69880ac9ad
Merge pull request #4650 from DaveAurionix/master
...
Expose GeoIP2 Organization as variable $geoip2_org
2019-10-12 15:34:36 -07:00
0476715022
Need to quote expansion of $cfg.LogFormatStream in log_stream access log
...
format in nginx.tmpl otherwise individual variables are just glued together
without separating spaces so that you would get these in access logs:
[10/Oct/2019:05:03:30 +0000]TCP200000.003
[10/Oct/2019:05:03:30 +0000]TCP200000.000
[10/Oct/2019:05:05:04 +0000]TCP200000.000
which supposed to be someting like these:
[10/Oct/2019:05:03:30 +0000] TCP 200 0 0 0.003
[10/Oct/2019:05:03:30 +0000] TCP 200 0 0 0.000
[10/Oct/2019:05:05:04 +0000] TCP 200 0 0 0.000
2019-10-10 17:27:15 +10:00
8e926b21d1
Expose GeoIP2 Organization as variable $geoip2_org
2019-10-09 09:47:48 +01:00
72c4ffa8b5
add modsecurity-snippet key
2019-09-28 09:54:07 +02:00
c5a8357f1d
handle hsts header injection in lua
2019-09-24 21:17:22 -04:00
c93d384fb1
delete redundant config
2019-09-24 18:51:35 -04:00
8c64b12a96
refactor force ssl redirect logic
2019-09-24 14:57:52 -04:00
786a3b6862
Add support for configmap of headers to be sent to external auth service
2019-09-24 10:53:23 -04:00
4b4176c830
Fix log format after #4557
2019-09-18 12:52:09 -03:00
9af574a234
Remove the_real_ip variable
2019-09-12 20:01:33 -03:00
ce3e3d51c3
WIP Remove nginx unix sockets ( #4531 )
...
* Remove nginx unix sockets
* Use an emptyDir volume for /tmp in PSP e2e tests
2019-09-08 18:14:54 -03:00
9c51676f17
Add support to CRL ( #3164 )
...
Signed-off-by: Ricardo Pchevuzinske Katz <ricardo.katz@serpro.gov.br>
Add support to CRL
Signed-off-by: Ricardo Pchevuzinske Katz <ricardo.katz@serpro.gov.br>
2019-09-03 16:47:28 -04:00
c2935ca35c
Refactor health checks and wait until NGINX process ends
2019-09-01 15:31:27 -04:00
c7d2444cf4
Fix nginx variable service_port (nginx) ( #4500 )
2019-08-31 11:24:01 -04:00
06f03a2af6
point users to kubectl ingress-nginx plugin
2019-08-27 07:42:42 -04:00
8def5ef7ca
Add support for multiple alias and remove duplication of SSL certificates ( #4472 )
2019-08-26 10:58:44 -04:00
f0e71cf688
Merge pull request #4463 from zerda/fix-add-headers
...
Always set headers with add-headers option
2019-08-25 09:16:21 -07:00
a44b5cf3f3
Always set headers with add-headers option
...
It should work regardless of the response code or add_header directive in location.
2019-08-18 14:28:43 +08:00
4624b5bc77
Change PemSHA to CASHA
2019-08-16 06:31:15 +02:00
65b9e2c574
Merge branch 'master' of https://github.com/kubernetes/ingress-nginx into proxyssl
2019-08-16 06:21:53 +02:00
d8bd8c5619
Add nginx proxy_max_temp_file_size configuration option
2019-08-15 13:47:42 -04:00
0b375989f3
Merge pull request #4412 from Shopify/ssl-early-data
...
Add nginx ssl_early_data option support
2019-08-15 10:08:35 -07:00
6a293c7e11
set /configuration client body size dynamically
2019-08-14 22:10:56 -04:00
0d690fba1a
Merge pull request #4356 from aledbf/only-dynamic-mode
...
Only support SSL dynamic mode
2019-08-14 17:08:35 -07:00
adef152db8
Merge pull request #4379 from diazjf/mirror
...
