr> </tr>
<tr> <tr>
<td><a href="#enable-rewrite-log">nginx.ingress.kubernetes.io/rewrite-log</a></td>
<td>URI</td>
</tr>
<tr>
<td><a href="#rewrite">nginx.ingress.kubernetes.io/rewrite-target</a></td> <td><a href="#rewrite">nginx.ingress.kubernetes.io/rewrite-target</a></td>
<td>URI</td> <td>URI</td>
</tr> </tr>
@ -1815,20 +1833,28 @@ This annotation also accepts the alternative form "namespace/secretName", in whi
<p>Please check the <a href="../../../examples/auth/basic/README/">auth</a> example.</p> <p>Please check the <a href="../../../examples/auth/basic/README/">auth</a> example.</p>
<h3 id="custom-nginx-upstream-checks">Custom NGINX upstream checks<a class="headerlink" href="#custom-nginx-upstream-checks" title="Permanent link">&para;</a></h3> <h3 id="custom-nginx-upstream-checks">Custom NGINX upstream checks<a class="headerlink" href="#custom-nginx-upstream-checks" title="Permanent link">&para;</a></h3>
<p>NGINX exposes some flags in the <a href="http://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream">upstream configuration</a> that enable the configuration of each server in the upstream. The Ingress controller allows custom <code class="codehilite">max_fails</code> and <code class="codehilite">fail_timeout</code> parameters in a global context using <code class="codehilite">upstream-max-fails</code> and <code class="codehilite">upstream-fail-timeout</code> in the NGINX ConfigMap or in a particular Ingress rule. <code class="codehilite">upstream-max-fails</code> defaults to 0. This means NGINX will respect the container's <code class="codehilite">readinessProbe</code> if it is defined. If there is no probe and no values for <code class="codehilite">upstream-max-fails</code> NGINX will continue to send traffic to the container.</p> <p>NGINX exposes some flags in the <a href="http://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream">upstream configuration</a> that enable the configuration of each server in the upstream. The Ingress controller allows custom <code class="codehilite">max_fails</code> and <code class="codehilite">fail_timeout</code> parameters in a global context using <code class="codehilite">upstream-max-fails</code> and <code class="codehilite">upstream-fail-timeout</code> in the NGINX ConfigMap or in a particular Ingress rule. <code class="codehilite">upstream-max-fails</code> defaults to 0. This means NGINX will respect the container's <code class="codehilite">readinessProbe</code> if it is defined. If there is no probe and no values for <code class="codehilite">upstream-max-fails</code> NGINX will continue to send traffic to the container.</p>
<p><strong>With the default configuration NGINX will not health check your backends. Whenever the endpoints controller notices a readiness probe failure, that pod's IP will be removed from the list of endpoints. This will trigger the NGINX controller to also remove it from the upstreams.</strong></p> <div class="admonition tip">
<p class="admonition-title">Tip</p>
<p>With the default configuration NGINX will not health check your backends. Whenever the endpoints controller notices a readiness probe failure, that pod's IP will be removed from the list of endpoints. This will trigger the NGINX controller to also remove it from the upstreams.**</p>
</div>
<p>To use custom values in an Ingress rule define these annotations:</p> <p>To use custom values in an Ingress rule define these annotations:</p>
<p><code class="codehilite">nginx.ingress.kubernetes.io/upstream-max-fails</code>: number of unsuccessful attempts to communicate with the server that should occur in the duration set by the <code class="codehilite">upstream-fail-timeout</code> parameter to consider the server unavailable.</p> <p><code class="codehilite">nginx.ingress.kubernetes.io/upstream-max-fails</code>: number of unsuccessful attempts to communicate with the server that should occur in the duration set by the <code class="codehilite">upstream-fail-timeout</code> parameter to consider the server unavailable.</p>
<p><code class="codehilite">nginx.ingress.kubernetes.io/upstream-fail-timeout</code>: time in seconds during which the specified number of unsuccessful attempts to communicate with the server should occur to consider the server unavailable. This is also the period of time the server will be considered unavailable.</p> <p><code class="codehilite">nginx.ingress.kubernetes.io/upstream-fail-timeout</code>: time in seconds during which the specified number of unsuccessful attempts to communicate with the server should occur to consider the server unavailable. This is also the period of time the server will be considered unavailable.</p>
<p>In NGINX, backend server pools are called "<a href="http://nginx.org/en/docs/http/ngx_http_upstream_module.html">upstreams</a>". Each upstream contains the endpoints for a service. An upstream is created for each service that has Ingress rules defined.</p> <p>In NGINX, backend server pools are called "<a href="http://nginx.org/en/docs/http/ngx_http_upstream_module.html">upstreams</a>". Each upstream contains the endpoints for a service. An upstream is created for each service that has Ingress rules defined.</p>
<p><strong>Important:</strong> All Ingress rules using the same service will use the same upstream. Only one of the Ingress rules should define annotations to configure the upstream servers.</p> <div class="admonition important">
<p class="admonition-title">Important</p>
<p>All Ingress rules using the same service will use the same upstream. Only one of the Ingress rules should define annotations to configure the upstream servers.</p>
</div>
<p>Please check the <a href="../../../examples/customization/custom-upstream-check/README/">custom upstream check</a> example.</p> <p>Please check the <a href="../../../examples/customization/custom-upstream-check/README/">custom upstream check</a> example.</p>
<h3 id="custom-nginx-upstream-hashing">Custom NGINX upstream hashing<a class="headerlink" href="#custom-nginx-upstream-hashing" title="Permanent link">&para;</a></h3> <h3 id="custom-nginx-upstream-hashing">Custom NGINX upstream hashing<a class="headerlink" href="#custom-nginx-upstream-hashing" title="Permanent link">&para;</a></h3>
<p>NGINX supports load balancing by client-server mapping based on <a href="http://nginx.org/en/docs/http/ngx_http_upstream_module.html#hash">consistent hashing</a> for a given key. The key can contain text, variables or any combination thereof. This feature allows for request stickiness other than client IP or cookies. The <a href="http://www.last.fm/user/RJ/journal/2007/04/10/392555/">ketama</a> consistent hashing method will be used which ensures only a few keys would be remapped to different servers on upstream group changes.</p> <p>NGINX supports load balancing by client-server mapping based on <a href="http://nginx.org/en/docs/http/ngx_http_upstream_module.html#hash">consistent hashing</a> for a given key. The key can contain text, variables or any combination thereof. This feature allows for request stickiness other than client IP or cookies. The <a href="http://www.last.fm/user/RJ/journal/2007/04/10/392555/">ketama</a> consistent hashing method will be used which ensures only a few keys would be remapped to different servers on upstream group changes.</p>
<p>To enable consistent hashing for a backend:</p> <p>To enable consistent hashing for a backend:</p>
<p><code class="codehilite">nginx.ingress.kubernetes.io/upstream-hash-by</code>: the nginx variable, text value or any combination thereof to use for consistent hashing. For example <code class="codehilite">nginx.ingress.kubernetes.io/upstream-hash-by: &quot;$request_uri&quot;</code> to consistently hash upstream requests by the current request URI.</p> <p><code class="codehilite">nginx.ingress.kubernetes.io/upstream-hash-by</code>: the nginx variable, text value or any combination thereof to use for consistent hashing. For example <code class="codehilite">nginx.ingress.kubernetes.io/upstream-hash-by: &quot;$request_uri&quot;</code> to consistently hash upstream requests by the current request URI.</p>
<h3 id="custom-nginx-load-balancing">Custom NGINX load balancing<a class="headerlink" href="#custom-nginx-load-balancing" title="Permanent link">&para;</a></h3> <h3 id="custom-nginx-load-balancing">Custom NGINX load balancing<a class="headerlink" href="#custom-nginx-load-balancing" title="Permanent link">&para;</a></h3>
<p>This is similar to https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/configmap.md#load-balance but configures load balancing algorithm per ingress. <p>This is similar to (https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/configmap.md#load-balance) but configures load balancing algorithm per ingress.</p>
Note that <code class="codehilite">nginx.ingress.kubernetes.io/upstream-hash-by</code> takes preference over this. If this and <code class="codehilite">nginx.ingress.kubernetes.io/upstream-hash-by</code> are not set then we fallback to using globally configured load balancing algorithm.</p> <blockquote>
<p>Note that <code class="codehilite">nginx.ingress.kubernetes.io/upstream-hash-by</code> takes preference over this. If this and <code class="codehilite">nginx.ingress.kubernetes.io/upstream-hash-by</code> are not set then we fallback to using globally configured load balancing algorithm.</p>
</blockquote>
<h3 id="custom-nginx-upstream-vhost">Custom NGINX upstream vhost<a class="headerlink" href="#custom-nginx-upstream-vhost" title="Permanent link">&para;</a></h3> <h3 id="custom-nginx-upstream-vhost">Custom NGINX upstream vhost<a class="headerlink" href="#custom-nginx-upstream-vhost" title="Permanent link">&para;</a></h3>
<p>This configuration setting allows you to control the value for host in the following statement: <code class="codehilite">proxy_set_header Host $host</code>, which forms part of the location block. This is useful if you need to call the upstream server by something other than <code class="codehilite">$host</code>.</p> <p>This configuration setting allows you to control the value for host in the following statement: <code class="codehilite">proxy_set_header Host $host</code>, which forms part of the location block. This is useful if you need to call the upstream server by something other than <code class="codehilite">$host</code>.</p>
<h3 id="client-certificate-authentication">Client Certificate Authentication<a class="headerlink" href="#client-certificate-authentication" title="Permanent link">&para;</a></h3> <h3 id="client-certificate-authentication">Client Certificate Authentication<a class="headerlink" href="#client-certificate-authentication" title="Permanent link">&para;</a></h3>
@ -1862,12 +1888,12 @@ This annotation also accepts the alternative form "namespace/secretName", in whi
<p>Indicates if the received certificates should be passed or not to the upstream server. <p>Indicates if the received certificates should be passed or not to the upstream server.
By default this is disabled.</p> By default this is disabled.</p>
<p>Please check the <a href="../../../examples/auth/client-certs/README/">client-certs</a> example.</p> <p>Please check the <a href="../../../examples/auth/client-certs/README/">client-certs</a> example.</p>
<p><strong>Important:</strong></p> <div class="admonition important">
<p class="admonition-title">Important</p>
<p>TLS with Client Authentication is NOT possible in Cloudflare as is not allowed it and might result in unexpected behavior.</p> <p>TLS with Client Authentication is NOT possible in Cloudflare as is not allowed it and might result in unexpected behavior.</p>
<p>Cloudflare only allows Authenticated Origin Pulls and is required to use their own certificate: <p>Cloudflare only allows Authenticated Origin Pulls and is required to use their own certificate: <a href="https://blog.cloudflare.com/protecting-the-origin-with-tls-authenticated-origin-pulls/">https://blog.cloudflare.com/protecting-the-origin-with-tls-authenticated-origin-pulls/</a></p>
https://blog.cloudflare.com/protecting-the-origin-with-tls-authenticated-origin-pulls/</p> <p>Only Authenticated Origin Pulls are allowed and can be configured by following their tutorial: <a href="https://support.cloudflare.com/hc/en-us/articles/204494148-Setting-up-NGINX-to-use-TLS-Authenticated-Origin-Pulls">https://support.cloudflare.com/hc/en-us/articles/204494148-Setting-up-NGINX-to-use-TLS-Authenticated-Origin-Pulls</a></p>
<p>Only Authenticated Origin Pulls are allowed and can be configured by following their tutorial: </div>
https://support.cloudflare.com/hc/en-us/articles/204494148-Setting-up-NGINX-to-use-TLS-Authenticated-Origin-Pulls</p>
<h3 id="configuration-snippet">Configuration snippet<a class="headerlink" href="#configuration-snippet" title="Permanent link">&para;</a></h3> <h3 id="configuration-snippet">Configuration snippet<a class="headerlink" href="#configuration-snippet" title="Permanent link">&para;</a></h3>
<p>Using this annotation you can add additional configuration to the NGINX location. For example:</p> <p>Using this annotation you can add additional configuration to the NGINX location. For example:</p>
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/configuration-snippet</span><span class="p p-Indicator">:</span> <span class="p p-Indicator">|</span> <div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/configuration-snippet</span><span class="p p-Indicator">:</span> <span class="p p-Indicator">|</span>
@ -1901,14 +1927,15 @@ This is a global configuration for the ingress controller. In some cases could b
<li><code class="codehilite">nginx.ingress.kubernetes.io/cors-max-age</code> controls how long preflight requests can be cached.</li> <li><code class="codehilite">nginx.ingress.kubernetes.io/cors-max-age</code> controls how long preflight requests can be cached.</li>
</ul> </ul>
<p>Example: <code class="codehilite">nginx.ingress.kubernetes.io/cors-max-age: 600</code></p> <p>Example: <code class="codehilite">nginx.ingress.kubernetes.io/cors-max-age: 600</code></p>
<p>For more information please check https://enable-cors.org/server_nginx.html</p> <p>For more information please see <a href="https://enable-cors.org/server_nginx.html">https://enable-cors.org</a></p>
<h3 id="server-alias">Server Alias<a class="headerlink" href="#server-alias" title="Permanent link">&para;</a></h3> <h3 id="server-alias">Server Alias<a class="headerlink" href="#server-alias" title="Permanent link">&para;</a></h3>
<p>To add Server Aliases to an Ingress rule add the annotation <code class="codehilite">nginx.ingress.kubernetes.io/server-alias: &quot;&lt;alias&gt;&quot;</code>. <p>To add Server Aliases to an Ingress rule add the annotation <code class="codehilite">nginx.ingress.kubernetes.io/server-alias: &quot;&lt;alias&gt;&quot;</code>.
