ced67e53a1
New logic: proxy-ssl parameters can be applied on locations only
...
Add: new parameter in the ConfigMap to control whether the proxy-ssl parameters of an Ingress should be applied on server and location levels, or only on location level
Add: logic in the config handling to work according to the new ConfigMap parameter
Add: unit test case
2020-01-29 10:00:55 +01:00
d9983cb387
Fix spell errors
2020-01-27 00:01:13 -03:00
7ff49b25d6
Move opentracing configuration for location to go ( #4965 )
2020-01-25 21:39:20 -03:00
66ef05849f
Refactor how to handle sigterm and nginx process goroutine ( #4959 )
2020-01-25 14:52:31 -03:00
c8015c7734
Update nginx image, use docker buildx and remove qemu ( #4923 )
...
* Update nginx image, use docker buildx and remove qemu
* Update e2e image
2020-01-14 20:52:57 -03:00
74944b99e9
Enable download of GeoLite2 databases ( #4896 )
2020-01-08 19:46:43 -03:00
d7be5db7de
Support sample rate and global sampling configuration for Datadog in ConfigMap
2020-01-07 16:59:59 -08:00
5f6c4cff3e
Add help task ( #4891 )
...
* Add help task
* Fix vet errors
2020-01-07 10:53:12 -03:00
b30115aba7
Merge pull request #4862 from aledbf/update-nginx-image
...
Update nginx image
2020-01-04 15:51:23 -03:00
fbdd924a45
Update nginx image
2020-01-04 13:23:16 -03:00
965ecd4b15
Default backend protocol only supports http ( #4870 )
2020-01-04 11:09:00 -03:00
a0523c3c8a
Use a named location for authSignURL ( #4859 )
2019-12-24 22:50:25 -03:00
facf841992
Return specific type ( #4840 )
2019-12-17 12:06:17 -03:00
5c30820d1f
Remove hard-coded annotation and don't use map pointers
2019-12-13 03:05:20 -03:00
be1907142b
Merge pull request #4823 from aledbf/go-modules
...
Update go dependencies to v1.17.0
2019-12-12 11:40:32 -08:00
fe2ae8a1ec
Check the configmap is valid
2019-12-10 22:45:02 -03:00
d5e197c3e2
Merge pull request #4816 from kdomanski/fix-ssl-redirect
...
apply default certificate again in cases of invalid or incomplete cert config
2019-12-10 17:40:05 -08:00
5c8522cdab
apply default certificate again in cases of invalid or incomplete cert config
...
Signed-off-by: Kamil Domański <kamil@domanski.co>
2019-12-06 12:15:52 +01:00
cfccc2acc0
Update default SSL ciphers
2019-12-05 19:34:53 -03:00
19d596b72b
Allow custom CA certificate when flag --api-server is specified ( #4807 )
2019-12-05 19:12:54 -03:00
a85d5ed93a
Merge pull request #4779 from aledbf/update-image
...
Remove lua-resty-waf feature
2019-11-27 11:45:05 -08:00
b286c2a336
Merge pull request #4732 from willthames/enable-opentracing-annotation
...
Allow enabling/disabling opentracing for ingresses
2019-11-26 17:31:21 -08:00
0ae463a5f3
Provide annotation to control opentracing
...
By default you might want opentracing off, but on for a particular
ingress.
Similarly, you might want opentracing globally on, but disabled for
a specific endpoint. To achieve this, `opentracing_propagate_context`
cannot be set when combined with `opentracing off`
A new annotation, `enable-opentracing` allows more fine grained control
of opentracing for specific ingresses.
2019-11-27 11:07:26 +10:00
61d902db14
Remove Lua resty waf feature
2019-11-26 10:37:43 -03:00
62518b60b4
Merge pull request #4689 from janosi/upstream_ssl
...
Server-only authentication of backends and per-location SSL config
2019-11-18 19:49:43 -08:00
0d244e1c41
Merge pull request #4730 from stamm/master
...
add configuration for http2_max_concurrent_streams
2019-11-08 07:12:29 -08:00
a0dc3a9a51
Merge pull request #4695 from janosi/secure-verify-ca-secret
...
