Update dependencies

pkg/ingress/annotations/alias/main.go

@@ -0,0 +1,41 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package alias
+
+import (
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+)
+
+const (
+	annotation = "ingress.kubernetes.io/server-alias"
+)
+
+type alias struct {
+}
+
+// NewParser creates a new Alias annotation parser
+func NewParser() parser.IngressAnnotation {
+	return alias{}
+}
+
+// Parse parses the annotations contained in the ingress rule
+// used to add an alias to the provided hosts
+func (a alias) Parse(ing *extensions.Ingress) (interface{}, error) {
+	return parser.GetStringAnnotation(annotation, ing)
+}

pkg/ingress/annotations/alias/main_test.go

@@ -0,0 +1,60 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package alias
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestParse(t *testing.T) {
+	ap := NewParser()
+	if ap == nil {
+		t.Fatalf("expected a parser.IngressAnnotation but returned nil")
+	}
+
+	testCases := []struct {
+		annotations map[string]string
+		expected    string
+	}{
+		{map[string]string{annotation: "www.example.com"}, "www.example.com"},
+		{map[string]string{annotation: "*.example.com www.example.*"}, "*.example.com www.example.*"},
+		{map[string]string{annotation: `~^www\d+\.example\.com$`}, `~^www\d+\.example\.com$`},
+		{map[string]string{annotation: ""}, ""},
+		{map[string]string{}, ""},
+		{nil, ""},
+	}
+
+	ing := &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{},
+	}
+
+	for _, testCase := range testCases {
+		ing.SetAnnotations(testCase.annotations)
+		result, _ := ap.Parse(ing)
+		if result != testCase.expected {
+			t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations)
+		}
+	}
+}

pkg/ingress/annotations/auth/main.go

@@ -0,0 +1,171 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path"
+	"regexp"
+
+	"github.com/pkg/errors"
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/file"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	ing_errors "k8s.io/ingress-nginx/pkg/ingress/errors"
+	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+)
+
+const (
+	authType   = "ingress.kubernetes.io/auth-type"
+	authSecret = "ingress.kubernetes.io/auth-secret"
+	authRealm  = "ingress.kubernetes.io/auth-realm"
+)
+
+var (
+	authTypeRegex = regexp.MustCompile(`basic|digest`)
+	// AuthDirectory default directory used to store files
+	// to authenticate request
+	AuthDirectory = "/etc/ingress-controller/auth"
+)
+
+// BasicDigest returns authentication configuration for an Ingress rule
+type BasicDigest struct {
+	Type    string `json:"type"`
+	Realm   string `json:"realm"`
+	File    string `json:"file"`
+	Secured bool   `json:"secured"`
+	FileSHA string `json:"fileSha"`
+}
+
+// Equal tests for equality between two BasicDigest types
+func (bd1 *BasicDigest) Equal(bd2 *BasicDigest) bool {
+	if bd1 == bd2 {
+		return true
+	}
+	if bd1 == nil || bd2 == nil {
+		return false
+	}
+	if bd1.Type != bd2.Type {
+		return false
+	}
+	if bd1.Realm != bd2.Realm {
+		return false
+	}
+	if bd1.File != bd2.File {
+		return false
+	}
+	if bd1.Secured != bd2.Secured {
+		return false
+	}
+	if bd1.FileSHA != bd2.FileSHA {
+		return false
+	}
+
+	return true
+}
+
+type auth struct {
+	secretResolver resolver.Secret
+	authDirectory  string
+}
+
+// NewParser creates a new authentication annotation parser
+func NewParser(authDirectory string, sr resolver.Secret) parser.IngressAnnotation {
+	os.MkdirAll(authDirectory, 0755)
+
+	currPath := authDirectory
+	for currPath != "/" {
+		currPath = path.Dir(currPath)
+		err := os.Chmod(currPath, 0755)
+		if err != nil {
+			break
+		}
+	}
+
+	return auth{sr, authDirectory}
+}
+
+// Parse parses the annotations contained in the ingress
+// rule used to add authentication in the paths defined in the rule
+// and generated an htpasswd compatible file to be used as source
+// during the authentication process
+func (a auth) Parse(ing *extensions.Ingress) (interface{}, error) {
+	at, err := parser.GetStringAnnotation(authType, ing)
+	if err != nil {
+		return nil, err
+	}
+
+	if !authTypeRegex.MatchString(at) {
+		return nil, ing_errors.NewLocationDenied("invalid authentication type")
+	}
+
+	s, err := parser.GetStringAnnotation(authSecret, ing)
+	if err != nil {
+		return nil, ing_errors.LocationDenied{
+			Reason: errors.Wrap(err, "error reading secret name from annotation"),
+		}
+	}
+
+	name := fmt.Sprintf("%v/%v", ing.Namespace, s)
+	secret, err := a.secretResolver.GetSecret(name)
+	if err != nil {
+		return nil, ing_errors.LocationDenied{
+			Reason: errors.Wrapf(err, "unexpected error reading secret %v", name),
+		}
+	}
+
+	realm, _ := parser.GetStringAnnotation(authRealm, ing)
+
+	passFile := fmt.Sprintf("%v/%v-%v.passwd", a.authDirectory, ing.GetNamespace(), ing.GetName())
+	err = dumpSecret(passFile, secret)
+	if err != nil {
+		return nil, err
+	}
+
+	return &BasicDigest{
+		Type:    at,
+		Realm:   realm,
+		File:    passFile,
+		Secured: true,
+		FileSHA: file.SHA1(passFile),
+	}, nil
+}
+
+// dumpSecret dumps the content of a secret into a file
+// in the expected format for the specified authorization
+func dumpSecret(filename string, secret *api.Secret) error {
+	val, ok := secret.Data["auth"]
+	if !ok {
+		return ing_errors.LocationDenied{
+			Reason: errors.Errorf("the secret %v does not contain a key with value auth", secret.Name),
+		}
+	}
+
+	// TODO: check permissions required
+	err := ioutil.WriteFile(filename, val, 0777)
+	if err != nil {
+		return ing_errors.LocationDenied{
+			Reason: errors.Wrap(err, "unexpected error creating password file"),
+		}
+	}
+
+	return nil
+}

pkg/ingress/annotations/auth/main_test.go

@@ -0,0 +1,177 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/pkg/errors"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+)
+
+func buildIngress() *extensions.Ingress {
+	defaultBackend := extensions.IngressBackend{
+		ServiceName: "default-backend",
+		ServicePort: intstr.FromInt(80),
+	}
+
+	return &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{
+			Backend: &extensions.IngressBackend{
+				ServiceName: "default-backend",
+				ServicePort: intstr.FromInt(80),
+			},
+			Rules: []extensions.IngressRule{
+				{
+					Host: "foo.bar.com",
+					IngressRuleValue: extensions.IngressRuleValue{
+						HTTP: &extensions.HTTPIngressRuleValue{
+							Paths: []extensions.HTTPIngressPath{
+								{
+									Path:    "/foo",
+									Backend: defaultBackend,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+type mockSecret struct {
+}
+
+func (m mockSecret) GetSecret(name string) (*api.Secret, error) {
+	if name != "default/demo-secret" {
+		return nil, errors.Errorf("there is no secret with name %v", name)
+	}
+
+	return &api.Secret{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Namespace: api.NamespaceDefault,
+			Name:      "demo-secret",
+		},
+		Data: map[string][]byte{"auth": []byte("foo:$apr1$OFG3Xybp$ckL0FHDAkoXYIlH9.cysT0")},
+	}, nil
+}
+
+func TestIngressWithoutAuth(t *testing.T) {
+	ing := buildIngress()
+	_, dir, _ := dummySecretContent(t)
+	defer os.RemoveAll(dir)
+	_, err := NewParser(dir, mockSecret{}).Parse(ing)
+	if err == nil {
+		t.Error("Expected error with ingress without annotations")
+	}
+}
+
+func TestIngressAuth(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	data[authType] = "basic"
+	data[authSecret] = "demo-secret"
+	data[authRealm] = "-realm-"
+	ing.SetAnnotations(data)
+
+	_, dir, _ := dummySecretContent(t)
+	defer os.RemoveAll(dir)
+
+	i, err := NewParser(dir, mockSecret{}).Parse(ing)
+	if err != nil {
+		t.Errorf("Uxpected error with ingress: %v", err)
+	}
+	auth, ok := i.(*BasicDigest)
+	if !ok {
+		t.Errorf("expected a BasicDigest type")
+	}
+	if auth.Type != "basic" {
+		t.Errorf("Expected basic as auth type but returned %s", auth.Type)
+	}
+	if auth.Realm != "-realm-" {
+		t.Errorf("Expected -realm- as realm but returned %s", auth.Realm)
+	}
+	if !auth.Secured {
+		t.Errorf("Expected true as secured but returned %v", auth.Secured)
+	}
+}
+
+func TestIngressAuthWithoutSecret(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	data[authType] = "basic"
+	data[authSecret] = "invalid-secret"
+	data[authRealm] = "-realm-"
+	ing.SetAnnotations(data)
+
+	_, dir, _ := dummySecretContent(t)
+	defer os.RemoveAll(dir)
+
+	_, err := NewParser(dir, mockSecret{}).Parse(ing)
+	if err == nil {
+		t.Errorf("expected an error with invalid secret name")
+	}
+}
+
+func dummySecretContent(t *testing.T) (string, string, *api.Secret) {
+	dir, err := ioutil.TempDir("", fmt.Sprintf("%v", time.Now().Unix()))
+	if err != nil {
+		t.Error(err)
+	}
+
+	tmpfile, err := ioutil.TempFile("", "example-")
+	if err != nil {
+		t.Error(err)
+	}
+	defer tmpfile.Close()
+	s, _ := mockSecret{}.GetSecret("default/demo-secret")
+	return tmpfile.Name(), dir, s
+}
+
+func TestDumpSecret(t *testing.T) {
+	tmpfile, dir, s := dummySecretContent(t)
+	defer os.RemoveAll(dir)
+
+	sd := s.Data
+	s.Data = nil
+
+	err := dumpSecret(tmpfile, s)
+	if err == nil {
+		t.Errorf("Expected error with secret without auth")
+	}
+
+	s.Data = sd
+	err = dumpSecret(tmpfile, s)
+	if err != nil {
+		t.Errorf("Unexpected error creating htpasswd file %v: %v", tmpfile, err)
+	}
+}

pkg/ingress/annotations/authreq/main.go

@@ -0,0 +1,183 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package authreq
+
+import (
+	"net/url"
+	"regexp"
+	"strings"
+
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	ing_errors "k8s.io/ingress-nginx/pkg/ingress/errors"
+)
+
+const (
+	// external URL that provides the authentication
+	authURL       = "ingress.kubernetes.io/auth-url"
+	authSigninURL = "ingress.kubernetes.io/auth-signin"
+	authMethod    = "ingress.kubernetes.io/auth-method"
+	authBody      = "ingress.kubernetes.io/auth-send-body"
+	authHeaders   = "ingress.kubernetes.io/auth-response-headers"
+)
+
+// External returns external authentication configuration for an Ingress rule
+type External struct {
+	URL string `json:"url"`
+	// Host contains the hostname defined in the URL
+	Host            string   `json:"host"`
+	SigninURL       string   `json:"signinUrl"`
+	Method          string   `json:"method"`
+	SendBody        bool     `json:"sendBody"`
+	ResponseHeaders []string `json:"responseHeaders,omitEmpty"`
+}
+
+// Equal tests for equality between two External types
+func (e1 *External) Equal(e2 *External) bool {
+	if e1 == e2 {
+		return true
+	}
+	if e1 == nil || e2 == nil {
+		return false
+	}
+	if e1.URL != e2.URL {
+		return false
+	}
+	if e1.Host != e2.Host {
+		return false
+	}
+	if e1.SigninURL != e2.SigninURL {
+		return false
+	}
+	if e1.Method != e2.Method {
+		return false
+	}
+	if e1.SendBody != e2.SendBody {
+		return false
+	}
+	if e1.Method != e2.Method {
+		return false
+	}
+
+	for _, ep1 := range e1.ResponseHeaders {
+		found := false
+		for _, ep2 := range e2.ResponseHeaders {
+			if ep1 == ep2 {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+
+	return true
+}
+
+var (
+	methods      = []string{"GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "CONNECT", "OPTIONS", "TRACE"}
+	headerRegexp = regexp.MustCompile(`^[a-zA-Z\d\-_]+$`)
+)
+
+func validMethod(method string) bool {
+	if len(method) == 0 {
+		return false
+	}
+
+	for _, m := range methods {
+		if method == m {
+			return true
+		}
+	}
+	return false
+}
+
+func validHeader(header string) bool {
+	return headerRegexp.Match([]byte(header))
+}
+
+type authReq struct {
+}
+
+// NewParser creates a new authentication request annotation parser
+func NewParser() parser.IngressAnnotation {
+	return authReq{}
+}
+
+// ParseAnnotations parses the annotations contained in the ingress
+// rule used to use an external URL as source for authentication
+func (a authReq) Parse(ing *extensions.Ingress) (interface{}, error) {
+	str, err := parser.GetStringAnnotation(authURL, ing)
+	if err != nil {
+		return nil, err
+	}
+
+	if str == "" {
+		return nil, ing_errors.NewLocationDenied("an empty string is not a valid URL")
+	}
+
+	signin, _ := parser.GetStringAnnotation(authSigninURL, ing)
+
+	ur, err := url.Parse(str)
+	if err != nil {
+		return nil, err
+	}
+	if ur.Scheme == "" {
+		return nil, ing_errors.NewLocationDenied("url scheme is empty")
+	}
+	if ur.Host == "" {
+		return nil, ing_errors.NewLocationDenied("url host is empty")
+	}
+
+	if strings.Contains(ur.Host, "..") {
+		return nil, ing_errors.NewLocationDenied("invalid url host")
+	}
+
+	m, _ := parser.GetStringAnnotation(authMethod, ing)
+	if len(m) != 0 && !validMethod(m) {
+		return nil, ing_errors.NewLocationDenied("invalid HTTP method")
+	}
+
+	h := []string{}
+	hstr, _ := parser.GetStringAnnotation(authHeaders, ing)
+	if len(hstr) != 0 {
+
+		harr := strings.Split(hstr, ",")
+		for _, header := range harr {
+			header = strings.TrimSpace(header)
+			if len(header) > 0 {
+				if !validHeader(header) {
+					return nil, ing_errors.NewLocationDenied("invalid headers list")
+				}
+				h = append(h, header)
+			}
+		}
+	}
+
+	sb, _ := parser.GetBoolAnnotation(authBody, ing)
+
+	return &External{
+		URL:             str,
+		Host:            ur.Hostname(),
+		SigninURL:       signin,
+		Method:          m,
+		SendBody:        sb,
+		ResponseHeaders: h,
+	}, nil
+}