This will create a server with the same configuration, but a different server_name as the provided host.</p> This will create a server with the same configuration, but a different server_name as the provided host.</p>
<p><em>Note:</em> A server-alias name cannot conflict with the hostname of an existing server. If it does the server-alias <div class="admonition note">
annotation will be ignored. If a server-alias is created and later a new server with the same hostname is created <p class="admonition-title">Note</p>
the new server configuration will take place over the alias configuration.</p> <p>A server-alias name cannot conflict with the hostname of an existing server. If it does the server-alias annotation will be ignored. If a server-alias is created and later a new server with the same hostname is created the new server configuration will take place over the alias configuration.</p>
<p>For more information please see http://nginx.org/en/docs/http/ngx_http_core_module.html#server_name</p> </div>
<p>For more information please see <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#server_name">http://nginx.org</a></p>
<h3 id="server-snippet">Server snippet<a class="headerlink" href="#server-snippet" title="Permanent link">&para;</a></h3> <h3 id="server-snippet">Server snippet<a class="headerlink" href="#server-snippet" title="Permanent link">&para;</a></h3>
<p>Using the annotation <code class="codehilite">nginx.ingress.kubernetes.io/server-snippet</code> it is possible to add custom configuration in the server configuration block.</p> <p>Using the annotation <code class="codehilite">nginx.ingress.kubernetes.io/server-snippet</code> it is possible to add custom configuration in the server configuration block.</p>
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">apiVersion</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">extensions/v1beta1</span> <div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">apiVersion</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">extensions/v1beta1</span>
@ -1928,13 +1955,16 @@ the new server configuration will take place over the alias configuration.</p>
</pre></div> </pre></div>
<p><strong>Important:</strong> This annotation can be used only once per host</p> <div class="admonition important">
<p class="admonition-title">Important</p>
<p>This annotation can be used only once per host</p>
</div>
<h3 id="client-body-buffer-size">Client Body Buffer Size<a class="headerlink" href="#client-body-buffer-size" title="Permanent link">&para;</a></h3> <h3 id="client-body-buffer-size">Client Body Buffer Size<a class="headerlink" href="#client-body-buffer-size" title="Permanent link">&para;</a></h3>
<p>Sets buffer size for reading client request body per location. In case the request body is larger than the buffer, <p>Sets buffer size for reading client request body per location. In case the request body is larger than the buffer,
the whole body or only its part is written to a temporary file. By default, buffer size is equal to two memory pages. the whole body or only its part is written to a temporary file. By default, buffer size is equal to two memory pages.
This is 8K on x86, other 32-bit platforms, and x86-64. It is usually 16K on other 64-bit platforms. This annotation is This is 8K on x86, other 32-bit platforms, and x86-64. It is usually 16K on other 64-bit platforms. This annotation is
applied to each location provided in the ingress rule.</p> applied to each location provided in the ingress rule.</p>
<p><em>Note:</em> The annotation value must be given in a valid format otherwise the <p><strong>Note:</strong> The annotation value must be given in a valid format otherwise the
For example to set the client-body-buffer-size the following can be done:</p> For example to set the client-body-buffer-size the following can be done:</p>
<ul> <ul>
<li><code class="codehilite">nginx.ingress.kubernetes.io/client-body-buffer-size: &quot;1000&quot;</code> # 1000 bytes</li> <li><code class="codehilite">nginx.ingress.kubernetes.io/client-body-buffer-size: &quot;1000&quot;</code> # 1000 bytes</li>
@ -1943,7 +1973,7 @@ For example to set the client-body-buffer-size the following can be done:</p>
<li><code class="codehilite">nginx.ingress.kubernetes.io/client-body-buffer-size: 1m</code> # 1 megabyte</li> <li><code class="codehilite">nginx.ingress.kubernetes.io/client-body-buffer-size: 1m</code> # 1 megabyte</li>
<li><code class="codehilite">nginx.ingress.kubernetes.io/client-body-buffer-size: 1M</code> # 1 megabyte</li> <li><code class="codehilite">nginx.ingress.kubernetes.io/client-body-buffer-size: 1M</code> # 1 megabyte</li>
</ul> </ul>
<p>For more information please see http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size</p> <p>For more information please see <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size">http://nginx.org</a></p>
<h3 id="external-authentication">External Authentication<a class="headerlink" href="#external-authentication" title="Permanent link">&para;</a></h3> <h3 id="external-authentication">External Authentication<a class="headerlink" href="#external-authentication" title="Permanent link">&para;</a></h3>
<p>To use an existing service that provides authentication the Ingress rule can be annotated with <code class="codehilite">nginx.ingress.kubernetes.io/auth-url</code> to indicate the URL where the HTTP request should be sent.</p> <p>To use an existing service that provides authentication the Ingress rule can be annotated with <code class="codehilite">nginx.ingress.kubernetes.io/auth-url</code> to indicate the URL where the HTTP request should be sent.</p>
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/auth-url</span><span class="p p-Indicator">:</span> <span class="s">&quot;URL</span><span class="nv"> </span><span class="s">to</span><span class="nv"> </span><span class="s">the</span><span class="nv"> </span><span class="s">authentication</span><span class="nv"> </span><span class="s">service&quot;</span> <div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/auth-url</span><span class="p p-Indicator">:</span> <span class="s">&quot;URL</span><span class="nv"> </span><span class="s">to</span><span class="nv"> </span><span class="s">the</span><span class="nv"> </span><span class="s">authentication</span><span class="nv"> </span><span class="s">service&quot;</span>
@ -1971,15 +2001,23 @@ For example to set the client-body-buffer-size the following can be done:</p>
<p>This annotation allows to return a permanent redirect instead of sending data to the upstream. For example <code class="codehilite">nginx.ingress.kubernetes.io/permanent-redirect: https://www.google.com</code> would redirect everything to Google.</p> <p>This annotation allows to return a permanent redirect instead of sending data to the upstream. For example <code class="codehilite">nginx.ingress.kubernetes.io/permanent-redirect: https://www.google.com</code> would redirect everything to Google.</p>
<h3 id="ssl-passthrough">SSL Passthrough<a class="headerlink" href="#ssl-passthrough" title="Permanent link">&para;</a></h3> <h3 id="ssl-passthrough">SSL Passthrough<a class="headerlink" href="#ssl-passthrough" title="Permanent link">&para;</a></h3>
<p>The annotation <code class="codehilite">nginx.ingress.kubernetes.io/ssl-passthrough</code> allows to configure TLS termination in the pod and not in NGINX.</p> <p>The annotation <code class="codehilite">nginx.ingress.kubernetes.io/ssl-passthrough</code> allows to configure TLS termination in the pod and not in NGINX.</p>
<p><strong>Important:</strong></p> <div class="admonition important">
<p class="admonition-title">Important</p>
<ul> <ul>
<li>Using the annotation <code class="codehilite">nginx.ingress.kubernetes.io/ssl-passthrough</code> invalidates all the other available annotations. This is because SSL Passthrough works in L4 (TCP).</li> <li>
<li>The use of this annotation requires Proxy Protocol to be enabled in the load-balancer. For example enabling Proxy Protocol for AWS ELB is described <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-proxy-protocol.html">here</a>. If you're using ingress-controller without load balancer then the flag <code class="codehilite">--enable-ssl-passthrough</code> is required (by default it is disabled).</li> <p>Using the annotation <code class="codehilite">nginx.ingress.kubernetes.io/ssl-passthrough</code> invalidates all the other available annotations. This is because SSL Passthrough works in L4 (TCP).</p>
</li>
<li>
<p>The use of this annotation requires Proxy Protocol to be enabled in the load-balancer. For example enabling Proxy Protocol for AWS ELB is described <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-proxy-protocol.html">here</a>. If you're using ingress-controller without load balancer then the flag <code class="codehilite">--enable-ssl-passthrough</code> is required (by default it is disabled).</p>
</li>
</ul> </ul>
</div>
<h3 id="secure-backends">Secure backends<a class="headerlink" href="#secure-backends" title="Permanent link">&para;</a></h3> <h3 id="secure-backends">Secure backends<a class="headerlink" href="#secure-backends" title="Permanent link">&para;</a></h3>
<p>By default NGINX uses <code class="codehilite">http</code> to reach the services. Adding the annotation <code class="codehilite">nginx.ingress.kubernetes.io/secure-backends: &quot;true&quot;</code> in the Ingress rule changes the protocol to <code class="codehilite">https</code>. <p>By default NGINX uses <code class="codehilite">http</code> to reach the services. Adding the annotation <code class="codehilite">nginx.ingress.kubernetes.io/secure-backends: &quot;true&quot;</code> in the Ingress rule changes the protocol to <code class="codehilite">https</code>.
If you want to validate the upstream against a specific certificate, you can create a secret with it and reference the secret with the annotation <code class="codehilite">nginx.ingress.kubernetes.io/secure-verify-ca-secret</code>.</p> If you want to validate the upstream against a specific certificate, you can create a secret with it and reference the secret with the annotation <code class="codehilite">nginx.ingress.kubernetes.io/secure-verify-ca-secret</code>.</p>
<p>Please note that if an invalid or non-existent secret is given, the NGINX ingress controller will ignore the <code class="codehilite">secure-backends</code> annotation.</p> <blockquote>
<p>Note that if an invalid or non-existent secret is given, the NGINX ingress controller will ignore the <code class="codehilite">secure-backends</code> annotation.</p>
</blockquote>
<h3 id="service-upstream">Service Upstream<a class="headerlink" href="#service-upstream" title="Permanent link">&para;</a></h3> <h3 id="service-upstream">Service Upstream<a class="headerlink" href="#service-upstream" title="Permanent link">&para;</a></h3>
<p>By default the NGINX ingress controller uses a list of all endpoints (Pod IP/port) in the NGINX upstream configuration. This annotation disables that behavior and instead uses a single upstream in NGINX, the service's Cluster IP and port. This can be desirable for things like zero-downtime deployments as it reduces the need to reload NGINX configuration when Pods come up and down. See issue <a href="https://github.com/kubernetes/ingress-nginx/issues/257">#257</a>.</p> <p>By default the NGINX ingress controller uses a list of all endpoints (Pod IP/port) in the NGINX upstream configuration. This annotation disables that behavior and instead uses a single upstream in NGINX, the service's Cluster IP and port. This can be desirable for things like zero-downtime deployments as it reduces the need to reload NGINX configuration when Pods come up and down. See issue <a href="https://github.com/kubernetes/ingress-nginx/issues/257">#257</a>.</p>
<h4 id="known-issues">Known Issues<a class="headerlink" href="#known-issues" title="Permanent link">&para;</a></h4> <h4 id="known-issues">Known Issues<a class="headerlink" href="#known-issues" title="Permanent link">&para;</a></h4>
@ -1995,16 +2033,18 @@ If you want to validate the upstream against a specific certificate, you can cre
<h3 id="redirect-from-to-www">Redirect from to www<a class="headerlink" href="#redirect-from-to-www" title="Permanent link">&para;</a></h3> <h3 id="redirect-from-to-www">Redirect from to www<a class="headerlink" href="#redirect-from-to-www" title="Permanent link">&para;</a></h3>
<p>In some scenarios is required to redirect from <code class="codehilite">www.domain.com</code> to <code class="codehilite">domain.com</code> or viceversa. <p>In some scenarios is required to redirect from <code class="codehilite">www.domain.com</code> to <code class="codehilite">domain.com</code> or viceversa.
