Rename controller to nginx

2016-03-27 22:12:15 -03:00 · 2016-03-27 22:12:15 -03:00 · b7dee6f95c
commit b7dee6f95c
parent 41c34bd9e8
47 changed files with 24 additions and 24 deletions
--- a/controllers/nginx/nginx/command.go
+++ b/controllers/nginx/nginx/command.go
@ -0,0 +1,110 @@
+/*
+Copyright 2015 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package nginx
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"os/exec"
+
+	"github.com/golang/glog"
+
+	"k8s.io/kubernetes/pkg/healthz"
+)
+
+// Start starts a nginx (master process) and waits. If the process ends
+// we need to kill the controller process and return the reason.
+func (ngx *Manager) Start() {
+	glog.Info("Starting NGINX process...")
+	cmd := exec.Command("nginx")
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	if err := cmd.Start(); err != nil {
+		glog.Errorf("nginx error: %v", err)
+	}
+
+	if err := cmd.Wait(); err != nil {
+		glog.Errorf("nginx error: %v", err)
+	}
+}
+
+// CheckAndReload verify if the nginx configuration changed and sends a reload
+//
+// the master process receives the signal to reload configuration, it checks
+// the syntax validity of the new configuration file and tries to apply the
+// configuration provided in it. If this is a success, the master process starts
+// new worker processes and sends messages to old worker processes, requesting them
+// to shut down. Otherwise, the master process rolls back the changes and continues
+// to work with the old configuration. Old worker processes, receiving a command to
+// shut down, stop accepting new connections and continue to service current requests
+// until all such requests are serviced. After that, the old worker processes exit.
+// http://nginx.org/en/docs/beginners_guide.html#control
+func (ngx *Manager) CheckAndReload(cfg nginxConfiguration, ingressCfg IngressConfig) {
+	ngx.reloadRateLimiter.Accept()
+
+	ngx.reloadLock.Lock()
+	defer ngx.reloadLock.Unlock()
+
+	newCfg, err := ngx.writeCfg(cfg, ingressCfg)
+
+	if err != nil {
+		glog.Errorf("failed to write new nginx configuration. Avoiding reload: %v", err)
+		return
+	}
+
+	if newCfg {
+		if err := ngx.shellOut("nginx -s reload"); err == nil {
+			glog.Info("change in configuration detected. Reloading...")
+		}
+	}
+}
+
+// shellOut executes a command and returns its combined standard output and standard
+// error in case of an error in the execution
+func (ngx *Manager) shellOut(cmd string) error {
+	out, err := exec.Command("sh", "-c", cmd).CombinedOutput()
+	if err != nil {
+		glog.Errorf("failed to execute %v: %v", cmd, string(out))
+		return err
+	}
+
+	return nil
+}
+
+// check to verify Manager implements HealthzChecker interface
+var _ healthz.HealthzChecker = Manager{}
+
+// Name returns the healthcheck name
+func (ngx Manager) Name() string {
+	return "NGINX"
+}
+
+// Check returns if the nginx healthz endpoint is returning ok (status code 200)
+func (ngx Manager) Check(_ *http.Request) error {
+	res, err := http.Get("http://127.0.0.1:8080/healthz")
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode != 200 {
+		return fmt.Errorf("NGINX is unhealthy")
+	}
+
+	return nil
+}
--- a/controllers/nginx/nginx/main.go
+++ b/controllers/nginx/nginx/main.go
@ -0,0 +1,315 @@
+/*
+Copyright 2015 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package nginx
+
+import (
+	"fmt"
+	"os"
+	"runtime"
+	"strconv"
+	"strings"
+	"sync"
+	"text/template"
+
+	"github.com/golang/glog"
+
+	"github.com/fatih/structs"
+	"github.com/ghodss/yaml"
+
+	"k8s.io/kubernetes/pkg/api"
+	client "k8s.io/kubernetes/pkg/client/unversioned"
+	"k8s.io/kubernetes/pkg/util"
+)
+
+const (
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
+	// Sets the maximum allowed size of the client request body
+	bodySize = "1m"
+
+	// http://nginx.org/en/docs/ngx_core_module.html#error_log
+	// Configures logging level [debug | info | notice | warn | error | crit | alert | emerg]
+	// Log levels above are listed in the order of increasing severity
+	errorLevel = "notice"
+
+	// HTTP Strict Transport Security (often abbreviated as HSTS) is a security feature (HTTP header)
+	// that tell browsers that it should only be communicated with using HTTPS, instead of using HTTP.
