Merge remote-tracking branch 'origin' into refactor-cert
This commit is contained in:
Henry Tran
commit
86def984a3
89 changed files with 4420 additions and 1800 deletions
|
|
@ -22,7 +22,6 @@ import (
|
|||
"sort"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync/atomic"
|
||||
"time"
|
||||
|
||||
"github.com/golang/glog"
|
||||
|
|
@ -61,15 +60,15 @@ type Configuration struct {
|
|||
|
||||
ForceNamespaceIsolation bool
|
||||
|
||||
// optional
|
||||
// +optional
|
||||
TCPConfigMapName string
|
||||
// optional
|
||||
// +optional
|
||||
UDPConfigMapName string
|
||||
|
||||
DefaultHealthzURL string
|
||||
DefaultSSLCertificate string
|
||||
|
||||
// optional
|
||||
// +optional
|
||||
PublishService string
|
||||
PublishStatusAddress string
|
||||
|
||||
|
|
@ -98,7 +97,7 @@ type Configuration struct {
|
|||
DisableLua bool
|
||||
}
|
||||
|
||||
// GetPublishService returns the configured service used to set ingress status
|
||||
// GetPublishService returns the Service used to set the load-balancer status of Ingresses.
|
||||
func (n NGINXController) GetPublishService() *apiv1.Service {
|
||||
s, err := n.store.GetService(n.cfg.PublishService)
|
||||
if err != nil {
|
||||
|
|
@ -108,9 +107,9 @@ func (n NGINXController) GetPublishService() *apiv1.Service {
|
|||
return s
|
||||
}
|
||||
|
||||
// sync collects all the pieces required to assemble the configuration file and
|
||||
// then sends the content to the backend (OnUpdate) receiving the populated
|
||||
// template as response reloading the backend if is required.
|
||||
// syncIngress collects all the pieces required to assemble the NGINX
|
||||
// configuration file and passes the resulting data structures to the backend
|
||||
// (OnUpdate) when a reload is deemed necessary.
|
||||
func (n *NGINXController) syncIngress(interface{}) error {
|
||||
n.syncRateLimiter.Accept()
|
||||
|
||||
|
|
@ -118,7 +117,7 @@ func (n *NGINXController) syncIngress(interface{}) error {
|
|||
return nil
|
||||
}
|
||||
|
||||
// Sort ingress rules using the ResourceVersion field
|
||||
// sort Ingresses using the ResourceVersion field
|
||||
ings := n.store.ListIngresses()
|
||||
sort.SliceStable(ings, func(i, j int) bool {
|
||||
ir := ings[i].ResourceVersion
|
||||
|
|
@ -136,7 +135,7 @@ func (n *NGINXController) syncIngress(interface{}) error {
|
|||
|
||||
for _, loc := range server.Locations {
|
||||
if loc.Path != rootLocation {
|
||||
glog.Warningf("ignoring path %v of ssl passthrough host %v", loc.Path, server.Hostname)
|
||||
glog.Warningf("Ignoring SSL Passthrough for location %q in server %q", loc.Path, server.Hostname)
|
||||
continue
|
||||
}
|
||||
passUpstreams = append(passUpstreams, &ingress.SSLPassthroughBackend{
|
||||
|
|
@ -155,27 +154,29 @@ func (n *NGINXController) syncIngress(interface{}) error {
|
|||
TCPEndpoints: n.getStreamServices(n.cfg.TCPConfigMapName, apiv1.ProtocolTCP),
|
||||
UDPEndpoints: n.getStreamServices(n.cfg.UDPConfigMapName, apiv1.ProtocolUDP),
|
||||
PassthroughBackends: passUpstreams,
|
||||
|
||||
ConfigurationChecksum: n.store.GetBackendConfiguration().Checksum,
|
||||
}
|
||||
|
||||
if !n.isForceReload() && n.runningConfig.Equal(&pcfg) {
|
||||
glog.V(3).Infof("skipping backend reload (no changes detected)")
|
||||
if n.runningConfig.Equal(&pcfg) {
|
||||
glog.V(3).Infof("No configuration change detected, skipping backend reload.")
|
||||
return nil
|
||||
}
|
||||
|
||||
if n.cfg.DynamicConfigurationEnabled && n.IsDynamicConfigurationEnough(&pcfg) && !n.isForceReload() {
|
||||
glog.Infof("skipping reload")
|
||||
if n.cfg.DynamicConfigurationEnabled && n.IsDynamicConfigurationEnough(&pcfg) {
|
||||
glog.Infof("Changes handled by the dynamic configuration, skipping backend reload.")
|
||||
} else {
|
||||
glog.Infof("backend reload required")
|
||||
glog.Infof("Configuration changes detected, backend reload required.")
|
||||
|
||||
err := n.OnUpdate(pcfg)
|
||||
if err != nil {
|
||||
IncReloadErrorCount()
|
||||
ConfigSuccess(false)
|
||||
glog.Errorf("unexpected failure restarting the backend: \n%v", err)
|
||||
glog.Errorf("Unexpected failure reloading the backend:\n%v", err)
|
||||
return err
|
||||
}
|
||||
|
||||
glog.Infof("ingress backend successfully reloaded...")
|
||||
glog.Infof("Backend successfully reloaded.")
|
||||
ConfigSuccess(true)
|
||||
IncReloadCount()
|
||||
setSSLExpireTime(servers)
|
||||
|
|
@ -185,49 +186,45 @@ func (n *NGINXController) syncIngress(interface{}) error {
|
|||
isFirstSync := n.runningConfig.Equal(&ingress.Configuration{})
|
||||
go func(isFirstSync bool) {
|
||||
if isFirstSync {
|
||||
glog.Infof("first sync of Nginx configuration")
|
||||
glog.Infof("Initial synchronization of the NGINX configuration.")
|
||||
|
||||
// it takes time for Nginx to start listening on the port
|
||||
// it takes time for NGINX to start listening on the configured ports
|
||||
time.Sleep(1 * time.Second)
|
||||
}
|
||||
err := configureDynamically(&pcfg, n.cfg.ListenPorts.Status)
|
||||
if err == nil {
|
||||
glog.Infof("dynamic reconfiguration succeeded")
|
||||
glog.Infof("Dynamic reconfiguration succeeded.")