To enable this feature use the annotation <code class="codehilite">nginx.ingress.kubernetes.io/from-to-www-redirect: &quot;true&quot;</code></p> To enable this feature use the annotation <code class="codehilite">nginx.ingress.kubernetes.io/from-to-www-redirect: &quot;true&quot;</code></p>
<p><strong>Important:</strong> <div class="admonition important">
If at some point a new Ingress is created with a host equal to one of the options (like <code class="codehilite">domain.com</code>) the annotation will be omitted.</p> <p class="admonition-title">Important</p>
<p>If at some point a new Ingress is created with a host equal to one of the options (like <code class="codehilite">domain.com</code>) the annotation will be omitted.</p>
</div>
<h3 id="whitelist-source-range">Whitelist source range<a class="headerlink" href="#whitelist-source-range" title="Permanent link">&para;</a></h3> <h3 id="whitelist-source-range">Whitelist source range<a class="headerlink" href="#whitelist-source-range" title="Permanent link">&para;</a></h3>
<p>You can specify the allowed client IP source ranges through the <code class="codehilite">nginx.ingress.kubernetes.io/whitelist-source-range</code> annotation. The value is a comma separated list of <a href="https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing">CIDRs</a>, e.g. <code class="codehilite">10.0.0.0/24,172.10.0.1</code>.</p> <p>You can specify the allowed client IP source ranges through the <code class="codehilite">nginx.ingress.kubernetes.io/whitelist-source-range</code> annotation. The value is a comma separated list of <a href="https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing">CIDRs</a>, e.g. <code class="codehilite">10.0.0.0/24,172.10.0.1</code>.</p>
<p>To configure this setting globally for all Ingress rules, the <code class="codehilite">whitelist-source-range</code> value may be set in the NGINX ConfigMap.</p> <p>To configure this setting globally for all Ingress rules, the <code class="codehilite">whitelist-source-range</code> value may be set in the NGINX ConfigMap.</p>
<p><em>Note:</em> Adding an annotation to an Ingress rule overrides any global restriction.</p> <p><strong>Note:</strong> Adding an annotation to an Ingress rule overrides any global restriction.</p>
<h3 id="cookie-affinity">Cookie affinity<a class="headerlink" href="#cookie-affinity" title="Permanent link">&para;</a></h3> <h3 id="cookie-affinity">Cookie affinity<a class="headerlink" href="#cookie-affinity" title="Permanent link">&para;</a></h3>
<p>If you use the <code class="codehilite">cookie</code> type you can also specify the name of the cookie that will be used to route the requests with the annotation <code class="codehilite">nginx.ingress.kubernetes.io/session-cookie-name</code>. The default is to create a cookie named 'INGRESSCOOKIE'.</p> <p>If you use the <code class="codehilite">cookie</code> type you can also specify the name of the cookie that will be used to route the requests with the annotation <code class="codehilite">nginx.ingress.kubernetes.io/session-cookie-name</code>. The default is to create a cookie named 'INGRESSCOOKIE'.</p>
<p>In case of NGINX the annotation <code class="codehilite">nginx.ingress.kubernetes.io/session-cookie-hash</code> defines which algorithm will be used to 'hash' the used upstream. Default value is <code class="codehilite">md5</code> and possible values are <code class="codehilite">md5</code>, <code class="codehilite">sha1</code> and <code class="codehilite">index</code>. <p>In case of NGINX the annotation <code class="codehilite">nginx.ingress.kubernetes.io/session-cookie-hash</code> defines which algorithm will be used to 'hash' the used upstream. Default value is <code class="codehilite">md5</code> and possible values are <code class="codehilite">md5</code>, <code class="codehilite">sha1</code> and <code class="codehilite">index</code>.
The <code class="codehilite">index</code> option is not hashed, an in-memory index is used instead, it's quicker and the overhead is shorter Warning: the matching against upstream servers list is inconsistent. So, at reload, if upstreams servers has changed, index values are not guaranteed to correspond to the same server as before! USE IT WITH CAUTION and only if you need to!</p> The <code class="codehilite">index</code> option is not hashed, an in-memory index is used instead, it's quicker and the overhead is shorter Warning: the matching against upstream servers list is inconsistent. So, at reload, if upstreams servers has changed, index values are not guaranteed to correspond to the same server as before! <strong>USE IT WITH CAUTION</strong> and only if you need to!</p>
<p>In NGINX this feature is implemented by the third party module <a href="https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng">nginx-sticky-module-ng</a>. The workflow used to define which upstream server will be used is explained <a href="https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng/raw/08a395c66e425540982c00482f55034e1fee67b6/docs/sticky.pdf">here</a></p> <p>In NGINX this feature is implemented by the third party module <a href="https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng">nginx-sticky-module-ng</a>. The workflow used to define which upstream server will be used is explained <a href="https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng/raw/08a395c66e425540982c00482f55034e1fee67b6/docs/sticky.pdf">here</a></p>
<h3 id="custom-timeouts">Custom timeouts<a class="headerlink" href="#custom-timeouts" title="Permanent link">&para;</a></h3> <h3 id="custom-timeouts">Custom timeouts<a class="headerlink" href="#custom-timeouts" title="Permanent link">&para;</a></h3>
<p>Using the configuration configmap it is possible to set the default global timeout for connections to the upstream servers. <p>Using the configuration configmap it is possible to set the default global timeout for connections to the upstream servers.
@ -2058,6 +2098,12 @@ To use custom values in an Ingress rule define these annotation:</p>
</pre></div> </pre></div>
<h3 id="enable-rewrite-log">Enable Rewrite Log<a class="headerlink" href="#enable-rewrite-log" title="Permanent link">&para;</a></h3>
<p>In some scenarios it could be required to enable NGINX rewrite logs. Note that rewrite logs are sent to the error_log file at the notice level. To enable this feature use the annotation:</p>
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/enable-rewrite-log</span><span class="p p-Indicator">:</span> <span class="s">&quot;true&quot;</span>
</pre></div>
<h3 id="lua-resty-waf">Lua Resty WAF<a class="headerlink" href="#lua-resty-waf" title="Permanent link">&para;</a></h3> <h3 id="lua-resty-waf">Lua Resty WAF<a class="headerlink" href="#lua-resty-waf" title="Permanent link">&para;</a></h3>
<p>Using <code class="codehilite">lua-resty-waf-*</code> annotations we can enable and control <a href="https://github.com/p0pr0ck5/lua-resty-waf">lua-resty-waf</a> per location. <p>Using <code class="codehilite">lua-resty-waf-*</code> annotations we can enable and control <a href="https://github.com/p0pr0ck5/lua-resty-waf">lua-resty-waf</a> per location.
Following configuration will enable WAF for the paths defined in the corresponding ingress:</p> Following configuration will enable WAF for the paths defined in the corresponding ingress:</p>
@ -2068,7 +2114,7 @@ Following configuration will enable WAF for the paths defined in the correspondi
<p>In order to run it in debugging mode you can set <code class="codehilite">nginx.ingress.kubernetes.io/lua-resty-waf-debug</code> to <code class="codehilite">&quot;true&quot;</code> in addition to the above configuration. <p>In order to run it in debugging mode you can set <code class="codehilite">nginx.ingress.kubernetes.io/lua-resty-waf-debug</code> to <code class="codehilite">&quot;true&quot;</code> in addition to the above configuration.
The other possible values for <code class="codehilite">nginx.ingress.kubernetes.io/lua-resty-waf</code> are <code class="codehilite">inactive</code> and <code class="codehilite">simulate</code>. In <code class="codehilite">inactive</code> mode WAF won't do anything, whereas The other possible values for <code class="codehilite">nginx.ingress.kubernetes.io/lua-resty-waf</code> are <code class="codehilite">inactive</code> and <code class="codehilite">simulate</code>. In <code class="codehilite">inactive</code> mode WAF won't do anything, whereas
in <code class="codehilite">simulate</code> mode it will log a warning message if there's a matching WAF rule for given request. This is useful to debug a rule and eliminate possible false positives before fully deploying it.</p> in <code class="codehilite">simulate</code> mode it will log a warning message if there's a matching WAF rule for given request. This is useful to debug a rule and eliminate possible false positives before fully deploying it.</p>
<p><code class="codehilite">lua-resty-waf</code> comes with predefined set of rules(https://github.com/p0pr0ck5/lua-resty-waf/tree/84b4f40362500dd0cb98b9e71b5875cb1a40f1ad/rules) that covers ModSecurity CRS. <p><code class="codehilite">lua-resty-waf</code> comes with predefined set of rules <a href="https://github.com/p0pr0ck5/lua-resty-waf/tree/84b4f40362500dd0cb98b9e71b5875cb1a40f1ad/rules">https://github.com/p0pr0ck5/lua-resty-waf/tree/84b4f40362500dd0cb98b9e71b5875cb1a40f1ad/rules</a> that covers ModSecurity CRS.
You can use <code class="codehilite">nginx.ingress.kubernetes.io/lua-resty-waf-ignore-rulesets</code> to ignore subset of those rulesets. For an example:</p> You can use <code class="codehilite">nginx.ingress.kubernetes.io/lua-resty-waf-ignore-rulesets</code> to ignore subset of those rulesets. For an example:</p>
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/lua-resty-waf-ignore-rulesets</span><span class="p p-Indicator">:</span> <span class="s">&quot;41000_sqli,</span><span class="nv"> </span><span class="s">42000_xss&quot;</span> <div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/lua-resty-waf-ignore-rulesets</span><span class="p p-Indicator">:</span> <span class="s">&quot;41000_sqli,</span><span class="nv"> </span><span class="s">42000_xss&quot;</span>
</pre></div> </pre></div>
@ -2081,7 +2127,7 @@ configure a WAF rule to deny requests with query string value that contains word
</pre></div> </pre></div>
<p>For details on how to write WAF rules, please refer to https://github.com/p0pr0ck5/lua-resty-waf.</p> <p>For details on how to write WAF rules, please refer to <a href="https://github.com/p0pr0ck5/lua-resty-waf">https://github.com/p0pr0ck5/lua-resty-waf</a>.</p>

196
user-guide/nginx-configuration/configmap/index.html
View file

@ -2631,11 +2631,13 @@ you can add key-value pairs to the data section of the config-map. For Example:<
</pre></div> </pre></div>
<p><strong>IMPORTANT:</strong></p> <div class="admonition important">
<p class="admonition-title">Important</p>
<p>The key and values in a ConfigMap can only be strings. <p>The key and values in a ConfigMap can only be strings.
This means that we want a value with boolean values we need to quote the values, like "true" or "false". This means that we want a value with boolean values we need to quote the values, like "true" or "false".
Same for numbers, like "100".</p> Same for numbers, like "100".</p>
<p>"Slice" types (defined below as <code class="codehilite">[]string</code> or <code class="codehilite">[]int</code> can be provided as a comma-delimited string.</p> <p>"Slice" types (defined below as <code class="codehilite">[]string</code> or <code class="codehilite">[]int</code> can be provided as a comma-delimited string.</p>
</div>
<h2 id="configuration-options">Configuration options<a class="headerlink" href="#configuration-options" title="Permanent link">&para;</a></h2> <h2 id="configuration-options">Configuration options<a class="headerlink" href="#configuration-options" title="Permanent link">&para;</a></h2>
<p>The following table shows a configuration option's name, type, and the default value:</p> <p>The following table shows a configuration option's name, type, and the default value:</p>
<table> <table>
@ -3217,12 +3219,12 @@ Same for numbers, like "100".</p>
<h2 id="add-headers">add-headers<a class="headerlink" href="#add-headers" title="Permanent link">&para;</a></h2> <h2 id="add-headers">add-headers<a class="headerlink" href="#add-headers" title="Permanent link">&para;</a></h2>
<p>Sets custom headers from named configmap before sending traffic to the client. See <a href="#proxy-set-headers">proxy-set-headers</a>. <a href="https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-headers">example</a></p> <p>Sets custom headers from named configmap before sending traffic to the client. See <a href="#proxy-set-headers">proxy-set-headers</a>. <a href="https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-headers">example</a></p>
<h2 id="allow-backend-server-header">allow-backend-server-header<a class="headerlink" href="#allow-backend-server-header" title="Permanent link">&para;</a></h2> <h2 id="allow-backend-server-header">allow-backend-server-header<a class="headerlink" href="#allow-backend-server-header" title="Permanent link">&para;</a></h2>
<p>Enables the return of the header Server from the backend instead of the generic nginx string. By default this is disabled.</p> <p>Enables the return of the header Server from the backend instead of the generic nginx string. <em><strong>default:</strong></em> is disabled</p>
<h2 id="hide-headers">hide-headers<a class="headerlink" href="#hide-headers" title="Permanent link">&para;</a></h2> <h2 id="hide-headers">hide-headers<a class="headerlink" href="#hide-headers" title="Permanent link">&para;</a></h2>
<p>Sets additional header that will not be passed from the upstream server to the client response. <p>Sets additional header that will not be passed from the upstream server to the client response.