pkg/ingress/annotations/authreq/main_test.go

@@ -0,0 +1,167 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package authreq
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"k8s.io/apimachinery/pkg/util/intstr"
+)
+
+func buildIngress() *extensions.Ingress {
+	defaultBackend := extensions.IngressBackend{
+		ServiceName: "default-backend",
+		ServicePort: intstr.FromInt(80),
+	}
+
+	return &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{
+			Backend: &extensions.IngressBackend{
+				ServiceName: "default-backend",
+				ServicePort: intstr.FromInt(80),
+			},
+			Rules: []extensions.IngressRule{
+				{
+					Host: "foo.bar.com",
+					IngressRuleValue: extensions.IngressRuleValue{
+						HTTP: &extensions.HTTPIngressRuleValue{
+							Paths: []extensions.HTTPIngressPath{
+								{
+									Path:    "/foo",
+									Backend: defaultBackend,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func TestAnnotations(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	ing.SetAnnotations(data)
+
+	tests := []struct {
+		title     string
+		url       string
+		signinURL string
+		method    string
+		sendBody  bool
+		expErr    bool
+	}{
+		{"empty", "", "", "", false, true},
+		{"no scheme", "bar", "bar", "", false, true},
+		{"invalid host", "http://", "http://", "", false, true},
+		{"invalid host (multiple dots)", "http://foo..bar.com", "http://foo..bar.com", "", false, true},
+		{"valid URL", "http://bar.foo.com/external-auth", "http://bar.foo.com/external-auth", "", false, false},
+		{"valid URL - send body", "http://foo.com/external-auth", "http://foo.com/external-auth", "POST", true, false},
+		{"valid URL - send body", "http://foo.com/external-auth", "http://foo.com/external-auth", "GET", true, false},
+	}
+
+	for _, test := range tests {
+		data[authURL] = test.url
+		data[authSigninURL] = test.signinURL
+		data[authBody] = fmt.Sprintf("%v", test.sendBody)
+		data[authMethod] = fmt.Sprintf("%v", test.method)
+
+		i, err := NewParser().Parse(ing)
+		if test.expErr {
+			if err == nil {
+				t.Errorf("%v: expected error but retuned nil", test.title)
+			}
+			continue
+		}
+		u, ok := i.(*External)
+		if !ok {
+			t.Errorf("%v: expected an External type", test.title)
+		}
+		if u.URL != test.url {
+			t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.title, test.url, u.URL)
+		}
+		if u.SigninURL != test.signinURL {
+			t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.title, test.signinURL, u.SigninURL)
+		}
+		if u.Method != test.method {
+			t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.title, test.method, u.Method)
+		}
+		if u.SendBody != test.sendBody {
+			t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.title, test.sendBody, u.SendBody)
+		}
+	}
+}
+
+func TestHeaderAnnotations(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	ing.SetAnnotations(data)
+
+	tests := []struct {
+		title         string
+		url           string
+		headers       string
+		parsedHeaders []string
+		expErr        bool
+	}{
+		{"single header", "http://goog.url", "h1", []string{"h1"}, false},
+		{"nothing", "http://goog.url", "", []string{}, false},
+		{"spaces", "http://goog.url", "  ", []string{}, false},
+		{"two headers", "http://goog.url", "1,2", []string{"1", "2"}, false},
+		{"two headers and empty entries", "http://goog.url", ",1,,2,", []string{"1", "2"}, false},
+		{"header with spaces", "http://goog.url", "1 2", []string{}, true},
+		{"header with other bad symbols", "http://goog.url", "1+2", []string{}, true},
+	}
+
+	for _, test := range tests {
+		data[authURL] = test.url
+		data[authHeaders] = test.headers
+		data[authMethod] = "GET"
+
+		i, err := NewParser().Parse(ing)
+		if test.expErr {
+			if err == nil {
+				t.Errorf("%v: expected error but retuned nil", err.Error())
+			}
+			continue
+		}
+
+		t.Log(i)
+		u, ok := i.(*External)
+		if !ok {
+			t.Errorf("%v: expected an External type", test.title)
+			continue
+		}
+
+		if !reflect.DeepEqual(u.ResponseHeaders, test.parsedHeaders) {
+			t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.title, test.headers, u.ResponseHeaders)
+		}
+	}
+}

pkg/ingress/annotations/authtls/main.go

@@ -0,0 +1,131 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package authtls
+
+import (
+	"github.com/pkg/errors"
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	ing_errors "k8s.io/ingress-nginx/pkg/ingress/errors"
+	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+	"k8s.io/ingress-nginx/pkg/k8s"
+	"regexp"
+)
+
+const (
+	// name of the secret
+	annotationAuthTLSSecret    = "ingress.kubernetes.io/auth-tls-secret"
+	annotationAuthVerifyClient = "ingress.kubernetes.io/auth-tls-verify-client"
+	annotationAuthTLSDepth     = "ingress.kubernetes.io/auth-tls-verify-depth"
+	annotationAuthTLSErrorPage = "ingress.kubernetes.io/auth-tls-error-page"
+	defaultAuthTLSDepth        = 1
+	defaultAuthVerifyClient    = "on"
+)
+
+var (
+	authVerifyClientRegex = regexp.MustCompile(`on|off|optional|optional_no_ca`)
+)
+
+// AuthSSLConfig contains the AuthSSLCert used for muthual autentication
+// and the configured ValidationDepth
+type AuthSSLConfig struct {
+	resolver.AuthSSLCert
+	VerifyClient    string `json:"verify_client"`
+	ValidationDepth int    `json:"validationDepth"`
+	ErrorPage       string `json:"errorPage"`
+}
+
+// Equal tests for equality between two AuthSSLConfig types
+func (assl1 *AuthSSLConfig) Equal(assl2 *AuthSSLConfig) bool {
+	if assl1 == assl2 {
+		return true
+	}
+	if assl1 == nil || assl2 == nil {
+		return false
+	}
+	if !(&assl1.AuthSSLCert).Equal(&assl2.AuthSSLCert) {
+		return false
+	}
+	if assl1.VerifyClient != assl2.VerifyClient {
+		return false
+	}
+	if assl1.ValidationDepth != assl2.ValidationDepth {
+		return false
+	}
+	if assl1.ErrorPage != assl2.ErrorPage {
+		return false
+	}
+	return true
+}
+
+// NewParser creates a new TLS authentication annotation parser
+func NewParser(resolver resolver.AuthCertificate) parser.IngressAnnotation {
+	return authTLS{resolver}
+}
+
+type authTLS struct {
+	certResolver resolver.AuthCertificate
+}
+
+// Parse parses the annotations contained in the ingress
+// rule used to use a Certificate as authentication method
+func (a authTLS) Parse(ing *extensions.Ingress) (interface{}, error) {
+
+	tlsauthsecret, err := parser.GetStringAnnotation(annotationAuthTLSSecret, ing)
+	if err != nil {
+		return &AuthSSLConfig{}, err
+	}
+
+	if tlsauthsecret == "" {
+		return &AuthSSLConfig{}, ing_errors.NewLocationDenied("an empty string is not a valid secret name")
+	}
+
+	_, _, err = k8s.ParseNameNS(tlsauthsecret)
+	if err != nil {
+		return &AuthSSLConfig{}, ing_errors.NewLocationDenied(err.Error())
+	}
+
+	tlsVerifyClient, err := parser.GetStringAnnotation(annotationAuthVerifyClient, ing)
+	if err != nil || !authVerifyClientRegex.MatchString(tlsVerifyClient) {
+		tlsVerifyClient = defaultAuthVerifyClient
+	}
+
+	tlsdepth, err := parser.GetIntAnnotation(annotationAuthTLSDepth, ing)
+	if err != nil || tlsdepth == 0 {
+		tlsdepth = defaultAuthTLSDepth
+	}
+
+	authCert, err := a.certResolver.GetAuthCertificate(tlsauthsecret)
+	if err != nil {
+		return &AuthSSLConfig{}, ing_errors.LocationDenied{
+			Reason: errors.Wrap(err, "error obtaining certificate"),
+		}
+	}
+
+	errorpage, err := parser.GetStringAnnotation(annotationAuthTLSErrorPage, ing)
+	if err != nil || errorpage == "" {
+		errorpage = ""
+	}
+
+	return &AuthSSLConfig{
+		AuthSSLCert:     *authCert,
+		VerifyClient:    tlsVerifyClient,
+		ValidationDepth: tlsdepth,
+		ErrorPage:       errorpage,
+	}, nil
+}

pkg/ingress/annotations/authtls/main_test.go

@@ -0,0 +1,108 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package authtls
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+)
+
+func buildIngress() *extensions.Ingress {
+	defaultBackend := extensions.IngressBackend{
+		ServiceName: "default-backend",
+		ServicePort: intstr.FromInt(80),
+	}
+
+	return &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{
+			Backend: &extensions.IngressBackend{
+				ServiceName: "default-backend",
+				ServicePort: intstr.FromInt(80),
+			},
+			Rules: []extensions.IngressRule{
+				{
+					Host: "foo.bar.com",
+					IngressRuleValue: extensions.IngressRuleValue{
+						HTTP: &extensions.HTTPIngressRuleValue{
+							Paths: []extensions.HTTPIngressPath{
+								{
+									Path:    "/foo",
+									Backend: defaultBackend,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func TestAnnotations(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	ing.SetAnnotations(data)
+	/*
+		tests := []struct {
+			title    string
+			url      string
+			method   string
+			sendBody bool
+			expErr   bool
+		}{
+			{"empty", "", "", false, true},
+			{"no scheme", "bar", "", false, true},
+			{"invalid host", "http://", "", false, true},
+			{"invalid host (multiple dots)", "http://foo..bar.com", "", false, true},
+			{"valid URL", "http://bar.foo.com/external-auth", "", false, false},
+			{"valid URL - send body", "http://foo.com/external-auth", "POST", true, false},
+			{"valid URL - send body", "http://foo.com/external-auth", "GET", true, false},
+		}
+
+		for _, test := range tests {
+			data[authTLSSecret] = ""
+			test.title
+
+				u, err := ParseAnnotations(ing)
+
+				if test.expErr {
+					if err == nil {
+						t.Errorf("%v: expected error but retuned nil", test.title)
+					}
+					continue
+				}
+
+				if u.URL != test.url {
+					t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.title, test.url, u.URL)
+				}
+				if u.Method != test.method {
+					t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.title, test.method, u.Method)
+				}
+				if u.SendBody != test.sendBody {
+					t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.title, test.sendBody, u.SendBody)
+				}
+		}*/
+}

pkg/ingress/annotations/class/main.go

@@ -0,0 +1,55 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package class
+
+import (
+	"github.com/golang/glog"
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/pkg/ingress/errors"
+)
+
+const (
+	// IngressKey picks a specific "class" for the Ingress.
+	// The controller only processes Ingresses with this annotation either
+	// unset, or set to either the configured value or the empty string.
+	IngressKey = "kubernetes.io/ingress.class"
+)
+
+// IsValid returns true if the given Ingress either doesn't specify
+// the ingress.class annotation, or it's set to the configured in the
+// ingress controller.
+func IsValid(ing *extensions.Ingress, controller, defClass string) bool {
+	ingress, err := parser.GetStringAnnotation(IngressKey, ing)
+	if err != nil && !errors.IsMissingAnnotations(err) {
+		glog.Warningf("unexpected error reading ingress annotation: %v", err)
+	}
+
+	// we have 2 valid combinations
+	// 1 - ingress with default class | blank annotation on ingress
+	// 2 - ingress with specific class | same annotation on ingress
+	//
+	// and 2 invalid combinations
+	// 3 - ingress with default class | fixed annotation on ingress
+	// 4 - ingress with specific class | different annotation on ingress
+	if ingress == "" && controller == defClass {
+		return true
+	}
+
+	return ingress == controller
+}