|
||||
} else {
|
||||
glog.Warningf("could not dynamically reconfigure: %v", err)
|
||||
glog.Warningf("Dynamic reconfiguration failed: %v", err)
|
||||
}
|
||||
}(isFirstSync)
|
||||
}
|
||||
|
||||
n.runningConfig = &pcfg
|
||||
n.SetForceReload(false)
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (n *NGINXController) getStreamServices(configmapName string, proto apiv1.Protocol) []ingress.L4Service {
|
||||
glog.V(3).Infof("obtaining information about stream services of type %v located in configmap %v", proto, configmapName)
|
||||
glog.V(3).Infof("Obtaining information about %v stream services from ConfigMap %q", proto, configmapName)
|
||||
if configmapName == "" {
|
||||
// no configmap configured
|
||||
return []ingress.L4Service{}
|
||||
}
|
||||
|
||||
_, _, err := k8s.ParseNameNS(configmapName)
|
||||
if err != nil {
|
||||
glog.Errorf("unexpected error reading configmap %v: %v", configmapName, err)
|
||||
glog.Errorf("Error parsing ConfigMap reference %q: %v", configmapName, err)
|
||||
return []ingress.L4Service{}
|
||||
}
|
||||
|
||||
configmap, err := n.store.GetConfigMap(configmapName)
|
||||
if err != nil {
|
||||
glog.Errorf("unexpected error reading configmap %v: %v", configmapName, err)
|
||||
glog.Errorf("Error reading ConfigMap %q: %v", configmapName, err)
|
||||
return []ingress.L4Service{}
|
||||
}
|
||||
|
||||
var svcs []ingress.L4Service
|
||||
var svcProxyProtocol ingress.ProxyProtocol
|
||||
// k -> port to expose
|
||||
// v -> <namespace>/<service name>:<port from service to be used>
|
||||
|
||||
rp := []int{
|
||||
n.cfg.ListenPorts.HTTP,
|
||||
|
|
@ -239,21 +236,22 @@ func (n *NGINXController) getStreamServices(configmapName string, proto apiv1.Pr
|
|||
}
|
||||
reserverdPorts := sets.NewInt(rp...)
|
||||
|
||||
for k, v := range configmap.Data {
|
||||
externalPort, err := strconv.Atoi(k)
|
||||
// svcRef format: <(str)namespace>/<(str)service>:<(intstr)port>[:<(bool)decode>:<(bool)encode>]
|
||||
for port, svcRef := range configmap.Data {
|
||||
externalPort, err := strconv.Atoi(port)
|
||||
if err != nil {
|
||||
glog.Warningf("%v is not valid as a TCP/UDP port", k)
|
||||
glog.Warningf("%q is not a valid %v port number", port, proto)
|
||||
continue
|
||||
}
|
||||
|
||||
if reserverdPorts.Has(externalPort) {
|
||||
glog.Warningf("port %v cannot be used for TCP or UDP services. It is reserved for the Ingress controller", k)
|
||||
glog.Warningf("Port %d cannot be used for %v stream services. It is reserved for the Ingress controller.", externalPort, proto)
|
||||
continue
|
||||
}
|
||||
|
||||
nsSvcPort := strings.Split(v, ":")
|
||||
nsSvcPort := strings.Split(svcRef, ":")
|
||||
if len(nsSvcPort) < 2 {
|
||||
glog.Warningf("invalid format (namespace/name:port:[PROXY]:[PROXY]) '%v'", k)
|
||||
glog.Warningf("Invalid Service reference %q for %v port %d", svcRef, proto, externalPort)
|
||||
continue
|
||||
}
|
||||
|
||||
|
|
@ -262,7 +260,7 @@ func (n *NGINXController) getStreamServices(configmapName string, proto apiv1.Pr
|
|||
svcProxyProtocol.Decode = false
|
||||
svcProxyProtocol.Encode = false
|
||||
|
||||
// Proxy protocol is possible if the service is TCP
|
||||
// Proxy Protocol is only compatible with TCP Services
|
||||
if len(nsSvcPort) >= 3 && proto == apiv1.ProtocolTCP {
|
||||
if len(nsSvcPort) >= 3 && strings.ToUpper(nsSvcPort[2]) == "PROXY" {
|
||||
svcProxyProtocol.Decode = true
|
||||
|
|
@ -280,14 +278,15 @@ func (n *NGINXController) getStreamServices(configmapName string, proto apiv1.Pr
|
|||
|
||||
svc, err := n.store.GetService(nsName)
|
||||
if err != nil {
|
||||
glog.Warningf("error getting service %v: %v", nsName, err)
|
||||
glog.Warningf("Error getting Service %q from local store: %v", nsName, err)
|
||||
continue
|
||||
}
|
||||
|
||||
var endps []ingress.Endpoint
|
||||
targetPort, err := strconv.Atoi(svcPort)
|
||||
if err != nil {
|
||||
glog.V(3).Infof("searching service %v endpoints using the name '%v'", svcNs, svcName, svcPort)
|
||||
// not a port number, fall back to using port name
|
||||
glog.V(3).Infof("Searching Endpoints with %v port name %q for Service %q", proto, svcPort, nsName)
|
||||
for _, sp := range svc.Spec.Ports {
|
||||
if sp.Name == svcPort {
|
||||
if sp.Protocol == proto {
|
||||
|
|
@ -297,8 +296,7 @@ func (n *NGINXController) getStreamServices(configmapName string, proto apiv1.Pr
|
|||
}
|
||||
}
|
||||
} else {
|
||||
// we need to use the TargetPort (where the endpoints are running)
|
||||
glog.V(3).Infof("searching service %v/%v endpoints using the target port '%v'", svcNs, svcName, targetPort)
|
||||
glog.V(3).Infof("Searching Endpoints with %v port number %d for Service %q", proto, targetPort, nsName)
|
||||
for _, sp := range svc.Spec.Ports {
|
||||
if sp.Port == int32(targetPort) {
|
||||
if sp.Protocol == proto {
|
||||
|
|
@ -309,10 +307,10 @@ func (n *NGINXController) getStreamServices(configmapName string, proto apiv1.Pr
|
|||
}
|
||||
}
|
||||
|
||||
// stream services cannot contain empty upstreams and there is no
|
||||
// default backend equivalent
|
||||
// stream services cannot contain empty upstreams and there is
|
||||
// no default backend equivalent
|
||||
if len(endps) == 0 {
|
||||
glog.Warningf("service %v/%v does not have any active endpoints for port %v and protocol %v", svcNs, svcName, svcPort, proto)
|
||||
glog.Warningf("Service %q does not have any active Endpoint for %v port %v", nsName, proto, svcPort)
|
||||
continue
|
||||
}
|
||||
|
||||
|
|
@ -332,9 +330,8 @@ func (n *NGINXController) getStreamServices(configmapName string, proto apiv1.Pr
|
|||
return svcs
|
||||
}
|
||||
|
||||
// getDefaultUpstream returns an upstream associated with the
|
||||
// default backend service. In case of error retrieving information
|
||||
// configure the upstream to return http code 503.