Allow Requests to be Mirrored to different backends
2019-08-13 17:52:24 -07:00
d46b4148fa
Lua /etc/resolv.conf parser and some refactoring
2019-08-13 18:34:54 -04:00
80bd481abb
Only support SSL dynamic mode
2019-08-13 17:33:34 -04:00
2ed75b3362
Move listen logic to go
2019-08-13 14:52:25 -04:00
4d97240d88
Add timezone value into $geoip2_time_zone variable
2019-08-11 14:26:48 +02:00
f459515d0d
Add quote function in template
...
Co-authored-by: Charle Demers <charle.demers@gmail.com>
2019-08-09 15:47:29 -04:00
8c472190d1
Merge pull request #4086 from jeroen92/issue-4038
...
Resolve #4038 , move X-Forwarded-Port variable to the location context
2019-08-09 08:07:25 -07:00
4a9b02bc03
Remove dynamic TLS records
2019-08-08 15:52:56 -04:00
a2e667c082
lua shared dict from cm
...
lua shared dict teml test and update func sign
lua shared dict cm test
lua shared dict integration test
lua shared dict add cm parsing
lua shared dict change test header
2019-08-08 12:44:11 +03:00
7219130da4
Add nginx ssl_early_data option support
2019-08-07 16:04:09 -04:00
8dd912114e
Move X-Forwarded-Port variable to the location context
...
Resolves issue #4038 where the X-Forwarded-Port header would be set to the value of the https listening port if all of the following settings were satisfied:
- The ingress controller was started with a non-default HTTPS port set with the `--https-port` argument
- An ingress is created having:
- the `nginx.ingress.kubernetes.io/auth-url` annotation set
- TLS enabled
This commit solves this issue by moving the setting of the `pass_server_port` variable from the server, one level down to the location context.
2019-08-06 17:00:58 +02:00
386486e969
Allow Requests to be Mirrored to different backends
...
Add a feature which allows traffic to be mirrored to
additional backends. This is useful for testing how
requests will behave on different "test" backends.
See https://nginx.org/en/docs/http/ngx_http_mirror_module.html
2019-08-01 11:53:58 -05:00
72271e9313
FastCGI backend support ( #2982 )
...
Co-authored-by: Pierrick Charron <pierrick@adoy.net>
2019-07-31 10:39:21 -04:00
def13fc06c
Add proxy_ssl_* directives
...
Add support for backends which require client certificate (eg. NiFi)
authentication. The `proxy-ssl-secret` k8s annotation references a
secret which is used to authenticate to the backend server. All other
directives fine tune the backend communication.
The following annotations are supported:
* proxy-ssl-secret
* proxy-ssl-ciphers
* proxy-ssl-protocol
* proxy-ssl-verify
* proxy-ssl-verify-depth
2019-07-18 03:21:52 +02:00
589c9a20f9
Merge pull request #4278 from moolen/feat/auth-req-cache
...
feat: auth-req caching
2019-07-17 12:06:12 -07:00
23504db770
feat: auth-req caching
...
add a way to configure the `proxy_cache_*` [1] directive for external-auth.
The user-defined cache_key may contain sensitive information
(e.g. Authorization header).
We want to store *only* a hash of that key, not the key itself on disk.
[1] http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_key
Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
2019-07-17 18:39:04 +02:00
fe6c086580
Merge pull request #4288 from eshicks4/proxy-http-version-annotation
...
added proxy-http-version annotation to override the HTTP/1.1 default …
2019-07-11 11:43:07 -07:00
1e07cc6933
Disable access log in stream section for configuration socket
2019-07-10 13:42:13 -04:00
3b0c523e49
added proxy-http-version annotation to override the HTTP/1.1 default connection type to reverse proxy backends
2019-07-08 14:32:00 -04:00
7c297e001a
Merge pull request #4246 from ElvinEfendi/proxy-alternative-upstream-name
...
introduce proxy_alternative_upstream_name Nginx var
2019-07-04 19:20:35 -07:00
8b208cac93
introduce proxy_alternative_upstream_name Nginx var to differentiate canary requests
2019-07-04 19:43:20 -04:00
8807db9748
Check and complete intermediate SSL certificates
2019-07-04 19:13:21 -04:00
27df697dde
introduce ngx.var.balancer_ewma_score
2019-07-03 16:50:22 -04:00
591887089f
Add e2e test suite to detect memory leaks in lua
2019-06-27 22:05:52 -04:00
ddffa2a173
Enable arm again
2019-06-26 23:00:58 -04:00
5dfc7e211f
Merge pull request #4221 from aledbf/upgrade-nginx-image
...