pkg/ingress/annotations/class/main_test.go

@@ -0,0 +1,59 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package class
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestIsValidClass(t *testing.T) {
+	tests := []struct {
+		ingress    string
+		controller string
+		defClass   string
+		isValid    bool
+	}{
+		{"", "", "nginx", true},
+		{"", "nginx", "nginx", true},
+		{"nginx", "nginx", "nginx", true},
+		{"custom", "custom", "nginx", true},
+		{"", "killer", "nginx", false},
+		{"", "", "nginx", true},
+		{"custom", "nginx", "nginx", false},
+	}
+
+	ing := &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+	}
+
+	data := map[string]string{}
+	ing.SetAnnotations(data)
+	for _, test := range tests {
+		ing.Annotations[IngressKey] = test.ingress
+		b := IsValid(ing, test.controller, test.defClass)
+		if b != test.isValid {
+			t.Errorf("test %v - expected %v but %v was returned", test, test.isValid, b)
+		}
+	}
+}

pkg/ingress/annotations/clientbodybuffersize/main.go

@@ -0,0 +1,41 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package clientbodybuffersize
+
+import (
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+)
+
+const (
+	annotation = "ingress.kubernetes.io/client-body-buffer-size"
+)
+
+type clientBodyBufferSize struct {
+}
+
+// NewParser creates a new clientBodyBufferSize annotation parser
+func NewParser() parser.IngressAnnotation {
+	return clientBodyBufferSize{}
+}
+
+// Parse parses the annotations contained in the ingress rule
+// used to add an client-body-buffer-size to the provided locations
+func (a clientBodyBufferSize) Parse(ing *extensions.Ingress) (interface{}, error) {
+	return parser.GetStringAnnotation(annotation, ing)
+}

pkg/ingress/annotations/clientbodybuffersize/main_test.go

@@ -0,0 +1,59 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package clientbodybuffersize
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestParse(t *testing.T) {
+	ap := NewParser()
+	if ap == nil {
+		t.Fatalf("expected a parser.IngressAnnotation but returned nil")
+	}
+
+	testCases := []struct {
+		annotations map[string]string
+		expected    string
+	}{
+		{map[string]string{annotation: "8k"}, "8k"},
+		{map[string]string{annotation: "16k"}, "16k"},
+		{map[string]string{annotation: ""}, ""},
+		{map[string]string{}, ""},
+		{nil, ""},
+	}
+
+	ing := &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{},
+	}
+
+	for _, testCase := range testCases {
+		ing.SetAnnotations(testCase.annotations)
+		result, _ := ap.Parse(ing)
+		if result != testCase.expected {
+			t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations)
+		}
+	}
+}

pkg/ingress/annotations/cors/main.go

@@ -0,0 +1,41 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cors
+
+import (
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+)
+
+const (
+	annotation = "ingress.kubernetes.io/enable-cors"
+)
+
+type cors struct {
+}
+
+// NewParser creates a new CORS annotation parser
+func NewParser() parser.IngressAnnotation {
+	return cors{}
+}
+
+// Parse parses the annotations contained in the ingress
+// rule used to indicate if the location/s should allows CORS
+func (a cors) Parse(ing *extensions.Ingress) (interface{}, error) {
+	return parser.GetBoolAnnotation(annotation, ing)
+}

pkg/ingress/annotations/cors/main_test.go

@@ -0,0 +1,63 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cors
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	notCorsAnnotation = "ingress.kubernetes.io/enable-not-cors"
+)
+
+func TestParse(t *testing.T) {
+	ap := NewParser()
+	if ap == nil {
+		t.Fatalf("expected a parser.IngressAnnotation but returned nil")
+	}
+
+	testCases := []struct {
+		annotations map[string]string
+		expected    bool
+	}{
+		{map[string]string{annotation: "true"}, true},
+		{map[string]string{annotation: "false"}, false},
+		{map[string]string{notCorsAnnotation: "true"}, false},
+		{map[string]string{}, false},
+		{nil, false},
+	}
+
+	ing := &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{},
+	}
+
+	for _, testCase := range testCases {
+		ing.SetAnnotations(testCase.annotations)
+		result, _ := ap.Parse(ing)
+		if result != testCase.expected {
+			t.Errorf("expected %t but returned %t, annotations: %s", testCase.expected, result, testCase.annotations)
+		}
+	}
+}

pkg/ingress/annotations/defaultbackend/main.go

@@ -0,0 +1,57 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package defaultbackend
+
+import (
+	"fmt"
+
+	"github.com/pkg/errors"
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+)
+
+const (
+	defaultBackend = "ingress.kubernetes.io/default-backend"
+)
+
+type backend struct {
+	serviceResolver resolver.Service
+}
+
+// NewParser creates a new default backend annotation parser
+func NewParser(sr resolver.Service) parser.IngressAnnotation {
+	return backend{sr}
+}
+
+// Parse parses the annotations contained in the ingress to use
+// a custom default backend
+func (db backend) Parse(ing *extensions.Ingress) (interface{}, error) {
+	s, err := parser.GetStringAnnotation(defaultBackend, ing)
+	if err != nil {
+		return nil, err
+	}
+
+	name := fmt.Sprintf("%v/%v", ing.Namespace, s)
+	svc, err := db.serviceResolver.GetService(name)
+	if err != nil {
+		return nil, errors.Wrapf(err, "unexpected error reading service %v", name)
+	}
+
+	return svc, nil
+}

pkg/ingress/annotations/healthcheck/main.go

@@ -0,0 +1,66 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package healthcheck
+
+import (
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+)
+
+const (
+	upsMaxFails    = "ingress.kubernetes.io/upstream-max-fails"
+	upsFailTimeout = "ingress.kubernetes.io/upstream-fail-timeout"
+)
+
+// Upstream returns the URL and method to use check the status of
+// the upstream server/s
+type Upstream struct {
+	MaxFails    int `json:"maxFails"`
+	FailTimeout int `json:"failTimeout"`
+}
+
+type healthCheck struct {
+	backendResolver resolver.DefaultBackend
+}
+
+// NewParser creates a new health check annotation parser
+func NewParser(br resolver.DefaultBackend) parser.IngressAnnotation {
+	return healthCheck{br}
+}
+
+// ParseAnnotations parses the annotations contained in the ingress
+// rule used to configure upstream check parameters
+func (a healthCheck) Parse(ing *extensions.Ingress) (interface{}, error) {
+	defBackend := a.backendResolver.GetDefaultBackend()
+	if ing.GetAnnotations() == nil {
+		return &Upstream{defBackend.UpstreamMaxFails, defBackend.UpstreamFailTimeout}, nil
+	}
+
+	mf, err := parser.GetIntAnnotation(upsMaxFails, ing)
+	if err != nil {
+		mf = defBackend.UpstreamMaxFails
+	}
+
+	ft, err := parser.GetIntAnnotation(upsFailTimeout, ing)
+	if err != nil {
+		ft = defBackend.UpstreamFailTimeout
+	}
+
+	return &Upstream{mf, ft}, nil
+}

pkg/ingress/annotations/healthcheck/main_test.go

@@ -0,0 +1,92 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package healthcheck
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+
+	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+)
+
+func buildIngress() *extensions.Ingress {
+	defaultBackend := extensions.IngressBackend{
+		ServiceName: "default-backend",
+		ServicePort: intstr.FromInt(80),
+	}
+
+	return &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{
+			Backend: &extensions.IngressBackend{
+				ServiceName: "default-backend",
+				ServicePort: intstr.FromInt(80),
+			},
+			Rules: []extensions.IngressRule{
+				{
+					Host: "foo.bar.com",
+					IngressRuleValue: extensions.IngressRuleValue{
+						HTTP: &extensions.HTTPIngressRuleValue{
+							Paths: []extensions.HTTPIngressPath{
+								{
+									Path:    "/foo",
+									Backend: defaultBackend,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+type mockBackend struct {
+}
+
+func (m mockBackend) GetDefaultBackend() defaults.Backend {
+	return defaults.Backend{UpstreamFailTimeout: 1}
+}
+
+func TestIngressHealthCheck(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	data[upsMaxFails] = "2"
+	ing.SetAnnotations(data)
+
+	hzi, _ := NewParser(mockBackend{}).Parse(ing)
+	nginxHz, ok := hzi.(*Upstream)
+	if !ok {
+		t.Errorf("expected a Upstream type")
+	}
+
+	if nginxHz.MaxFails != 2 {
+		t.Errorf("expected 2 as max-fails but returned %v", nginxHz.MaxFails)
+	}
+
+	if nginxHz.FailTimeout != 1 {
+		t.Errorf("expected 0 as fail-timeout but returned %v", nginxHz.FailTimeout)
+	}
+}

pkg/ingress/annotations/ipwhitelist/main.go

@@ -0,0 +1,113 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ipwhitelist
+
+import (
+	"sort"
+	"strings"
+
+	"github.com/pkg/errors"
+
+	extensions "k8s.io/api/extensions/v1beta1"
+	"k8s.io/ingress-nginx/pkg/net"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	ing_errors "k8s.io/ingress-nginx/pkg/ingress/errors"
+	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+)
+
+const (
+	whitelist = "ingress.kubernetes.io/whitelist-source-range"
+)
+
+// SourceRange returns the CIDR
+type SourceRange struct {
+	CIDR []string `json:"cidr,omitEmpty"`
+}
+
+// Equal tests for equality between two SourceRange types
+func (sr1 *SourceRange) Equal(sr2 *SourceRange) bool {
+	if sr1 == sr2 {
+		return true
+	}
+	if sr1 == nil || sr2 == nil {
+		return false
+	}
+
+	if len(sr1.CIDR) != len(sr2.CIDR) {
+		return false
+	}
+
+	for _, s1l := range sr1.CIDR {
+		found := false
+		for _, sl2 := range sr2.CIDR {
+			if s1l == sl2 {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+
+	return true
+}
+
+type ipwhitelist struct {
+	backendResolver resolver.DefaultBackend
+}
+
+// NewParser creates a new whitelist annotation parser
+func NewParser(br resolver.DefaultBackend) parser.IngressAnnotation {
+	return ipwhitelist{br}
+}
+
+// ParseAnnotations parses the annotations contained in the ingress
+// rule used to limit access to certain client addresses or networks.
+// Multiple ranges can specified using commas as separator
+// e.g. `18.0.0.0/8,56.0.0.0/8`
+func (a ipwhitelist) Parse(ing *extensions.Ingress) (interface{}, error) {
+	defBackend := a.backendResolver.GetDefaultBackend()
+	sort.Strings(defBackend.WhitelistSourceRange)
+
+	val, err := parser.GetStringAnnotation(whitelist, ing)
+	// A missing annotation is not a problem, just use the default
+	if err == ing_errors.ErrMissingAnnotations {
+		return &SourceRange{CIDR: defBackend.WhitelistSourceRange}, nil
+	}
+
+	values := strings.Split(val, ",")
+	ipnets, ips, err := net.ParseIPNets(values...)
+	if err != nil && len(ips) == 0 {
+		return &SourceRange{CIDR: defBackend.WhitelistSourceRange}, ing_errors.LocationDenied{
+			Reason: errors.Wrap(err, "the annotation does not contain a valid IP address or network"),
+		}
+	}
+
+	cidrs := []string{}
+	for k := range ipnets {
+		cidrs = append(cidrs, k)
+	}
+	for k := range ips {
+		cidrs = append(cidrs, k)
+	}
+
+	sort.Strings(cidrs)
+
+	return &SourceRange{cidrs}, nil
+}