|
||||
// getDefaultUpstream returns the upstream associated with the default backend.
|
||||
// Configures the upstream to return HTTP code 503 in case of error.
|
||||
func (n *NGINXController) getDefaultUpstream() *ingress.Backend {
|
||||
upstream := &ingress.Backend{
|
||||
Name: defUpstreamName,
|
||||
|
|
@ -342,14 +339,14 @@ func (n *NGINXController) getDefaultUpstream() *ingress.Backend {
|
|||
svcKey := n.cfg.DefaultService
|
||||
svc, err := n.store.GetService(svcKey)
|
||||
if err != nil {
|
||||
glog.Warningf("unexpected error searching the default backend %v: %v", n.cfg.DefaultService, err)
|
||||
glog.Warningf("Unexpected error getting default backend %q from local store: %v", n.cfg.DefaultService, err)
|
||||
upstream.Endpoints = append(upstream.Endpoints, n.DefaultEndpoint())
|
||||
return upstream
|
||||
}
|
||||
|
||||
endps := getEndpoints(svc, &svc.Spec.Ports[0], apiv1.ProtocolTCP, &healthcheck.Config{}, n.store.GetServiceEndpoints)
|
||||
if len(endps) == 0 {
|
||||
glog.Warningf("service %v does not have any active endpoints", svcKey)
|
||||
glog.Warningf("Service %q does not have any active Endpoint", svcKey)
|
||||
endps = []ingress.Endpoint{n.DefaultEndpoint()}
|
||||
}
|
||||
|
||||
|
|
@ -358,8 +355,9 @@ func (n *NGINXController) getDefaultUpstream() *ingress.Backend {
|
|||
return upstream
|
||||
}
|
||||
|
||||
// getBackendServers returns a list of Upstream and Server to be used by the backend
|
||||
// An upstream can be used in multiple servers if the namespace, service name and port are the same
|
||||
// getBackendServers returns a list of Upstream and Server to be used by the
|
||||
// backend. An upstream can be used in multiple servers if the namespace,
|
||||
// service name and port are the same.
|
||||
func (n *NGINXController) getBackendServers(ingresses []*extensions.Ingress) ([]*ingress.Backend, []*ingress.Server) {
|
||||
du := n.getDefaultUpstream()
|
||||
upstreams := n.createUpstreams(ingresses, du)
|
||||
|
|
@ -368,7 +366,7 @@ func (n *NGINXController) getBackendServers(ingresses []*extensions.Ingress) ([]
|
|||
for _, ing := range ingresses {
|
||||
anns, err := n.store.GetIngressAnnotations(ing)
|
||||
if err != nil {
|
||||
glog.Errorf("unexpected error reading ingress annotations: %v", err)
|
||||
glog.Errorf("Unexpected error reading annotations for Ingress %q from local store: %v", ing.Name, err)
|
||||
}
|
||||
|
||||
for _, rule := range ing.Spec.Rules {
|
||||
|
|
@ -383,7 +381,7 @@ func (n *NGINXController) getBackendServers(ingresses []*extensions.Ingress) ([]
|
|||
|
||||
if rule.HTTP == nil &&
|
||||
host != defServerName {
|
||||
glog.V(3).Infof("ingress rule %v/%v does not contain HTTP rules, using default backend", ing.Namespace, ing.Name)
|
||||
glog.V(3).Infof("Ingress \"%v/%v\" does not contain any HTTP rule, using default backend.", ing.Namespace, ing.Name)
|
||||
continue
|
||||
}
|
||||
|
||||
|
|
@ -393,23 +391,21 @@ func (n *NGINXController) getBackendServers(ingresses []*extensions.Ingress) ([]
|
|||
|
||||
if server.CertificateAuth.CAFileName == "" {
|
||||
server.CertificateAuth = anns.CertificateAuth
|
||||
// It is possible that no CAFileName is found in the secret
|
||||
if server.CertificateAuth.CAFileName == "" {
|
||||
glog.V(3).Infof("secret %v does not contain 'ca.crt', mutual authentication not enabled - ingress rule %v/%v.", server.CertificateAuth.Secret, ing.Namespace, ing.Name)
|
||||
if server.CertificateAuth.Secret != "" && server.CertificateAuth.CAFileName == "" {
|
||||
glog.V(3).Infof("Secret %q does not contain 'ca.crt' key, mutual authentication disabled for Ingress \"%v/%v\"", server.CertificateAuth.Secret, ing.Namespace, ing.Name)
|
||||
}
|
||||
} else {
|
||||
glog.V(3).Infof("server %v already contains a mutual authentication configuration - ingress rule %v/%v", server.Hostname, ing.Namespace, ing.Name)
|
||||
glog.V(3).Infof("Server %v is already configured for mutual authentication (Ingress \"%v/%v\")", server.Hostname, ing.Namespace, ing.Name)
|
||||
}
|
||||
|
||||
for _, path := range rule.HTTP.Paths {
|
||||
upsName := fmt.Sprintf("%v-%v-%v",
|
||||
ing.GetNamespace(),
|
||||
ing.Namespace,
|
||||
path.Backend.ServiceName,
|
||||
path.Backend.ServicePort.String())
|
||||
|
||||
ups := upstreams[upsName]
|
||||
|
||||
// if there's no path defined we assume /
|
||||
nginxPath := rootLocation
|
||||
if path.Path != "" {
|
||||
nginxPath = path.Path
|
||||
|
|
@ -421,11 +417,11 @@ func (n *NGINXController) getBackendServers(ingresses []*extensions.Ingress) ([]
|
|||
addLoc = false
|
||||
|
||||
if !loc.IsDefBackend {
|
||||
glog.V(3).Infof("avoiding replacement of ingress rule %v/%v location %v upstream %v (%v)", ing.Namespace, ing.Name, loc.Path, ups.Name, loc.Backend)
|
||||