Default: empty</p> <em><strong>default:</strong></em> empty</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header</p> <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header">http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header</a></p>
<h2 id="access-log-path">access-log-path<a class="headerlink" href="#access-log-path" title="Permanent link">&para;</a></h2> <h2 id="access-log-path">access-log-path<a class="headerlink" href="#access-log-path" title="Permanent link">&para;</a></h2>
<p>Access log path. Goes to <code class="codehilite">/var/log/nginx/access.log</code> by default.</p> <p>Access log path. Goes to <code class="codehilite">/var/log/nginx/access.log</code> by default.</p>
<p><strong>Note:</strong> the file <code class="codehilite">/var/log/nginx/access.log</code> is a symlink to <code class="codehilite">/dev/stdout</code></p> <p><strong>Note:</strong> the file <code class="codehilite">/var/log/nginx/access.log</code> is a symlink to <code class="codehilite">/dev/stdout</code></p>
@ -3230,77 +3232,81 @@ Default: empty</p>
<p>Error log path. Goes to <code class="codehilite">/var/log/nginx/error.log</code> by default.</p> <p>Error log path. Goes to <code class="codehilite">/var/log/nginx/error.log</code> by default.</p>
<p><strong>Note:</strong> the file <code class="codehilite">/var/log/nginx/error.log</code> is a symlink to <code class="codehilite">/dev/stderr</code></p> <p><strong>Note:</strong> the file <code class="codehilite">/var/log/nginx/error.log</code> is a symlink to <code class="codehilite">/dev/stderr</code></p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/ngx_core_module.html#error_log</p> <a href="http://nginx.org/en/docs/ngx_core_module.html#error_log">http://nginx.org/en/docs/ngx_core_module.html#error_log</a></p>
<h2 id="enable-dynamic-tls-records">enable-dynamic-tls-records<a class="headerlink" href="#enable-dynamic-tls-records" title="Permanent link">&para;</a></h2> <h2 id="enable-dynamic-tls-records">enable-dynamic-tls-records<a class="headerlink" href="#enable-dynamic-tls-records" title="Permanent link">&para;</a></h2>
<p>Enables dynamically sized TLS records to improve time-to-first-byte. By default this is enabled. See <a href="https://blog.cloudflare.com/optimizing-tls-over-tcp-to-reduce-latency">CloudFlare's blog</a> for more information.</p> <p>Enables dynamically sized TLS records to improve time-to-first-byte. <em><strong>default:</strong></em> is enabled</p>
<p><em>References:</em>
<a href="https://blog.cloudflare.com/optimizing-tls-over-tcp-to-reduce-latency">https://blog.cloudflare.com/optimizing-tls-over-tcp-to-reduce-latency</a></p>
<h2 id="enable-modsecurity">enable-modsecurity<a class="headerlink" href="#enable-modsecurity" title="Permanent link">&para;</a></h2> <h2 id="enable-modsecurity">enable-modsecurity<a class="headerlink" href="#enable-modsecurity" title="Permanent link">&para;</a></h2>
<p>Enables the modsecurity module for NGINX. By default this is disabled.</p> <p>Enables the modsecurity module for NGINX. <em><strong>default:</strong></em> is disabled</p>
<h2 id="enable-owasp-modsecurity-crs">enable-owasp-modsecurity-crs<a class="headerlink" href="#enable-owasp-modsecurity-crs" title="Permanent link">&para;</a></h2> <h2 id="enable-owasp-modsecurity-crs">enable-owasp-modsecurity-crs<a class="headerlink" href="#enable-owasp-modsecurity-crs" title="Permanent link">&para;</a></h2>
<p>Enables the OWASP ModSecurity Core Rule Set (CRS). By default this is disabled.</p> <p>Enables the OWASP ModSecurity Core Rule Set (CRS). <em><strong>default:</strong></em> is disabled</p>
<h2 id="client-header-buffer-size">client-header-buffer-size<a class="headerlink" href="#client-header-buffer-size" title="Permanent link">&para;</a></h2> <h2 id="client-header-buffer-size">client-header-buffer-size<a class="headerlink" href="#client-header-buffer-size" title="Permanent link">&para;</a></h2>
<p>Allows to configure a custom buffer size for reading client request header.</p> <p>Allows to configure a custom buffer size for reading client request header.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_buffer_size</p> <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_buffer_size">http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_buffer_size</a></p>
<h2 id="client-header-timeout">client-header-timeout<a class="headerlink" href="#client-header-timeout" title="Permanent link">&para;</a></h2> <h2 id="client-header-timeout">client-header-timeout<a class="headerlink" href="#client-header-timeout" title="Permanent link">&para;</a></h2>
<p>Defines a timeout for reading client request header, in seconds.</p> <p>Defines a timeout for reading client request header, in seconds.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout</p> <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout">http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout</a></p>
<h2 id="client-body-buffer-size">client-body-buffer-size<a class="headerlink" href="#client-body-buffer-size" title="Permanent link">&para;</a></h2> <h2 id="client-body-buffer-size">client-body-buffer-size<a class="headerlink" href="#client-body-buffer-size" title="Permanent link">&para;</a></h2>
<p>Sets buffer size for reading client request body.</p> <p>Sets buffer size for reading client request body.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size</p> <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size">http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size</a></p>
<h2 id="client-body-timeout">client-body-timeout<a class="headerlink" href="#client-body-timeout" title="Permanent link">&para;</a></h2> <h2 id="client-body-timeout">client-body-timeout<a class="headerlink" href="#client-body-timeout" title="Permanent link">&para;</a></h2>
<p>Defines a timeout for reading client request body, in seconds.</p> <p>Defines a timeout for reading client request body, in seconds.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout</p> <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout">http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout</a></p>
<h2 id="disable-access-log">disable-access-log<a class="headerlink" href="#disable-access-log" title="Permanent link">&para;</a></h2> <h2 id="disable-access-log">disable-access-log<a class="headerlink" href="#disable-access-log" title="Permanent link">&para;</a></h2>
<p>Disables the Access Log from the entire Ingress Controller. This is '"false"' by default.</p> <p>Disables the Access Log from the entire Ingress Controller. <em><strong>default:</strong></em> '"false"'</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_log_module.html#access_log</p> <a href="http://nginx.org/en/docs/http/ngx_http_log_module.html#access_log">http://nginx.org/en/docs/http/ngx_http_log_module.html#access_log</a></p>
<h2 id="disable-ipv6">disable-ipv6<a class="headerlink" href="#disable-ipv6" title="Permanent link">&para;</a></h2> <h2 id="disable-ipv6">disable-ipv6<a class="headerlink" href="#disable-ipv6" title="Permanent link">&para;</a></h2>
<p>Disable listening on IPV6. By default this is disabled.</p> <p>Disable listening on IPV6. <em><strong>default:</strong></em> is disabled</p>
<h2 id="disable-ipv6-dns">disable-ipv6-dns<a class="headerlink" href="#disable-ipv6-dns" title="Permanent link">&para;</a></h2> <h2 id="disable-ipv6-dns">disable-ipv6-dns<a class="headerlink" href="#disable-ipv6-dns" title="Permanent link">&para;</a></h2>
<p>Disable IPV6 for nginx DNS resolver. By default this is disabled.</p> <p>Disable IPV6 for nginx DNS resolver. <em><strong>default:</strong></em> is disabled</p>
<h2 id="enable-underscores-in-headers">enable-underscores-in-headers<a class="headerlink" href="#enable-underscores-in-headers" title="Permanent link">&para;</a></h2> <h2 id="enable-underscores-in-headers">enable-underscores-in-headers<a class="headerlink" href="#enable-underscores-in-headers" title="Permanent link">&para;</a></h2>
<p>Enables underscores in header names. By default this is disabled.</p> <p>Enables underscores in header names. <em><strong>default:</strong></em> is disabled</p>
<h2 id="ignore-invalid-headers">ignore-invalid-headers<a class="headerlink" href="#ignore-invalid-headers" title="Permanent link">&para;</a></h2> <h2 id="ignore-invalid-headers">ignore-invalid-headers<a class="headerlink" href="#ignore-invalid-headers" title="Permanent link">&para;</a></h2>
<p>Set if header fields with invalid names should be ignored. <p>Set if header fields with invalid names should be ignored.
By default this is enabled.</p> <em><strong>default:</strong></em> is enabled</p>
<h2 id="enable-vts-status">enable-vts-status<a class="headerlink" href="#enable-vts-status" title="Permanent link">&para;</a></h2> <h2 id="enable-vts-status">enable-vts-status<a class="headerlink" href="#enable-vts-status" title="Permanent link">&para;</a></h2>
<p>Allows the replacement of the default status page with a third party module named <a href="https://github.com/vozlt/nginx-module-vts">nginx-module-vts</a>. <p>Allows the replacement of the default status page with a third party module named <a href="https://github.com/vozlt/nginx-module-vts">nginx-module-vts</a>.
By default this is disabled.</p> <em><strong>default:</strong></em> is disabled</p>
<h2 id="vts-status-zone-size">vts-status-zone-size<a class="headerlink" href="#vts-status-zone-size" title="Permanent link">&para;</a></h2> <h2 id="vts-status-zone-size">vts-status-zone-size<a class="headerlink" href="#vts-status-zone-size" title="Permanent link">&para;</a></h2>
<p>Vts config on http level sets parameters for a shared memory zone that will keep states for various keys. The cache is shared between all worker processes. Default value is 10m</p> <p>Vts config on http level sets parameters for a shared memory zone that will keep states for various keys. The cache is shared between all worker processes. <em><strong>default:</strong></em> 10m</p>
<p><em>References:</em> <p><em>References:</em>
- https://github.com/vozlt/nginx-module-vts#vhost_traffic_status_zone</p> <a href="https://github.com/vozlt/nginx-module-vts#vhost_traffic_status_zone">https://github.com/vozlt/nginx-module-vts#vhost_traffic_status_zone</a></p>
<h2 id="vts-default-filter-key">vts-default-filter-key<a class="headerlink" href="#vts-default-filter-key" title="Permanent link">&para;</a></h2> <h2 id="vts-default-filter-key">vts-default-filter-key<a class="headerlink" href="#vts-default-filter-key" title="Permanent link">&para;</a></h2>
<p>Vts config on http level enables the keys by user defined variable. The key is a key string to calculate traffic. The name is a group string to calculate traffic. The key and name can contain variables such as $host, $server_name. The name's group belongs to filterZones if specified. The key's group belongs to serverZones if not specified second argument name. Default value is $geoip_country_code country::*</p> <p>Vts config on http level enables the keys by user defined variable. The key is a key string to calculate traffic. The name is a group string to calculate traffic. The key and name can contain variables such as $host, $server_name. The name's group belongs to filterZones if specified. The key's group belongs to serverZones if not specified second argument name. <em><strong>default:</strong></em> $geoip_country_code country::*</p>
<p><em>References:</em> <p><em>References:</em>
- https://github.com/vozlt/nginx-module-vts#vhost_traffic_status_filter_by_set_key</p> <a href="https://github.com/vozlt/nginx-module-vts#vhost_traffic_status_filter_by_set_key">https://github.com/vozlt/nginx-module-vts#vhost_traffic_status_filter_by_set_key</a></p>
<h2 id="vts-sum-key">vts-sum-key<a class="headerlink" href="#vts-sum-key" title="Permanent link">&para;</a></h2> <h2 id="vts-sum-key">vts-sum-key<a class="headerlink" href="#vts-sum-key" title="Permanent link">&para;</a></h2>
<p>For metrics keyed (or when using Prometheus, labeled) by server zone, this value is used to indicate metrics for all server zones combined. Default value is *</p> <p>For metrics keyed (or when using Prometheus, labeled) by server zone, this value is used to indicate metrics for all server zones combined. <em><strong>default:</strong></em> *</p>
<p><em>References:</em> <p><em>References:</em>
- https://github.com/vozlt/nginx-module-vts#vhost_traffic_status_display_sum_key</p> <a href="https://github.com/vozlt/nginx-module-vts#vhost_traffic_status_display_sum_key">https://github.com/vozlt/nginx-module-vts#vhost_traffic_status_display_sum_key</a></p>
<h2 id="retry-non-idempotent">retry-non-idempotent<a class="headerlink" href="#retry-non-idempotent" title="Permanent link">&para;</a></h2> <h2 id="retry-non-idempotent">retry-non-idempotent<a class="headerlink" href="#retry-non-idempotent" title="Permanent link">&para;</a></h2>
<p>Since 1.9.13 NGINX will not retry non-idempotent requests (POST, LOCK, PATCH) in case of an error in the upstream server. The previous behavior can be restored using the value "true".</p> <p>Since 1.9.13 NGINX will not retry non-idempotent requests (POST, LOCK, PATCH) in case of an error in the upstream server. The previous behavior can be restored using the value "true".</p>
<h2 id="error-log-level">error-log-level<a class="headerlink" href="#error-log-level" title="Permanent link">&para;</a></h2> <h2 id="error-log-level">error-log-level<a class="headerlink" href="#error-log-level" title="Permanent link">&para;</a></h2>
<p>Configures the logging level of errors. Log levels above are listed in the order of increasing severity.</p> <p>Configures the logging level of errors. Log levels above are listed in the order of increasing severity.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/ngx_core_module.html#error_log</p> <a href="http://nginx.org/en/docs/ngx_core_module.html#error_log">http://nginx.org/en/docs/ngx_core_module.html#error_log</a></p>
<h2 id="http2-max-field-size">http2-max-field-size<a class="headerlink" href="#http2-max-field-size" title="Permanent link">&para;</a></h2> <h2 id="http2-max-field-size">http2-max-field-size<a class="headerlink" href="#http2-max-field-size" title="Permanent link">&para;</a></h2>
<p>Limits the maximum size of an HPACK-compressed request header field.</p> <p>Limits the maximum size of an HPACK-compressed request header field.</p>
<p><em>References:</em> <p><em>References:</em>
- https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_field_size</p> <a href="https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_field_size">https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_field_size</a></p>
<h2 id="http2-max-header-size">http2-max-header-size<a class="headerlink" href="#http2-max-header-size" title="Permanent link">&para;</a></h2> <h2 id="http2-max-header-size">http2-max-header-size<a class="headerlink" href="#http2-max-header-size" title="Permanent link">&para;</a></h2>
<p>Limits the maximum size of the entire request header list after HPACK decompression.</p> <p>Limits the maximum size of the entire request header list after HPACK decompression.</p>
<p><em>References:</em> <p><em>References:</em>
- https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_header_size</p> <a href="https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_header_size">https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_header_size</a></p>
<h2 id="hsts">hsts<a class="headerlink" href="#hsts" title="Permanent link">&para;</a></h2> <h2 id="hsts">hsts<a class="headerlink" href="#hsts" title="Permanent link">&para;</a></h2>
<p>Enables or disables the header HSTS in servers running SSL. <p>Enables or disables the header HSTS in servers running SSL.