pkg/ingress/annotations/ipwhitelist/main_test.go

@@ -0,0 +1,199 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ipwhitelist
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+
+	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+)
+
+func buildIngress() *extensions.Ingress {
+	defaultBackend := extensions.IngressBackend{
+		ServiceName: "default-backend",
+		ServicePort: intstr.FromInt(80),
+	}
+
+	return &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{
+			Backend: &extensions.IngressBackend{
+				ServiceName: "default-backend",
+				ServicePort: intstr.FromInt(80),
+			},
+			Rules: []extensions.IngressRule{
+				{
+					Host: "foo.bar.com",
+					IngressRuleValue: extensions.IngressRuleValue{
+						HTTP: &extensions.HTTPIngressRuleValue{
+							Paths: []extensions.HTTPIngressPath{
+								{
+									Path:    "/foo",
+									Backend: defaultBackend,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+type mockBackend struct {
+	defaults.Backend
+}
+
+func (m mockBackend) GetDefaultBackend() defaults.Backend {
+	return m.Backend
+}
+
+func TestParseAnnotations(t *testing.T) {
+	ing := buildIngress()
+	tests := map[string]struct {
+		net        string
+		expectCidr []string
+		expectErr  bool
+		errOut     string
+	}{
+		"test parse a valid net": {
+			net:        "10.0.0.0/24",
+			expectCidr: []string{"10.0.0.0/24"},
+			expectErr:  false,
+		},
+		"test parse a invalid net": {
+			net:       "ww",
+			expectErr: true,
+			errOut:    "the annotation does not contain a valid IP address or network: invalid CIDR address: ww",
+		},
+		"test parse a empty net": {
+			net:       "",
+			expectErr: true,
+			errOut:    "the annotation does not contain a valid IP address or network: invalid CIDR address: ",
+		},
+		"test parse multiple valid cidr": {
+			net:        "2.2.2.2/32,1.1.1.1/32,3.3.3.0/24",
+			expectCidr: []string{"1.1.1.1/32", "2.2.2.2/32", "3.3.3.0/24"},
+			expectErr:  false,
+		},
+	}
+
+	for testName, test := range tests {
+		data := map[string]string{}
+		data[whitelist] = test.net
+		ing.SetAnnotations(data)
+		p := NewParser(mockBackend{})
+		i, err := p.Parse(ing)
+		if err != nil && !test.expectErr {
+			t.Errorf("%v:unexpected error: %v", testName, err)
+		}
+		if test.expectErr {
+			if err.Error() != test.errOut {
+				t.Errorf("%v:expected error: %v but %v return", testName, test.errOut, err.Error())
+			}
+		}
+		if !test.expectErr {
+			sr, ok := i.(*SourceRange)
+			if !ok {
+				t.Errorf("%v:expected a SourceRange type", testName)
+			}
+			if !strsEquals(sr.CIDR, test.expectCidr) {
+				t.Errorf("%v:expected %v CIDR but %v returned", testName, test.expectCidr, sr.CIDR)
+			}
+		}
+	}
+}
+
+// Test that when we have a whitelist set on the Backend that is used when we
+// don't have the annotation
+func TestParseAnnotationsWithDefaultConfig(t *testing.T) {
+	ing := buildIngress()
+	mockBackend := mockBackend{}
+	mockBackend.Backend.WhitelistSourceRange = []string{"4.4.4.0/24", "1.2.3.4/32"}
+	tests := map[string]struct {
+		net        string
+		expectCidr []string
+		expectErr  bool
+		errOut     string
+	}{
+		"test parse a valid net": {
+			net:        "10.0.0.0/24",
+			expectCidr: []string{"10.0.0.0/24"},
+			expectErr:  false,
+		},
+		"test parse a invalid net": {
+			net:       "ww",
+			expectErr: true,
+			errOut:    "the annotation does not contain a valid IP address or network: invalid CIDR address: ww",
+		},
+		"test parse a empty net": {
+			net:       "",
+			expectErr: true,
+			errOut:    "the annotation does not contain a valid IP address or network: invalid CIDR address: ",
+		},
+		"test parse multiple valid cidr": {
+			net:        "2.2.2.2/32,1.1.1.1/32,3.3.3.0/24",
+			expectCidr: []string{"1.1.1.1/32", "2.2.2.2/32", "3.3.3.0/24"},
+			expectErr:  false,
+		},
+	}
+
+	for testName, test := range tests {
+		data := map[string]string{}
+		data[whitelist] = test.net
+		ing.SetAnnotations(data)
+		p := NewParser(mockBackend)
+		i, err := p.Parse(ing)
+		if err != nil && !test.expectErr {
+			t.Errorf("%v:unexpected error: %v", testName, err)
+		}
+		if test.expectErr {
+			if err.Error() != test.errOut {
+				t.Errorf("%v:expected error: %v but %v return", testName, test.errOut, err.Error())
+			}
+		}
+		if !test.expectErr {
+			sr, ok := i.(*SourceRange)
+			if !ok {
+				t.Errorf("%v:expected a SourceRange type", testName)
+			}
+			if !strsEquals(sr.CIDR, test.expectCidr) {
+				t.Errorf("%v:expected %v CIDR but %v returned", testName, test.expectCidr, sr.CIDR)
+			}
+		}
+	}
+}
+
+func strsEquals(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i, v := range a {
+		if v != b[i] {
+			return false
+		}
+	}
+	return true
+}

pkg/ingress/annotations/parser/main.go

@@ -0,0 +1,102 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package parser
+
+import (
+	"strconv"
+
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/errors"
+)
+
+// IngressAnnotation has a method to parse annotations located in Ingress
+type IngressAnnotation interface {
+	Parse(ing *extensions.Ingress) (interface{}, error)
+}
+
+type ingAnnotations map[string]string
+
+func (a ingAnnotations) parseBool(name string) (bool, error) {
+	val, ok := a[name]
+	if ok {
+		b, err := strconv.ParseBool(val)
+		if err != nil {
+			return false, errors.NewInvalidAnnotationContent(name, val)
+		}
+		return b, nil
+	}
+	return false, errors.ErrMissingAnnotations
+}
+
+func (a ingAnnotations) parseString(name string) (string, error) {
+	val, ok := a[name]
+	if ok {
+		return val, nil
+	}
+	return "", errors.ErrMissingAnnotations
+}
+
+func (a ingAnnotations) parseInt(name string) (int, error) {
+	val, ok := a[name]
+	if ok {
+		i, err := strconv.Atoi(val)
+		if err != nil {
+			return 0, errors.NewInvalidAnnotationContent(name, val)
+		}
+		return i, nil
+	}
+	return 0, errors.ErrMissingAnnotations
+}
+
+func checkAnnotation(name string, ing *extensions.Ingress) error {
+	if ing == nil || len(ing.GetAnnotations()) == 0 {
+		return errors.ErrMissingAnnotations
+	}
+	if name == "" {
+		return errors.ErrInvalidAnnotationName
+	}
+
+	return nil
+}
+
+// GetBoolAnnotation extracts a boolean from an Ingress annotation
+func GetBoolAnnotation(name string, ing *extensions.Ingress) (bool, error) {
+	err := checkAnnotation(name, ing)
+	if err != nil {
+		return false, err
+	}
+	return ingAnnotations(ing.GetAnnotations()).parseBool(name)
+}
+
+// GetStringAnnotation extracts a string from an Ingress annotation
+func GetStringAnnotation(name string, ing *extensions.Ingress) (string, error) {
+	err := checkAnnotation(name, ing)
+	if err != nil {
+		return "", err
+	}
+	return ingAnnotations(ing.GetAnnotations()).parseString(name)
+}
+
+// GetIntAnnotation extracts an int from an Ingress annotation
+func GetIntAnnotation(name string, ing *extensions.Ingress) (int, error) {
+	err := checkAnnotation(name, ing)
+	if err != nil {
+		return 0, err
+	}
+	return ingAnnotations(ing.GetAnnotations()).parseInt(name)
+}

pkg/ingress/annotations/parser/main_test.go

@@ -0,0 +1,161 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package parser
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func buildIngress() *extensions.Ingress {
+	return &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{},
+	}
+}
+
+func TestGetBoolAnnotation(t *testing.T) {
+	ing := buildIngress()
+
+	_, err := GetBoolAnnotation("", nil)
+	if err == nil {
+		t.Errorf("expected error but retuned nil")
+	}
+
+	tests := []struct {
+		name   string
+		field  string
+		value  string
+		exp    bool
+		expErr bool
+	}{
+		{"empty - false", "", "false", false, true},
+		{"empty - true", "", "true", false, true},
+		{"valid - false", "bool", "false", false, false},
+		{"valid - true", "bool", "true", true, false},
+	}
+
+	data := map[string]string{}
+	ing.SetAnnotations(data)
+
+	for _, test := range tests {
+		data[test.field] = test.value
+
+		u, err := GetBoolAnnotation(test.field, ing)
+		if test.expErr {
+			if err == nil {
+				t.Errorf("%v: expected error but retuned nil", test.name)
+			}
+			continue
+		}
+		if u != test.exp {
+			t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.name, test.exp, u)
+		}
+
+		delete(data, test.field)
+	}
+}
+
+func TestGetStringAnnotation(t *testing.T) {
+	ing := buildIngress()
+
+	_, err := GetStringAnnotation("", nil)
+	if err == nil {
+		t.Errorf("expected error but retuned nil")
+	}
+
+	tests := []struct {
+		name   string
+		field  string
+		value  string
+		exp    string
+		expErr bool
+	}{
+		{"empty - A", "", "A", "", true},
+		{"empty - B", "", "B", "", true},
+		{"valid - A", "string", "A", "A", false},
+		{"valid - B", "string", "B", "B", false},
+	}
+
+	data := map[string]string{}
+	ing.SetAnnotations(data)
+
+	for _, test := range tests {
+		data[test.field] = test.value
+
+		s, err := GetStringAnnotation(test.field, ing)
+		if test.expErr {
+			if err == nil {
+				t.Errorf("%v: expected error but retuned nil", test.name)
+			}
+			continue
+		}
+		if s != test.exp {
+			t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.name, test.exp, s)
+		}
+
+		delete(data, test.field)
+	}
+}
+
+func TestGetIntAnnotation(t *testing.T) {
+	ing := buildIngress()
+
+	_, err := GetIntAnnotation("", nil)
+	if err == nil {
+		t.Errorf("expected error but retuned nil")
+	}
+
+	tests := []struct {
+		name   string
+		field  string
+		value  string
+		exp    int
+		expErr bool
+	}{
+		{"empty - A", "", "1", 0, true},
+		{"empty - B", "", "2", 0, true},
+		{"valid - A", "string", "1", 1, false},
+		{"valid - B", "string", "2", 2, false},
+	}
+
+	data := map[string]string{}
+	ing.SetAnnotations(data)
+
+	for _, test := range tests {
+		data[test.field] = test.value
+
+		s, err := GetIntAnnotation(test.field, ing)
+		if test.expErr {
+			if err == nil {
+				t.Errorf("%v: expected error but retuned nil", test.name)
+			}
+			continue
+		}
+		if s != test.exp {
+			t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.name, test.exp, s)
+		}
+
+		delete(data, test.field)
+	}
+}

pkg/ingress/annotations/portinredirect/main.go

@@ -0,0 +1,48 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package portinredirect
+
+import (
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+)
+
+const (
+	annotation = "ingress.kubernetes.io/use-port-in-redirects"
+)
+
+type portInRedirect struct {
+	backendResolver resolver.DefaultBackend
+}
+
+// NewParser creates a new port in redirect annotation parser
+func NewParser(db resolver.DefaultBackend) parser.IngressAnnotation {
+	return portInRedirect{db}
+}
+
+// Parse parses the annotations contained in the ingress
+// rule used to indicate if the redirects must
+func (a portInRedirect) Parse(ing *extensions.Ingress) (interface{}, error) {
+	up, err := parser.GetBoolAnnotation(annotation, ing)
+	if err != nil {
+		return a.backendResolver.GetDefaultBackend().UsePortInRedirects, nil
+	}
+
+	return up, nil
+}

pkg/ingress/annotations/portinredirect/main_test.go

@@ -0,0 +1,121 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package portinredirect
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+
+	"fmt"
+
+	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+)
+
+func buildIngress() *extensions.Ingress {
+	defaultBackend := extensions.IngressBackend{
+		ServiceName: "default-backend",
+		ServicePort: intstr.FromInt(80),
+	}
+
+	return &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{
+			Backend: &extensions.IngressBackend{
+				ServiceName: "default-backend",
+				ServicePort: intstr.FromInt(80),
+			},
+			Rules: []extensions.IngressRule{
+				{
+					Host: "foo.bar.com",
+					IngressRuleValue: extensions.IngressRuleValue{
+						HTTP: &extensions.HTTPIngressRuleValue{
+							Paths: []extensions.HTTPIngressPath{
+								{
+									Path:    "/foo",
+									Backend: defaultBackend,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+type mockBackend struct {
+	usePortInRedirects bool
+}
+
+func (m mockBackend) GetDefaultBackend() defaults.Backend {
+	return defaults.Backend{UsePortInRedirects: m.usePortInRedirects}
+}
+
+func TestPortInRedirect(t *testing.T) {
+	tests := []struct {
+		title   string
+		usePort *bool
+		def     bool
+		exp     bool
+	}{
+		{"false - default false", newFalse(), false, false},
+		{"false - default true", newFalse(), true, false},
+		{"no annotation - default false", nil, false, false},
+		{"no annotation - default true", nil, true, true},
+		{"true - default true", newTrue(), true, true},
+	}
+
+	for _, test := range tests {
+		ing := buildIngress()
+
+		data := map[string]string{}
+		if test.usePort != nil {
+			data[annotation] = fmt.Sprintf("%v", *test.usePort)
+		}
+		ing.SetAnnotations(data)
+
+		i, err := NewParser(mockBackend{test.def}).Parse(ing)
+		if err != nil {
+			t.Errorf("unexpected error parsing a valid")
+		}
+		p, ok := i.(bool)
+		if !ok {
+			t.Errorf("expected a bool type")
+		}
+
+		if p != test.exp {
+			t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.title, test.exp, p)
+		}
+	}
+}
+
+func newTrue() *bool {
+	b := true
+	return &b
+}
+
+func newFalse() *bool {
+	b := false
+	return &b
+}