glog.V(3).Infof("Location %q already configured for server %q with upstream %q (Ingress \"%v/%v\")", loc.Path, server.Hostname, loc.Backend, ing.Namespace, ing.Name)
|
||||
break
|
||||
}
|
||||
|
||||
glog.V(3).Infof("replacing ingress rule %v/%v location %v upstream %v (%v)", ing.Namespace, ing.Name, loc.Path, ups.Name, loc.Backend)
|
||||
glog.V(3).Infof("Replacing location %q for server %q with upstream %q to use upstream %q (Ingress \"%v/%v\")", loc.Path, server.Hostname, loc.Backend, ups.Name, ing.Namespace, ing.Name)
|
||||
loc.Backend = ups.Name
|
||||
loc.IsDefBackend = false
|
||||
loc.Port = ups.Port
|
||||
|
|
@ -441,7 +437,6 @@ func (n *NGINXController) getBackendServers(ingresses []*extensions.Ingress) ([]
|
|||
loc.Redirect = anns.Redirect
|
||||
loc.Rewrite = anns.Rewrite
|
||||
loc.UpstreamVhost = anns.UpstreamVhost
|
||||
loc.VtsFilterKey = anns.VtsFilterKey
|
||||
loc.Whitelist = anns.Whitelist
|
||||
loc.Denied = anns.Denied
|
||||
loc.XForwardedPrefix = anns.XForwardedPrefix
|
||||
|
|
@ -459,9 +454,10 @@ func (n *NGINXController) getBackendServers(ingresses []*extensions.Ingress) ([]
|
|||
break
|
||||
}
|
||||
}
|
||||
// is a new location
|
||||
|
||||
// new location
|
||||
if addLoc {
|
||||
glog.V(3).Infof("adding location %v in ingress rule %v/%v upstream %v", nginxPath, ing.Namespace, ing.Name, ups.Name)
|
||||
glog.V(3).Infof("Adding location %q for server %q with upstream %q (Ingress \"%v/%v\")", nginxPath, server.Hostname, ups.Name, ing.Namespace, ing.Name)
|
||||
loc := &ingress.Location{
|
||||
Path: nginxPath,
|
||||
Backend: ups.Name,
|
||||
|
|
@ -479,7 +475,6 @@ func (n *NGINXController) getBackendServers(ingresses []*extensions.Ingress) ([]
|
|||
Redirect: anns.Redirect,
|
||||
Rewrite: anns.Rewrite,
|
||||
UpstreamVhost: anns.UpstreamVhost,
|
||||
VtsFilterKey: anns.VtsFilterKey,
|
||||
Whitelist: anns.Whitelist,
|
||||
Denied: anns.Denied,
|
||||
XForwardedPrefix: anns.XForwardedPrefix,
|
||||
|
|
@ -525,15 +520,16 @@ func (n *NGINXController) getBackendServers(ingresses []*extensions.Ingress) ([]
|
|||
for _, location := range server.Locations {
|
||||
if upstream.Name == location.Backend {
|
||||
if len(upstream.Endpoints) == 0 {
|
||||
glog.V(3).Infof("upstream %v does not have any active endpoints.", upstream.Name)
|
||||
glog.V(3).Infof("Upstream %q does not have any active endpoints.", upstream.Name)
|
||||
location.Backend = "" // for nginx.tmpl checking
|
||||
|
||||
// check if the location contains endpoints and a custom default backend
|
||||
if location.DefaultBackend != nil {
|
||||
sp := location.DefaultBackend.Spec.Ports[0]
|
||||
endps := getEndpoints(location.DefaultBackend, &sp, apiv1.ProtocolTCP, &healthcheck.Config{}, n.store.GetServiceEndpoints)
|
||||
if len(endps) > 0 {
|
||||
glog.V(3).Infof("using custom default backend in server %v location %v (service %v/%v)",
|
||||
server.Hostname, location.Path, location.DefaultBackend.Namespace, location.DefaultBackend.Name)
|
||||
glog.V(3).Infof("Using custom default backend for location %q in server %q (Service \"%v/%v\")",
|
||||
location.Path, server.Hostname, location.DefaultBackend.Namespace, location.DefaultBackend.Name)
|
||||
nb := upstream.DeepCopy()
|
||||
name := fmt.Sprintf("custom-default-backend-%v", upstream.Name)
|
||||
nb.Name = name
|
||||
|
|
@ -544,14 +540,12 @@ func (n *NGINXController) getBackendServers(ingresses []*extensions.Ingress) ([]
|
|||
}
|
||||
}
|
||||
|
||||
// Configure Backends[].SSLPassthrough
|
||||
if server.SSLPassthrough {
|
||||
if location.Path == rootLocation {
|
||||
if location.Backend == defUpstreamName {
|
||||
glog.Warningf("ignoring ssl passthrough of %v as it doesn't have a default backend (root context)", server.Hostname)
|
||||
glog.Warningf("Server %q has no default backend, ignoring SSL Passthrough.", server.Hostname)
|
||||
continue
|
||||
}
|
||||
|
||||
isHTTPSfrom = append(isHTTPSfrom, server)
|
||||
}
|
||||
}
|
||||
|
|
@ -564,7 +558,7 @@ func (n *NGINXController) getBackendServers(ingresses []*extensions.Ingress) ([]
|
|||
}
|
||||
}
|
||||
|
||||
// create the list of upstreams and skip those without endpoints
|
||||
// create the list of upstreams and skip those without Endpoints
|
||||
for _, upstream := range upstreams {
|
||||
if len(upstream.Endpoints) == 0 {
|
||||
continue
|
||||
|
|
@ -591,8 +585,8 @@ func (n *NGINXController) getBackendServers(ingresses []*extensions.Ingress) ([]
|
|||
return aUpstreams, aServers
|
||||
}
|
||||
|
||||
// createUpstreams creates the NGINX upstreams for each service referenced in
|
||||
// Ingress rules. The servers inside the upstream are endpoints.
|
||||
// createUpstreams creates the NGINX upstreams (Endpoints) for each Service
|
||||
// referenced in Ingress rules.