+	// https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
+	// max-age is the time, in seconds, that the browser should remember that this site is only to be accessed using HTTPS.
+	htsMaxAge = "15724800"
+
+	// If UseProxyProtocol is enabled defIPCIDR defines the default the IP/network address of your external load balancer
+	defIPCIDR = "0.0.0.0/0"
+
+	gzipTypes = "application/atom+xml application/javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component"
+
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size
+	// Sets the size of the buffer used for sending data.
+	// 4k helps NGINX to improve TLS Time To First Byte (TTTFB)
+	// https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/
+	sslBufferSize = "4k"
+
+	// Enabled ciphers list to enabled. The ciphers are specified in the format understood by the OpenSSL library
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers
+	sslCiphers = "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
+
+	// SSL enabled protocols to use
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols
+	sslProtocols = "TLSv1 TLSv1.1 TLSv1.2"
+
+	// Time during which a client may reuse the session parameters stored in a cache.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_timeout
+	sslSessionTimeout = "10m"
+
+	// Size of the SSL shared cache between all worker processes.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
+	sslSessionCacheSize = "10m"
+
+	// Base directory that contains the mounted secrets with SSL certificates, keys and
+	sslDirectory = "/etc/nginx-ssl"
+)
+
+type nginxConfiguration struct {
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
+	// Sets the maximum allowed size of the client request body
+	BodySize string `structs:"body-size,omitempty"`
+
+	// EnableVtsStatus allows the replacement of the default status page with a third party module named
+	// nginx-module-vts - https://github.com/vozlt/nginx-module-vts
+	// By default this is disabled
+	EnableVtsStatus bool `structs:"enable-vts-status,omitempty"`
+
+	VtsStatusZoneSize string `structs:"vts-status-zone-size,omitempty"`
+
+	// http://nginx.org/en/docs/ngx_core_module.html#error_log
+	// Configures logging level [debug | info | notice | warn | error | crit | alert | emerg]
+	// Log levels above are listed in the order of increasing severity
+	ErrorLogLevel string `structs:"error-log-level,omitempty"`
+
+	// Enables or disables the header HTS in servers running SSL
+	UseHTS bool `structs:"use-hts,omitempty"`
+
+	// Enables or disables the use of HTS in all the subdomains of the servername
+	HTSIncludeSubdomains bool `structs:"hts-include-subdomains,omitempty"`
+
+	// HTTP Strict Transport Security (often abbreviated as HSTS) is a security feature (HTTP header)
+	// that tell browsers that it should only be communicated with using HTTPS, instead of using HTTP.
+	// https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
+	// max-age is the time, in seconds, that the browser should remember that this site is only to be
+	// accessed using HTTPS.
+	HTSMaxAge string `structs:"hts-max-age,omitempty"`
+
+	// Time during which a keep-alive client connection will stay open on the server side.
+	// The zero value disables keep-alive client connections
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout
+	KeepAlive int `structs:"keep-alive,omitempty"`
+
+	// Maximum number of simultaneous connections that can be opened by each worker process
+	// http://nginx.org/en/docs/ngx_core_module.html#worker_connections
+	MaxWorkerConnections int `structs:"max-worker-connections,omitempty"`
+
+	// Defines a timeout for establishing a connection with a proxied server.
+	// It should be noted that this timeout cannot usually exceed 75 seconds.