pkg/ingress/annotations/proxy/main.go

@@ -0,0 +1,160 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+)
+
+const (
+	bodySize         = "ingress.kubernetes.io/proxy-body-size"
+	connect          = "ingress.kubernetes.io/proxy-connect-timeout"
+	send             = "ingress.kubernetes.io/proxy-send-timeout"
+	read             = "ingress.kubernetes.io/proxy-read-timeout"
+	bufferSize       = "ingress.kubernetes.io/proxy-buffer-size"
+	cookiePath       = "ingress.kubernetes.io/proxy-cookie-path"
+	cookieDomain     = "ingress.kubernetes.io/proxy-cookie-domain"
+	nextUpstream     = "ingress.kubernetes.io/proxy-next-upstream"
+	passParams       = "ingress.kubernetes.io/proxy-pass-params"
+	requestBuffering = "ingress.kubernetes.io/proxy-request-buffering"
+)
+
+// Configuration returns the proxy timeout to use in the upstream server/s
+type Configuration struct {
+	BodySize         string `json:"bodySize"`
+	ConnectTimeout   int    `json:"connectTimeout"`
+	SendTimeout      int    `json:"sendTimeout"`
+	ReadTimeout      int    `json:"readTimeout"`
+	BufferSize       string `json:"bufferSize"`
+	CookieDomain     string `json:"cookieDomain"`
+	CookiePath       string `json:"cookiePath"`
+	NextUpstream     string `json:"nextUpstream"`
+	PassParams       string `json:"passParams"`
+	RequestBuffering string `json:"requestBuffering"`
+}
+
+// Equal tests for equality between two Configuration types
+func (l1 *Configuration) Equal(l2 *Configuration) bool {
+	if l1 == l2 {
+		return true
+	}
+	if l1 == nil || l2 == nil {
+		return false
+	}
+	if l1.BodySize != l2.BodySize {
+		return false
+	}
+	if l1.ConnectTimeout != l2.ConnectTimeout {
+		return false
+	}
+	if l1.SendTimeout != l2.SendTimeout {
+		return false
+	}
+	if l1.ReadTimeout != l2.ReadTimeout {
+		return false
+	}
+	if l1.BufferSize != l2.BufferSize {
+		return false
+	}
+	if l1.CookieDomain != l2.CookieDomain {
+		return false
+	}
+	if l1.CookiePath != l2.CookiePath {
+		return false
+	}
+	if l1.NextUpstream != l2.NextUpstream {
+		return false
+	}
+	if l1.PassParams != l2.PassParams {
+		return false
+	}
+
+	if l1.RequestBuffering != l2.RequestBuffering {
+		return false
+	}
+
+	return true
+}
+
+type proxy struct {
+	backendResolver resolver.DefaultBackend
+}
+
+// NewParser creates a new reverse proxy configuration annotation parser
+func NewParser(br resolver.DefaultBackend) parser.IngressAnnotation {
+	return proxy{br}
+}
+
+// ParseAnnotations parses the annotations contained in the ingress
+// rule used to configure upstream check parameters
+func (a proxy) Parse(ing *extensions.Ingress) (interface{}, error) {
+	defBackend := a.backendResolver.GetDefaultBackend()
+	ct, err := parser.GetIntAnnotation(connect, ing)
+	if err != nil {
+		ct = defBackend.ProxyConnectTimeout
+	}
+
+	st, err := parser.GetIntAnnotation(send, ing)
+	if err != nil {
+		st = defBackend.ProxySendTimeout
+	}
+
+	rt, err := parser.GetIntAnnotation(read, ing)
+	if err != nil {
+		rt = defBackend.ProxyReadTimeout
+	}
+
+	bufs, err := parser.GetStringAnnotation(bufferSize, ing)
+	if err != nil || bufs == "" {
+		bufs = defBackend.ProxyBufferSize
+	}
+
+	cp, err := parser.GetStringAnnotation(cookiePath, ing)
+	if err != nil || cp == "" {
+		cp = defBackend.ProxyCookiePath
+	}
+
+	cd, err := parser.GetStringAnnotation(cookieDomain, ing)
+	if err != nil || cd == "" {
+		cd = defBackend.ProxyCookieDomain
+	}
+
+	bs, err := parser.GetStringAnnotation(bodySize, ing)
+	if err != nil || bs == "" {
+		bs = defBackend.ProxyBodySize
+	}
+
+	nu, err := parser.GetStringAnnotation(nextUpstream, ing)
+	if err != nil || nu == "" {
+		nu = defBackend.ProxyNextUpstream
+	}
+
+	pp, err := parser.GetStringAnnotation(passParams, ing)
+	if err != nil || pp == "" {
+		pp = defBackend.ProxyPassParams
+	}
+
+	rb, err := parser.GetStringAnnotation(requestBuffering, ing)
+	if err != nil || rb == "" {
+		rb = defBackend.ProxyRequestBuffering
+	}
+
+	return &Configuration{bs, ct, st, rt, bufs, cd, cp, nu, pp, rb}, nil
+}

pkg/ingress/annotations/proxy/main_test.go

@@ -0,0 +1,168 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+
+	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+)
+
+func buildIngress() *extensions.Ingress {
+	defaultBackend := extensions.IngressBackend{
+		ServiceName: "default-backend",
+		ServicePort: intstr.FromInt(80),
+	}
+
+	return &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{
+			Backend: &extensions.IngressBackend{
+				ServiceName: "default-backend",
+				ServicePort: intstr.FromInt(80),
+			},
+			Rules: []extensions.IngressRule{
+				{
+					Host: "foo.bar.com",
+					IngressRuleValue: extensions.IngressRuleValue{
+						HTTP: &extensions.HTTPIngressRuleValue{
+							Paths: []extensions.HTTPIngressPath{
+								{
+									Path:    "/foo",
+									Backend: defaultBackend,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+type mockBackend struct {
+}
+
+func (m mockBackend) GetDefaultBackend() defaults.Backend {
+	return defaults.Backend{
+		UpstreamFailTimeout: 1,
+		ProxyConnectTimeout: 10,
+		ProxySendTimeout:    15,
+		ProxyReadTimeout:    20,
+		ProxyBufferSize:     "10k",
+		ProxyBodySize:       "3k",
+		ProxyNextUpstream:   "error",
+		ProxyPassParams:     "nocanon keepalive=On",
+		ProxyRequestBuffering: "on",
+	}
+}
+
+func TestProxy(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	data[connect] = "1"
+	data[send] = "2"
+	data[read] = "3"
+	data[bufferSize] = "1k"
+	data[bodySize] = "2k"
+	data[nextUpstream] = "off"
+	data[passParams] = "smax=5 max=10"
+	data[requestBuffering] = "off"
+	ing.SetAnnotations(data)
+
+	i, err := NewParser(mockBackend{}).Parse(ing)
+	if err != nil {
+		t.Fatalf("unexpected error parsing a valid")
+	}
+	p, ok := i.(*Configuration)
+	if !ok {
+		t.Fatalf("expected a Configuration type")
+	}
+	if p.ConnectTimeout != 1 {
+		t.Errorf("expected 1 as connect-timeout but returned %v", p.ConnectTimeout)
+	}
+	if p.SendTimeout != 2 {
+		t.Errorf("expected 2 as send-timeout but returned %v", p.SendTimeout)
+	}
+	if p.ReadTimeout != 3 {
+		t.Errorf("expected 3 as read-timeout but returned %v", p.ReadTimeout)
+	}
+	if p.BufferSize != "1k" {
+		t.Errorf("expected 1k as buffer-size but returned %v", p.BufferSize)
+	}
+	if p.BodySize != "2k" {
+		t.Errorf("expected 2k as body-size but returned %v", p.BodySize)
+	}
+	if p.NextUpstream != "off" {
+		t.Errorf("expected off as next-upstream but returned %v", p.NextUpstream)
+	}
+	if p.PassParams != "smax=5 max=10" {
+		t.Errorf("expected \"smax=5 max=10\" as pass-params but returned \"%v\"", p.PassParams)
+	}
+	if p.RequestBuffering != "off" {
+		t.Errorf("expected off as request-buffering but returned %v", p.RequestBuffering)
+	}
+}
+
+func TestProxyWithNoAnnotation(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	ing.SetAnnotations(data)
+
+	i, err := NewParser(mockBackend{}).Parse(ing)
+	if err != nil {
+		t.Fatalf("unexpected error parsing a valid")
+	}
+	p, ok := i.(*Configuration)
+	if !ok {
+		t.Fatalf("expected a Configuration type")
+	}
+	if p.ConnectTimeout != 10 {
+		t.Errorf("expected 10 as connect-timeout but returned %v", p.ConnectTimeout)
+	}
+	if p.SendTimeout != 15 {
+		t.Errorf("expected 15 as send-timeout but returned %v", p.SendTimeout)
+	}
+	if p.ReadTimeout != 20 {
+		t.Errorf("expected 20 as read-timeout but returned %v", p.ReadTimeout)
+	}
+	if p.BufferSize != "10k" {
+		t.Errorf("expected 10k as buffer-size but returned %v", p.BufferSize)
+	}
+	if p.BodySize != "3k" {
+		t.Errorf("expected 3k as body-size but returned %v", p.BodySize)
+	}
+	if p.NextUpstream != "error" {
+		t.Errorf("expected error as next-upstream but returned %v", p.NextUpstream)
+	}
+	if p.PassParams != "nocanon keepalive=On" {
+		t.Errorf("expected \"nocanon keepalive=On\" as pass-params but returned \"%v\"", p.PassParams)
+	}
+	if p.RequestBuffering != "on" {
+		t.Errorf("expected on as request-buffering but returned %v", p.RequestBuffering)
+	}
+}

pkg/ingress/annotations/ratelimit/main.go

@@ -0,0 +1,255 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ratelimit
+
+import (
+	"encoding/base64"
+	"fmt"
+	"sort"
+	"strings"
+
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+	"k8s.io/ingress-nginx/pkg/net"
+)
+
+const (
+	limitIP        = "ingress.kubernetes.io/limit-connections"
+	limitRPS       = "ingress.kubernetes.io/limit-rps"
+	limitRPM       = "ingress.kubernetes.io/limit-rpm"
+	limitRATE      = "ingress.kubernetes.io/limit-rate"
+	limitRATEAFTER = "ingress.kubernetes.io/limit-rate-after"
+	limitWhitelist = "ingress.kubernetes.io/limit-whitelist"
+
+	// allow 5 times the specified limit as burst
+	defBurst = 5
+
+	// 1MB -> 16 thousand 64-byte states or about 8 thousand 128-byte states
+	// default is 5MB
+	defSharedSize = 5
+)
+
+// RateLimit returns rate limit configuration for an Ingress rule limiting the
+// number of connections per IP address and/or connections per second.
+// If you both annotations are specified in a single Ingress rule, RPS limits
+// takes precedence
+type RateLimit struct {
+	// Connections indicates a limit with the number of connections per IP address
+	Connections Zone `json:"connections"`
+	// RPS indicates a limit with the number of connections per second
+	RPS Zone `json:"rps"`
+
+	RPM Zone `json:"rpm"`
+
+	LimitRate int `json:"limit-rate"`
+
+	LimitRateAfter int `json:"limit-rate-after"`
+
+	Name string `json:"name"`
+
+	ID string `json:"id"`
+
+	Whitelist []string `json:"whitelist"`
+}
+
+// Equal tests for equality between two RateLimit types
+func (rt1 *RateLimit) Equal(rt2 *RateLimit) bool {
+	if rt1 == rt2 {
+		return true
+	}
+	if rt1 == nil || rt2 == nil {
+		return false
+	}
+	if !(&rt1.Connections).Equal(&rt2.Connections) {
+		return false
+	}
+	if !(&rt1.RPM).Equal(&rt2.RPM) {
+		return false
+	}
+	if !(&rt1.RPS).Equal(&rt2.RPS) {
+		return false
+	}
+	if rt1.LimitRate != rt2.LimitRate {
+		return false
+	}
+	if rt1.LimitRateAfter != rt2.LimitRateAfter {
+		return false
+	}
+	if rt1.ID != rt2.ID {
+		return false
+	}
+	if rt1.Name != rt2.Name {
+		return false
+	}
+	if len(rt1.Whitelist) != len(rt2.Whitelist) {
+		return false
+	}
+
+	for _, r1l := range rt1.Whitelist {
+		found := false
+		for _, rl2 := range rt2.Whitelist {
+			if r1l == rl2 {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+
+	return true
+}
+
+// Zone returns information about the NGINX rate limit (limit_req_zone)
+// http://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone
+type Zone struct {
+	Name  string `json:"name"`
+	Limit int    `json:"limit"`
+	Burst int    `json:"burst"`
+	// SharedSize amount of shared memory for the zone
+	SharedSize int `json:"sharedSize"`
+}
+
+// Equal tests for equality between two Zone types
+func (z1 *Zone) Equal(z2 *Zone) bool {
+	if z1 == z2 {
+		return true
+	}
+	if z1 == nil || z2 == nil {
+		return false
+	}
+	if z1.Name != z2.Name {
+		return false
+	}
+	if z1.Limit != z2.Limit {
+		return false
+	}
+	if z1.Burst != z2.Burst {
+		return false
+	}
+	if z1.SharedSize != z2.SharedSize {
+		return false
+	}
+
+	return true
+}
+
+type ratelimit struct {
+	backendResolver resolver.DefaultBackend
+}
+
+// NewParser creates a new ratelimit annotation parser
+func NewParser(br resolver.DefaultBackend) parser.IngressAnnotation {
+	return ratelimit{br}
+}
+
+// ParseAnnotations parses the annotations contained in the ingress
+// rule used to rewrite the defined paths
+func (a ratelimit) Parse(ing *extensions.Ingress) (interface{}, error) {
+	defBackend := a.backendResolver.GetDefaultBackend()
+	lr, err := parser.GetIntAnnotation(limitRATE, ing)
+	if err != nil {
+		lr = defBackend.LimitRate
+	}
+	lra, err := parser.GetIntAnnotation(limitRATEAFTER, ing)
+	if err != nil {
+		lra = defBackend.LimitRateAfter
+	}
+
+	rpm, _ := parser.GetIntAnnotation(limitRPM, ing)
+	rps, _ := parser.GetIntAnnotation(limitRPS, ing)
+	conn, _ := parser.GetIntAnnotation(limitIP, ing)
+
+	val, _ := parser.GetStringAnnotation(limitWhitelist, ing)
+
+	cidrs, err := parseCIDRs(val)
+	if err != nil {
+		return nil, err
+	}
+
+	if rpm == 0 && rps == 0 && conn == 0 {
+		return &RateLimit{
+			Connections:    Zone{},
+			RPS:            Zone{},
+			RPM:            Zone{},
+			LimitRate:      lr,
+			LimitRateAfter: lra,
+		}, nil
+	}
+
+	zoneName := fmt.Sprintf("%v_%v", ing.GetNamespace(), ing.GetName())
+
+	return &RateLimit{
+		Connections: Zone{
+			Name:       fmt.Sprintf("%v_conn", zoneName),
+			Limit:      conn,
+			Burst:      conn * defBurst,
+			SharedSize: defSharedSize,
+		},
+		RPS: Zone{
+			Name:       fmt.Sprintf("%v_rps", zoneName),
+			Limit:      rps,
+			Burst:      rps * defBurst,
+			SharedSize: defSharedSize,
+		},
+		RPM: Zone{
+			Name:       fmt.Sprintf("%v_rpm", zoneName),
+			Limit:      rpm,
+			Burst:      rpm * defBurst,
+			SharedSize: defSharedSize,
+		},
+		LimitRate:      lr,
+		LimitRateAfter: lra,
+		Name:           zoneName,
+		ID:             encode(zoneName),
+		Whitelist:      cidrs,
+	}, nil
+}
+
+func parseCIDRs(s string) ([]string, error) {
+	if s == "" {
+		return []string{}, nil
+	}
+
+	values := strings.Split(s, ",")
+
+	ipnets, ips, err := net.ParseIPNets(values...)
+	if err != nil {
+		return nil, err
+	}
+
+	cidrs := []string{}
+	for k := range ipnets {
+		cidrs = append(cidrs, k)
+	}
+
+	for k := range ips {
+		cidrs = append(cidrs, k)
+	}
+
+	sort.Strings(cidrs)
+
+	return cidrs, nil
+}
+
+func encode(s string) string {
+	str := base64.URLEncoding.EncodeToString([]byte(s))
+	return strings.Replace(str, "=", "", -1)
+}

