77234fcde0
Fix nginx ingress variables for definitions with Backend
2020-12-05 14:40:22 -03:00
d781d99797
Fixes for gosec
2020-12-04 20:29:07 -03:00
1389cc0e80
Refactor extraction of ingress pod details
2020-11-19 17:31:28 -03:00
3f153add00
Refactor handling of path Prefix and Exact
2020-11-10 07:21:34 -03:00
a85e53f4cb
Remove k8s.io/kubernetes dependency
2020-10-26 13:04:00 -03:00
108637bb1c
Migrate to structured logging (klog)
2020-09-27 18:59:57 -03:00
a767b1d906
Cleanup
2020-09-27 17:16:09 -03:00
29ea30a4e8
Add events for NGINX reloads
2020-09-27 17:16:09 -03:00
7722fa38aa
Add admission controller e2e test
2020-09-26 16:06:58 -03:00
9612180f6e
reject annotations with default prefix in the case of an override
2020-09-10 09:16:44 -04:00
cb86c5698c
Migrate to klog v2
2020-08-08 21:01:03 -04:00
e4c4edd626
Custom default backend service must have ports
2020-07-07 08:49:13 -04:00
7ab0916c92
Resolve conflicts
2020-06-20 17:13:31 +09:00
53a6b0fd3b
Configurable metrics max batch size
2020-06-20 15:58:14 +09:00
41d82005ec
Add annotation ssl-prefer-server-ciphers.
2020-05-11 16:31:08 +08:00
af910a16d4
Refactor ingress validation in webhook
2020-04-28 18:35:03 -04:00
c775b439dc
Case-insensitive TLS host matching
2020-04-28 11:07:43 +02:00
dbaefc8ee9
Ensure webhook validation ingress has a PathTypePrefix
2020-04-27 10:37:26 -04:00
a95d850384
Add support for PathTypeExact
2020-04-23 11:12:37 -04:00
ecc20461aa
Removed wrong code
2020-04-20 12:30:18 -04:00
1216ed03f7
Fix condition in server-alias annotation
2020-04-01 08:37:14 -03:00
78576a9bbc
Add Maxmind Editions support
2020-03-19 19:36:10 +07:00
ad460e16ce
Avoid secret without tls.crt and tls.key but a valid ca.crt ( #5225 )
2020-03-07 21:15:24 -03:00
35264d6e8f
Merge pull request #5114 from whalecold/match
...
Feat: add header-pattern annotation.
2020-02-24 17:07:36 -08:00
6cd223558f
Merge pull request #4981 from janosi/proxy-ssl-scope
...
Applying proxy-ssl-* directives on locations only
2020-02-24 15:53:36 -08:00
cd94ac7f84
Allow service type ExternalName with different port and targetPort ( #5141 )
2020-02-20 23:06:05 -03:00
0b33650bb8
Feat: canary supports using specific match strategy to match header value.
2020-02-21 10:02:20 +08:00
54c30b91c9
Fix server aliases ( #5003 )
2020-02-02 19:08:55 -03:00
1b523390bb
Add SameSite=None support and conditionally omit SameSite=None for backwards compatibility
2020-01-29 14:30:00 -07:00
ced67e53a1
New logic: proxy-ssl parameters can be applied on locations only
...
Add: new parameter in the ConfigMap to control whether the proxy-ssl parameters of an Ingress should be applied on server and location levels, or only on location level
Add: logic in the config handling to work according to the new ConfigMap parameter
Add: unit test case
2020-01-29 10:00:55 +01:00
5c8522cdab
apply default certificate again in cases of invalid or incomplete cert config
...
Signed-off-by: Kamil Domański <kamil@domanski.co>
2019-12-06 12:15:52 +01:00
19d596b72b
Allow custom CA certificate when flag --api-server is specified ( #4807 )
2019-12-05 19:12:54 -03:00
a85d5ed93a
Merge pull request #4779 from aledbf/update-image
...