+	// http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout
+	ProxyConnectTimeout int `structs:"proxy-connect-timeout,omitempty"`
+
+	// If UseProxyProtocol is enabled ProxyRealIPCIDR defines the default the IP/network address
+	// of your external load balancer
+	ProxyRealIPCIDR string `structs:"proxy-real-ip-cidr,omitempty"`
+
+	// Timeout in seconds for reading a response from the proxied server. The timeout is set only between
+	// two successive read operations, not for the transmission of the whole response
+	// http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout
+	ProxyReadTimeout int `structs:"proxy-read-timeout,omitempty"`
+
+	// Timeout in seconds for transmitting a request to the proxied server. The timeout is set only between
+	// two successive write operations, not for the transmission of the whole request.
+	// http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout
+	ProxySendTimeout int `structs:"proxy-send-timeout,omitempty"`
+
+	// Configures name servers used to resolve names of upstream servers into addresses
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#resolver
+	Resolver string `structs:"resolver,omitempty"`
+
+	// Maximum size of the server names hash tables used in server names, map directive’s values,
+	// MIME types, names of request header strings, etcd.
+	// http://nginx.org/en/docs/hash.html
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_max_size
+	ServerNameHashMaxSize int `structs:"server-name-hash-max-size,omitempty"`
+
+	// Size of the bucker for the server names hash tables
+	// http://nginx.org/en/docs/hash.html
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_bucket_size
+	ServerNameHashBucketSize int `structs:"server-name-hash-bucket-size,omitempty"`
+
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size
+	// Sets the size of the buffer used for sending data.
+	// 4k helps NGINX to improve TLS Time To First Byte (TTTFB)
+	// https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/
+	SSLBufferSize string `structs:"ssl-buffer-size,omitempty"`
+
+	// Enabled ciphers list to enabled. The ciphers are specified in the format understood by
+	// the OpenSSL library
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers
+	SSLCiphers string `structs:"ssl-ciphers,omitempty"`
+
+	// Base64 string that contains Diffie-Hellman key to help with "Perfect Forward Secrecy"
+	// https://www.openssl.org/docs/manmaster/apps/dhparam.html
+	// https://wiki.mozilla.org/Security/Server_Side_TLS#DHE_handshake_and_dhparam
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam
+	SSLDHParam string `structs:"ssl-dh-param,omitempty"`
+
+	// SSL enabled protocols to use
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols
+	SSLProtocols string `structs:"ssl-protocols,omitempty"`
+
+	// Enables or disables the use of shared SSL cache among worker processes.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
+	SSLSessionCache bool `structs:"ssl-session-cache,omitempty"`
+
+	// Size of the SSL shared cache between all worker processes.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
+	SSLSessionCacheSize string `structs:"ssl-session-cache-size,omitempty"`
+
+	// Enables or disables session resumption through TLS session tickets.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets
+	SSLSessionTickets bool `structs:"ssl-session-tickets,omitempty"`
+
+	// Time during which a client may reuse the session parameters stored in a cache.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_timeout
+	SSLSessionTimeout string `structs:"ssl-session-timeout,omitempty"`
+
+	// Enables or disables the use of the PROXY protocol to receive client connection
+	// (real IP address) information passed through proxy servers and load balancers
+	// such as HAproxy and Amazon Elastic Load Balancer (ELB).
+	// https://www.nginx.com/resources/admin-guide/proxy-protocol/
+	UseProxyProtocol bool `structs:"use-proxy-protocol,omitempty"`
+
+	// Enables or disables the use of the nginx module that compresses responses using the "gzip" method
+	// http://nginx.org/en/docs/http/ngx_http_gzip_module.html
+	UseGzip bool `structs:"use-gzip,omitempty"`
+
+	// MIME types in addition to "text/html" to compress. The special value “*” matches any MIME type.
+	// Responses with the “text/html” type are always compressed if UseGzip is enabled
+	GzipTypes string `structs:"gzip-types,omitempty"`
+
+	// Defines the number of worker processes. By default auto means number of available CPU cores
+	// http://nginx.org/en/docs/ngx_core_module.html#worker_processes
+	WorkerProcesses string `structs:"worker-processes,omitempty"`
+}
+
+// Manager ...