Switch to openresty image
2019-06-24 09:45:57 -07:00
991f95f6bf
Migrate to openresty
2019-06-23 22:29:11 -04:00
d7b213d979
Do not set Host header when backend protocol is grpc
2019-06-18 23:44:10 -04:00
c11583dc5f
Only load modsecurity_module when ModSec is active
2019-06-11 16:39:52 +02:00
c4597522bf
Refactor whitelist from map to standard allow directives
2019-05-27 04:55:38 -04:00
abca32ba8e
reduce memory footprint and cpu usage when modsecurity and owasp rules are enabled globally
2019-05-18 19:08:30 +02:00
8b7f069b56
load modsecurity.conf on ModSecurity.Enable
2019-05-13 17:39:06 +02:00
8cc9afe8ee
Added Global External Authentication settings to configmap parameters incl. addons
2019-05-03 12:08:16 +02:00
34734edc6e
Merge pull request #4005 from Shopify/proxy-next-upstream-timeout
...
Support proxy_next_upstream_timeout
2019-04-15 09:10:09 -07:00
ffeb1fe348
Support proxy_next_upstream_timeout
2019-04-15 11:08:57 -04:00
2f3cf1a6c0
do not create empty access_by_lua_block
2019-04-13 16:11:46 -04:00
8f81538b0d
lua plugin system
2019-04-04 09:25:22 -04:00
496ff07bf1
replace some of the Nginx configuration to Lua code
2019-03-31 12:04:52 -04:00
1bef3e75b2
Set `X-Request-ID` for the `default-backend`, too.
2019-03-22 11:33:11 +01:00
a3c87cf9cb
Properly set ing.Service when there are multiple rules with different hosts using the same path
...
Fixes #3611
Signed-off-by: Alejandro Pedraza <alejandro.pedraza@gmail.com>
2019-03-07 06:06:24 -05:00
8b3702c829
Enable access log for default backend
...
disable log on default_server
2019-02-26 11:14:31 +03:00
3865e30a00
Changes CustomHTTPErrors annotation to use custom default backend
...
Updates e2e test
Removes focus from e2e test
Fixes renamed function
Adds tests for new template funcs
Addresses gofmt
Updates e2e test, fixes custom-default-backend test by creating service
Updates docs
2019-02-24 22:48:56 +01:00
7b2495047f
Merge pull request #3781 from zoumo/proxy-buffer-number
...
feat: configurable proxy buffers number
2019-02-22 12:11:46 -08:00
dc63e5d185
fix: rename proxy-buffer-number to proxy-buffers-number
2019-02-22 10:21:17 +08:00
8b6e4d4697
Use UsePortInRedirects only if enabled
2019-02-21 17:48:45 -03:00
c92d29d462
feat: configurable proxy buffer number
2019-02-20 18:05:09 +08:00
ec04852526
Create custom annotation for satisfy "value"
2019-02-19 15:58:35 -05:00
201718ec0f
Merge pull request #3775 from kppullin/fix-l4-dns-resolve-failures
...
Fix DNS lookup failures in L4 services
2019-02-19 11:11:48 -08:00
f6aded2c51
Fix DNS failures in L4 services
2019-02-17 14:12:10 -08:00
adc128711b
delete confusing CustomErrors attribute to make things more explicit
2019-02-13 22:41:02 -05:00
17e788b8e1
Merge pull request #3684 from aledbf/health
...
Replace Status port using a socket
2019-02-06 13:49:08 -08:00
34b0580225
Replace Status port using a socket
2019-02-06 18:00:10 -03:00
5dee6af957
add params for access log
2019-01-26 21:42:11 +03:00
61bca89d13
Merge pull request #3637 from aledbf/fix-redirect
...
Add support for redirect https to https (from-to-www-redirect)
2019-01-10 19:58:35 -08:00
a3bcbeb3d2
Add support for redirect https to https when from-to-www-redirect is defined
2019-01-10 20:59:49 -03:00
916b6a06d2
Empty access_by_lua_block breaks satisfy any
2019-01-10 10:27:23 -03:00
edd87fbae3
add limit connection status code
...
add default conn status code
add missing colon
add limit connection status code
2019-01-09 19:31:10 +02:00
71cc6df74f
Merge pull request #3174 from Shopify/rewrite-regex
...
Generalize Rewrite Block Creation and Deprecate AddBaseUrl (not backwards compatible)
2019-01-02 12:30:18 -08:00
a73dac2c0b
Fix proxy_host variable configuration
2019-01-02 15:31:27 -03:00
bf7b5ebd81
Add an option to automatically set worker_connections based on worker_rlimit_nofile
2018-12-27 18:36:19 +01:00
382049a0bf
Adds support for HTTP2 Push Preload annotation
...
update test for backendprotocols
Adds support for HTTP2 Push Preload annotation
Signed-off-by: Ricardo Pchevuzinske Katz <ricardo.katz@serpro.gov.br>
Adds support for HTTP2 Push Preload annotation
Signed-off-by: Ricardo Pchevuzinske Katz <ricardo.katz@serpro.gov.br>
Adds support for HTTP2 Push Preload annotation
Signed-off-by: Ricardo Pchevuzinske Katz <ricardo.katz@serpro.gov.br>
Adds support for HTTP2 Push Preload annotation
Signed-off-by: Ricardo Pchevuzinske Katz <ricardo.katz@serpro.gov.br>
Adds support for HTTP2 Push Preload annotation
Adds support for HTTP2 Push Preload annotation
2018-12-24 17:13:25 -02:00
4896b064ca
lua randomseed per worker
2018-12-20 17:09:29 +04:00
67654a6fd5
Generalize Rewrite Block Creation
2018-12-13 13:02:05 -05:00
06d33c16b5
Allow to disable NGINX metrics
2018-12-05 10:14:35 -03:00
4eabd535f9
be consistent with what Nginx supports
2018-12-02 22:20:56 +04:00
b80b19902a
Use opentracing_grpc_propagate_context when necessary
2018-12-01 16:31:10 -05:00
35b8023dc8
Match body buffer to max upload size
2018-11-20 15:06:03 -03:00
bf7ad0daca
Merge pull request #3374 from aledbf/restore-tcp-udp
...
Revert removal of support for TCP and UDP services
2018-11-18 08:33:29 -08:00
34598e71e0
Merge pull request #3428 from aledbf/set-variables
...
Set proxy_host variable to avoid using default value from proxy_pass
2018-11-18 02:17:49 -08:00
442b01e5e8
Merge pull request #3400 from diazjf/more-modsecurity
...
Add Snippet for ModSecurity
2018-11-17 03:35:53 -08:00
a2d50c2cd6
Set proxy_host variable to avoid using default value from proxy_pass
2018-11-16 14:55:53 -03:00
168f30d1ec
Revert removal of support for TCP and UDP services
2018-11-16 13:48:47 -03:00
95b3042b6e
Add a Snippet for ModSecurity
...
Allows for the configuration of Mod Security rules via
a Snippet.
2018-11-14 23:31:27 -06:00
20b095f444
Fix X-Forwarded-Proto typo
2018-11-14 10:19:31 -05:00
0f3e2b9bf0
Convert isValidClientBodyBufferSize to something more generic and use it for client_max_body_size
2018-11-13 10:11:40 -05:00
e1720d62f4
Prevent X-Forwarded-Proto forward during external auth subrequest
2018-11-12 09:13:48 -05:00
Kubernetes Prow Robot