pkg/ingress/annotations/ratelimit/main_test.go

@@ -0,0 +1,129 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ratelimit
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+)
+
+func buildIngress() *extensions.Ingress {
+	defaultBackend := extensions.IngressBackend{
+		ServiceName: "default-backend",
+		ServicePort: intstr.FromInt(80),
+	}
+
+	return &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{
+			Backend: &extensions.IngressBackend{
+				ServiceName: "default-backend",
+				ServicePort: intstr.FromInt(80),
+			},
+			Rules: []extensions.IngressRule{
+				{
+					Host: "foo.bar.com",
+					IngressRuleValue: extensions.IngressRuleValue{
+						HTTP: &extensions.HTTPIngressRuleValue{
+							Paths: []extensions.HTTPIngressPath{
+								{
+									Path:    "/foo",
+									Backend: defaultBackend,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+type mockBackend struct {
+}
+
+func (m mockBackend) GetDefaultBackend() defaults.Backend {
+	return defaults.Backend{
+		LimitRateAfter: 0,
+		LimitRate:      0,
+	}
+}
+
+func TestWithoutAnnotations(t *testing.T) {
+	ing := buildIngress()
+	_, err := NewParser(mockBackend{}).Parse(ing)
+	if err != nil {
+		t.Error("unexpected error with ingress without annotations")
+	}
+}
+
+func TestBadRateLimiting(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	data[limitIP] = "0"
+	data[limitRPS] = "0"
+	data[limitRPM] = "0"
+	ing.SetAnnotations(data)
+
+	_, err := NewParser(mockBackend{}).Parse(ing)
+	if err != nil {
+		t.Errorf("unexpected error with invalid limits (0)")
+	}
+
+	data = map[string]string{}
+	data[limitIP] = "5"
+	data[limitRPS] = "100"
+	data[limitRPM] = "10"
+	data[limitRATEAFTER] = "100"
+	data[limitRATE] = "10"
+
+	ing.SetAnnotations(data)
+
+	i, err := NewParser(mockBackend{}).Parse(ing)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	rateLimit, ok := i.(*RateLimit)
+	if !ok {
+		t.Errorf("expected a RateLimit type")
+	}
+	if rateLimit.Connections.Limit != 5 {
+		t.Errorf("expected 5 in limit by ip but %v was returend", rateLimit.Connections)
+	}
+	if rateLimit.RPS.Limit != 100 {
+		t.Errorf("expected 100 in limit by rps but %v was returend", rateLimit.RPS)
+	}
+	if rateLimit.RPM.Limit != 10 {
+		t.Errorf("expected 10 in limit by rpm but %v was returend", rateLimit.RPM)
+	}
+	if rateLimit.LimitRateAfter != 100 {
+		t.Errorf("expected 100 in limit by limitrateafter but %v was returend", rateLimit.LimitRateAfter)
+	}
+	if rateLimit.LimitRate != 10 {
+		t.Errorf("expected 10 in limit by limitrate but %v was returend", rateLimit.LimitRate)
+	}
+}

pkg/ingress/annotations/redirect/redirect.go

@@ -0,0 +1,131 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package redirect
+
+import (
+	"net/http"
+	"net/url"
+	"strings"
+
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/pkg/ingress/errors"
+)
+
+const (
+	permanent = "ingress.kubernetes.io/permanent-redirect"
+	temporal  = "ingress.kubernetes.io/temporal-redirect"
+	www       = "ingress.kubernetes.io/from-to-www-redirect"
+)
+
+// Redirect returns the redirect configuration for an Ingress rule
+type Redirect struct {
+	URL       string `json:"url"`
+	Code      int    `json:"code"`
+	FromToWWW bool   `json:"fromToWWW"`
+}
+
+type redirect struct{}
+
+// NewParser creates a new redirect annotation parser
+func NewParser() parser.IngressAnnotation {
+	return redirect{}
+}
+
+// Parse parses the annotations contained in the ingress
+// rule used to create a redirect in the paths defined in the rule.
+// If the Ingress containes both annotations the execution order is
+// temporal and then permanent
+func (a redirect) Parse(ing *extensions.Ingress) (interface{}, error) {
+	r3w, _ := parser.GetBoolAnnotation(www, ing)
+
+	tr, err := parser.GetStringAnnotation(temporal, ing)
+	if err != nil && !errors.IsMissingAnnotations(err) {
+		return nil, err
+	}
+
+	if tr != "" {
+		if err := isValidURL(tr); err != nil {
+			return nil, err
+		}
+
+		return &Redirect{
+			URL:       tr,
+			Code:      http.StatusFound,
+			FromToWWW: r3w,
+		}, nil
+	}
+
+	pr, err := parser.GetStringAnnotation(permanent, ing)
+	if err != nil && !errors.IsMissingAnnotations(err) {
+		return nil, err
+	}
+
+	if pr != "" {
+		if err := isValidURL(pr); err != nil {
+			return nil, err
+		}
+
+		return &Redirect{
+			URL:       pr,
+			Code:      http.StatusMovedPermanently,
+			FromToWWW: r3w,
+		}, nil
+	}
+
+	if r3w {
+		return &Redirect{
+			FromToWWW: r3w,
+		}, nil
+	}
+
+	return nil, errors.ErrMissingAnnotations
+}
+
+// Equal tests for equality between two Redirect types
+func (r1 *Redirect) Equal(r2 *Redirect) bool {
+	if r1 == r2 {
+		return true
+	}
+	if r1 == nil || r2 == nil {
+		return false
+	}
+	if r1.URL != r2.URL {
+		return false
+	}
+	if r1.Code != r2.Code {
+		return false
+	}
+	if r1.FromToWWW != r2.FromToWWW {
+		return false
+	}
+	return true
+}
+
+func isValidURL(s string) error {
+	u, err := url.Parse(s)
+	if err != nil {
+		return err
+	}
+
+	if !strings.HasPrefix(u.Scheme, "http") {
+		return errors.Errorf("only http and https are valid protocols (%v)", u.Scheme)
+	}
+
+	return nil
+}

pkg/ingress/annotations/rewrite/main.go

@@ -0,0 +1,114 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package rewrite
+
+import (
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+)
+
+const (
+	rewriteTo        = "ingress.kubernetes.io/rewrite-target"
+	addBaseURL       = "ingress.kubernetes.io/add-base-url"
+	baseURLScheme    = "ingress.kubernetes.io/base-url-scheme"
+	sslRedirect      = "ingress.kubernetes.io/ssl-redirect"
+	forceSSLRedirect = "ingress.kubernetes.io/force-ssl-redirect"
+	appRoot          = "ingress.kubernetes.io/app-root"
+)
+
+// Redirect describes the per location redirect config
+type Redirect struct {
+	// Target URI where the traffic must be redirected
+	Target string `json:"target"`
+	// AddBaseURL indicates if is required to add a base tag in the head
+	// of the responses from the upstream servers
+	AddBaseURL bool `json:"addBaseUrl"`
+	// BaseURLScheme override for the scheme passed to the base tag
+	BaseURLScheme string `json:"baseUrlScheme"`
+	// SSLRedirect indicates if the location section is accessible SSL only
+	SSLRedirect bool `json:"sslRedirect"`
+	// ForceSSLRedirect indicates if the location section is accessible SSL only
+	ForceSSLRedirect bool `json:"forceSSLRedirect"`
+	// AppRoot defines the Application Root that the Controller must redirect if it's not in '/' context
+	AppRoot string `json:"appRoot"`
+}
+
+// Equal tests for equality between two Redirect types
+func (r1 *Redirect) Equal(r2 *Redirect) bool {
+	if r1 == r2 {
+		return true
+	}
+	if r1 == nil || r2 == nil {
+		return false
+	}
+	if r1.Target != r2.Target {
+		return false
+	}
+	if r1.AddBaseURL != r2.AddBaseURL {
+		return false
+	}
+	if r1.BaseURLScheme != r2.BaseURLScheme {
+		return false
+	}
+	if r1.SSLRedirect != r2.SSLRedirect {
+		return false
+	}
+	if r1.ForceSSLRedirect != r2.ForceSSLRedirect {
+		return false
+	}
+	if r1.AppRoot != r2.AppRoot {
+		return false
+	}
+
+	return true
+}
+
+type rewrite struct {
+	backendResolver resolver.DefaultBackend
+}
+
+// NewParser creates a new reqrite annotation parser
+func NewParser(br resolver.DefaultBackend) parser.IngressAnnotation {
+	return rewrite{br}
+}
+
+// ParseAnnotations parses the annotations contained in the ingress
+// rule used to rewrite the defined paths
+func (a rewrite) Parse(ing *extensions.Ingress) (interface{}, error) {
+	rt, _ := parser.GetStringAnnotation(rewriteTo, ing)
+	sslRe, err := parser.GetBoolAnnotation(sslRedirect, ing)
+	if err != nil {
+		sslRe = a.backendResolver.GetDefaultBackend().SSLRedirect
+	}
+	fSslRe, err := parser.GetBoolAnnotation(forceSSLRedirect, ing)
+	if err != nil {
+		fSslRe = a.backendResolver.GetDefaultBackend().ForceSSLRedirect
+	}
+	abu, _ := parser.GetBoolAnnotation(addBaseURL, ing)
+	bus, _ := parser.GetStringAnnotation(baseURLScheme, ing)
+	ar, _ := parser.GetStringAnnotation(appRoot, ing)
+	return &Redirect{
+		Target:           rt,
+		AddBaseURL:       abu,
+		BaseURLScheme:    bus,
+		SSLRedirect:      sslRe,
+		ForceSSLRedirect: fSslRe,
+		AppRoot:          ar,
+	}, nil
+}

pkg/ingress/annotations/rewrite/main_test.go

@@ -0,0 +1,178 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package rewrite
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+
+	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+)
+
+const (
+	defRoute = "/demo"
+)
+
+func buildIngress() *extensions.Ingress {
+	defaultBackend := extensions.IngressBackend{
+		ServiceName: "default-backend",
+		ServicePort: intstr.FromInt(80),
+	}
+
+	return &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{
+			Backend: &extensions.IngressBackend{
+				ServiceName: "default-backend",
+				ServicePort: intstr.FromInt(80),
+			},
+			Rules: []extensions.IngressRule{
+				{
+					Host: "foo.bar.com",
+					IngressRuleValue: extensions.IngressRuleValue{
+						HTTP: &extensions.HTTPIngressRuleValue{
+							Paths: []extensions.HTTPIngressPath{
+								{
+									Path:    "/foo",
+									Backend: defaultBackend,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+type mockBackend struct {
+	redirect bool
+}
+
+func (m mockBackend) GetDefaultBackend() defaults.Backend {
+	return defaults.Backend{SSLRedirect: m.redirect}
+}
+
+func TestWithoutAnnotations(t *testing.T) {
+	ing := buildIngress()
+	_, err := NewParser(mockBackend{}).Parse(ing)
+	if err != nil {
+		t.Errorf("unexpected error with ingress without annotations: %v", err)
+	}
+}
+
+func TestRedirect(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	data[rewriteTo] = defRoute
+	ing.SetAnnotations(data)
+
+	i, err := NewParser(mockBackend{}).Parse(ing)
+	if err != nil {
+		t.Errorf("Unexpected error with ingress: %v", err)
+	}
+	redirect, ok := i.(*Redirect)
+	if !ok {
+		t.Errorf("expected a Redirect type")
+	}
+	if redirect.Target != defRoute {
+		t.Errorf("Expected %v as redirect but returned %s", defRoute, redirect.Target)
+	}
+}
+
+func TestSSLRedirect(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	data[rewriteTo] = defRoute
+	ing.SetAnnotations(data)
+
+	i, _ := NewParser(mockBackend{true}).Parse(ing)
+	redirect, ok := i.(*Redirect)
+	if !ok {
+		t.Errorf("expected a Redirect type")
+	}
+	if !redirect.SSLRedirect {
+		t.Errorf("Expected true but returned false")
+	}
+
+	data[sslRedirect] = "false"
+	ing.SetAnnotations(data)
+
+	i, _ = NewParser(mockBackend{false}).Parse(ing)
+	redirect, ok = i.(*Redirect)
+	if !ok {
+		t.Errorf("expected a Redirect type")
+	}
+	if redirect.SSLRedirect {
+		t.Errorf("Expected false but returned true")
+	}
+}
+
+func TestForceSSLRedirect(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	data[rewriteTo] = defRoute
+	ing.SetAnnotations(data)
+
+	i, _ := NewParser(mockBackend{true}).Parse(ing)
+	redirect, ok := i.(*Redirect)
+	if !ok {
+		t.Errorf("expected a Redirect type")
+	}
+	if redirect.ForceSSLRedirect {
+		t.Errorf("Expected false but returned true")
+	}
+
+	data[forceSSLRedirect] = "true"
+	ing.SetAnnotations(data)
+
+	i, _ = NewParser(mockBackend{false}).Parse(ing)
+	redirect, ok = i.(*Redirect)
+	if !ok {
+		t.Errorf("expected a Redirect type")
+	}
+	if !redirect.ForceSSLRedirect {
+		t.Errorf("Expected true but returned false")
+	}
+}
+func TestAppRoot(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	data[appRoot] = "/app1"
+	ing.SetAnnotations(data)
+
+	i, _ := NewParser(mockBackend{true}).Parse(ing)
+	redirect, ok := i.(*Redirect)
+	if !ok {
+		t.Errorf("expected a App Context")
+	}
+	if redirect.AppRoot != "/app1" {
+		t.Errorf("Unexpected value got in AppRoot")
+	}
+
+}