+type Manager struct {
+	ConfigFile string
+
+	defCfg nginxConfiguration
+
+	defResolver string
+
+	sslDHParam string
+
+	reloadRateLimiter util.RateLimiter
+
+	// template loaded ready to be used to generate the nginx configuration file
+	template *template.Template
+
+	reloadLock *sync.Mutex
+}
+
+// defaultConfiguration returns the default configuration contained
+// in the file default-conf.json
+func newDefaultNginxCfg() nginxConfiguration {
+	cfg := nginxConfiguration{
+		BodySize:                 bodySize,
+		ErrorLogLevel:            errorLevel,
+		UseHTS:                   true,
+		HTSIncludeSubdomains:     true,
+		HTSMaxAge:                htsMaxAge,
+		GzipTypes:                gzipTypes,
+		KeepAlive:                75,
+		MaxWorkerConnections:     16384,
+		ProxyConnectTimeout:      5,
+		ProxyRealIPCIDR:          defIPCIDR,
+		ProxyReadTimeout:         60,
+		ProxySendTimeout:         60,
+		ServerNameHashMaxSize:    512,
+		ServerNameHashBucketSize: 64,
+		SSLBufferSize:            sslBufferSize,
+		SSLCiphers:               sslCiphers,
+		SSLProtocols:             sslProtocols,
+		SSLSessionCache:          true,
+		SSLSessionCacheSize:      sslSessionCacheSize,
+		SSLSessionTickets:        true,
+		SSLSessionTimeout:        sslSessionTimeout,
+		UseProxyProtocol:         false,
+		UseGzip:                  true,
+		WorkerProcesses:          strconv.Itoa(runtime.NumCPU()),
+		VtsStatusZoneSize:        "10m",
+	}
+
+	if glog.V(5) {
+		cfg.ErrorLogLevel = "debug"
+	}
+
+	return cfg
+}
+
+// NewManager ...
+func NewManager(kubeClient *client.Client) *Manager {
+	ngx := &Manager{
+		ConfigFile:        "/etc/nginx/nginx.conf",
+		defCfg:            newDefaultNginxCfg(),
+		defResolver:       strings.Join(getDNSServers(), " "),
+		reloadLock:        &sync.Mutex{},
+		reloadRateLimiter: util.NewTokenBucketRateLimiter(0.1, 1),
+	}
+
+	ngx.createCertsDir(sslDirectory)
+
+	ngx.sslDHParam = ngx.SearchDHParamFile(sslDirectory)
+
+	ngx.loadTemplate()
+
+	return ngx
+}
+
+func (nginx *Manager) createCertsDir(base string) {
+	if err := os.Mkdir(base, os.ModeDir); err != nil {
+		glog.Fatalf("Couldn't create directory %v: %v", base, err)
+	}
+}
+
+// ConfigMapAsString returns a ConfigMap with the default NGINX
+// configuration to be used a guide to provide a custom configuration
+func ConfigMapAsString() string {
+	cfg := &api.ConfigMap{}
+	cfg.Name = "custom-name"
+	cfg.Namespace = "a-valid-namespace"
+	cfg.Data = make(map[string]string)
+
+	data := structs.Map(newDefaultNginxCfg())
+	for k, v := range data {
+		cfg.Data[k] = fmt.Sprintf("%v", v)
+	}
+
+	out, err := yaml.Marshal(cfg)
+	if err != nil {
+		glog.Warningf("Unexpected error creating default configuration: %v", err)
+		return ""
+	}
+
+	return string(out)
+}
--- a/controllers/nginx/nginx/nginx.go
+++ b/controllers/nginx/nginx/nginx.go
@ -0,0 +1,108 @@
+/*
+Copyright 2015 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package nginx
+
+// IngressConfig describes an NGINX configuration
+type IngressConfig struct {
+	Upstreams    []*Upstream
+	Servers      []*Server
+	TCPUpstreams []*Location
+}
+
+// Upstream describes an NGINX upstream
+type Upstream struct {
+	Name     string
+	Backends []UpstreamServer
+}
+
+// UpstreamByNameServers sorts upstreams by name
+type UpstreamByNameServers []*Upstream
+
+func (c UpstreamByNameServers) Len() int      { return len(c) }
+func (c UpstreamByNameServers) Swap(i, j int) { c[i], c[j] = c[j], c[i] }