|
||||
func (n *NGINXController) createUpstreams(data []*extensions.Ingress, du *ingress.Backend) map[string]*ingress.Backend {
|
||||
upstreams := make(map[string]*ingress.Backend)
|
||||
upstreams[defUpstreamName] = du
|
||||
|
|
@ -600,17 +594,17 @@ func (n *NGINXController) createUpstreams(data []*extensions.Ingress, du *ingres
|
|||
for _, ing := range data {
|
||||
anns, err := n.store.GetIngressAnnotations(ing)
|
||||
if err != nil {
|
||||
glog.Errorf("unexpected error reading ingress annotations: %v", err)
|
||||
glog.Errorf("Error reading Ingress annotations: %v", err)
|
||||
}
|
||||
|
||||
var defBackend string
|
||||
if ing.Spec.Backend != nil {
|
||||
defBackend = fmt.Sprintf("%v-%v-%v",
|
||||
ing.GetNamespace(),
|
||||
ing.Namespace,
|
||||
ing.Spec.Backend.ServiceName,
|
||||
ing.Spec.Backend.ServicePort.String())
|
||||
|
||||
glog.V(3).Infof("creating upstream %v", defBackend)
|
||||
glog.V(3).Infof("Creating upstream %q", defBackend)
|
||||
upstreams[defBackend] = newUpstream(defBackend)
|
||||
if !upstreams[defBackend].Secure {
|
||||
upstreams[defBackend].Secure = anns.SecureUpstream.Secure
|
||||
|
|
@ -625,14 +619,13 @@ func (n *NGINXController) createUpstreams(data []*extensions.Ingress, du *ingres
|
|||
upstreams[defBackend].LoadBalancing = anns.LoadBalancing
|
||||
}
|
||||
|
||||
svcKey := fmt.Sprintf("%v/%v", ing.GetNamespace(), ing.Spec.Backend.ServiceName)
|
||||
svcKey := fmt.Sprintf("%v/%v", ing.Namespace, ing.Spec.Backend.ServiceName)
|
||||
|
||||
// Add the service cluster endpoint as the upstream instead of individual endpoints
|
||||
// if the serviceUpstream annotation is enabled
|
||||
// add the service ClusterIP as a single Endpoint instead of individual Endpoints
|
||||
if anns.ServiceUpstream {
|
||||
endpoint, err := n.getServiceClusterEndpoint(svcKey, ing.Spec.Backend)
|
||||
if err != nil {
|
||||
glog.Errorf("Failed to get service cluster endpoint for service %s: %v", svcKey, err)
|
||||
glog.Errorf("Failed to determine a suitable ClusterIP Endpoint for Service %q: %v", svcKey, err)
|
||||
} else {
|
||||
upstreams[defBackend].Endpoints = []ingress.Endpoint{endpoint}
|
||||
}
|
||||
|
|
@ -642,7 +635,7 @@ func (n *NGINXController) createUpstreams(data []*extensions.Ingress, du *ingres
|
|||
endps, err := n.serviceEndpoints(svcKey, ing.Spec.Backend.ServicePort.String(), &anns.HealthCheck)
|
||||
upstreams[defBackend].Endpoints = append(upstreams[defBackend].Endpoints, endps...)
|
||||
if err != nil {
|
||||
glog.Warningf("error creating upstream %v: %v", defBackend, err)
|
||||
glog.Warningf("Error creating upstream %q: %v", defBackend, err)
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -655,7 +648,7 @@ func (n *NGINXController) createUpstreams(data []*extensions.Ingress, du *ingres
|
|||
|
||||
for _, path := range rule.HTTP.Paths {
|
||||
name := fmt.Sprintf("%v-%v-%v",
|
||||
ing.GetNamespace(),
|
||||
ing.Namespace,
|
||||
path.Backend.ServiceName,
|
||||
path.Backend.ServicePort.String())
|
||||
|
||||
|
|
@ -663,7 +656,7 @@ func (n *NGINXController) createUpstreams(data []*extensions.Ingress, du *ingres
|
|||
continue
|
||||
}
|
||||
|
||||
glog.V(3).Infof("creating upstream %v", name)
|
||||
glog.V(3).Infof("Creating upstream %q", name)
|
||||
upstreams[name] = newUpstream(name)
|
||||
upstreams[name].Port = path.Backend.ServicePort
|
||||
|
||||
|
|
@ -683,14 +676,13 @@ func (n *NGINXController) createUpstreams(data []*extensions.Ingress, du *ingres
|
|||
upstreams[name].LoadBalancing = anns.LoadBalancing
|
||||
}
|
||||
|
||||
svcKey := fmt.Sprintf("%v/%v", ing.GetNamespace(), path.Backend.ServiceName)
|
||||
svcKey := fmt.Sprintf("%v/%v", ing.Namespace, path.Backend.ServiceName)
|
||||
|
||||
// Add the service cluster endpoint as the upstream instead of individual endpoints
|
||||
// if the serviceUpstream annotation is enabled
|
||||
// add the service ClusterIP as a single Endpoint instead of individual Endpoints
|
||||
if anns.ServiceUpstream {
|
||||
endpoint, err := n.getServiceClusterEndpoint(svcKey, &path.Backend)
|
||||
if err != nil {
|
||||
glog.Errorf("failed to get service cluster endpoint for service %s: %v", svcKey, err)
|
||||
glog.Errorf("Failed to determine a suitable ClusterIP Endpoint for Service %q: %v", svcKey, err)
|
||||
} else {
|
||||
upstreams[name].Endpoints = []ingress.Endpoint{endpoint}
|
||||
}
|
||||
|
|
@ -699,7 +691,7 @@ func (n *NGINXController) createUpstreams(data []*extensions.Ingress, du *ingres
|
|||
if len(upstreams[name].Endpoints) == 0 {
|
||||
endp, err := n.serviceEndpoints(svcKey, path.Backend.ServicePort.String(), &anns.HealthCheck)
|
||||
if err != nil {
|
||||
glog.Warningf("error obtaining service endpoints: %v", err)
|
||||
glog.Warningf("Error obtaining Endpoints for Service %q: %v", svcKey, err)
|
||||
continue
|
||||
}
|
||||
upstreams[name].Endpoints = endp
|
||||
|
|
@ -707,7 +699,7 @@ func (n *NGINXController) createUpstreams(data []*extensions.Ingress, du *ingres
|
|||
|
||||
s, err := n.store.GetService(svcKey)
|
||||
if err != nil {
|
||||
glog.Warningf("error obtaining service: %v", err)
|
||||
glog.Warningf("Error obtaining Service %q: %v", svcKey, err)
|
||||
continue
|
||||
}
|
||||
|
||||
|
|
@ -719,20 +711,22 @@ func (n *NGINXController) createUpstreams(data []*extensions.Ingress, du *ingres
|
|||
return upstreams
|
||||
}
|
||||
|
||||
// getServiceClusterEndpoint returns an Endpoint corresponding to the ClusterIP
|
||||
// field of a Service.