Remove lua-resty-waf feature
2019-11-27 11:45:05 -08:00
b286c2a336
Merge pull request #4732 from willthames/enable-opentracing-annotation
...
Allow enabling/disabling opentracing for ingresses
2019-11-26 17:31:21 -08:00
0ae463a5f3
Provide annotation to control opentracing
...
By default you might want opentracing off, but on for a particular
ingress.
Similarly, you might want opentracing globally on, but disabled for
a specific endpoint. To achieve this, `opentracing_propagate_context`
cannot be set when combined with `opentracing off`
A new annotation, `enable-opentracing` allows more fine grained control
of opentracing for specific ingresses.
2019-11-27 11:07:26 +10:00
61d902db14
Remove Lua resty waf feature
2019-11-26 10:37:43 -03:00
62518b60b4
Merge pull request #4689 from janosi/upstream_ssl
...
Server-only authentication of backends and per-location SSL config
2019-11-18 19:49:43 -08:00
a0dc3a9a51
Merge pull request #4695 from janosi/secure-verify-ca-secret
...
Removing secure-verify-ca-secret support
2019-11-08 07:12:21 -08:00
cc84bd4ab6
Server level proxy_ssl parameters are applied again, following the comments received.
...
Also writing tls.crt and tls.key to disk is according to the original code.
2019-10-26 20:20:18 +02:00
31227d61c2
Removing secure-verify-ca-secret support and writing an error log if that annotation is used in an Ingress definition
2019-10-18 10:58:57 +02:00
37fe9c9876
Enabling per-location proxy-ssl parameters, so locations of the same server but with own unique Ingress definitions can have different SSL configs
2019-10-17 10:15:53 +02:00
9957d30048
warn when ConfigMap is missing or unparsable instead of erroring
2019-10-11 17:15:38 -07:00
d5d2b4037c
Fix ports collision when hostNetwork=true ( #4617 )
2019-09-28 17:30:57 -03:00
a9f332704a
Fix custom default backend switch to default ( #4611 )
2019-09-27 10:21:28 -03:00
f6c2f5fb97
Merge pull request #4514 from alexmaret/4475-stickyness-mode
...
Added new affinity mode for maximum session stickyness.
2019-09-24 05:09:27 -07:00
76e2a5d731
Merge pull request #4506 from ProNic-QY/master
...
Fix panic on multiple ingress mess up upstream is primary or not
2019-09-07 12:15:18 -07:00
c2935ca35c
Refactor health checks and wait until NGINX process ends
2019-09-01 15:31:27 -04:00
9170591185
Added new affinity mode for maximum session stickyness. Fixes kubernetes/ingress-nginx#4475
2019-08-30 11:40:29 +02:00
435377f47f
Fix panic on multiple ingress mess up upstream is primary or not
2019-08-30 07:32:02 +08:00
8def5ef7ca
Add support for multiple alias and remove duplication of SSL certificates ( #4472 )
2019-08-26 10:58:44 -04:00
65b9e2c574
Merge branch 'master' of https://github.com/kubernetes/ingress-nginx into proxyssl
2019-08-16 06:21:53 +02:00
4b0aabc0c3
Merge pull request #4451 from ElvinEfendi/avoid-redundant-lua-sync
...
post data to Lua only if it changes
2019-08-15 16:20:34 -07:00
05c889335d
post data to Lua only if it changes
2019-08-15 17:21:34 -04:00
f4da014907
Merge pull request #4449 from aledbf/fix-en
...
Fix service type external name using the name
2019-08-15 13:08:35 -07:00
d8bd8c5619
Add nginx proxy_max_temp_file_size configuration option
2019-08-15 13:47:42 -04:00
816f4b0824
Fix service type external name using the name
2019-08-15 12:09:42 -04:00
0d690fba1a
Merge pull request #4356 from aledbf/only-dynamic-mode
...
Only support SSL dynamic mode
2019-08-14 17:08:35 -07:00
adef152db8
Merge pull request #4379 from diazjf/mirror
...