+func (c UpstreamByNameServers) Less(i, j int) bool {
+	return c[i].Name < c[j].Name
+}
+
+// UpstreamServer describes a server in an NGINX upstream
+type UpstreamServer struct {
+	Address string
+	Port    string
+}
+
+// UpstreamServerByAddrPort sorts upstream servers by address and port
+type UpstreamServerByAddrPort []UpstreamServer
+
+func (c UpstreamServerByAddrPort) Len() int      { return len(c) }
+func (c UpstreamServerByAddrPort) Swap(i, j int) { c[i], c[j] = c[j], c[i] }
+func (c UpstreamServerByAddrPort) Less(i, j int) bool {
+	iName := c[i].Address
+	jName := c[j].Address
+	if iName != jName {
+		return iName < jName
+	}
+
+	iU := c[i].Port
+	jU := c[j].Port
+	return iU < jU
+}
+
+// Server describes an NGINX server
+type Server struct {
+	Name              string
+	Locations         []*Location
+	SSL               bool
+	SSLCertificate    string
+	SSLCertificateKey string
+}
+
+// ServerByName sorts server by name
+type ServerByName []*Server
+
+func (c ServerByName) Len() int      { return len(c) }
+func (c ServerByName) Swap(i, j int) { c[i], c[j] = c[j], c[i] }
+func (c ServerByName) Less(i, j int) bool {
+	return c[i].Name < c[j].Name
+}
+
+// Location describes an NGINX location
+type Location struct {
+	Path     string
+	Upstream Upstream
+}
+
+// LocationByPath sorts location by path
+type LocationByPath []*Location
+
+func (c LocationByPath) Len() int      { return len(c) }
+func (c LocationByPath) Swap(i, j int) { c[i], c[j] = c[j], c[i] }
+func (c LocationByPath) Less(i, j int) bool {
+	return c[i].Path < c[j].Path
+}
+
+// NewDefaultServer return an UpstreamServer to be use as default server that returns 503.
+func NewDefaultServer() UpstreamServer {
+	return UpstreamServer{Address: "127.0.0.1", Port: "8181"}
+}
+
+// NewUpstream creates an upstream without servers.
+func NewUpstream(name string) *Upstream {
+	return &Upstream{
+		Name:     name,
+		Backends: []UpstreamServer{},
+	}
+}
--- a/controllers/nginx/nginx/ssl.go
+++ b/controllers/nginx/nginx/ssl.go
@ -0,0 +1,92 @@
+/*
+Copyright 2015 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package nginx
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"io/ioutil"
+	"os"
+
+	"github.com/golang/glog"
+)
+
+// AddOrUpdateCertAndKey creates a .pem file wth the cert and the key with the specified name
+func (nginx *Manager) AddOrUpdateCertAndKey(name string, cert string, key string) string {
+	pemFileName := sslDirectory + "/" + name + ".pem"
+
+	pem, err := os.Create(pemFileName)
+	if err != nil {
+		glog.Fatalf("Couldn't create pem file %v: %v", pemFileName, err)
+	}
+	defer pem.Close()
+
+	_, err = pem.WriteString(fmt.Sprintf("%v\n%v", key, cert))
+	if err != nil {
+		glog.Fatalf("Couldn't write to pem file %v: %v", pemFileName, err)
+	}
+
+	return pemFileName
+}
+
+// CheckSSLCertificate checks if the certificate and key file are valid
+// returning the result of the validation and the list of hostnames
+// contained in the common name/s
+func (nginx *Manager) CheckSSLCertificate(pemFileName string) ([]string, error) {
+	pemCerts, err := ioutil.ReadFile(pemFileName)
+	if err != nil {
+		return []string{}, err
+	}
+
+	var block *pem.Block
+	block, _ = pem.Decode(pemCerts)
+
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return []string{}, err
+	}
+
+	cn := []string{cert.Subject.CommonName}
+	if len(cert.DNSNames) > 0 {
+		cn = append(cn, cert.DNSNames...)