|
||||
func (n *NGINXController) getServiceClusterEndpoint(svcKey string, backend *extensions.IngressBackend) (endpoint ingress.Endpoint, err error) {
|
||||
svc, err := n.store.GetService(svcKey)
|
||||
if err != nil {
|
||||
return endpoint, fmt.Errorf("service %v does not exist", svcKey)
|
||||
return endpoint, fmt.Errorf("service %q does not exist", svcKey)
|
||||
}
|
||||
|
||||
if svc.Spec.ClusterIP == "" || svc.Spec.ClusterIP == "None" {
|
||||
return endpoint, fmt.Errorf("No ClusterIP found for service %s", svcKey)
|
||||
return endpoint, fmt.Errorf("no ClusterIP found for Service %q", svcKey)
|
||||
}
|
||||
|
||||
endpoint.Address = svc.Spec.ClusterIP
|
||||
|
||||
// If the service port in the ingress uses a name, lookup
|
||||
// the actual port in the service spec
|
||||
// if the Service port is referenced by name in the Ingress, lookup the
|
||||
// actual port in the service spec
|
||||
if backend.ServicePort.Type == intstr.String {
|
||||
var port int32 = -1
|
||||
for _, svcPort := range svc.Spec.Ports {
|
||||
|
|
@ -742,7 +736,7 @@ func (n *NGINXController) getServiceClusterEndpoint(svcKey string, backend *exte
|
|||
}
|
||||
}
|
||||
if port == -1 {
|
||||
return endpoint, fmt.Errorf("no port mapped for service %s and port name %s", svc.Name, backend.ServicePort.String())
|
||||
return endpoint, fmt.Errorf("service %q does not have a port named %q", svc.Name, backend.ServicePort)
|
||||
}
|
||||
endpoint.Port = fmt.Sprintf("%d", port)
|
||||
} else {
|
||||
|
|
@ -752,27 +746,27 @@ func (n *NGINXController) getServiceClusterEndpoint(svcKey string, backend *exte
|
|||
return endpoint, err
|
||||
}
|
||||
|
||||
// serviceEndpoints returns the upstream servers (endpoints) associated
|
||||
// to a service.
|
||||
// serviceEndpoints returns the upstream servers (Endpoints) associated with a
|
||||
// Service.
|
||||
func (n *NGINXController) serviceEndpoints(svcKey, backendPort string,
|
||||
hz *healthcheck.Config) ([]ingress.Endpoint, error) {
|
||||
svc, err := n.store.GetService(svcKey)
|
||||
|
||||
var upstreams []ingress.Endpoint
|
||||
if err != nil {
|
||||
return upstreams, fmt.Errorf("error getting service %v from the cache: %v", svcKey, err)
|
||||
return upstreams, fmt.Errorf("error getting Service %q from local store: %v", svcKey, err)
|
||||
}
|
||||
|
||||
glog.V(3).Infof("obtaining port information for service %v", svcKey)
|
||||
glog.V(3).Infof("Obtaining ports information for Service %q", svcKey)
|
||||
for _, servicePort := range svc.Spec.Ports {
|
||||
// targetPort could be a string, use the name or the port (int)
|
||||
// targetPort could be a string, use either the port name or number (int)
|
||||
if strconv.Itoa(int(servicePort.Port)) == backendPort ||
|
||||
servicePort.TargetPort.String() == backendPort ||
|
||||
servicePort.Name == backendPort {
|
||||
|
||||
endps := getEndpoints(svc, &servicePort, apiv1.ProtocolTCP, hz, n.store.GetServiceEndpoints)
|
||||
if len(endps) == 0 {
|
||||
glog.Warningf("service %v does not have any active endpoints", svcKey)
|
||||
glog.Warningf("Service %q does not have any active Endpoint.", svcKey)
|
||||
}
|
||||
|
||||
if n.cfg.SortBackends {
|
||||
|
|
@ -791,11 +785,11 @@ func (n *NGINXController) serviceEndpoints(svcKey, backendPort string,
|
|||
}
|
||||
}
|
||||
|
||||
// Ingress with an ExternalName service and no port defined in the service.
|
||||
// Ingress with an ExternalName Service and no port defined for that Service
|
||||
if len(svc.Spec.Ports) == 0 && svc.Spec.Type == apiv1.ServiceTypeExternalName {
|
||||
externalPort, err := strconv.Atoi(backendPort)
|
||||
if err != nil {
|
||||
glog.Warningf("only numeric ports are allowed in ExternalName services: %v is not valid as a TCP/UDP port", backendPort)
|
||||
glog.Warningf("Only numeric ports are allowed in ExternalName Services: %q is not a valid port number.", backendPort)
|
||||
return upstreams, nil
|
||||
}
|
||||
|
||||
|
|
@ -806,7 +800,7 @@ func (n *NGINXController) serviceEndpoints(svcKey, backendPort string,
|
|||
}
|
||||
endps := getEndpoints(svc, &servicePort, apiv1.ProtocolTCP, hz, n.store.GetServiceEndpoints)
|
||||
if len(endps) == 0 {
|
||||
glog.Warningf("service %v does not have any active endpoints", svcKey)
|
||||
glog.Warningf("Service %q does not have any active Endpoint.", svcKey)
|
||||
return upstreams, nil
|
||||
}
|
||||
|
||||
|
|
@ -825,17 +819,14 @@ func (n *NGINXController) serviceEndpoints(svcKey, backendPort string,
|
|||
return upstreams, nil
|
||||
}
|
||||
|
||||
// createServers initializes a map that contains information about the list of
|
||||
// FDQN referenced by ingress rules and the common name field in the referenced
|
||||
// SSL certificates. Each server is configured with location / using a default
|
||||
// backend specified by the user or the one inside the ingress spec.
|
||||
// createServers builds a map of host name to Server structs from a map of
|
||||
// already computed Upstream structs. Each Server is configured with at least
|
||||
// one root location, which uses a default backend if left unspecified.
|
||||
func (n *NGINXController) createServers(data []*extensions.Ingress,
|
||||
upstreams map[string]*ingress.Backend,
|
||||
du *ingress.Backend) map[string]*ingress.Server {
|
||||
|
||||
servers := make(map[string]*ingress.Server, len(data))
|
||||
// If a server has a hostname equivalent to a pre-existing alias, then we
|
||||
// remove the alias to avoid conflicts.
|
||||
aliases := make(map[string]string, len(data))
|
||||
|
||||
bdef := n.store.GetDefaultBackend()
|
||||
|
|
@ -858,15 +849,14 @@ func (n *NGINXController) createServers(data []*extensions.Ingress,
|
|||
defaultPemFileName := n.cfg.FakeCertificatePath
|
||||
defaultPemSHA := n.cfg.FakeCertificateSHA
|
||||
|
||||
// Tries to fetch the default Certificate from nginx configuration.