Allow Requests to be Mirrored to different backends
2019-08-13 17:52:24 -07:00
80bd481abb
Only support SSL dynamic mode
2019-08-13 17:33:34 -04:00
386486e969
Allow Requests to be Mirrored to different backends
...
Add a feature which allows traffic to be mirrored to
additional backends. This is useful for testing how
requests will behave on different "test" backends.
See https://nginx.org/en/docs/http/ngx_http_mirror_module.html
2019-08-01 11:53:58 -05:00
72271e9313
FastCGI backend support ( #2982 )
...
Co-authored-by: Pierrick Charron <pierrick@adoy.net>
2019-07-31 10:39:21 -04:00
def13fc06c
Add proxy_ssl_* directives
...
Add support for backends which require client certificate (eg. NiFi)
authentication. The `proxy-ssl-secret` k8s annotation references a
secret which is used to authenticate to the backend server. All other
directives fine tune the backend communication.
The following annotations are supported:
* proxy-ssl-secret
* proxy-ssl-ciphers
* proxy-ssl-protocol
* proxy-ssl-verify
* proxy-ssl-verify-depth
2019-07-18 03:21:52 +02:00
3b0c523e49
added proxy-http-version annotation to override the HTTP/1.1 default connection type to reverse proxy backends
2019-07-08 14:32:00 -04:00
8807db9748
Check and complete intermediate SSL certificates
2019-07-04 19:13:21 -04:00
ccd88f625c
Refactor metric prometheus leader helper
2019-06-29 17:44:53 -04:00
0ac850cba4
Service type=ExternalName can be defined with ports
2019-06-18 17:17:43 -04:00
6f1261015b
Merge pull request #4127 from aledbf/migration
...
Migrate to new networking.k8s.io/v1beta1 package
2019-06-13 09:28:19 -07:00
84102eec2b
Migrate to new networking.k8s.io/v1beta1 package
2019-06-13 11:32:39 -04:00
b28577a4bf
Fix: fillout missing health check timeout on health check.
2019-06-13 21:15:50 +08:00
c4ced9d694
fix source file mods
2019-06-06 10:47:08 -04:00
286ff13af2
Merge pull request #4048 from fedunineyu/change-upstream-on-error-with-sticky-session
...
Change upstream on error when sticky session balancer is used
2019-06-06 07:22:17 -07:00
29489097c9
SSL expiration metrics cannot be tied to dynamic updates
2019-06-05 11:04:27 -04:00
254629cf16
Added support for annotation `session-cookie-change-on-failure`
...
1. Session cookie is updated on previous attempt failure when `session-cookie-change-on-failure = true` (default value is `false`).
2. Added tests to check both cases.
3. Updated docs.
Co-Authored-By: Vladimir Grishin <yadolov@users.noreply.github.com>
2019-05-27 13:00:07 +03:00
bae49a4657
Refactor ListIngresses to add filters
2019-05-22 05:37:44 -04:00
8cc9afe8ee
Added Global External Authentication settings to configmap parameters incl. addons
2019-05-03 12:08:16 +02:00
1cd17cd12c
Implement a validation webhook
...
In case some ingress have a syntax error in the snippet configuration,
the freshly generated configuration will not be reloaded to prevent tearing down existing rules.
Although, once inserted, this configuration is preventing from any other valid configuration to be inserted as it remains in the ingresses of the cluster.
To solve this problem, implement an optional validation webhook that simulates the addition of the ingress to be added together with the rest of ingresses.
In case the generated configuration is not validated by nginx, deny the insertion of the ingress.
In case certificates are mounted using kubernetes secrets, when those
changes, keys are automatically updated in the container volume, and the
controller reloads it using the filewatcher.
Related changes:
- Update vendors
- Extract useful functions to check configuration with an additional ingress
- Update documentation for validating webhook
- Add validating webhook examples
- Add a metric for each syntax check success and errors
- Add more certificate generation examples
2019-04-18 19:07:04 +02:00
34734edc6e
Merge pull request #4005 from Shopify/proxy-next-upstream-timeout
...