+	}
+
+	glog.V(2).Infof("DNS %v %v\n", cn, len(cn))
+	return cn, nil
+}
+
+// SearchDHParamFile iterates all the secrets mounted inside the /etc/nginx-ssl directory
+// in order to find a file with the name dhparam.pem. If such file exists it will
+// returns the path. If not it just returns an empty string
+func (nginx *Manager) SearchDHParamFile(baseDir string) string {
+	files, _ := ioutil.ReadDir(baseDir)
+	for _, file := range files {
+		if !file.IsDir() {
+			continue
+		}
+
+		dhPath := fmt.Sprintf("%v/%v/dhparam.pem", baseDir, file.Name())
+		if _, err := os.Stat(dhPath); err == nil {
+			glog.Infof("using file '%v' for parameter ssl_dhparam", dhPath)
+			return dhPath
+		}
+	}
+
+	glog.Warning("no file dhparam.pem found in secrets")
+	return ""
+}
--- a/controllers/nginx/nginx/template.go
+++ b/controllers/nginx/nginx/template.go
@ -0,0 +1,104 @@
+/*
+Copyright 2015 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package nginx
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"regexp"
+	"text/template"
+
+	"github.com/fatih/structs"
+	"github.com/golang/glog"
+)
+
+var (
+	camelRegexp = regexp.MustCompile("[0-9A-Za-z]+")
+
+	funcMap = template.FuncMap{
+		"empty": func(input interface{}) bool {
+			check, ok := input.(string)
+			if ok {
+				return len(check) == 0
+			}
+
+			return true
+		},
+	}
+)
+
+func (ngx *Manager) loadTemplate() {
+	tmpl, _ := template.New("nginx.tmpl").Funcs(funcMap).ParseFiles("./nginx.tmpl")
+	ngx.template = tmpl
+}
+
+func (ngx *Manager) writeCfg(cfg nginxConfiguration, ingressCfg IngressConfig) (bool, error) {
+	fromMap := structs.Map(cfg)
+	toMap := structs.Map(ngx.defCfg)
+	curNginxCfg := merge(toMap, fromMap)
+
+	conf := make(map[string]interface{})
+	conf["upstreams"] = ingressCfg.Upstreams
+	conf["servers"] = ingressCfg.Servers
+	conf["tcpUpstreams"] = ingressCfg.TCPUpstreams
+	conf["defResolver"] = ngx.defResolver
+	conf["sslDHParam"] = ngx.sslDHParam
+	conf["cfg"] = fixKeyNames(curNginxCfg)
+
+	buffer := new(bytes.Buffer)
+	err := ngx.template.Execute(buffer, conf)
+	if err != nil {
+		glog.Infof("NGINX error: %v", err)
+		return false, err
+	}
+
+	if glog.V(3) {
+		b, err := json.Marshal(conf)
+		if err != nil {
+			fmt.Println("error:", err)
+		}
+		glog.Infof("NGINX configuration: %v", string(b))
+	}
+
+	changed, err := ngx.needsReload(buffer)
+	if err != nil {
+		return false, err
+	}
+
+	return changed, nil
+}
+
+func fixKeyNames(data map[string]interface{}) map[string]interface{} {
+	fixed := make(map[string]interface{})
+	for k, v := range data {
+		fixed[toCamelCase(k)] = v
+	}
+
+	return fixed
+}
+
+func toCamelCase(src string) string {
+	byteSrc := []byte(src)
+	chunks := camelRegexp.FindAll(byteSrc, -1)
+	for idx, val := range chunks {
+		if idx > 0 {
+			chunks[idx] = bytes.Title(val)
+		}
+	}
+	return string(bytes.Join(chunks, nil))
+}
--- a/controllers/nginx/nginx/utils.go
+++ b/controllers/nginx/nginx/utils.go
@ -0,0 +1,173 @@
+/*
+Copyright 2015 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package nginx
+
+import (
+	"bytes"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"reflect"
+	"strings"
+
+	"github.com/golang/glog"
+
+	"github.com/mitchellh/mapstructure"
+	"k8s.io/kubernetes/pkg/api"
+)
+
+// getDNSServers returns the list of nameservers located in the file /etc/resolv.conf
+func getDNSServers() []string {
+	file, err := ioutil.ReadFile("/etc/resolv.conf")
+	if err != nil {
+		return []string{}
+	}
+
+	// Lines of the form "nameserver 1.2.3.4" accumulate.