pkg/ingress/annotations/secureupstream/main.go

@@ -0,0 +1,78 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package secureupstream
+
+import (
+	"fmt"
+
+	"github.com/pkg/errors"
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+)
+
+const (
+	secureUpstream       = "ingress.kubernetes.io/secure-backends"
+	secureVerifyCASecret = "ingress.kubernetes.io/secure-verify-ca-secret"
+)
+
+// Secure describes SSL backend configuration
+type Secure struct {
+	Secure bool                 `json:"secure"`
+	CACert resolver.AuthSSLCert `json:"caCert"`
+}
+
+type su struct {
+	certResolver resolver.AuthCertificate
+}
+
+// NewParser creates a new secure upstream annotation parser
+func NewParser(resolver resolver.AuthCertificate) parser.IngressAnnotation {
+	return su{
+		certResolver: resolver,
+	}
+}
+
+// Parse parses the annotations contained in the ingress
+// rule used to indicate if the upstream servers should use SSL
+func (a su) Parse(ing *extensions.Ingress) (interface{}, error) {
+	s, _ := parser.GetBoolAnnotation(secureUpstream, ing)
+	ca, _ := parser.GetStringAnnotation(secureVerifyCASecret, ing)
+	secure := &Secure{
+		Secure: s,
+		CACert: resolver.AuthSSLCert{},
+	}
+	if !s && ca != "" {
+		return secure,
+			errors.Errorf("trying to use CA from secret %v/%v on a non secure backend", ing.Namespace, ca)
+	}
+	if ca == "" {
+		return secure, nil
+	}
+	caCert, err := a.certResolver.GetAuthCertificate(fmt.Sprintf("%v/%v", ing.Namespace, ca))
+	if err != nil {
+		return secure, errors.Wrap(err, "error obtaining certificate")
+	}
+	if caCert == nil {
+		return secure, nil
+	}
+	return &Secure{
+		Secure: s,
+		CACert: *caCert,
+	}, nil
+}

pkg/ingress/annotations/secureupstream/main_test.go

@@ -0,0 +1,121 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package secureupstream
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+)
+
+func buildIngress() *extensions.Ingress {
+	defaultBackend := extensions.IngressBackend{
+		ServiceName: "default-backend",
+		ServicePort: intstr.FromInt(80),
+	}
+
+	return &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{
+			Backend: &extensions.IngressBackend{
+				ServiceName: "default-backend",
+				ServicePort: intstr.FromInt(80),
+			},
+			Rules: []extensions.IngressRule{
+				{
+					Host: "foo.bar.com",
+					IngressRuleValue: extensions.IngressRuleValue{
+						HTTP: &extensions.HTTPIngressRuleValue{
+							Paths: []extensions.HTTPIngressPath{
+								{
+									Path:    "/foo",
+									Backend: defaultBackend,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+type mockCfg struct {
+	certs map[string]resolver.AuthSSLCert
+}
+
+func (cfg mockCfg) GetAuthCertificate(secret string) (*resolver.AuthSSLCert, error) {
+	if cert, ok := cfg.certs[secret]; ok {
+		return &cert, nil
+	}
+	return nil, fmt.Errorf("secret not found: %v", secret)
+}
+
+func TestAnnotations(t *testing.T) {
+	ing := buildIngress()
+	data := map[string]string{}
+	data[secureUpstream] = "true"
+	data[secureVerifyCASecret] = "secure-verify-ca"
+	ing.SetAnnotations(data)
+
+	_, err := NewParser(mockCfg{
+		certs: map[string]resolver.AuthSSLCert{
+			"default/secure-verify-ca": {},
+		},
+	}).Parse(ing)
+	if err != nil {
+		t.Errorf("Unexpected error on ingress: %v", err)
+	}
+}
+
+func TestSecretNotFound(t *testing.T) {
+	ing := buildIngress()
+	data := map[string]string{}
+	data[secureUpstream] = "true"
+	data[secureVerifyCASecret] = "secure-verify-ca"
+	ing.SetAnnotations(data)
+	_, err := NewParser(mockCfg{}).Parse(ing)
+	if err == nil {
+		t.Error("Expected secret not found error on ingress")
+	}
+}
+
+func TestSecretOnNonSecure(t *testing.T) {
+	ing := buildIngress()
+	data := map[string]string{}
+	data[secureUpstream] = "false"
+	data[secureVerifyCASecret] = "secure-verify-ca"
+	ing.SetAnnotations(data)
+	_, err := NewParser(mockCfg{
+		certs: map[string]resolver.AuthSSLCert{
+			"default/secure-verify-ca": {},
+		},
+	}).Parse(ing)
+	if err == nil {
+		t.Error("Expected CA secret on non secure backend error on ingress")
+	}
+}

pkg/ingress/annotations/serversnippet/main.go

@@ -0,0 +1,42 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serversnippet
+
+import (
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+)
+
+const (
+	annotation = "ingress.kubernetes.io/server-snippet"
+)
+
+type serverSnippet struct {
+}
+
+// NewParser creates a new server snippet annotation parser
+func NewParser() parser.IngressAnnotation {
+	return serverSnippet{}
+}
+
+// Parse parses the annotations contained in the ingress rule
+// used to indicate if the location/s contains a fragment of
+// configuration to be included inside the paths of the rules
+func (a serverSnippet) Parse(ing *extensions.Ingress) (interface{}, error) {
+	return parser.GetStringAnnotation(annotation, ing)
+}

pkg/ingress/annotations/serversnippet/main_test.go

@@ -0,0 +1,58 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serversnippet
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestParse(t *testing.T) {
+	ap := NewParser()
+	if ap == nil {
+		t.Fatalf("expected a parser.IngressAnnotation but returned nil")
+	}
+
+	testCases := []struct {
+		annotations map[string]string
+		expected    string
+	}{
+		{map[string]string{annotation: "more_headers"}, "more_headers"},
+		{map[string]string{annotation: "false"}, "false"},
+		{map[string]string{}, ""},
+		{nil, ""},
+	}
+
+	ing := &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{},
+	}
+
+	for _, testCase := range testCases {
+		ing.SetAnnotations(testCase.annotations)
+		result, _ := ap.Parse(ing)
+		if result != testCase.expected {
+			t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations)
+		}
+	}
+}

pkg/ingress/annotations/serviceupstream/main.go

@@ -0,0 +1,38 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serviceupstream
+
+import (
+	extensions "k8s.io/api/extensions/v1beta1"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+)
+
+const (
+	annotationServiceUpstream = "ingress.kubernetes.io/service-upstream"
+)
+
+type serviceUpstream struct {
+}
+
+// NewParser creates a new serviceUpstream annotation parser
+func NewParser() parser.IngressAnnotation {
+	return serviceUpstream{}
+}
+
+func (s serviceUpstream) Parse(ing *extensions.Ingress) (interface{}, error) {
+	return parser.GetBoolAnnotation(annotationServiceUpstream, ing)
+}

pkg/ingress/annotations/serviceupstream/main_test.go

@@ -0,0 +1,112 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serviceupstream
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+)
+
+func buildIngress() *extensions.Ingress {
+	defaultBackend := extensions.IngressBackend{
+		ServiceName: "default-backend",
+		ServicePort: intstr.FromInt(80),
+	}
+
+	return &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{
+			Backend: &extensions.IngressBackend{
+				ServiceName: "default-backend",
+				ServicePort: intstr.FromInt(80),
+			},
+			Rules: []extensions.IngressRule{
+				{
+					Host: "foo.bar.com",
+					IngressRuleValue: extensions.IngressRuleValue{
+						HTTP: &extensions.HTTPIngressRuleValue{
+							Paths: []extensions.HTTPIngressPath{
+								{
+									Path:    "/foo",
+									Backend: defaultBackend,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func TestIngressAnnotationServiceUpstreamEnabled(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	data[annotationServiceUpstream] = "true"
+	ing.SetAnnotations(data)
+
+	val, _ := NewParser().Parse(ing)
+	enabled, ok := val.(bool)
+	if !ok {
+		t.Errorf("expected a bool type")
+	}
+
+	if !enabled {
+		t.Errorf("expected annotation value to be true, got false")
+	}
+}
+
+func TestIngressAnnotationServiceUpstreamSetFalse(t *testing.T) {
+	ing := buildIngress()
+
+	// Test with explicitly set to false
+	data := map[string]string{}
+	data[annotationServiceUpstream] = "false"
+	ing.SetAnnotations(data)
+
+	val, _ := NewParser().Parse(ing)
+	enabled, ok := val.(bool)
+	if !ok {
+		t.Errorf("expected a bool type")
+	}
+
+	if enabled {
+		t.Errorf("expected annotation value to be false, got true")
+	}
+
+	// Test with no annotation specified, should default to false
+	data = map[string]string{}
+	ing.SetAnnotations(data)
+
+	val, _ = NewParser().Parse(ing)
+	enabled, ok = val.(bool)
+	if !ok {
+		t.Errorf("expected a bool type")
+	}
+
+	if enabled {
+		t.Errorf("expected annotation value to be false, got true")
+	}
+}

pkg/ingress/annotations/sessionaffinity/main.go

@@ -0,0 +1,115 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sessionaffinity
+
+import (
+	"regexp"
+
+	"github.com/golang/glog"
+
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+)
+
+const (
+	annotationAffinityType = "ingress.kubernetes.io/affinity"
+	// If a cookie with this name exists,
+	// its value is used as an index into the list of available backends.
+	annotationAffinityCookieName = "ingress.kubernetes.io/session-cookie-name"
+	defaultAffinityCookieName    = "INGRESSCOOKIE"
+	// This is the algorithm used by nginx to generate a value for the session cookie, if
+	// one isn't supplied and affinity is set to "cookie".
+	annotationAffinityCookieHash = "ingress.kubernetes.io/session-cookie-hash"
+	defaultAffinityCookieHash    = "md5"
+)
+
+var (
+	affinityCookieHashRegex = regexp.MustCompile(`^(index|md5|sha1)$`)
+)
+
+// AffinityConfig describes the per ingress session affinity config
+type AffinityConfig struct {
+	// The type of affinity that will be used
+	AffinityType string `json:"type"`
+	CookieConfig
+}
+
+// CookieConfig describes the Config of cookie type affinity
+type CookieConfig struct {
+	// The name of the cookie that will be used in case of cookie affinity type.
+	Name string `json:"name"`
+	// The hash that will be used to encode the cookie in case of cookie affinity type
+	Hash string `json:"hash"`
+}
+
+// CookieAffinityParse gets the annotation values related to Cookie Affinity
+// It also sets default values when no value or incorrect value is found
+func CookieAffinityParse(ing *extensions.Ingress) *CookieConfig {
+
+	sn, err := parser.GetStringAnnotation(annotationAffinityCookieName, ing)
+
+	if err != nil || sn == "" {
+		glog.V(3).Infof("Ingress %v: No value found in annotation %v. Using the default %v", ing.Name, annotationAffinityCookieName, defaultAffinityCookieName)
+		sn = defaultAffinityCookieName
+	}
+
+	sh, err := parser.GetStringAnnotation(annotationAffinityCookieHash, ing)
+
+	if err != nil || !affinityCookieHashRegex.MatchString(sh) {
+		glog.V(3).Infof("Invalid or no annotation value found in Ingress %v: %v. Setting it to default %v", ing.Name, annotationAffinityCookieHash, defaultAffinityCookieHash)
+		sh = defaultAffinityCookieHash
+	}
+
+	return &CookieConfig{
+		Name: sn,
+		Hash: sh,
+	}
+}
+
+// NewParser creates a new Affinity annotation parser
+func NewParser() parser.IngressAnnotation {
+	return affinity{}
+}
+
+type affinity struct {
+}
+
+// ParseAnnotations parses the annotations contained in the ingress
+// rule used to configure the affinity directives
+func (a affinity) Parse(ing *extensions.Ingress) (interface{}, error) {
+	cookieAffinityConfig := &CookieConfig{}
+	// Check the type of affinity that will be used
+	at, err := parser.GetStringAnnotation(annotationAffinityType, ing)
+	if err != nil {
+		at = ""
+	}
+
+	switch at {
+	case "cookie":
+		cookieAffinityConfig = CookieAffinityParse(ing)
+
+	default:
+		glog.V(3).Infof("No default affinity was found for Ingress %v", ing.Name)
+
+	}
+	return &AffinityConfig{
+		AffinityType: at,
+		CookieConfig: *cookieAffinityConfig,
+	}, nil
+
+}