HTTP Strict Transport Security (often abbreviated as HSTS) is a security feature (HTTP header) that tell browsers that it should only be communicated with using HTTPS, instead of using HTTP. It provides protection against protocol downgrade attacks and cookie theft.</p> HTTP Strict Transport Security (often abbreviated as HSTS) is a security feature (HTTP header) that tell browsers that it should only be communicated with using HTTPS, instead of using HTTP. It provides protection against protocol downgrade attacks and cookie theft.</p>
<p><em>References:</em> <p><em>References:</em></p>
- https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security <ul>
- https://blog.qualys.com/securitylabs/2016/03/28/the-importance-of-a-proper-http-strict-transport-security-implementation-on-your-web-server</p> <li><a href="https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security">https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security</a></li>
<li><a href="https://blog.qualys.com/securitylabs/2016/03/28/the-importance-of-a-proper-http-strict-transport-security-implementation-on-your-web-server">https://blog.qualys.com/securitylabs/2016/03/28/the-importance-of-a-proper-http-strict-transport-security-implementation-on-your-web-server</a></li>
</ul>
<h2 id="hsts-include-subdomains">hsts-include-subdomains<a class="headerlink" href="#hsts-include-subdomains" title="Permanent link">&para;</a></h2> <h2 id="hsts-include-subdomains">hsts-include-subdomains<a class="headerlink" href="#hsts-include-subdomains" title="Permanent link">&para;</a></h2>
<p>Enables or disables the use of HSTS in all the subdomains of the server-name.</p> <p>Enables or disables the use of HSTS in all the subdomains of the server-name.</p>
<h2 id="hsts-max-age">hsts-max-age<a class="headerlink" href="#hsts-max-age" title="Permanent link">&para;</a></h2> <h2 id="hsts-max-age">hsts-max-age<a class="headerlink" href="#hsts-max-age" title="Permanent link">&para;</a></h2>
@ -3310,22 +3316,22 @@ HTTP Strict Transport Security (often abbreviated as HSTS) is a security feature
<h2 id="keep-alive">keep-alive<a class="headerlink" href="#keep-alive" title="Permanent link">&para;</a></h2> <h2 id="keep-alive">keep-alive<a class="headerlink" href="#keep-alive" title="Permanent link">&para;</a></h2>
<p>Sets the time during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections.</p> <p>Sets the time during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout</p> <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout">http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout</a></p>
<h2 id="keep-alive-requests">keep-alive-requests<a class="headerlink" href="#keep-alive-requests" title="Permanent link">&para;</a></h2> <h2 id="keep-alive-requests">keep-alive-requests<a class="headerlink" href="#keep-alive-requests" title="Permanent link">&para;</a></h2>
<p>Sets the maximum number of requests that can be served through one keep-alive connection.</p> <p>Sets the maximum number of requests that can be served through one keep-alive connection.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_requests</p> <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_requests">http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_requests</a></p>
<h2 id="large-client-header-buffers">large-client-header-buffers<a class="headerlink" href="#large-client-header-buffers" title="Permanent link">&para;</a></h2> <h2 id="large-client-header-buffers">large-client-header-buffers<a class="headerlink" href="#large-client-header-buffers" title="Permanent link">&para;</a></h2>
<p>Sets the maximum number and size of buffers used for reading large client request header. Default: 4 8k.</p> <p>Sets the maximum number and size of buffers used for reading large client request header. <em><strong>default:</strong></em> 4 8k</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers</p> <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers">http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers</a></p>
<h2 id="log-format-escape-json">log-format-escape-json<a class="headerlink" href="#log-format-escape-json" title="Permanent link">&para;</a></h2> <h2 id="log-format-escape-json">log-format-escape-json<a class="headerlink" href="#log-format-escape-json" title="Permanent link">&para;</a></h2>
<p>Sets if the escape parameter allows JSON ("true") or default characters escaping in variables ("false") Sets the nginx <a href="http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format">log format</a>.</p> <p>Sets if the escape parameter allows JSON ("true") or default characters escaping in variables ("false") Sets the nginx <a href="http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format">log format</a>.</p>
<h2 id="log-format-upstream">log-format-upstream<a class="headerlink" href="#log-format-upstream" title="Permanent link">&para;</a></h2> <h2 id="log-format-upstream">log-format-upstream<a class="headerlink" href="#log-format-upstream" title="Permanent link">&para;</a></h2>
<p>Sets the nginx <a href="http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format">log format</a>. <p>Sets the nginx <a href="http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format">log format</a>.
Example for json output:</p> Example for json output:</p>
<p><code class="codehilite">consolelog-format-upstream: &#39;{ &quot;time&quot;: &quot;$time_iso8601&quot;, &quot;remote_addr&quot;: &quot;$proxy_protocol_addr&quot;,&quot;x-forward-for&quot;: &quot;$proxy_add_x_forwarded_for&quot;, &quot;request_id&quot;: &quot;$req_id&quot;, &quot;remote_user&quot;:&quot;$remote_user&quot;, &quot;bytes_sent&quot;: $bytes_sent, &quot;request_time&quot;: $request_time, &quot;status&quot;:$status, &quot;vhost&quot;: &quot;$host&quot;, &quot;request_proto&quot;: &quot;$server_protocol&quot;, &quot;path&quot;: &quot;$uri&quot;,&quot;request_query&quot;: &quot;$args&quot;, &quot;request_length&quot;: $request_length, &quot;duration&quot;: $request_time,&quot;method&quot;: &quot;$request_method&quot;, &quot;http_referrer&quot;: &quot;$http_referer&quot;, &quot;http_user_agent&quot;:&quot;$http_user_agent&quot; }&#39;</code></p> <p><code class="codehilite">consolelog-format-upstream: &#39;{ &quot;time&quot;: &quot;$time_iso8601&quot;, &quot;remote_addr&quot;: &quot;$proxy_protocol_addr&quot;,&quot;x-forward-for&quot;: &quot;$proxy_add_x_forwarded_for&quot;, &quot;request_id&quot;: &quot;$req_id&quot;, &quot;remote_user&quot;:&quot;$remote_user&quot;, &quot;bytes_sent&quot;: $bytes_sent, &quot;request_time&quot;: $request_time, &quot;status&quot;:$status, &quot;vhost&quot;: &quot;$host&quot;, &quot;request_proto&quot;: &quot;$server_protocol&quot;, &quot;path&quot;: &quot;$uri&quot;,&quot;request_query&quot;: &quot;$args&quot;, &quot;request_length&quot;: $request_length, &quot;duration&quot;: $request_time,&quot;method&quot;: &quot;$request_method&quot;, &quot;http_referrer&quot;: &quot;$http_referer&quot;, &quot;http_user_agent&quot;:&quot;$http_user_agent&quot; }&#39;</code></p>
<p>Please check <a href="../log-format/">log-format</a> for definition of each field.</p> <p>Please check the <a href="../log-format/">log-format</a> for definition of each field.</p>
<h2 id="log-format-stream">log-format-stream<a class="headerlink" href="#log-format-stream" title="Permanent link">&para;</a></h2> <h2 id="log-format-stream">log-format-stream<a class="headerlink" href="#log-format-stream" title="Permanent link">&para;</a></h2>
<p>Sets the nginx <a href="https://nginx.org/en/docs/stream/ngx_stream_log_module.html#log_format">stream format</a>.</p> <p>Sets the nginx <a href="https://nginx.org/en/docs/stream/ngx_stream_log_module.html#log_format">stream format</a>.</p>
<h2 id="max-worker-connections">max-worker-connections<a class="headerlink" href="#max-worker-connections" title="Permanent link">&para;</a></h2> <h2 id="max-worker-connections">max-worker-connections<a class="headerlink" href="#max-worker-connections" title="Permanent link">&para;</a></h2>
@ -3339,24 +3345,30 @@ Example for json output:</p>
<h2 id="server-name-hash-max-size">server-name-hash-max-size<a class="headerlink" href="#server-name-hash-max-size" title="Permanent link">&para;</a></h2> <h2 id="server-name-hash-max-size">server-name-hash-max-size<a class="headerlink" href="#server-name-hash-max-size" title="Permanent link">&para;</a></h2>
<p>Sets the maximum size of the <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_max_size">server names hash tables</a> used in server names,map directive’s values, MIME types, names of request header strings, etc.</p> <p>Sets the maximum size of the <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_max_size">server names hash tables</a> used in server names,map directive’s values, MIME types, names of request header strings, etc.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/hash.html</p> <a href="http://nginx.org/en/docs/hash.html">http://nginx.org/en/docs/hash.html</a></p>
<h2 id="server-name-hash-bucket-size">server-name-hash-bucket-size<a class="headerlink" href="#server-name-hash-bucket-size" title="Permanent link">&para;</a></h2> <h2 id="server-name-hash-bucket-size">server-name-hash-bucket-size<a class="headerlink" href="#server-name-hash-bucket-size" title="Permanent link">&para;</a></h2>
<p>Sets the size of the bucket for the server names hash tables.</p> <p>Sets the size of the bucket for the server names hash tables.</p>
<p><em>References:</em> <p><em>References:</em></p>
- http://nginx.org/en/docs/hash.html <ul>
- http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_bucket_size</p> <li><a href="http://nginx.org/en/docs/hash.html">http://nginx.org/en/docs/hash.html</a></li>
<li><a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_bucket_size">http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_bucket_size</a></li>
</ul>
<h2 id="proxy-headers-hash-max-size">proxy-headers-hash-max-size<a class="headerlink" href="#proxy-headers-hash-max-size" title="Permanent link">&para;</a></h2> <h2 id="proxy-headers-hash-max-size">proxy-headers-hash-max-size<a class="headerlink" href="#proxy-headers-hash-max-size" title="Permanent link">&para;</a></h2>
<p>Sets the maximum size of the proxy headers hash tables.</p> <p>Sets the maximum size of the proxy headers hash tables.</p>
<p><em>References:</em> <p><em>References:</em></p>
- http://nginx.org/en/docs/hash.html <ul>
- https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_headers_hash_max_size</p> <li><a href="http://nginx.org/en/docs/hash.html">http://nginx.org/en/docs/hash.html</a></li>
<li><a href="https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_headers_hash_max_size">https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_headers_hash_max_size</a></li>
</ul>
<h2 id="proxy-headers-hash-bucket-size">proxy-headers-hash-bucket-size<a class="headerlink" href="#proxy-headers-hash-bucket-size" title="Permanent link">&para;</a></h2> <h2 id="proxy-headers-hash-bucket-size">proxy-headers-hash-bucket-size<a class="headerlink" href="#proxy-headers-hash-bucket-size" title="Permanent link">&para;</a></h2>
<p>Sets the size of the bucket for the proxy headers hash tables.</p> <p>Sets the size of the bucket for the proxy headers hash tables.</p>
<p><em>References:</em> <p><em>References:</em></p>
- http://nginx.org/en/docs/hash.html <ul>
- https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_headers_hash_bucket_size</p> <li><a href="http://nginx.org/en/docs/hash.html">http://nginx.org/en/docs/hash.html</a></li>
<li><a href="https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_headers_hash_bucket_size">https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_headers_hash_bucket_size</a></li>
</ul>
<h2 id="server-tokens">server-tokens<a class="headerlink" href="#server-tokens" title="Permanent link">&para;</a></h2> <h2 id="server-tokens">server-tokens<a class="headerlink" href="#server-tokens" title="Permanent link">&para;</a></h2>
<p>Send NGINX Server header in responses and display NGINX version in error pages. By default this is enabled.</p> <p>Send NGINX Server header in responses and display NGINX version in error pages. <em><strong>default:</strong></em> is enabled</p>
<h2 id="ssl-ciphers">ssl-ciphers<a class="headerlink" href="#ssl-ciphers" title="Permanent link">&para;</a></h2> <h2 id="ssl-ciphers">ssl-ciphers<a class="headerlink" href="#ssl-ciphers" title="Permanent link">&para;</a></h2>
<p>Sets the <a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers">ciphers</a> list to enable. The ciphers are specified in the format understood by the OpenSSL library.</p> <p>Sets the <a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers">ciphers</a> list to enable. The ciphers are specified in the format understood by the OpenSSL library.</p>
<p>The default cipher list is: <p>The default cipher list is:
@ -3366,13 +3378,15 @@ Example for json output:</p>
<h2 id="ssl-ecdh-curve">ssl-ecdh-curve<a class="headerlink" href="#ssl-ecdh-curve" title="Permanent link">&para;</a></h2> <h2 id="ssl-ecdh-curve">ssl-ecdh-curve<a class="headerlink" href="#ssl-ecdh-curve" title="Permanent link">&para;</a></h2>
<p>Specifies a curve for ECDHE ciphers.</p> <p>Specifies a curve for ECDHE ciphers.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ecdh_curve</p> <a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ecdh_curve">http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ecdh_curve</a></p>
<h2 id="ssl-dh-param">ssl-dh-param<a class="headerlink" href="#ssl-dh-param" title="Permanent link">&para;</a></h2> <h2 id="ssl-dh-param">ssl-dh-param<a class="headerlink" href="#ssl-dh-param" title="Permanent link">&para;</a></h2>
<p>Sets the name of the secret that contains Diffie-Hellman key to help with "Perfect Forward Secrecy".</p> <p>Sets the name of the secret that contains Diffie-Hellman key to help with "Perfect Forward Secrecy".</p>
<p><em>References:</em> <p><em>References:</em></p>
- https://wiki.openssl.org/index.php/Diffie-Hellman_parameters <ul>
- https://wiki.mozilla.org/Security/Server_Side_TLS#DHE_handshake_and_dhparam <li><a href="https://wiki.openssl.org/index.php/Diffie-Hellman_parameters">https://wiki.openssl.org/index.php/Diffie-Hellman_parameters</a></li>
- http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam</p> <li><a href="https://wiki.mozilla.org/Security/Server_Side_TLS#DHE_handshake_and_dhparam">https://wiki.mozilla.org/Security/Server_Side_TLS#DHE_handshake_and_dhparam</a></li>
<li><a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam">http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam</a></li>
</ul>
<h2 id="ssl-protocols">ssl-protocols<a class="headerlink" href="#ssl-protocols" title="Permanent link">&para;</a></h2> <h2 id="ssl-protocols">ssl-protocols<a class="headerlink" href="#ssl-protocols" title="Permanent link">&para;</a></h2>
<p>Sets the <a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols">SSL protocols</a> to use. The default is: <code class="codehilite">TLSv1.2</code>.</p> <p>Sets the <a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols">SSL protocols</a> to use. The default is: <code class="codehilite">TLSv1.2</code>.</p>
<p>Please check the result of the configuration using <code class="codehilite">https://ssllabs.com/ssltest/analyze.html</code> or <code class="codehilite">https://testssl.sh</code>.</p> <p>Please check the result of the configuration using <code class="codehilite">https://ssllabs.com/ssltest/analyze.html</code> or <code class="codehilite">https://testssl.sh</code>.</p>
@ -3390,7 +3404,7 @@ Example for json output:</p>
<h2 id="ssl-buffer-size">ssl-buffer-size<a class="headerlink" href="#ssl-buffer-size" title="Permanent link">&para;</a></h2> <h2 id="ssl-buffer-size">ssl-buffer-size<a class="headerlink" href="#ssl-buffer-size" title="Permanent link">&para;</a></h2>
<p>Sets the size of the <a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size">SSL buffer</a> used for sending data. The default of 4k helps NGINX to improve TLS Time To First Byte (TTTFB).</p> <p>Sets the size of the <a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size">SSL buffer</a> used for sending data. The default of 4k helps NGINX to improve TLS Time To First Byte (TTTFB).</p>
<p><em>References:</em> <p><em>References:</em>
- https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/</p> <a href="https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/">https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/</a></p>
<h2 id="use-proxy-protocol">use-proxy-protocol<a class="headerlink" href="#use-proxy-protocol" title="Permanent link">&para;</a></h2> <h2 id="use-proxy-protocol">use-proxy-protocol<a class="headerlink" href="#use-proxy-protocol" title="Permanent link">&para;</a></h2>
<p>Enables or disables the <a href="https://www.nginx.com/resources/admin-guide/proxy-protocol/">PROXY protocol</a> to receive client connection (real IP address) information passed through proxy servers and load balancers such as HAProxy and Amazon Elastic Load Balancer (ELB).</p> <p>Enables or disables the <a href="https://www.nginx.com/resources/admin-guide/proxy-protocol/">PROXY protocol</a> to receive client connection (real IP address) information passed through proxy servers and load balancers such as HAProxy and Amazon Elastic Load Balancer (ELB).</p>
<h2 id="use-gzip">use-gzip<a class="headerlink" href="#use-gzip" title="Permanent link">&para;</a></h2> <h2 id="use-gzip">use-gzip<a class="headerlink" href="#use-gzip" title="Permanent link">&para;</a></h2>
@ -3398,16 +3412,18 @@ Example for json output:</p>
The default mime type list to compress is: <code class="codehilite">application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component</code>.</p> The default mime type list to compress is: <code class="codehilite">application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component</code>.</p>
<h2 id="use-geoip">use-geoip<a class="headerlink" href="#use-geoip" title="Permanent link">&para;</a></h2> <h2 id="use-geoip">use-geoip<a class="headerlink" href="#use-geoip" title="Permanent link">&para;</a></h2>
<p>Enables or disables <a href="http://nginx.org/en/docs/http/ngx_http_geoip_module.html">"geoip" module</a> that creates variables with values depending on the client IP address, using the precompiled MaxMind databases. <p>Enables or disables <a href="http://nginx.org/en/docs/http/ngx_http_geoip_module.html">"geoip" module</a> that creates variables with values depending on the client IP address, using the precompiled MaxMind databases.
The default value is true.</p> <em><strong>default:</strong></em> true</p>
<h2 id="enable-brotli">enable-brotli<a class="headerlink" href="#enable-brotli" title="Permanent link">&para;</a></h2> <h2 id="enable-brotli">enable-brotli<a class="headerlink" href="#enable-brotli" title="Permanent link">&para;</a></h2>
<p>Enables or disables compression of HTTP responses using the <a href="https://github.com/google/ngx_brotli">"brotli" module</a>. <p>Enables or disables compression of HTTP responses using the <a href="https://github.com/google/ngx_brotli">"brotli" module</a>.
The default mime type list to compress is: <code class="codehilite">application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component</code>. This is <em>disabled</em> by default.</p> The default mime type list to compress is: <code class="codehilite">application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component</code>. <em><strong>default:</strong></em> is disabled</p>
<p><em>Note:</em> Brotli does not works in Safari &lt; 11 https://caniuse.com/#feat=brotli</p> <blockquote>
<p><strong>Note:</strong> Brotli does not works in Safari &lt; 11. For more information see <a href="https://caniuse.com/#feat=brotli">https://caniuse.com/#feat=brotli</a></p>
</blockquote>
<h2 id="brotli-level">brotli-level<a class="headerlink" href="#brotli-level" title="Permanent link">&para;</a></h2> <h2 id="brotli-level">brotli-level<a class="headerlink" href="#brotli-level" title="Permanent link">&para;</a></h2>
<p>Sets the Brotli Compression Level that will be used. <em>Defaults to</em> 4.</p> <p>Sets the Brotli Compression Level that will be used. <em><strong>default:</strong></em> 4</p>
<h2 id="brotli-types">brotli-types<a class="headerlink" href="#brotli-types" title="Permanent link">&para;</a></h2> <h2 id="brotli-types">brotli-types<a class="headerlink" href="#brotli-types" title="Permanent link">&para;</a></h2>
<p>Sets the MIME Types that will be compressed on-the-fly by brotli. <p>Sets the MIME Types that will be compressed on-the-fly by brotli.
<em>Defaults to</em> <code class="codehilite">application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component</code>.</p> <em><strong>default:</strong></em> <code class="codehilite">application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component</code></p>
<h2 id="use-http2">use-http2<a class="headerlink" href="#use-http2" title="Permanent link">&para;</a></h2> <h2 id="use-http2">use-http2<a class="headerlink" href="#use-http2" title="Permanent link">&para;</a></h2>
<p>Enables or disables <a href="http://nginx.org/en/docs/http/ngx_http_v2_module.html">HTTP/2</a> support in secure connections.</p> <p>Enables or disables <a href="http://nginx.org/en/docs/http/ngx_http_v2_module.html">HTTP/2</a> support in secure connections.</p>
<h2 id="gzip-types">gzip-types<a class="headerlink" href="#gzip-types" title="Permanent link">&para;</a></h2> <h2 id="gzip-types">gzip-types<a class="headerlink" href="#gzip-types" title="Permanent link">&para;</a></h2>
@ -3424,7 +3440,7 @@ By default worker processes are not bound to any specific CPUs. The value can be
<li>auto: binding worker processes automatically to available CPUs.</li> <li>auto: binding worker processes automatically to available CPUs.</li>
</ul> </ul>
<h2 id="worker-shutdown-timeout">worker-shutdown-timeout<a class="headerlink" href="#worker-shutdown-timeout" title="Permanent link">&para;</a></h2> <h2 id="worker-shutdown-timeout">worker-shutdown-timeout<a class="headerlink" href="#worker-shutdown-timeout" title="Permanent link">&para;</a></h2>
<p>Sets a timeout for Nginx to <a href="http://nginx.org/en/docs/ngx_core_module.html#worker_shutdown_timeout">wait for worker to gracefully shutdown</a>. The default is "10s".</p> <p>Sets a timeout for Nginx to <a href="http://nginx.org/en/docs/ngx_core_module.html#worker_shutdown_timeout">wait for worker to gracefully shutdown</a>. <em><strong>default:</strong></em> "10s"</p>
<h2 id="load-balance">load-balance<a class="headerlink" href="#load-balance" title="Permanent link">&para;</a></h2> <h2 id="load-balance">load-balance<a class="headerlink" href="#load-balance" title="Permanent link">&para;</a></h2>
<p>Sets the algorithm to use for load balancing. <p>Sets the algorithm to use for load balancing.
The value can either be:</p> The value can either be:</p>
@ -3436,70 +3452,70 @@ The value can either be:</p>
</ul> </ul>
<p>The default is least_conn.</p> <p>The default is least_conn.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/load_balancing.html.</p> <a href="http://nginx.org/en/docs/http/load_balancing.html">http://nginx.org/en/docs/http/load_balancing.html</a></p>
<h2 id="variables-hash-bucket-size">variables-hash-bucket-size<a class="headerlink" href="#variables-hash-bucket-size" title="Permanent link">&para;</a></h2> <h2 id="variables-hash-bucket-size">variables-hash-bucket-size<a class="headerlink" href="#variables-hash-bucket-size" title="Permanent link">&para;</a></h2>
<p>Sets the bucket size for the variables hash table.</p> <p>Sets the bucket size for the variables hash table.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_map_module.html#variables_hash_bucket_size</p> <a href="http://nginx.org/en/docs/http/ngx_http_map_module.html#variables_hash_bucket_size">http://nginx.org/en/docs/http/ngx_http_map_module.html#variables_hash_bucket_size</a></p>
<h2 id="variables-hash-max-size">variables-hash-max-size<a class="headerlink" href="#variables-hash-max-size" title="Permanent link">&para;</a></h2> <h2 id="variables-hash-max-size">variables-hash-max-size<a class="headerlink" href="#variables-hash-max-size" title="Permanent link">&para;</a></h2>
<p>Sets the maximum size of the variables hash table.</p> <p>Sets the maximum size of the variables hash table.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_map_module.html#variables_hash_max_size</p> <a href="http://nginx.org/en/docs/http/ngx_http_map_module.html#variables_hash_max_size">http://nginx.org/en/docs/http/ngx_http_map_module.html#variables_hash_max_size</a></p>
<h2 id="upstream-keepalive-connections">upstream-keepalive-connections<a class="headerlink" href="#upstream-keepalive-connections" title="Permanent link">&para;</a></h2> <h2 id="upstream-keepalive-connections">upstream-keepalive-connections<a class="headerlink" href="#upstream-keepalive-connections" title="Permanent link">&para;</a></h2>
<p>Activates the cache for connections to upstream servers. The connections parameter sets the maximum number of idle keepalive connections to upstream servers that are preserved in the cache of each worker process. When this <p>Activates the cache for connections to upstream servers. The connections parameter sets the maximum number of idle keepalive connections to upstream servers that are preserved in the cache of each worker process. When this
number is exceeded, the least recently used connections are closed. Default: 32</p> number is exceeded, the least recently used connections are closed. <em><strong>default:</strong></em> 32</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive</p> <a href="http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive">http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive</a></p>
<h2 id="limit-conn-zone-variable">limit-conn-zone-variable<a class="headerlink" href="#limit-conn-zone-variable" title="Permanent link">&para;</a></h2> <h2 id="limit-conn-zone-variable">limit-conn-zone-variable<a class="headerlink" href="#limit-conn-zone-variable" title="Permanent link">&para;</a></h2>
<p>Sets parameters for a shared memory zone that will keep states for various keys of <a href="http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone">limit_conn_zone</a>. The default of "$binary_remote_addr" variable’s size is always 4 bytes for IPv4 addresses or 16 bytes for IPv6 addresses.</p> <p>Sets parameters for a shared memory zone that will keep states for various keys of <a href="http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone">limit_conn_zone</a>. The default of "$binary_remote_addr" variable’s size is always 4 bytes for IPv4 addresses or 16 bytes for IPv6 addresses.</p>
<h2 id="proxy-stream-timeout">proxy-stream-timeout<a class="headerlink" href="#proxy-stream-timeout" title="Permanent link">&para;</a></h2> <h2 id="proxy-stream-timeout">proxy-stream-timeout<a class="headerlink" href="#proxy-stream-timeout" title="Permanent link">&para;</a></h2>
<p>Sets the timeout between two successive read or write operations on client or proxied server connections. If no data is transmitted within this time, the connection is closed.</p> <p>Sets the timeout between two successive read or write operations on client or proxied server connections. If no data is transmitted within this time, the connection is closed.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_timeout</p> <a href="http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_timeout">http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_timeout</a></p>
<h2 id="proxy-stream-responses">proxy-stream-responses<a class="headerlink" href="#proxy-stream-responses" title="Permanent link">&para;</a></h2> <h2 id="proxy-stream-responses">proxy-stream-responses<a class="headerlink" href="#proxy-stream-responses" title="Permanent link">&para;</a></h2>
<p>Sets the number of datagrams expected from the proxied server in response to the client request if the UDP protocol is used.</p> <p>Sets the number of datagrams expected from the proxied server in response to the client request if the UDP protocol is used.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_responses</p> <a href="http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_responses">http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_responses</a></p>
<h2 id="bind-address-ipv4">bind-address-ipv4<a class="headerlink" href="#bind-address-ipv4" title="Permanent link">&para;</a></h2> <h2 id="bind-address-ipv4">bind-address-ipv4<a class="headerlink" href="#bind-address-ipv4" title="Permanent link">&para;</a></h2>
<p>Sets the addresses on which the server will accept requests instead of *. It should be noted that these addresses must exist in the runtime environment or the controller will crash loop.</p> <p>Sets the addresses on which the server will accept requests instead of *. It should be noted that these addresses must exist in the runtime environment or the controller will crash loop.</p>
<h2 id="bind-address-ipv6">bind-address-ipv6<a class="headerlink" href="#bind-address-ipv6" title="Permanent link">&para;</a></h2> <h2 id="bind-address-ipv6">bind-address-ipv6<a class="headerlink" href="#bind-address-ipv6" title="Permanent link">&para;</a></h2>
<p>Sets the addresses on which the server will accept requests instead of *. It should be noted that these addresses must exist in the runtime environment or the controller will crash loop.</p> <p>Sets the addresses on which the server will accept requests instead of *. It should be noted that these addresses must exist in the runtime environment or the controller will crash loop.</p>
<h2 id="forwarded-for-header">forwarded-for-header<a class="headerlink" href="#forwarded-for-header" title="Permanent link">&para;</a></h2> <h2 id="forwarded-for-header">forwarded-for-header<a class="headerlink" href="#forwarded-for-header" title="Permanent link">&para;</a></h2>
<p>Sets the header field for identifying the originating IP address of a client. Default is X-Forwarded-For</p> <p>Sets the header field for identifying the originating IP address of a client. <em><strong>default:</strong></em> X-Forwarded-For</p>
<h2 id="compute-full-forwarded-for">compute-full-forwarded-for<a class="headerlink" href="#compute-full-forwarded-for" title="Permanent link">&para;</a></h2> <h2 id="compute-full-forwarded-for">compute-full-forwarded-for<a class="headerlink" href="#compute-full-forwarded-for" title="Permanent link">&para;</a></h2>
<p>Append the remote address to the X-Forwarded-For header instead of replacing it. When this option is enabled, the upstream application is responsible for extracting the client IP based on its own list of trusted proxies.</p> <p>Append the remote address to the X-Forwarded-For header instead of replacing it. When this option is enabled, the upstream application is responsible for extracting the client IP based on its own list of trusted proxies.</p>
<h2 id="proxy-add-original-uri-header">proxy-add-original-uri-header<a class="headerlink" href="#proxy-add-original-uri-header" title="Permanent link">&para;</a></h2> <h2 id="proxy-add-original-uri-header">proxy-add-original-uri-header<a class="headerlink" href="#proxy-add-original-uri-header" title="Permanent link">&para;</a></h2>
<p>Adds an X-Original-Uri header with the original request URI to the backend request</p> <p>Adds an X-Original-Uri header with the original request URI to the backend request</p>
<h2 id="enable-opentracing">enable-opentracing<a class="headerlink" href="#enable-opentracing" title="Permanent link">&para;</a></h2> <h2 id="enable-opentracing">enable-opentracing<a class="headerlink" href="#enable-opentracing" title="Permanent link">&para;</a></h2>
<p>Enables the nginx Opentracing extension. By default this is disabled.</p> <p>Enables the nginx Opentracing extension. <em><strong>default:</strong></em> is disabled</p>
<p><em>References:</em> <p><em>References:</em>
- https://github.com/opentracing-contrib/nginx-opentracing</p> <a href="https://github.com/opentracing-contrib/nginx-opentracing">https://github.com/opentracing-contrib/nginx-opentracing</a></p>
<h2 id="zipkin-collector-host">zipkin-collector-host<a class="headerlink" href="#zipkin-collector-host" title="Permanent link">&para;</a></h2> <h2 id="zipkin-collector-host">zipkin-collector-host<a class="headerlink" href="#zipkin-collector-host" title="Permanent link">&para;</a></h2>
<p>Specifies the host to use when uploading traces. It must be a valid URL.</p> <p>Specifies the host to use when uploading traces. It must be a valid URL.</p>
<h2 id="zipkin-collector-port">zipkin-collector-port<a class="headerlink" href="#zipkin-collector-port" title="Permanent link">&para;</a></h2> <h2 id="zipkin-collector-port">zipkin-collector-port<a class="headerlink" href="#zipkin-collector-port" title="Permanent link">&para;</a></h2>
<p>Specifies the port to use when uploading traces. Default: 9411</p> <p>Specifies the port to use when uploading traces. <em><strong>default:</strong></em> 9411</p>
<h2 id="zipkin-service-name">zipkin-service-name<a class="headerlink" href="#zipkin-service-name" title="Permanent link">&para;</a></h2> <h2 id="zipkin-service-name">zipkin-service-name<a class="headerlink" href="#zipkin-service-name" title="Permanent link">&para;</a></h2>
<p>Specifies the service name to use for any traces created. Default: nginx</p> <p>Specifies the service name to use for any traces created. <em><strong>default:</strong></em> nginx</p>
<h2 id="jaeger-collector-host">jaeger-collector-host<a class="headerlink" href="#jaeger-collector-host" title="Permanent link">&para;</a></h2> <h2 id="jaeger-collector-host">jaeger-collector-host<a class="headerlink" href="#jaeger-collector-host" title="Permanent link">&para;</a></h2>
<p>Specifies the host to use when uploading traces. It must be a valid URL.</p> <p>Specifies the host to use when uploading traces. It must be a valid URL.</p>
<h2 id="jaeger-collector-port">jaeger-collector-port<a class="headerlink" href="#jaeger-collector-port" title="Permanent link">&para;</a></h2> <h2 id="jaeger-collector-port">jaeger-collector-port<a class="headerlink" href="#jaeger-collector-port" title="Permanent link">&para;</a></h2>
<p>Specifies the port to use when uploading traces. Default: 6831</p> <p>Specifies the port to use when uploading traces. <em><strong>default:</strong></em> 6831</p>
<h2 id="jaeger-service-name">jaeger-service-name<a class="headerlink" href="#jaeger-service-name" title="Permanent link">&para;</a></h2> <h2 id="jaeger-service-name">jaeger-service-name<a class="headerlink" href="#jaeger-service-name" title="Permanent link">&para;</a></h2>
<p>Specifies the service name to use for any traces created. Default: nginx</p> <p>Specifies the service name to use for any traces created. <em><strong>default:</strong></em> nginx</p>
<h2 id="jaeger-sampler-type">jaeger-sampler-type<a class="headerlink" href="#jaeger-sampler-type" title="Permanent link">&para;</a></h2> <h2 id="jaeger-sampler-type">jaeger-sampler-type<a class="headerlink" href="#jaeger-sampler-type" title="Permanent link">&para;</a></h2>
<p>Specifies the sampler to be used when sampling traces. The available samplers are: const, probabilistic, ratelimiting, remote. Default const.</p> <p>Specifies the sampler to be used when sampling traces. The available samplers are: const, probabilistic, ratelimiting, remote. <em><strong>default:</strong></em> const</p>
<h2 id="jaeger-sampler-param">jaeger-sampler-param<a class="headerlink" href="#jaeger-sampler-param" title="Permanent link">&para;</a></h2> <h2 id="jaeger-sampler-param">jaeger-sampler-param<a class="headerlink" href="#jaeger-sampler-param" title="Permanent link">&para;</a></h2>
<p>Specifies the argument to be passed to the sampler constructor. Must be a number. <p>Specifies the argument to be passed to the sampler constructor. Must be a number.
For const this should be 0 to never sample and 1 to always sample. Default: 1</p> For const this should be 0 to never sample and 1 to always sample. <em><strong>default:</strong></em> 1</p>
<h2 id="http-snippet">http-snippet<a class="headerlink" href="#http-snippet" title="Permanent link">&para;</a></h2> <h2 id="http-snippet">http-snippet<a class="headerlink" href="#http-snippet" title="Permanent link">&para;</a></h2>
<p>Adds custom configuration to the http section of the nginx configuration. <p>Adds custom configuration to the http section of the nginx configuration.
Default: ""</p> <em><strong>default:</strong></em> ""</p>
<h2 id="server-snippet">server-snippet<a class="headerlink" href="#server-snippet" title="Permanent link">&para;</a></h2> <h2 id="server-snippet">server-snippet<a class="headerlink" href="#server-snippet" title="Permanent link">&para;</a></h2>
<p>Adds custom configuration to all the servers in the nginx configuration. <p>Adds custom configuration to all the servers in the nginx configuration.
Default: ""</p> <em><strong>default:</strong></em> ""</p>
<h2 id="location-snippet">location-snippet<a class="headerlink" href="#location-snippet" title="Permanent link">&para;</a></h2> <h2 id="location-snippet">location-snippet<a class="headerlink" href="#location-snippet" title="Permanent link">&para;</a></h2>
<p>Adds custom configuration to all the locations in the nginx configuration. <p>Adds custom configuration to all the locations in the nginx configuration.
Default: ""</p> <em><strong>default:</strong></em> ""</p>
<h2 id="custom-http-errors">custom-http-errors<a class="headerlink" href="#custom-http-errors" title="Permanent link">&para;</a></h2> <h2 id="custom-http-errors">custom-http-errors<a class="headerlink" href="#custom-http-errors" title="Permanent link">&para;</a></h2>
<p>Enables which HTTP codes should be passed for processing with the <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#error_page">error_page directive</a></p> <p>Enables which HTTP codes should be passed for processing with the <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#error_page">error_page directive</a></p>
<p>Setting at least one code also enables <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_intercept_errors">proxy_intercept_errors</a> which are required to process error_page.</p> <p>Setting at least one code also enables <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_intercept_errors">proxy_intercept_errors</a> which are required to process error_page.</p>
@ -3524,43 +3540,45 @@ See NGINX <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#clien
<h2 id="proxy-next-upstream-tries">proxy-next-upstream-tries<a class="headerlink" href="#proxy-next-upstream-tries" title="Permanent link">&para;</a></h2> <h2 id="proxy-next-upstream-tries">proxy-next-upstream-tries<a class="headerlink" href="#proxy-next-upstream-tries" title="Permanent link">&para;</a></h2>
<p>Limit the number of <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream_tries">possible tries</a> a request should be passed to the next server.</p> <p>Limit the number of <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream_tries">possible tries</a> a request should be passed to the next server.</p>
<h2 id="proxy-redirect-from">proxy-redirect-from<a class="headerlink" href="#proxy-redirect-from" title="Permanent link">&para;</a></h2> <h2 id="proxy-redirect-from">proxy-redirect-from<a class="headerlink" href="#proxy-redirect-from" title="Permanent link">&para;</a></h2>
<p>Sets the original text that should be changed in the "Location" and "Refresh" header fields of a proxied server response. Default: off.</p> <p>Sets the original text that should be changed in the "Location" and "Refresh" header fields of a proxied server response. <em><strong>default:</strong></em> off</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_redirect</p> <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_redirect">http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_redirect</a></p>
<h2 id="proxy-request-buffering">proxy-request-buffering<a class="headerlink" href="#proxy-request-buffering" title="Permanent link">&para;</a></h2> <h2 id="proxy-request-buffering">proxy-request-buffering<a class="headerlink" href="#proxy-request-buffering" title="Permanent link">&para;</a></h2>
<p>Enables or disables <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_request_buffering">buffering of a client request body</a>.</p> <p>Enables or disables <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_request_buffering">buffering of a client request body</a>.</p>
<h2 id="ssl-redirect">ssl-redirect<a class="headerlink" href="#ssl-redirect" title="Permanent link">&para;</a></h2> <h2 id="ssl-redirect">ssl-redirect<a class="headerlink" href="#ssl-redirect" title="Permanent link">&para;</a></h2>
<p>Sets the global value of redirects (301) to HTTPS if the server has a TLS certificate (defined in an Ingress rule). <p>Sets the global value of redirects (301) to HTTPS if the server has a TLS certificate (defined in an Ingress rule).
Default is "true".</p> <em><strong>default:</strong></em> "true"</p>
<h2 id="whitelist-source-range">whitelist-source-range<a class="headerlink" href="#whitelist-source-range" title="Permanent link">&para;</a></h2> <h2 id="whitelist-source-range">whitelist-source-range<a class="headerlink" href="#whitelist-source-range" title="Permanent link">&para;</a></h2>
<p>Sets the default whitelisted IPs for each <code class="codehilite">server</code> block. This can be overwritten by an annotation on an Ingress rule. <p>Sets the default whitelisted IPs for each <code class="codehilite">server</code> block. This can be overwritten by an annotation on an Ingress rule.
See <a href="http://nginx.org/en/docs/http/ngx_http_access_module.html">ngx_http_access_module</a>.</p> See <a href="http://nginx.org/en/docs/http/ngx_http_access_module.html">ngx_http_access_module</a>.</p>
<h2 id="skip-access-log-urls">skip-access-log-urls<a class="headerlink" href="#skip-access-log-urls" title="Permanent link">&para;</a></h2> <h2 id="skip-access-log-urls">skip-access-log-urls<a class="headerlink" href="#skip-access-log-urls" title="Permanent link">&para;</a></h2>
<p>Sets a list of URLs that should not appear in the NGINX access log. This is useful with urls like <code class="codehilite">/health</code> or <code class="codehilite">health-check</code> that make "complex" reading the logs. By default this list is empty</p> <p>Sets a list of URLs that should not appear in the NGINX access log. This is useful with urls like <code class="codehilite">/health</code> or <code class="codehilite">health-check</code> that make "complex" reading the logs. <em><strong>default:</strong></em> is empty</p>
<h2 id="limit-rate">limit-rate<a class="headerlink" href="#limit-rate" title="Permanent link">&para;</a></h2> <h2 id="limit-rate">limit-rate<a class="headerlink" href="#limit-rate" title="Permanent link">&para;</a></h2>
<p>Limits the rate of response transmission to a client. The rate is specified in bytes per second. The zero value disables rate limiting. The limit is set per a request, and so if a client simultaneously opens two connections, the overall rate will be twice as much as the specified limit.</p> <p>Limits the rate of response transmission to a client. The rate is specified in bytes per second. The zero value disables rate limiting. The limit is set per a request, and so if a client simultaneously opens two connections, the overall rate will be twice as much as the specified limit.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_core_module.html#limit_rate</p> <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#limit_rate">http://nginx.org/en/docs/http/ngx_http_core_module.html#limit_rate</a></p>
<h2 id="limit-rate-after">limit-rate-after<a class="headerlink" href="#limit-rate-after" title="Permanent link">&para;</a></h2> <h2 id="limit-rate-after">limit-rate-after<a class="headerlink" href="#limit-rate-after" title="Permanent link">&para;</a></h2>
<p>Sets the initial amount after which the further transmission of a response to a client will be rate limited.</p> <p>Sets the initial amount after which the further transmission of a response to a client will be rate limited.</p>
<p><em>References:</em> <p><em>References:</em>
- http://nginx.org/en/docs/http/ngx_http_core_module.html#limit_rate_after</p> <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#limit_rate_after">http://nginx.org/en/docs/http/ngx_http_core_module.html#limit_rate_after</a></p>
<h2 id="http-redirect-code">http-redirect-code<a class="headerlink" href="#http-redirect-code" title="Permanent link">&para;</a></h2> <h2 id="http-redirect-code">http-redirect-code<a class="headerlink" href="#http-redirect-code" title="Permanent link">&para;</a></h2>
<p>Sets the HTTP status code to be used in redirects. <p>Sets the HTTP status code to be used in redirects.
Supported codes are <a href="https://developer.mozilla.org/es/docs/Web/HTTP/Status/301">301</a>,<a href="https://developer.mozilla.org/es/docs/Web/HTTP/Status/302">302</a>,<a href="https://developer.mozilla.org/es/docs/Web/HTTP/Status/307">307</a> and <a href="https://developer.mozilla.org/es/docs/Web/HTTP/Status/308">308</a> Supported codes are <a href="https://developer.mozilla.org/es/docs/Web/HTTP/Status/301">301</a>,<a href="https://developer.mozilla.org/es/docs/Web/HTTP/Status/302">302</a>,<a href="https://developer.mozilla.org/es/docs/Web/HTTP/Status/307">307</a> and <a href="https://developer.mozilla.org/es/docs/Web/HTTP/Status/308">308</a>
Default code is 308.</p> <em><strong>default:</strong></em> 308</p>
<p>Why the default code is 308?</p> <blockquote>
<p><strong>Why the default code is 308?</strong></p>
<p><a href="https://tools.ietf.org/html/rfc7238">RFC 7238</a> was created to define the 308 (Permanent Redirect) status code that is similar to 301 (Moved Permanently) but it keeps the payload in the redirect. This is important if the we send a redirect in methods like POST.</p> <p><a href="https://tools.ietf.org/html/rfc7238">RFC 7238</a> was created to define the 308 (Permanent Redirect) status code that is similar to 301 (Moved Permanently) but it keeps the payload in the redirect. This is important if the we send a redirect in methods like POST.</p>
</blockquote>
<h2 id="proxy-buffering">proxy-buffering<a class="headerlink" href="#proxy-buffering" title="Permanent link">&para;</a></h2> <h2 id="proxy-buffering">proxy-buffering<a class="headerlink" href="#proxy-buffering" title="Permanent link">&para;</a></h2>
<p>Enables or disables <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering">buffering of responses from the proxied server</a>.</p> <p>Enables or disables <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering">buffering of responses from the proxied server</a>.</p>
<h2 id="limit-req-status-code">limit-req-status-code<a class="headerlink" href="#limit-req-status-code" title="Permanent link">&para;</a></h2> <h2 id="limit-req-status-code">limit-req-status-code<a class="headerlink" href="#limit-req-status-code" title="Permanent link">&para;</a></h2>
<p>Sets the <a href="http://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_status">status code to return in response to rejected requests</a>.Default: 503</p> <p>Sets the <a href="http://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_status">status code to return in response to rejected requests</a>. <em><strong>default:</strong></em> 503</p>
<h2 id="no-tls-redirect-locations">no-tls-redirect-locations<a class="headerlink" href="#no-tls-redirect-locations" title="Permanent link">&para;</a></h2> <h2 id="no-tls-redirect-locations">no-tls-redirect-locations<a class="headerlink" href="#no-tls-redirect-locations" title="Permanent link">&para;</a></h2>
<p>A comma-separated list of locations on which http requests will never get redirected to their https counterpart. <p>A comma-separated list of locations on which http requests will never get redirected to their https counterpart.
Default: "/.well-known/acme-challenge"</p> <em><strong>default:</strong></em> "/.well-known/acme-challenge"</p>
<h2 id="no-auth-locations">no-auth-locations<a class="headerlink" href="#no-auth-locations" title="Permanent link">&para;</a></h2> <h2 id="no-auth-locations">no-auth-locations<a class="headerlink" href="#no-auth-locations" title="Permanent link">&para;</a></h2>
<p>A comma-separated list of locations that should not get authenticated. <p>A comma-separated list of locations that should not get authenticated.
Default: "/.well-known/acme-challenge"</p> <em><strong>default:</strong></em> "/.well-known/acme-challenge"</p>

8
user-guide/third-party-addons/modsecurity/index.html
View file

@ -1021,14 +1021,16 @@
<h1 id="modsecurity-web-application-firewall">ModSecurity Web Application Firewall<a class="headerlink" href="#modsecurity-web-application-firewall" title="Permanent link">&para;</a></h1> <h1 id="modsecurity-web-application-firewall">ModSecurity Web Application Firewall<a class="headerlink" href="#modsecurity-web-application-firewall" title="Permanent link">&para;</a></h1>
<p>ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis - https://www.modsecurity.org</p> <p>ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis - <a href="https://www.modsecurity.org">https://www.modsecurity.org</a></p>
<p>The <a href="https://github.com/SpiderLabs/ModSecurity-nginx">ModSecurity-nginx</a> connector is the connection point between NGINX and libmodsecurity (ModSecurity v3).</p> <p>The <a href="https://github.com/SpiderLabs/ModSecurity-nginx">ModSecurity-nginx</a> connector is the connection point between NGINX and libmodsecurity (ModSecurity v3).</p>
<p>The default ModSecurity configuration file is located in <code class="codehilite">/etc/nginx/modsecurity/modsecurity.conf</code>. This is the only file located in this directory and contains the default recommended configuration. Using a volume we can replace this file with the desired configuration. <p>The default ModSecurity configuration file is located in <code class="codehilite">/etc/nginx/modsecurity/modsecurity.conf</code>. This is the only file located in this directory and contains the default recommended configuration. Using a volume we can replace this file with the desired configuration.
To enable the ModSecurity feature we need to specify <code class="codehilite">enable-modsecurity: &quot;true&quot;</code> in the configuration configmap.</p> To enable the ModSecurity feature we need to specify <code class="codehilite">enable-modsecurity: &quot;true&quot;</code> in the configuration configmap.</p>
<p><strong>NOTE:</strong> the default configuration use detection only, because that minimises the chances of post-installation disruption. <blockquote>
<p><strong>Note:</strong> the default configuration use detection only, because that minimises the chances of post-installation disruption.
The file <code class="codehilite">/var/log/modsec_audit.log</code> contains the log of ModSecurity.</p> The file <code class="codehilite">/var/log/modsec_audit.log</code> contains the log of ModSecurity.</p>
</blockquote>
<p>The OWASP ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts. <p>The OWASP ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts.
The directory <code class="codehilite">/etc/nginx/owasp-modsecurity-crs</code> contains the https://github.com/SpiderLabs/owasp-modsecurity-crs repository. The directory <code class="codehilite">/etc/nginx/owasp-modsecurity-crs</code> contains the <a href="https://github.com/SpiderLabs/owasp-modsecurity-crs repository">https://github.com/SpiderLabs/owasp-modsecurity-crs repository</a>.
Using <code class="codehilite">enable-owasp-modsecurity-crs: &quot;true&quot;</code> we enable the use of the rules.</p> Using <code class="codehilite">enable-owasp-modsecurity-crs: &quot;true&quot;</code> we enable the use of the rules.</p>

2
user-guide/third-party-addons/opentracing/index.html
View file

@ -1054,7 +1054,7 @@ kubectl create -f https://raw.githubusercontent.com/rnburn/zipkin-date-server/ma
<p>In the zipkin interface we can see the details:</p> <p>In the zipkin interface we can see the details:</p>
<p><img alt="zipkin screenshot" src="../../images/zipkin-demo.png" title="zipkin collector screenshot" /></p> <p><img alt="zipkin screenshot" src="../../../images/zipkin-demo.png" title="zipkin collector screenshot" /></p>