|
||||
// If it does not exists, use the ones generated on Start()
|
||||
// read custom default SSL certificate, fall back to generated default certificate
|
||||
defaultCertificate, err := n.store.GetLocalSSLCert(n.cfg.DefaultSSLCertificate)
|
||||
if err == nil {
|
||||
defaultPemFileName = defaultCertificate.PemFileName
|
||||
defaultPemSHA = defaultCertificate.PemSHA
|
||||
}
|
||||
|
||||
// initialize the default server
|
||||
// initialize default server and root location
|
||||
servers[defServerName] = &ingress.Server{
|
||||
Hostname: defServerName,
|
||||
SSLCert: ingress.SSLCert{
|
||||
|
|
@ -883,33 +873,34 @@ func (n *NGINXController) createServers(data []*extensions.Ingress,
|
|||
},
|
||||
}}
|
||||
|
||||
// initialize all the servers
|
||||
// initialize all other servers
|
||||
for _, ing := range data {
|
||||
anns, err := n.store.GetIngressAnnotations(ing)
|
||||
if err != nil {
|
||||
glog.Errorf("unexpected error reading ingress annotations: %v", err)
|
||||
glog.Errorf("Error reading Ingress %q annotations from local store: %v", ing.Name, err)
|
||||
}
|
||||
|
||||
// default upstream server
|
||||
// default upstream name
|
||||
un := du.Name
|
||||
|
||||
if ing.Spec.Backend != nil {
|
||||
// replace default backend
|
||||
defUpstream := fmt.Sprintf("%v-%v-%v", ing.GetNamespace(), ing.Spec.Backend.ServiceName, ing.Spec.Backend.ServicePort.String())
|
||||
defUpstream := fmt.Sprintf("%v-%v-%v", ing.Namespace, ing.Spec.Backend.ServiceName, ing.Spec.Backend.ServicePort.String())
|
||||
|
||||
if backendUpstream, ok := upstreams[defUpstream]; ok {
|
||||
// use backend specified in Ingress as the default backend for all its rules
|
||||
un = backendUpstream.Name
|
||||
|
||||
// Special case:
|
||||
// ingress only with a backend and no rules
|
||||
// this case defines a "catch all" server
|
||||
// special "catch all" case, Ingress with a backend but no rule
|
||||
defLoc := servers[defServerName].Locations[0]
|
||||
if defLoc.IsDefBackend && len(ing.Spec.Rules) == 0 {
|
||||
glog.Infof("Ingress \"%v/%v\" defines a backend but no rule. Using it to configure the catch-all server %q", ing.Namespace, ing.Name, defServerName)
|
||||
|
||||
defLoc.IsDefBackend = false
|
||||
defLoc.Backend = backendUpstream.Name
|
||||
defLoc.Service = backendUpstream.Service
|
||||
defLoc.Ingress = ing
|
||||
|
||||
// we need to use the ingress annotations
|
||||
// customize using Ingress annotations
|
||||
defLoc.Logs = anns.Logs
|
||||
defLoc.BasicDigestAuth = anns.BasicDigestAuth
|
||||
defLoc.ClientBodyBufferSize = anns.ClientBodyBufferSize
|
||||
|
|
@ -918,16 +909,17 @@ func (n *NGINXController) createServers(data []*extensions.Ingress,
|
|||
defLoc.ExternalAuth = anns.ExternalAuth
|
||||
defLoc.Proxy = anns.Proxy
|
||||
defLoc.RateLimit = anns.RateLimit
|
||||
// TODO: Redirect and rewrite can affect the catch all behavior. Don't use this annotations for now
|
||||
// TODO: Redirect and rewrite can affect the catch all behavior, skip for now
|
||||
// defLoc.Redirect = anns.Redirect
|
||||
// defLoc.Rewrite = anns.Rewrite
|
||||
defLoc.UpstreamVhost = anns.UpstreamVhost
|
||||
defLoc.VtsFilterKey = anns.VtsFilterKey
|
||||
defLoc.Whitelist = anns.Whitelist
|
||||
defLoc.Denied = anns.Denied
|
||||
defLoc.GRPC = anns.GRPC
|
||||
defLoc.LuaRestyWAF = anns.LuaRestyWAF
|
||||
defLoc.InfluxDB = anns.InfluxDB
|
||||
} else {
|
||||
glog.V(3).Infof("Ingress \"%v/%v\" defines both a backend and rules. Using its backend as default upstream for all its rules.", ing.Namespace, ing.Name)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -963,7 +955,7 @@ func (n *NGINXController) createServers(data []*extensions.Ingress,
|
|||
for _, ing := range data {
|
||||
anns, err := n.store.GetIngressAnnotations(ing)
|
||||
if err != nil {
|
||||
glog.Errorf("unexpected error reading ingress annotations: %v", err)
|
||||
glog.Errorf("Error reading Ingress %q annotations from local store: %v", ing.Name, err)
|
||||
}
|
||||
|
||||
for _, rule := range ing.Spec.Rules {
|
||||
|
|
@ -972,7 +964,6 @@ func (n *NGINXController) createServers(data []*extensions.Ingress,
|
|||
host = defServerName
|
||||
}
|
||||
|
||||
// setup server aliases
|
||||
if anns.Alias != "" {
|
||||
if servers[host].Alias == "" {
|
||||
servers[host].Alias = anns.Alias
|
||||
|
|
@ -980,23 +971,21 @@ func (n *NGINXController) createServers(data []*extensions.Ingress,
|
|||
aliases["Alias"] = host
|
||||
}
|
||||
} else {
|
||||
glog.Warningf("ingress %v/%v for host %v contains an Alias but one has already been configured.",
|
||||
ing.Namespace, ing.Name, host)
|
||||
glog.Warningf("Aliases already configured for server %q, skipping (Ingress \"%v/%v\")",
|
||||
host, ing.Namespace, ing.Name)
|
||||
}
|
||||
}
|
||||
|
||||
//notifying the user that it has already been configured.