Support proxy_next_upstream_timeout
2019-04-15 09:10:09 -07:00
ffeb1fe348
Support proxy_next_upstream_timeout
2019-04-15 11:08:57 -04:00
417af76e97
properly handle default and custom default certs in dynamic ssl mode
2019-04-13 12:32:06 -04:00
39ecab8d5a
Merge pull request #3954 from Shopify/lb-configmap
...
Fix load-balance configmap value
2019-04-02 05:10:34 -07:00
4f819b6256
Fix load-balance configmap value
2019-04-01 15:55:36 -04:00
23902058f9
Adds a log warning when falling back to default fake cert
2019-03-29 17:30:10 +01:00
e624fe171d
Merge pull request #3839 from perprogramming/bugfix/panic-on-multiple-non-matching-canary
...
Fix panic on multiple non-matching canary
2019-03-27 16:46:48 -07:00
189e2db412
Merge pull request #3889 from Shopify/simplify-controller-annotations
...
Separate out annotation assignment logic
2019-03-14 11:00:38 -07:00
e0793650d0
Merge pull request #3885 from aledbf/status
...
Refactor status update
2019-03-13 08:19:36 -07:00
d74cc69693
Separate out annotation assignment logic
2019-03-12 14:18:09 -04:00
f4e4335d8c
Only the leader updates metrics for SSL certificate expiration
2019-03-12 12:08:24 -03:00
c995e13249
Improve text, error level, tests...
2019-03-12 15:57:36 +01:00
d8fe2d992b
Remove useless nodeip call and deprecate --force-namespace-isolation
2019-03-11 18:19:13 -04:00
d3ac73be79
Remove session-cookie-hash annotation
2019-03-04 10:34:48 -05:00
8a40e82ffb
Fix panic on multiple non-matching canary
2019-03-04 12:30:59 +01:00
8b3702c829
Enable access log for default backend
...
disable log on default_server
2019-02-26 11:14:31 +03:00
3865e30a00
Changes CustomHTTPErrors annotation to use custom default backend
...
Updates e2e test
Removes focus from e2e test
Fixes renamed function
Adds tests for new template funcs
Addresses gofmt
Updates e2e test, fixes custom-default-backend test by creating service
Updates docs
2019-02-24 22:48:56 +01:00
7b2495047f
Merge pull request #3781 from zoumo/proxy-buffer-number
...
feat: configurable proxy buffers number
2019-02-22 12:11:46 -08:00
6305e1d152
fix: run gofmt
2019-02-22 15:04:19 +08:00
dc63e5d185
fix: rename proxy-buffer-number to proxy-buffers-number
2019-02-22 10:21:17 +08:00
c92d29d462
feat: configurable proxy buffer number
2019-02-20 18:05:09 +08:00
ec04852526
Create custom annotation for satisfy "value"
2019-02-19 15:58:35 -05:00
7e3304d4f9
Apply annotations to default location
2019-02-11 14:32:49 -05:00
aca51a3d4e
dont log unnecessarily
2019-02-07 13:22:02 -05:00
Manuel Alejandro de Brito Fontes
Matthew Silverman
Bo0km4n
agile6v
Andreas Sommer
Rodrigo Villablanca
Maxim Pogozhiy
Kubernetes Prow Robot
Lisheng Zheng
Brian Kopp
Laszlo Janosi
Kamil Domański
Will Thames
Bryan Hanner
Alexander Maret-Huskinson
qianyong
Gabor Lekeny
Elvin Efendi
Maxime Ginters
Fernando Diaz
Charle Demers
E. Stuart Hicks
Colstuwjx
Eugene Fedunin
okryvoshapka-connyun
Thibault Jamet
Alex Kursell
Vincent Van Driessche
Per Bernhardt
Per Bernhardt
Mikhail Marchenko
jasongwartz
Jim Zhang
Anthony Ho