+	nameservers := []string{}
+
+	lines := strings.Split(string(file), "\n")
+	for l := range lines {
+		trimmed := strings.TrimSpace(lines[l])
+		if strings.HasPrefix(trimmed, "#") {
+			continue
+		}
+		fields := strings.Fields(trimmed)
+		if len(fields) == 0 {
+			continue
+		}
+		if fields[0] == "nameserver" {
+			nameservers = append(nameservers, fields[1:]...)
+		}
+	}
+
+	glog.V(3).Infof("nameservers to use: %v", nameservers)
+	return nameservers
+}
+
+// ReadConfig obtains the configuration defined by the user merged with the defaults.
+func (ngx *Manager) ReadConfig(config *api.ConfigMap) nginxConfiguration {
+	if len(config.Data) == 0 {
+		return newDefaultNginxCfg()
+	}
+
+	cfg := newDefaultNginxCfg()
+
+	decoder, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
+		TagName:          "structs",
+		Result:           &cfg,
+		WeaklyTypedInput: true,
+	})
+
+	err = decoder.Decode(config.Data)
+	if err != nil {
+		glog.Infof("%v", err)
+	}
+
+	return cfg
+}
+
+func (ngx *Manager) needsReload(data *bytes.Buffer) (bool, error) {
+	filename := ngx.ConfigFile
+	in, err := os.Open(filename)
+	if err != nil {
+		return false, err
+	}
+
+	src, err := ioutil.ReadAll(in)
+	in.Close()
+	if err != nil {
+		return false, err
+	}
+
+	res := data.Bytes()
+	if !bytes.Equal(src, res) {
+		err = ioutil.WriteFile(filename, res, 0644)
+		if err != nil {
+			return false, err
+		}
+
+		dData, err := diff(src, res)
+		if err != nil {
+			glog.Errorf("error computing diff: %s", err)
+			return true, nil
+		}
+
+		if glog.V(2) {
+			glog.Infof("NGINX configuration diff a/%s b/%s\n", filename, filename)
+			glog.Infof("%v", string(dData))
+		}
+
+		return len(dData) > 0, nil
+	}
+
+	return false, nil
+}
+
+func diff(b1, b2 []byte) (data []byte, err error) {
+	f1, err := ioutil.TempFile("", "")
+	if err != nil {
+		return
+	}
+	defer os.Remove(f1.Name())
+	defer f1.Close()
+
+	f2, err := ioutil.TempFile("", "")
+	if err != nil {
+		return
+	}
+	defer os.Remove(f2.Name())
+	defer f2.Close()
+
+	f1.Write(b1)
+	f2.Write(b2)
+
+	data, err = exec.Command("diff", "-u", f1.Name(), f2.Name()).CombinedOutput()
+	if len(data) > 0 {
+		err = nil
+	}
+	return
+}
+
+func merge(dst, src map[string]interface{}) map[string]interface{} {
+	for key, srcVal := range src {
+		if dstVal, ok := dst[key]; ok {
+			srcMap, srcMapOk := toMap(srcVal)
+			dstMap, dstMapOk := toMap(dstVal)
+			if srcMapOk && dstMapOk {
+				srcVal = merge(dstMap, srcMap)
+			}
+		}
+		dst[key] = srcVal
+	}
+
+	return dst
+}
+
+func toMap(iface interface{}) (map[string]interface{}, bool) {
+	value := reflect.ValueOf(iface)
+	if value.Kind() == reflect.Map {
+		m := map[string]interface{}{}
+		for _, k := range value.MapKeys() {
+			m[k.String()] = value.MapIndex(k).Interface()
+		}
+
+		return m, true
+	}
+
+	return map[string]interface{}{}, false
+}