|
||||
if servers[host].ServerSnippet != "" && anns.ServerSnippet != "" {
|
||||
glog.Warningf("ingress %v/%v for host %v contains a Server Snippet section that it has already been configured.",
|
||||
ing.Namespace, ing.Name, host)
|
||||
if anns.ServerSnippet != "" {
|
||||
if servers[host].ServerSnippet == "" {
|
||||
servers[host].ServerSnippet = anns.ServerSnippet
|
||||
} else {
|
||||
glog.Warningf("Server snippet already configured for server %q, skipping (Ingress \"%v/%v\")",
|
||||
host, ing.Namespace, ing.Name)
|
||||
}
|
||||
}
|
||||
|
||||
// only add a server snippet if the server does not have one previously configured
|
||||
if servers[host].ServerSnippet == "" && anns.ServerSnippet != "" {
|
||||
servers[host].ServerSnippet = anns.ServerSnippet
|
||||
}
|
||||
|
||||
// only add ssl ciphers if the server does not have one previously configured
|
||||
// only add SSL ciphers if the server does not have them previously configured
|
||||
if servers[host].SSLCiphers == "" && anns.SSLCiphers != "" {
|
||||
servers[host].SSLCiphers = anns.SSLCiphers
|
||||
}
|
||||
|
|
@ -1007,14 +996,14 @@ func (n *NGINXController) createServers(data []*extensions.Ingress,
|
|||
}
|
||||
|
||||
if len(ing.Spec.TLS) == 0 {
|
||||
glog.V(3).Infof("ingress %v/%v for host %v does not contains a TLS section", ing.Namespace, ing.Name, host)
|
||||
glog.V(3).Infof("Ingress \"%v/%v\" does not contains a TLS section.", ing.Namespace, ing.Name)
|
||||
continue
|
||||
}
|
||||
|
||||
tlsSecretName := extractTLSSecretName(host, ing, n.store.GetLocalSSLCert)
|
||||
|
||||
if tlsSecretName == "" {
|
||||
glog.V(3).Infof("host %v is listed on tls section but secretName is empty. Using default cert", host)
|
||||
glog.V(3).Infof("Host %q is listed in the TLS section but secretName is empty. Using default certificate.", host)
|
||||
servers[host].SSLCert.PemFileName = defaultPemFileName
|
||||
servers[host].SSLCert.PemSHA = defaultPemSHA
|
||||
continue
|
||||
|
|
@ -1023,19 +1012,19 @@ func (n *NGINXController) createServers(data []*extensions.Ingress,
|
|||
key := fmt.Sprintf("%v/%v", ing.Namespace, tlsSecretName)
|
||||
cert, err := n.store.GetLocalSSLCert(key)
|
||||
if err != nil {
|
||||
glog.Warningf("ssl certificate \"%v\" does not exist in local store", key)
|
||||
glog.Warningf("SSL certificate %q does not exist in local store.", key)
|
||||
continue
|
||||
}
|
||||
|
||||
err = cert.Certificate.VerifyHostname(host)
|
||||
if err != nil {
|
||||
glog.Warningf("unexpected error validating SSL certificate %v for host %v. Reason: %v", key, host, err)
|
||||
glog.Warningf("Unexpected error validating SSL certificate %q for server %q: %v", key, host, err)
|
||||
glog.Warningf("Validating certificate against DNS names. This will be deprecated in a future version.")
|
||||
// check the common name field
|
||||
// check the Common Name field
|
||||
// https://github.com/golang/go/issues/22922
|
||||
err := verifyHostname(host, cert.Certificate)
|
||||
if err != nil {
|
||||
glog.Warningf("ssl certificate %v does not contain a Common Name or Subject Alternative Name for host %v. Reason: %v", key, host, err)
|
||||
glog.Warningf("SSL certificate %q does not contain a Common Name or Subject Alternative Name for server %q: %v", key, host, err)
|
||||
continue
|
||||
}
|
||||
}
|
||||
|
|
@ -1043,14 +1032,14 @@ func (n *NGINXController) createServers(data []*extensions.Ingress,
|
|||
servers[host].SSLCert = *cert
|
||||
|
||||
if cert.ExpireTime.Before(time.Now().Add(240 * time.Hour)) {
|
||||
glog.Warningf("ssl certificate for host %v is about to expire in 10 days", host)
|
||||
glog.Warningf("SSL certificate for server %q is about to expire (%v)", cert.ExpireTime)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for alias, host := range aliases {
|
||||
if _, ok := servers[alias]; ok {
|
||||
glog.Warningf("There is a conflict with server hostname '%v' and alias '%v' (in server %v). Removing alias to avoid conflicts.", alias, host)
|
||||
glog.Warningf("Conflicting hostname (%v) and alias (%v) in server %q. Removing alias to avoid conflicts.", alias, host)
|
||||
servers[host].Alias = ""
|
||||
}
|
||||
}
|
||||
|
|
@ -1058,43 +1047,28 @@ func (n *NGINXController) createServers(data []*extensions.Ingress,
|
|||
return servers
|
||||
}
|
||||
|
||||
func (n *NGINXController) isForceReload() bool {
|
||||
return atomic.LoadInt32(&n.forceReload) != 0
|
||||
}
|
||||
|
||||
// SetForceReload sets if the ingress controller should be reloaded or not
|
||||
func (n *NGINXController) SetForceReload(shouldReload bool) {
|
||||
if shouldReload {
|
||||
atomic.StoreInt32(&n.forceReload, 1)
|
||||
n.syncQueue.Enqueue(&extensions.Ingress{})
|
||||
} else {
|
||||
atomic.StoreInt32(&n.forceReload, 0)
|
||||
}
|
||||
}
|
||||
|
||||
// extractTLSSecretName returns the name of the secret that
|
||||
// contains a SSL certificate for a particular hostname.
|
||||
// In case there is no match, an empty string is returned.
|
||||
// extractTLSSecretName returns the name of the Secret containing a SSL
|
||||
// certificate for the given host name, or an empty string.
|
||||
func extractTLSSecretName(host string, ing *extensions.Ingress,
|
||||
getLocalSSLCert func(string) (*ingress.SSLCert, error)) string {
|
||||
|
||||
if ing == nil {
|
||||
return ""
|
||||
}
|
||||
|
||||
// naively return Secret name from TLS spec if host name matches
|
||||
for _, tls := range ing.Spec.TLS {
|
||||
if sets.NewString(tls.Hosts...).Has(host) {
|
||||
return tls.SecretName
|
||||
}
|
||||
}
|
||||
|
||||
// contains a TLS section but none of the host match or there
|
||||
// is no hosts in the TLS section. As last resort we valide
|
||||
// the host against the certificate and we use it if is valid
|
||||
// no TLS host matching host name, try each TLS host for matching CN
|
||||
for _, tls := range ing.Spec.TLS {
|
||||
key := fmt.Sprintf("%v/%v", ing.Namespace, tls.SecretName)
|
||||
cert, err := getLocalSSLCert(key)
|
||||
if err != nil {
|
||||
glog.Warningf("ssl certificate \"%v\" does not exist in local store", key)
|
||||
glog.Warningf("SSL certificate %q does not exist in local store.", key)
|
||||
continue
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue