DevFW-CICD/ingress-nginx-helm
12
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
5969 commits 4 branches 217 tags 166 MiB
Commit graph

923 commits

Author SHA1 Message Date
Manuel Alejandro de Brito Fontes
fbdd924a45 Update nginx image 2020-01-04 13:23:16 -03:00
Manuel Alejandro de Brito Fontes
965ecd4b15
Default backend protocol only supports http (#4870) 2020-01-04 11:09:00 -03:00
Manuel Alejandro de Brito Fontes
41a3e04163 Update auto-generated code year to 2020 2020-01-02 16:58:36 -03:00
Manuel Alejandro de Brito Fontes
f0f9618a89
Fix ingress status regression introduced in #4490 (#4871) 2019-12-30 20:46:20 -03:00
Manuel Alejandro de Brito Fontes
a0523c3c8a
Use a named location for authSignURL (#4859) 2019-12-24 22:50:25 -03:00
Manuel Alejandro de Brito Fontes
facf841992
Return specific type (#4840) 2019-12-17 12:06:17 -03:00
Manuel Alejandro de Brito Fontes
5c30820d1f Remove hard-coded annotation and don't use map pointers 2019-12-13 03:05:20 -03:00
Manuel Alejandro de Brito Fontes
0dce5be743 Migrate ingress definitions from extensions to networking.k8s.io 2019-12-12 21:25:00 -03:00
Kubernetes Prow Robot
be1907142b
Merge pull request #4823 from aledbf/go-modules 
Update go dependencies to v1.17.0
 2019-12-12 11:40:32 -08:00
Manuel Alejandro de Brito Fontes
fe2ae8a1ec Check the configmap is valid 2019-12-10 22:45:02 -03:00
Kubernetes Prow Robot
d5e197c3e2
Merge pull request #4816 from kdomanski/fix-ssl-redirect 
apply default certificate again in cases of invalid or incomplete cert config
 2019-12-10 17:40:05 -08:00
Kamil Domański
5c8522cdab apply default certificate again in cases of invalid or incomplete cert config 
Signed-off-by: Kamil Domański <kamil@domanski.co>
 2019-12-06 12:15:52 +01:00
Manuel Alejandro de Brito Fontes
cfccc2acc0 Update default SSL ciphers 2019-12-05 19:34:53 -03:00
Manuel Alejandro de Brito Fontes
19d596b72b
Allow custom CA certificate when flag --api-server is specified (#4807) 2019-12-05 19:12:54 -03:00
Kubernetes Prow Robot
a85d5ed93a
Merge pull request #4779 from aledbf/update-image 
Remove lua-resty-waf feature
 2019-11-27 11:45:05 -08:00
Kubernetes Prow Robot
b286c2a336
Merge pull request #4732 from willthames/enable-opentracing-annotation 
Allow enabling/disabling opentracing for ingresses
 2019-11-26 17:31:21 -08:00
Will Thames
6927d9351a Improve safety of AWS-based builds 
Ensure that AWS and Docker credentials don't get
accidentally added
 2019-11-27 11:07:26 +10:00
Will Thames
0ae463a5f3 Provide annotation to control opentracing 
By default you might want opentracing off, but on for a particular
ingress.

Similarly, you might want opentracing globally on, but disabled for
a specific endpoint. To achieve this, `opentracing_propagate_context`
cannot be set when combined with `opentracing off`

A new annotation, `enable-opentracing` allows more fine grained control
of opentracing for specific ingresses.
 2019-11-27 11:07:26 +10:00
Kubernetes Prow Robot
95edf02f91
Merge pull request #4700 from TronWallet/fix/nodeport_externalips 
adds hability to use externalIP when controller service is of type NodePort
 2019-11-26 15:33:20 -08:00
Manuel Alejandro de Brito Fontes
61d902db14 Remove Lua resty waf feature 2019-11-26 10:37:43 -03:00
Kubernetes Prow Robot
62518b60b4
Merge pull request #4689 from janosi/upstream_ssl 
Server-only authentication of backends and per-location SSL config
 2019-11-18 19:49:43 -08:00
Kubernetes Prow Robot
0d244e1c41
Merge pull request #4730 from stamm/master 
add configuration for http2_max_concurrent_streams
 2019-11-08 07:12:29 -08:00
Kubernetes Prow Robot
a0dc3a9a51
Merge pull request #4695 from janosi/secure-verify-ca-secret 
Removing secure-verify-ca-secret support
 2019-11-08 07:12:21 -08:00
Kubernetes Prow Robot
f808f955ee
Merge pull request #4664 from bryanhanner/master 
warn when ConfigMap is missing or not parsable instead of erroring
 2019-11-08 07:12:14 -08:00
Rustam Zagirov
d9cfad1894 add configuration for http2_max_concurrent_streams 2019-10-31 15:13:38 +03:00
Laszlo Janosi
cc84bd4ab6 Server level proxy_ssl parameters are applied again, following the comments received. 
Also writing tls.crt and tls.key to disk is according to the original code.
 2019-10-26 20:20:18 +02:00
Vinicius Niche Correa
b14a6944a7 adds hability to use externalIP 2019-10-21 01:23:27 -03:00
Laszlo Janosi
c76995b81b Fixing comments 2019-10-18 11:36:00 +02:00
Laszlo Janosi
31227d61c2 Removing secure-verify-ca-secret support and writing an error log if that annotation is used in an Ingress definition 2019-10-18 10:58:57 +02:00
Peter Pan
6aa48def3a add remote_addr in layer 4 access log 
original:
[18/Oct/2019:00:47:53 +0000]  TCP 200 4333 81 0.002
new:
[10.6.124.202]  [18/Oct/2019:01:05:15 +0000]  TCP 200 4333  81 0.002
 2019-10-18 09:21:01 +08:00
Laszlo Janosi
37fe9c9876 Enabling per-location proxy-ssl parameters, so locations of the same server but with own unique Ingress definitions can have different SSL configs 2019-10-17 10:15:53 +02:00
Thomas Jackson
500b043f27 Don't use DNS resolution to "validate FQDN" 
As the controller stands today this "validation" is done once per config load, which means if the DNS query fails for any reason the endpoint will remain dead until both (1) a change happens to the ingress and (2) the DNS resolution works. If the user configured the name we should just pass it through, this way the lua dns can attempt to re-query it at its leisure.
 2019-10-13 13:16:47 -07:00
Arthur Axel 'fREW' Schmidt
ea8f7ea8b7 Simplify initialization function of bytes.Buffer 2019-10-12 08:36:54 -07:00
Bryan Hanner
9957d30048 warn when ConfigMap is missing or unparsable instead of erroring 2019-10-11 17:15:38 -07:00
Kubernetes Prow Robot
fb025ab501
Merge pull request #4087 from MRoci/master 
Define Modsecurity Snippet via ConfigMap
 2019-09-30 15:19:32 -07:00
Andrea Spacca
203a3ed455 ISSUE-4244 comply with --health-check-path (#4619) 2019-09-29 14:37:57 -03:00
Manuel Alejandro de Brito Fontes
d5d2b4037c
Fix ports collision when hostNetwork=true (#4617) 2019-09-28 17:30:57 -03:00
MRoci
72c4ffa8b5
add modsecurity-snippet key 2019-09-28 09:54:07 +02:00
Manuel Alejandro de Brito Fontes
6715108d8a
Release 0.26.0 2019-09-27 10:23:12 -03:00
Manuel Alejandro de Brito Fontes
a9f332704a
Fix custom default backend switch to default (#4611) 2019-09-27 10:21:28 -03:00
Manuel Alejandro de Brito Fontes
2bd8121338
Change default for proxy-add-original-uri-header 2019-09-25 10:57:31 -03:00
Elvin Efendi
d8a3d616b4 fix bug with new and running configuration comparison 2019-09-25 06:33:59 -04:00
Elvin Efendi
c5a8357f1d handle hsts header injection in lua 2019-09-24 21:17:22 -04:00
Kubernetes Prow Robot
14f9b0d64e
Merge pull request #4596 from Shopify/fix-auth-proxy-header-order 
sort auth proxy headers from configmap
 2019-09-24 13:29:26 -07:00
Elvin Efendi
d124dd5eee sort auth proxy headers from configmap 2019-09-24 15:19:49 -04:00
Elvin Efendi
8c64b12a96 refactor force ssl redirect logic 2019-09-24 14:57:52 -04:00
Elvin Efendi
e392c8a8af cleanup unused certificates 2019-09-24 14:16:03 -04:00
A Gardner
786a3b6862 Add support for configmap of headers to be sent to external auth service 2019-09-24 10:53:23 -04:00
Kubernetes Prow Robot
cb2889b87b
Merge pull request #4586 from aledbf/fix-reload 
Fix reload when a configmap changes
 2019-09-24 07:23:28 -07:00
Manuel Alejandro de Brito Fontes
a40a4b0325
Fix reload when a configmap changes 2019-09-24 10:55:59 -03:00
Kubernetes Prow Robot
f6c2f5fb97
Merge pull request #4514 from alexmaret/4475-stickyness-mode 
Added new affinity mode for maximum session stickyness.
 2019-09-24 05:09:27 -07:00
Manuel Alejandro de Brito Fontes
1b8f6518cf
Avoid unnecessary reloads generating lua_shared_dict directives 2019-09-22 21:16:00 -03:00
Manuel Alejandro de Brito Fontes
624ce0857a
Remove retries to ExternalName (#4584) 2019-09-22 18:16:25 -03:00
Manuel Alejandro de Brito Fontes
e888fcff7b
Update runc cgroup mount api 2019-09-19 11:01:31 -03:00
Manuel Alejandro de Brito Fontes
4b4176c830
Fix log format after #4557 2019-09-18 12:52:09 -03:00
Manuel Alejandro de Brito Fontes
9f092a2c81
Increase log level for identical CreationTimestamp warning 2019-09-18 11:59:03 -03:00
Kubernetes Prow Robot
87ad033483
Merge pull request #4569 from mkabischev/jaeger-header-configuration 
allow to configure jaeger header names
 2019-09-17 20:29:29 -07:00
Mike Kabischev
d5563a7e47 allow to configure jaeger header names 2019-09-17 12:35:53 +03:00
Kubernetes Prow Robot
846ff00363
Merge pull request #4560 from Shopify/basic-auth-map 
Support configuring basic auth credentials as a map of user/password hashes
 2019-09-16 07:52:39 -07:00
Kubernetes Prow Robot
2d8f8128b6
Merge pull request #4557 from aledbf/remove-realipvar 
Remove the_real_ip variable
 2019-09-16 07:30:39 -07:00
A Gardner
376b862c23 Add annotation to support map of user/pass pairs in basic auth 2019-09-13 11:33:33 -04:00
Manuel Alejandro de Brito Fontes
55820ef1e8
Allow multiple CA Certificates (#4556) 2019-09-13 09:22:24 -03:00
Manuel Alejandro de Brito Fontes
9af574a234
Remove the_real_ip variable 2019-09-12 20:01:33 -03:00
Manuel Alejandro de Brito Fontes
ce3e3d51c3
WIP Remove nginx unix sockets (#4531) 
* Remove nginx unix sockets
* Use an emptyDir volume for /tmp in PSP e2e tests
 2019-09-08 18:14:54 -03:00
Kubernetes Prow Robot
76e2a5d731
Merge pull request #4506 from ProNic-QY/master 
Fix panic on multiple ingress mess up upstream is primary or not
 2019-09-07 12:15:18 -07:00
Ricardo Katz
9c51676f17 Add support to CRL (#3164) 
Signed-off-by: Ricardo Pchevuzinske Katz <ricardo.katz@serpro.gov.br>

Add support to CRL

Signed-off-by: Ricardo Pchevuzinske Katz <ricardo.katz@serpro.gov.br>
 2019-09-03 16:47:28 -04:00
zhangty
3dc8211c46 backward compatibility for k8s version < 1.14 2019-09-02 17:05:52 +08:00
Manuel Alejandro de Brito Fontes
c2935ca35c
Refactor health checks and wait until NGINX process ends 2019-09-01 15:31:27 -04:00
Manuel Alejandro de Brito Fontes
c7d2444cf4
Fix nginx variable service_port (nginx) (#4500) 2019-08-31 11:24:01 -04:00
Manuel Alejandro de Brito Fontes
72cb7f5e14
Move nginx helper (#4501) 2019-08-30 20:18:11 -04:00
Alexander Maret-Huskinson
880b3dc5f1 Fixed test findings. 2019-08-30 19:08:03 +02:00
Alexander Maret-Huskinson
9170591185 Added new affinity mode for maximum session stickyness. Fixes kubernetes/ingress-nginx#4475 2019-08-30 11:40:29 +02:00
qianyong
435377f47f Fix panic on multiple ingress mess up upstream is primary or not 2019-08-30 07:32:02 +08:00
Manuel Alejandro de Brito Fontes
8def5ef7ca
Add support for multiple alias and remove duplication of SSL certificates (#4472) 2019-08-26 10:58:44 -04:00
Manuel Alejandro de Brito Fontes
4847bb02f0
Refactor ingress status IP address (#4490) 2019-08-25 12:27:34 -04:00
Manuel Alejandro de Brito Fontes
fcd3054f13
Lint code using staticcheck (#4471) 2019-08-23 12:08:40 -04:00
Kubernetes Prow Robot
82b241c517
Merge pull request #4476 from antoineco/bug/nil-err-channel 
Initialize nginx process error channel
 2019-08-22 09:46:33 -07:00
Antoine Cotten
d1feb65ff9
Initialize nginx process error channel 
goroutines that write to ngxErrCh remain asleep forever without that
necessary initialization.
 2019-08-22 16:25:47 +02:00
Kubernetes Prow Robot
6697203891
Merge pull request #4409 from ProNic-QY/master 
sort ingress by namespace and name when ingress.CreationTimestamp identical
 2019-08-18 17:30:03 -07:00
Kubernetes Prow Robot
75d65bbd15
Merge pull request #4327 from leki75/proxyssl 
Add proxy_ssl_* directives
 2019-08-18 09:14:04 -07:00
qianyong
70614f4622 sort ingress by namespace and name when ingress.CreationTimestamp identical 2019-08-18 23:11:15 +08:00
Kubernetes Prow Robot
839076e3b0
Merge pull request #4456 from aledbf/psp-mount 
Fix file permissions to support volumes
 2019-08-16 06:24:32 -07:00
Gabor Lekeny
4624b5bc77 Change PemSHA to CASHA 2019-08-16 06:31:15 +02:00
Gabor Lekeny
65b9e2c574 Merge branch 'master' of https://github.com/kubernetes/ingress-nginx into proxyssl 2019-08-16 06:21:53 +02:00
Manuel Alejandro de Brito Fontes
23ed3ba4c4
Fix file permissions to support volumes 2019-08-15 20:48:37 -04:00
Kubernetes Prow Robot
4b0aabc0c3
Merge pull request #4451 from ElvinEfendi/avoid-redundant-lua-sync 
post data to Lua only if it changes
 2019-08-15 16:20:34 -07:00
Elvin Efendi
05c889335d post data to Lua only if it changes 2019-08-15 17:21:34 -04:00
Manuel Alejandro de Brito Fontes
9543aacc76
Fix test description on error 2019-08-15 16:56:20 -04:00
Kubernetes Prow Robot
f4da014907
Merge pull request #4449 from aledbf/fix-en 
Fix service type external name using the name
 2019-08-15 13:08:35 -07:00
Kubernetes Prow Robot
b5fecd0dc8
Merge pull request #4450 from Shopify/proxy-max-temp-file-size 
Add nginx proxy_max_temp_file_size configuration option
 2019-08-15 12:40:33 -07:00
Maxime Ginters
d8bd8c5619 Add nginx proxy_max_temp_file_size configuration option 2019-08-15 13:47:42 -04:00
Elvin Efendi
0b619dc772 make luaSharedDicts test less dependent on default values 2019-08-15 13:13:43 -04:00
Elvin Efendi
30b64df10a ewma improvements 2019-08-15 13:13:43 -04:00
Kubernetes Prow Robot
0b375989f3
Merge pull request #4412 from Shopify/ssl-early-data 
Add nginx ssl_early_data option support
 2019-08-15 10:08:35 -07:00
Manuel Alejandro de Brito Fontes
816f4b0824
Fix service type external name using the name 2019-08-15 12:09:42 -04:00
Elvin Efendi
94052b1bfc fix test by setting default luashareddicts 2019-08-14 22:10:56 -04:00
Elvin Efendi
6a293c7e11 set /configuration client body size dynamically 2019-08-14 22:10:56 -04:00
Elvin Efendi
b21c721196 lua-shared-dicts improvements, fixes and documentation 2019-08-14 22:10:56 -04:00
Kubernetes Prow Robot
0d690fba1a
Merge pull request #4356 from aledbf/only-dynamic-mode 
Only support SSL dynamic mode
 2019-08-14 17:08:35 -07:00
Kubernetes Prow Robot
adef152db8
Merge pull request #4379 from diazjf/mirror 
Allow Requests to be Mirrored to different backends
 2019-08-13 17:52:24 -07:00
Elvin Efendi
d46b4148fa Lua /etc/resolv.conf parser and some refactoring 2019-08-13 18:34:54 -04:00
Manuel Alejandro de Brito Fontes
80bd481abb
Only support SSL dynamic mode 2019-08-13 17:33:34 -04:00
Manuel Alejandro de Brito Fontes
2ed75b3362
Move listen logic to go 2019-08-13 14:52:25 -04:00
Manuel Alejandro de Brito Fontes
016219d394
Refactor version helper (#4437) 2019-08-13 13:46:16 -04:00
Kubernetes Prow Robot
1926340a7b
Merge pull request #4423 from Nuglif/quote 
Add quote function in template
 2019-08-09 20:55:13 -07:00
Pierrick Charron
f459515d0d Add quote function in template 
Co-authored-by: Charle Demers <charle.demers@gmail.com>
 2019-08-09 15:47:29 -04:00
Manuel Alejandro de Brito Fontes
a768b6066e
Ignore kubernetes objects in hash calculation 2019-08-09 08:44:46 -04:00
Manuel Alejandro de Brito Fontes
40533ad989
Code linting 2019-08-09 08:44:14 -04:00
Manuel Alejandro de Brito Fontes
4a9b02bc03
Remove dynamic TLS records 2019-08-08 15:52:56 -04:00
Kubernetes Prow Robot
f4678764f5
Merge pull request #4416 from aledbf/diff 
Remove invalid log "Failed to executing diff command: exit status 1"
 2019-08-08 11:31:20 -07:00
Manuel Alejandro de Brito Fontes
171da635ef
Remove invalid log "Failed to executing diff command: exit status 1" 2019-08-08 12:53:23 -04:00
tals
a2e667c082 lua shared dict from cm 
lua shared dict teml test and update func sign

lua shared dict cm test

lua shared dict integration test

lua shared dict add cm parsing

lua shared dict change test header
 2019-08-08 12:44:11 +03:00
Maxime Ginters
7219130da4 Add nginx ssl_early_data option support 2019-08-07 16:04:09 -04:00
Fernando Diaz
386486e969 Allow Requests to be Mirrored to different backends 
Add a feature which allows traffic to be mirrored to
additional backends. This is useful for testing how
requests will behave on different "test" backends.

See https://nginx.org/en/docs/http/ngx_http_mirror_module.html
 2019-08-01 11:53:58 -05:00
Kubernetes Prow Robot
c8a3710fb8
Merge pull request #4344 from Nuglif/fastcgi-backend-support 
Add FastCGI backend support (#2982)
 2019-07-31 11:20:14 -07:00
Charle Demers
72271e9313
FastCGI backend support (#2982) 
Co-authored-by: Pierrick Charron <pierrick@adoy.net>
 2019-07-31 10:39:21 -04:00
Pierrick Charron
29788452b6 Fix broken test's filename 2019-07-26 18:15:25 -04:00
Manuel Alejandro de Brito Fontes
2f124e4b76
Refactor http client for unix sockets 2019-07-19 11:07:51 -04:00
Gabor Lekeny
def13fc06c Add proxy_ssl_* directives 
Add support for backends which require client certificate (eg. NiFi)
authentication. The `proxy-ssl-secret` k8s annotation references a
secret which is used to authenticate to the backend server. All other
directives fine tune the backend communication.

The following annotations are supported:
* proxy-ssl-secret
* proxy-ssl-ciphers
* proxy-ssl-protocol
* proxy-ssl-verify
* proxy-ssl-verify-depth
 2019-07-18 03:21:52 +02:00
Kubernetes Prow Robot
589c9a20f9
Merge pull request #4278 from moolen/feat/auth-req-cache 
feat: auth-req caching
 2019-07-17 12:06:12 -07:00
Moritz Johner
23504db770 feat: auth-req caching 
add a way to configure the `proxy_cache_*` [1] directive for external-auth.
The user-defined cache_key may contain sensitive information
(e.g. Authorization header).
We want to store *only* a hash of that key, not the key itself on disk.

[1] http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_key

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
 2019-07-17 18:39:04 +02:00
Manuel Alejandro de Brito Fontes
d5c7fa8cfb
Fix scripts to be able to run tests in docker 2019-07-17 11:06:53 -04:00
Kubernetes Prow Robot
fe6c086580
Merge pull request #4288 from eshicks4/proxy-http-version-annotation 
added proxy-http-version annotation to override the HTTP/1.1 default …
 2019-07-11 11:43:07 -07:00
Manuel Alejandro de Brito Fontes
295c1276d9
Remove unnecessary output 2019-07-10 13:39:55 -04:00
Manuel Alejandro de Brito Fontes
3d7a09347d
Apply fixes suggested by staticcheck 2019-07-08 16:18:52 -04:00
E. Stuart Hicks
3b0c523e49 added proxy-http-version annotation to override the HTTP/1.1 default connection type to reverse proxy backends 2019-07-08 14:32:00 -04:00
Kubernetes Prow Robot
7c297e001a
Merge pull request #4246 from ElvinEfendi/proxy-alternative-upstream-name 
introduce proxy_alternative_upstream_name Nginx var
 2019-07-04 19:20:35 -07:00
Elvin Efendi
8b208cac93 introduce proxy_alternative_upstream_name Nginx var to differentiate canary requests 2019-07-04 19:43:20 -04:00
Manuel Alejandro de Brito Fontes
8807db9748
Check and complete intermediate SSL certificates 2019-07-04 19:13:21 -04:00
Manuel Alejandro de Brito Fontes
004d0c8214
Fix go imports 2019-06-30 18:58:18 -04:00
Manuel Alejandro de Brito Fontes
ccd88f625c
Refactor metric prometheus leader helper 2019-06-29 17:44:53 -04:00
Manuel Alejandro de Brito Fontes
ddffa2a173
Enable arm again 2019-06-26 23:00:58 -04:00
Kubernetes Prow Robot
ecce3fd7b1
Merge pull request #4180 from aledbf/externalname 
Service type=ExternalName can be defined with ports
 2019-06-25 13:47:15 -07:00
Manuel Alejandro de Brito Fontes
8ca5c1cba9
Do not send empty certificates to nginx 2019-06-25 08:15:28 -04:00
Manuel Alejandro de Brito Fontes
85a848faaf
Fix misspelled and e2e check 2019-06-24 23:47:22 -04:00
Manuel Alejandro de Brito Fontes
991f95f6bf
Migrate to openresty 2019-06-23 22:29:11 -04:00
Fernando Diaz
e616f6d4ad Get AuthTLS annotation unit tests to 100% 
Adds more unit tests for the authtls annotation. Increases the
coverage.
 2019-06-21 12:46:07 -05:00
Kubernetes Prow Robot
cff97c210a
Merge pull request #4128 from cornershop/feature/service-collectLabel 
feature(collectors): Added services to collectorLabels
 2019-06-18 19:08:31 -07:00
Manuel Alejandro de Brito Fontes
0ac850cba4
Service type=ExternalName can be defined with ports 2019-06-18 17:17:43 -04:00
Kubernetes Prow Robot
6f1261015b
Merge pull request #4127 from aledbf/migration 
Migrate to new networking.k8s.io/v1beta1 package
 2019-06-13 09:28:19 -07:00
Kubernetes Prow Robot
ec674aa22d
Merge pull request #4185 from Colstuwjx/fix/missing-healthcheck-timeout 
Fix: fillout missing health check timeout on health check.
 2019-06-13 08:38:20 -07:00
Manuel Alejandro de Brito Fontes
84102eec2b
Migrate to new networking.k8s.io/v1beta1 package 2019-06-13 11:32:39 -04:00
Colstuwjx
b28577a4bf Fix: fillout missing health check timeout on health check. 2019-06-13 21:15:50 +08:00
tals
a9a73c6ed6 increase lua_shared_dict config data 2019-06-12 18:42:47 +03:00
Sebastiaan Tammer
c11583dc5f Only load modsecurity_module when ModSec is active 2019-06-11 16:39:52 +02:00
Jorrit Salverda
f77eaaee50 Add opentracing-operation-name and opentracing-location-operation-name config settings 
With these settings custom span names can be used for the server span and location span

Signed-off-by: Jorrit Salverda <jsalverda@travix.com>
 2019-06-07 14:19:34 +02:00
Kubernetes Prow Robot
e76418cd99
Merge pull request #4162 from stramel/patch-1 
Add "text/javascript" to compressible MIME types
 2019-06-06 11:35:34 -07:00
Michael Stramel
686f2310e4 Add "text/javascript" to compressible MIME types 
Based on the HTML Standard, https://html.spec.whatwg.org/multipage/scripting.html#scriptingLanguages, servers _should_ use `text/javascript`.
 2019-06-06 13:11:56 -05:00
Elvin Efendi
83f2acbe38 Session Affinity ChangeOnFailure should be boolean 2019-06-06 11:22:05 -04:00
Elvin Efendi
c4ced9d694 fix source file mods 2019-06-06 10:47:08 -04:00
Kubernetes Prow Robot
286ff13af2
Merge pull request #4048 from fedunineyu/change-upstream-on-error-with-sticky-session 
Change upstream on error when sticky session balancer is used
 2019-06-06 07:22:17 -07:00
Manuel Alejandro de Brito Fontes
29489097c9
SSL expiration metrics cannot be tied to dynamic updates 2019-06-05 11:04:27 -04:00
Manuel Alejandro de Brito Fontes
14a394fc9e
Update nginx (#4150) 
* Update nginx image
* Fix IPV6 test issues in Prow
 2019-06-04 12:15:03 -04:00
Christian Hoffmeister
3ee5161cca Always collect metrics when --metrics-per-host=false 2019-05-31 12:31:10 +02:00
Sergio Morales
c38c66e00a feature(collectors): Added services to collectorLabels and requests Countervec to capture the name of the kubernetes service used to serve the client request. 2019-05-27 11:19:42 -04:00
Eugene Fedunin
254629cf16 Added support for annotation session-cookie-change-on-failure 
1. Session cookie is updated on previous attempt failure when `session-cookie-change-on-failure = true` (default value is `false`).
2. Added tests to check both cases.
3. Updated docs.

Co-Authored-By: Vladimir Grishin <yadolov@users.noreply.github.com>
 2019-05-27 13:00:07 +03:00
Kubernetes Prow Robot
c7df848662
Merge pull request #4109 from aledbf/use-real-server 
Use real apiserver
 2019-05-26 04:47:50 -07:00
Manuel Alejandro de Brito Fontes
0baf75cd17
Add retry to LookupHost used to check the content of ExternalName 2019-05-23 05:07:25 -04:00
Manuel Alejandro de Brito Fontes
c639f490b1
Use a real apiserver to test the store 2019-05-23 04:58:14 -04:00
Kubernetes Prow Robot
3e3e29b78f
Merge pull request #4102 from aledbf/listingresses 
Refactor ListIngresses to add filters
 2019-05-22 06:48:14 -07:00
Manuel Alejandro de Brito Fontes
bae49a4657
Refactor ListIngresses to add filters 2019-05-22 05:37:44 -04:00
reynaldi.wijaya
31ffad8fa1 UPT: Add variable to define custom sampler host and port, add commituser 2019-05-21 12:34:38 +08:00
Manuel Alejandro de Brito Fontes
89c157c63b
Update generated code 2019-05-14 20:15:49 -04:00
Kubernetes Prow Robot
fafa0a6e13
Merge pull request #4067 from aledbf/normalize 
Trim spaces from annotations that can contain multiple lines
 2019-05-09 07:18:51 -07:00
Manuel Alejandro de Brito Fontes
23e7423477
Trim spaces from annotations that can contain multiple lines 2019-05-07 14:25:52 -04:00
okryvoshapka-connyun
4811168d2a Fixed typos 2019-05-06 09:04:12 +02:00
okryvoshapka-connyun
8cc9afe8ee Added Global External Authentication settings to configmap parameters incl. addons 2019-05-03 12:08:16 +02:00
Thibault Jamet
1cd17cd12c
Implement a validation webhook 
In case some ingress have a syntax error in the snippet configuration,
the freshly generated configuration will not be reloaded to prevent tearing down existing rules.
Although, once inserted, this configuration is preventing from any other valid configuration to be inserted as it remains in the ingresses of the cluster.
To solve this problem, implement an optional validation webhook that simulates the addition of the ingress to be added together with the rest of ingresses.
In case the generated configuration is not validated by nginx, deny the insertion of the ingress.

In case certificates are mounted using kubernetes secrets, when those
changes, keys are automatically updated in the container volume, and the
controller reloads it using the filewatcher.

Related changes:

- Update vendors
- Extract useful functions to check configuration with an additional ingress
- Update documentation for validating webhook
- Add validating webhook examples
- Add a metric for each syntax check success and errors
- Add more certificate generation examples
 2019-04-18 19:07:04 +02:00
Kubernetes Prow Robot
34734edc6e
Merge pull request #4005 from Shopify/proxy-next-upstream-timeout 
Support proxy_next_upstream_timeout
 2019-04-15 09:10:09 -07:00
Alex Kursell
ffeb1fe348 Support proxy_next_upstream_timeout 2019-04-15 11:08:57 -04:00
Elvin Efendi
13a7e2c5d0 refactor GetFakeSSLCert 2019-04-14 09:35:48 -04:00
Kubernetes Prow Robot
4c37e0e4b7
Merge pull request #4004 from Shopify/no-valgrind 
Remove valgrind
 2019-04-13 20:48:01 -07:00
Elvin Efendi
b1a6aa2973 make sure unit test create fakecertificate 2019-04-13 16:35:52 -04:00
Elvin Efendi
417af76e97 properly handle default and custom default certs in dynamic ssl mode 2019-04-13 12:32:06 -04:00
Alex Kursell
ae592821c6 Remove valgrind 2019-04-12 12:09:52 -04:00
Kubernetes Prow Robot
ac043771ff
Merge pull request #3990 from ElvinEfendi/fix-dynamic-cert-issue 
Fix dynamic cert issue with default-ssl-certificate
 2019-04-09 20:30:11 -07:00
Elvin Efendi
fc6e7c9be0 fix dynamic cert bug 2019-04-09 22:11:21 -04:00
Manuel Alejandro de Brito Fontes
6d02a9e475
Refactor isIterable 2019-04-08 10:11:44 -04:00
Kubernetes Prow Robot
d3f9fbb8fb
Merge pull request #3960 from Shopify/fix-add-headers-segfault 
Fix segfault on reference to nonexistent configmap
 2019-04-04 08:52:53 -07:00
Manuel Alejandro de Brito Fontes
951f7d7c1b
Refactor equals 2019-04-03 22:39:32 -03:00
Alex Kursell
f6beef960d Fix segfault on reference to nonexistent configmap 2019-04-02 16:39:42 -04:00
Kubernetes Prow Robot
39ecab8d5a
Merge pull request #3954 from Shopify/lb-configmap 
Fix load-balance configmap value
 2019-04-02 05:10:34 -07:00
Alex Kursell
4f819b6256 Fix load-balance configmap value 2019-04-01 15:55:36 -04:00
Kubernetes Prow Robot
b87cc5a1a6
Merge pull request #3786 from Shopify/rewrite-x-forwarded-prefix 
Fix x-forwarded-prefix annotation
 2019-03-31 16:18:32 -07:00
Elvin Efendi
496ff07bf1 replace some of the Nginx configuration to Lua code 2019-03-31 12:04:52 -04:00
Kubernetes Prow Robot
4bee401d16
Merge pull request #3947 from vncntvandriessche/bug/silent-custom-default-certificate-failure 
Adds a log warning when falling back to default fake cert
 2019-03-31 08:42:32 -07:00
Alex Kursell
188295550c Simplify x-forwarded-prefix annotation 2019-03-29 16:25:25 -04:00
Vincent Van Driessche
23902058f9 Adds a log warning when falling back to default fake cert 2019-03-29 17:30:10 +01:00
Manuel Alejandro de Brito Fontes
14a9e9f3fa
Update dependencies client-go to release-11.0 and kubernetes-1.14.0 2019-03-28 20:43:18 -03:00
Manuel Alejandro de Brito Fontes
3ec1028d0b
Fix dynamic SSL certificate for aliases and redirect-from-to-www 2019-03-28 16:29:11 -03:00
Kubernetes Prow Robot
e624fe171d
Merge pull request #3839 from perprogramming/bugfix/panic-on-multiple-non-matching-canary 
Fix panic on multiple non-matching canary
 2019-03-27 16:46:48 -07:00
Kubernetes Prow Robot
614a2d43bc
Merge pull request #3895 from jacksontj/issue_3881 
Correctly format ipv6 resolver config for lua
 2019-03-14 11:22:27 -07:00
Kubernetes Prow Robot
189e2db412
Merge pull request #3889 from Shopify/simplify-controller-annotations 
Separate out annotation assignment logic
 2019-03-14 11:00:38 -07:00
Thomas Jackson
eba4a8b87c Correctly format ipv6 resolver config for lua 
Fixes #3881
 2019-03-14 10:00:24 -07:00
Kubernetes Prow Robot
2dbc1ea3b3
Merge pull request #3870 from Shopify/improve-plugin 
Improve kubectl plugin
 2019-03-14 07:36:30 -07:00
Kubernetes Prow Robot
e0793650d0
Merge pull request #3885 from aledbf/status 
Refactor status update
 2019-03-13 08:19:36 -07:00
Alex Kursell
d74cc69693 Separate out annotation assignment logic 2019-03-12 14:18:09 -04:00
Alex Kursell
9d62ec97de Improve kubectl plugin 2019-03-12 12:52:23 -04:00
Manuel Alejandro de Brito Fontes
f4e4335d8c
Only the leader updates metrics for SSL certificate expiration 2019-03-12 12:08:24 -03:00
Per Bernhardt
c995e13249 Improve text, error level, tests... 2019-03-12 15:57:36 +01:00
Kubernetes Prow Robot
55bda6e7f4
Merge pull request #3887 from Shopify/remove-nodeip 
Remove useless nodeip calls and deprecate --force-namespace-isolation
 2019-03-11 16:38:38 -07:00
Alex Kursell
d8fe2d992b Remove useless nodeip call and deprecate --force-namespace-isolation 2019-03-11 18:19:13 -04:00
Kubernetes Prow Robot
869095866a
Merge pull request #3875 from aledbf/fix-auth-secret 
Allow the use of a secret located in a different namespace
 2019-03-11 12:16:12 -07:00
Manuel Alejandro de Brito Fontes
870b89c72b
Fix documentation 2019-03-11 13:21:10 -03:00
Manuel Alejandro de Brito Fontes
20a89480f0
Use full election leader ID 2019-03-11 13:11:27 -03:00
Manuel Alejandro de Brito Fontes
7c717cabcf
Add promehteus metric about leader election status 2019-03-11 13:11:27 -03:00
Manuel Alejandro de Brito Fontes
476d0106d6
Fix status tests 2019-03-11 13:11:27 -03:00
Manuel Alejandro de Brito Fontes
0a39425e8f
Refactor status update 2019-03-11 13:11:26 -03:00
Manuel Alejandro de Brito Fontes
d403b3ef86
Allow the use of a secret located in a different namespace 2019-03-11 11:16:10 -03:00
Kubernetes Prow Robot
8e7480e0f1
Merge pull request #3853 from aledbf/remove-authbind 
Remove authbind
 2019-03-11 07:09:29 -07:00
Elvin Efendi
c934509309 fix function comment 2019-03-11 00:53:06 -04:00
Elvin Efendi
5667ea5d67 bugfix: when secret includes ca.crt store it on disk even in dynamic cert mode 2019-03-11 00:53:06 -04:00
Elvin Efendi
c28247abf6 adjust unit tests 2019-03-11 00:53:06 -04:00
Elvin Efendi
70df5e03e5 clean up certificate processing 2019-03-11 00:53:06 -04:00
Elvin Efendi
0dc5a1d2e2 do not repeat cert verification against root ca 2019-03-11 00:53:06 -04:00
Elvin Efendi
301a4fb9a5 extract common logic into a helper 2019-03-11 00:53:06 -04:00
Alejandro Pedraza
7ea245e6e6 Add test 
Signed-off-by: Alejandro Pedraza <alejandro.pedraza@gmail.com>
 2019-03-07 06:18:06 -05:00
Alejandro Pedraza
a3c87cf9cb Properly set ing.Service when there are multiple rules with different hosts using the same path 
Fixes #3611

Signed-off-by: Alejandro Pedraza <alejandro.pedraza@gmail.com>
 2019-03-07 06:06:24 -05:00
Manuel Alejandro de Brito Fontes
d898169484 Fix ssl-dh-param issue when secret does not exit 2019-03-05 16:31:33 -03:00
Manuel Alejandro de Brito Fontes
26f2b1330f Remove authbind 2019-03-05 10:08:34 -03:00
Kubernetes Prow Robot
b1c2812dc5
Merge pull request #3849 from trnl/master 
Use Gauge instead of Counter for connections_active Prometheus metric
 2019-03-05 03:09:00 -08:00
Uladzimir Mihura
13d0f0ddab Use Gauge instead of Counter for connections_active Prometheus metric 2019-03-04 22:35:45 +01:00
Thibault Jamet
27a98f2920
Fix race condition in metric process collector test 
There was a goroutine started to log things upon a test that could be
ended at the time `cmd.Wait()` ends.

To solve the problem, when the sub-test ends, ensure we wait until the
command ends when ending the test

The output of `make test` before the fix shows:

```
=== RUN   TestNewUDPLogListener
==================
WARNING: DATA RACE
Read at 0x00c0002a8643 by goroutine 74:
  testing.(*common).logDepth()
      /usr/local/go/src/testing/testing.go:629 +0x132
  testing.(*common).Logf()
      /usr/local/go/src/testing/testing.go:614 +0x90
  k8s.io/ingress-nginx/internal/ingress/metric/collectors.TestProcessCollector.func1.1()
      /go/src/k8s.io/ingress-nginx/internal/ingress/metric/collectors/process_test.go:54 +0x140

Previous write at 0x00c0002a8643 by goroutine 72:
  testing.tRunner.func1()
      /usr/local/go/src/testing/testing.go:856 +0x33e
  testing.tRunner()
      /usr/local/go/src/testing/testing.go:869 +0x17f

Goroutine 74 (running) created at:
  k8s.io/ingress-nginx/internal/ingress/metric/collectors.TestProcessCollector.func1()
      /go/src/k8s.io/ingress-nginx/internal/ingress/metric/collectors/process_test.go:50 +0x218
  testing.tRunner()
      /usr/local/go/src/testing/testing.go:865 +0x163

Goroutine 72 (finished) created at:
  testing.(*T).Run()
      /usr/local/go/src/testing/testing.go:916 +0x699
  testing.runTests.func1()
      /usr/local/go/src/testing/testing.go:1157 +0xa8
  testing.tRunner()
      /usr/local/go/src/testing/testing.go:865 +0x163
  testing.runTests()
      /usr/local/go/src/testing/testing.go:1155 +0x523
  testing.(*M).Run()
      /usr/local/go/src/testing/testing.go:1072 +0x2eb
  main.main()
      _testmain.go:52 +0x222
==================
--- PASS: TestNewUDPLogListener (0.00s)
```

after the patch:

```
=== RUN   TestNewUDPLogListener
--- PASS: TestNewUDPLogListener (0.01s)
```

Change-Id: I8ea246d14f5f80b330be19dd5b8299c6762f6d6b
 2019-03-04 21:54:42 +01:00
Alex Kursell
d3ac73be79 Remove session-cookie-hash annotation 2019-03-04 10:34:48 -05:00
Per Bernhardt
8a40e82ffb Fix panic on multiple non-matching canary 2019-03-04 12:30:59 +01:00
Alex Kursell
28d99c6d7d Set default for satisfy annotation to nothing 2019-02-26 15:05:45 -05:00
Mikhail Marchenko
8b3702c829 Enable access log for default backend 
disable log on default_server
 2019-02-26 11:14:31 +03:00
Alex Kursell
c96eae3015 Add /dbg certs command 2019-02-25 11:38:07 -05:00
jasongwartz
3865e30a00 Changes CustomHTTPErrors annotation to use custom default backend 
Updates e2e test

Removes focus from e2e test

Fixes renamed function

Adds tests for new template funcs

Addresses gofmt

Updates e2e test, fixes custom-default-backend test by creating service

Updates docs
 2019-02-24 22:48:56 +01:00
Kubernetes Prow Robot
7b2495047f
Merge pull request #3781 from zoumo/proxy-buffer-number 
feat: configurable proxy buffers number
 2019-02-22 12:11:46 -08:00
Kubernetes Prow Robot
debe933f43
Merge pull request #3793 from Shopify/update-mergo 
Update mergo dependency
 2019-02-22 12:07:39 -08:00
Alex Kursell
53538acbaf Change Denied to *string 2019-02-22 11:48:13 -05:00
Alex Kursell
62191fc3e2 Fix test 2019-02-22 10:35:44 -05:00
Alex Kursell
6b6e7f5464 go fmt 2019-02-22 10:19:40 -05:00
Alex Kursell
521be9b258 Remove interface type from annotations.Ingress struct 2019-02-22 10:14:09 -05:00
Jim Zhang
6305e1d152 fix: run gofmt 2019-02-22 15:04:19 +08:00
Jim Zhang
dc63e5d185 fix: rename proxy-buffer-number to proxy-buffers-number 2019-02-22 10:21:17 +08:00
Elvin Efendi
420d804cce increase log verbosity for auth annotations 2019-02-21 16:19:10 -05:00
Taoge
24993f359f
- remove annoations in nginxcontroller struct 2019-02-21 19:14:11 +08:00
Jim Zhang
c92d29d462 feat: configurable proxy buffer number 2019-02-20 18:05:09 +08:00
Kubernetes Prow Robot
15d5ef95ef
Merge pull request #3740 from Shopify/session-annotation-reload 
Fix ingress updating for session-cookie-* annotation changes
 2019-02-19 15:14:21 -08:00
Alex Kursell
c180a0998b Fix session-cookie-* annotation reloading 2019-02-19 17:27:08 -05:00
Anthony Ho
ec04852526 Create custom annotation for satisfy "value" 2019-02-19 15:58:35 -05:00
Kubernetes Prow Robot
784d57ea69
Merge pull request #3695 from yowenter/patch-1 
> Don't reload nginx when L4 endpoints changed
 2019-02-19 11:27:11 -08:00
TaoGe
b03049c0af
> Don't reload nginx when L4 service pods changed 
Since we use lua upstream for L4 service balancer. We don't need reload nginx when L4 service pod changed.
 2019-02-19 14:31:45 +08:00
Manuel Alejandro de Brito Fontes
bef6ff9042
Do not log unnecessarily (#3771) 2019-02-16 20:56:18 -03:00
Alan J Castonguay
a29c27ed4c Datadog Opentracing support - part 2 
This commit is part 2 of 2, adding configuration of the
Datadog Opentracing module to the controller.

Fixes half of #3752
 2019-02-15 15:20:10 -05:00
Kubernetes Prow Robot
b72dfa99d8
Merge pull request #3765 from ElvinEfendi/custom-http-error-bug-fix 
simplify customhttperrors e2e test and add regression test and fix a bug
 2019-02-14 06:51:33 -08:00
Elvin Efendi
94a9a47225 fix no config change bug with custom-http-errors 2019-02-14 08:29:31 -05:00
Kubernetes Prow Robot
908a2ae506
Merge pull request #3764 from ElvinEfendi/cleanup-confusing-attribute 
delete confusing CustomErrors attribute to make things more explicit
 2019-02-14 03:26:21 -08:00