Removing secure-verify-ca-secret support
2019-11-08 07:12:21 -08:00
f808f955ee
Merge pull request #4664 from bryanhanner/master
...
warn when ConfigMap is missing or not parsable instead of erroring
2019-11-08 07:12:14 -08:00
d9cfad1894
add configuration for http2_max_concurrent_streams
2019-10-31 15:13:38 +03:00
cc84bd4ab6
Server level proxy_ssl parameters are applied again, following the comments received.
...
Also writing tls.crt and tls.key to disk is according to the original code.
2019-10-26 20:20:18 +02:00
31227d61c2
Removing secure-verify-ca-secret support and writing an error log if that annotation is used in an Ingress definition
2019-10-18 10:58:57 +02:00
6aa48def3a
add remote_addr in layer 4 access log
...
original:
[18/Oct/2019:00:47:53 +0000] TCP 200 4333 81 0.002
new:
[10.6.124.202] [18/Oct/2019:01:05:15 +0000] TCP 200 4333 81 0.002
2019-10-18 09:21:01 +08:00
37fe9c9876
Enabling per-location proxy-ssl parameters, so locations of the same server but with own unique Ingress definitions can have different SSL configs
2019-10-17 10:15:53 +02:00
500b043f27
Don't use DNS resolution to "validate FQDN"
...
As the controller stands today this "validation" is done once per config load, which means if the DNS query fails for any reason the endpoint will remain dead until both (1) a change happens to the ingress and (2) the DNS resolution works. If the user configured the name we should just pass it through, this way the lua dns can attempt to re-query it at its leisure.
2019-10-13 13:16:47 -07:00
ea8f7ea8b7
Simplify initialization function of bytes.Buffer
2019-10-12 08:36:54 -07:00
9957d30048
warn when ConfigMap is missing or unparsable instead of erroring
2019-10-11 17:15:38 -07:00
fb025ab501
Merge pull request #4087 from MRoci/master
...
Define Modsecurity Snippet via ConfigMap
2019-09-30 15:19:32 -07:00
203a3ed455
ISSUE-4244 comply with --health-check-path ( #4619 )
2019-09-29 14:37:57 -03:00
d5d2b4037c
Fix ports collision when hostNetwork=true ( #4617 )
2019-09-28 17:30:57 -03:00
72c4ffa8b5
add modsecurity-snippet key
2019-09-28 09:54:07 +02:00
6715108d8a
Release 0.26.0
2019-09-27 10:23:12 -03:00
a9f332704a
Fix custom default backend switch to default ( #4611 )
2019-09-27 10:21:28 -03:00
2bd8121338
Change default for proxy-add-original-uri-header
2019-09-25 10:57:31 -03:00
d8a3d616b4
fix bug with new and running configuration comparison
2019-09-25 06:33:59 -04:00
c5a8357f1d
handle hsts header injection in lua
2019-09-24 21:17:22 -04:00
14f9b0d64e
Merge pull request #4596 from Shopify/fix-auth-proxy-header-order
...
sort auth proxy headers from configmap
2019-09-24 13:29:26 -07:00
d124dd5eee
sort auth proxy headers from configmap
2019-09-24 15:19:49 -04:00
8c64b12a96
refactor force ssl redirect logic
2019-09-24 14:57:52 -04:00
e392c8a8af
cleanup unused certificates
2019-09-24 14:16:03 -04:00
786a3b6862
Add support for configmap of headers to be sent to external auth service
2019-09-24 10:53:23 -04:00
Laszlo Janosi
Manuel Alejandro de Brito Fontes
Sungmin Lee
Kubernetes Prow Robot
Kamil Domański
Will Thames
Rustam Zagirov
Peter Pan
Thomas Jackson
Arthur Axel 'fREW' Schmidt
Bryan Hanner
Andrea Spacca
MRoci
Elvin Efendi
A Gardner