pkg/ingress/annotations/sessionaffinity/main_test.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sessionaffinity
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+)
+
+func buildIngress() *extensions.Ingress {
+	defaultBackend := extensions.IngressBackend{
+		ServiceName: "default-backend",
+		ServicePort: intstr.FromInt(80),
+	}
+
+	return &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{
+			Backend: &extensions.IngressBackend{
+				ServiceName: "default-backend",
+				ServicePort: intstr.FromInt(80),
+			},
+			Rules: []extensions.IngressRule{
+				{
+					Host: "foo.bar.com",
+					IngressRuleValue: extensions.IngressRuleValue{
+						HTTP: &extensions.HTTPIngressRuleValue{
+							Paths: []extensions.HTTPIngressPath{
+								{
+									Path:    "/foo",
+									Backend: defaultBackend,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func TestIngressAffinityCookieConfig(t *testing.T) {
+	ing := buildIngress()
+
+	data := map[string]string{}
+	data[annotationAffinityType] = "cookie"
+	data[annotationAffinityCookieHash] = "sha123"
+	data[annotationAffinityCookieName] = "INGRESSCOOKIE"
+	ing.SetAnnotations(data)
+
+	affin, _ := NewParser().Parse(ing)
+	nginxAffinity, ok := affin.(*AffinityConfig)
+	if !ok {
+		t.Errorf("expected a Config type")
+	}
+
+	if nginxAffinity.AffinityType != "cookie" {
+		t.Errorf("expected cookie as sticky-type but returned %v", nginxAffinity.AffinityType)
+	}
+
+	if nginxAffinity.CookieConfig.Hash != "md5" {
+		t.Errorf("expected md5 as sticky-hash but returned %v", nginxAffinity.CookieConfig.Hash)
+	}
+
+	if nginxAffinity.CookieConfig.Name != "INGRESSCOOKIE" {
+		t.Errorf("expected route as sticky-name but returned %v", nginxAffinity.CookieConfig.Name)
+	}
+}

pkg/ingress/annotations/snippet/main.go

@@ -0,0 +1,42 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package snippet
+
+import (
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+)
+
+const (
+	annotation = "ingress.kubernetes.io/configuration-snippet"
+)
+
+type snippet struct {
+}
+
+// NewParser creates a new CORS annotation parser
+func NewParser() parser.IngressAnnotation {
+	return snippet{}
+}
+
+// Parse parses the annotations contained in the ingress rule
+// used to indicate if the location/s contains a fragment of
+// configuration to be included inside the paths of the rules
+func (a snippet) Parse(ing *extensions.Ingress) (interface{}, error) {
+	return parser.GetStringAnnotation(annotation, ing)
+}

pkg/ingress/annotations/snippet/main_test.go

@@ -0,0 +1,58 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package snippet
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestParse(t *testing.T) {
+	ap := NewParser()
+	if ap == nil {
+		t.Fatalf("expected a parser.IngressAnnotation but returned nil")
+	}
+
+	testCases := []struct {
+		annotations map[string]string
+		expected    string
+	}{
+		{map[string]string{annotation: "more_headers"}, "more_headers"},
+		{map[string]string{annotation: "false"}, "false"},
+		{map[string]string{}, ""},
+		{nil, ""},
+	}
+
+	ing := &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{},
+	}
+
+	for _, testCase := range testCases {
+		ing.SetAnnotations(testCase.annotations)
+		result, _ := ap.Parse(ing)
+		if result != testCase.expected {
+			t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations)
+		}
+	}
+}

pkg/ingress/annotations/sslpassthrough/main.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sslpassthrough
+
+import (
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	ing_errors "k8s.io/ingress-nginx/pkg/ingress/errors"
+)
+
+const (
+	passthrough = "ingress.kubernetes.io/ssl-passthrough"
+)
+
+type sslpt struct {
+}
+
+// NewParser creates a new SSL passthrough annotation parser
+func NewParser() parser.IngressAnnotation {
+	return sslpt{}
+}
+
+// ParseAnnotations parses the annotations contained in the ingress
+// rule used to indicate if is required to configure
+func (a sslpt) Parse(ing *extensions.Ingress) (interface{}, error) {
+	if ing.GetAnnotations() == nil {
+		return false, ing_errors.ErrMissingAnnotations
+	}
+
+	return parser.GetBoolAnnotation(passthrough, ing)
+}

pkg/ingress/annotations/sslpassthrough/main_test.go

@@ -0,0 +1,78 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sslpassthrough
+
+import (
+	"testing"
+
+	api "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"k8s.io/apimachinery/pkg/util/intstr"
+)
+
+func buildIngress() *extensions.Ingress {
+	return &extensions.Ingress{
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: api.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{
+			Backend: &extensions.IngressBackend{
+				ServiceName: "default-backend",
+				ServicePort: intstr.FromInt(80),
+			},
+		},
+	}
+}
+
+func TestParseAnnotations(t *testing.T) {
+	ing := buildIngress()
+
+	_, err := NewParser().Parse(ing)
+	if err == nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	data := map[string]string{}
+	data[passthrough] = "true"
+	ing.SetAnnotations(data)
+	// test ingress using the annotation without a TLS section
+	_, err = NewParser().Parse(ing)
+	if err != nil {
+		t.Errorf("unexpected error parsing ingress with sslpassthrough")
+	}
+
+	// test with a valid host
+	ing.Spec.TLS = []extensions.IngressTLS{
+		{
+			Hosts: []string{"foo.bar.com"},
+		},
+	}
+	i, err := NewParser().Parse(ing)
+	if err != nil {
+		t.Errorf("expected error parsing ingress with sslpassthrough")
+	}
+	val, ok := i.(bool)
+	if !ok {
+		t.Errorf("expected a bool type")
+	}
+	if !val {
+		t.Errorf("expected true but false returned")
+	}
+}

pkg/ingress/annotations/upstreamvhost/main.go

@@ -0,0 +1,42 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package upstreamvhost
+
+import (
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+)
+
+const (
+	annotation = "ingress.kubernetes.io/upstream-vhost"
+)
+
+type upstreamVhost struct {
+}
+
+// NewParser creates a new upstream VHost annotation parser
+func NewParser() parser.IngressAnnotation {
+	return upstreamVhost{}
+}
+
+// Parse parses the annotations contained in the ingress rule
+// used to indicate if the location/s contains a fragment of
+// configuration to be included inside the paths of the rules
+func (a upstreamVhost) Parse(ing *extensions.Ingress) (interface{}, error) {
+	return parser.GetStringAnnotation(annotation, ing)
+}

pkg/ingress/annotations/vtsfilterkey/main.go

@@ -0,0 +1,42 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package vtsfilterkey
+
+import (
+	extensions "k8s.io/api/extensions/v1beta1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+)
+
+const (
+	annotation = "ingress.kubernetes.io/vts-filter-key"
+)
+
+type vtsFilterKey struct {
+}
+
+// NewParser creates a new vts filter key annotation parser
+func NewParser() parser.IngressAnnotation {
+	return vtsFilterKey{}
+}
+
+// Parse parses the annotations contained in the ingress rule
+// used to indicate if the location/s contains a fragment of
+// configuration to be included inside the paths of the rules
+func (a vtsFilterKey) Parse(ing *extensions.Ingress) (interface{}, error) {
+	return parser.GetStringAnnotation(annotation, ing)
+}

pkg/ingress/controller/annotations.go

@@ -0,0 +1,191 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"github.com/golang/glog"
+
+	extensions "k8s.io/api/extensions/v1beta1"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/alias"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/auth"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/authreq"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/authtls"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/clientbodybuffersize"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/cors"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/defaultbackend"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/healthcheck"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/ipwhitelist"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/portinredirect"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/proxy"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/ratelimit"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/redirect"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/rewrite"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/secureupstream"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/serversnippet"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/serviceupstream"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/sessionaffinity"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/snippet"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/sslpassthrough"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/upstreamvhost"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/vtsfilterkey"
+	"k8s.io/ingress-nginx/pkg/ingress/errors"
+	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+)
+
+type extractorConfig interface {
+	resolver.AuthCertificate
+	resolver.DefaultBackend
+	resolver.Secret
+	resolver.Service
+}
+
+type annotationExtractor struct {
+	secretResolver resolver.Secret
+	annotations    map[string]parser.IngressAnnotation
+}
+
+func newAnnotationExtractor(cfg extractorConfig) annotationExtractor {
+	return annotationExtractor{
+		cfg,
+		map[string]parser.IngressAnnotation{
+			"BasicDigestAuth":      auth.NewParser(auth.AuthDirectory, cfg),
+			"ExternalAuth":         authreq.NewParser(),
+			"CertificateAuth":      authtls.NewParser(cfg),
+			"EnableCORS":           cors.NewParser(),
+			"HealthCheck":          healthcheck.NewParser(cfg),
+			"Whitelist":            ipwhitelist.NewParser(cfg),
+			"UsePortInRedirects":   portinredirect.NewParser(cfg),
+			"Proxy":                proxy.NewParser(cfg),
+			"RateLimit":            ratelimit.NewParser(cfg),
+			"Redirect":             redirect.NewParser(),
+			"Rewrite":              rewrite.NewParser(cfg),
+			"SecureUpstream":       secureupstream.NewParser(cfg),
+			"ServiceUpstream":      serviceupstream.NewParser(),
+			"SessionAffinity":      sessionaffinity.NewParser(),
+			"SSLPassthrough":       sslpassthrough.NewParser(),
+			"ConfigurationSnippet": snippet.NewParser(),
+			"Alias":                alias.NewParser(),
+			"ClientBodyBufferSize": clientbodybuffersize.NewParser(),
+			"DefaultBackend":       defaultbackend.NewParser(cfg),
+			"UpstreamVhost":        upstreamvhost.NewParser(),
+			"VtsFilterKey":         vtsfilterkey.NewParser(),
+			"ServerSnippet":        serversnippet.NewParser(),
+		},
+	}
+}
+
+func (e *annotationExtractor) Extract(ing *extensions.Ingress) map[string]interface{} {
+	anns := make(map[string]interface{})
+	for name, annotationParser := range e.annotations {
+		val, err := annotationParser.Parse(ing)
+		glog.V(5).Infof("annotation %v in Ingress %v/%v: %v", name, ing.GetNamespace(), ing.GetName(), val)
+		if err != nil {
+			if errors.IsMissingAnnotations(err) {
+				continue
+			}
+
+			if !errors.IsLocationDenied(err) {
+				continue
+			}
+
+			_, alreadyDenied := anns[DeniedKeyName]
+			if !alreadyDenied {
+				anns[DeniedKeyName] = err
+				glog.Errorf("error reading %v annotation in Ingress %v/%v: %v", name, ing.GetNamespace(), ing.GetName(), err)
+				continue
+			}
+
+			glog.V(5).Infof("error reading %v annotation in Ingress %v/%v: %v", name, ing.GetNamespace(), ing.GetName(), err)
+		}
+
+		if val != nil {
+			anns[name] = val
+		}
+	}
+
+	return anns
+}
+
+const (
+	secureUpstream       = "SecureUpstream"
+	healthCheck          = "HealthCheck"
+	sslPassthrough       = "SSLPassthrough"
+	sessionAffinity      = "SessionAffinity"
+	serviceUpstream      = "ServiceUpstream"
+	serverAlias          = "Alias"
+	clientBodyBufferSize = "ClientBodyBufferSize"
+	certificateAuth      = "CertificateAuth"
+	serverSnippet        = "ServerSnippet"
+)
+
+func (e *annotationExtractor) ServiceUpstream(ing *extensions.Ingress) bool {
+	val, _ := e.annotations[serviceUpstream].Parse(ing)
+	return val.(bool)
+}
+
+func (e *annotationExtractor) SecureUpstream(ing *extensions.Ingress) *secureupstream.Secure {
+	val, err := e.annotations[secureUpstream].Parse(ing)
+	if err != nil {
+		glog.Errorf("error parsing secure upstream: %v", err)
+	}
+	secure := val.(*secureupstream.Secure)
+	return secure
+}
+
+func (e *annotationExtractor) HealthCheck(ing *extensions.Ingress) *healthcheck.Upstream {
+	val, _ := e.annotations[healthCheck].Parse(ing)
+	return val.(*healthcheck.Upstream)
+}
+
+func (e *annotationExtractor) SSLPassthrough(ing *extensions.Ingress) bool {
+	val, _ := e.annotations[sslPassthrough].Parse(ing)
+	return val.(bool)
+}
+
+func (e *annotationExtractor) Alias(ing *extensions.Ingress) string {
+	val, _ := e.annotations[serverAlias].Parse(ing)
+	return val.(string)
+}
+
+func (e *annotationExtractor) ClientBodyBufferSize(ing *extensions.Ingress) string {
+	val, _ := e.annotations[clientBodyBufferSize].Parse(ing)
+	return val.(string)
+}
+
+func (e *annotationExtractor) SessionAffinity(ing *extensions.Ingress) *sessionaffinity.AffinityConfig {
+	val, _ := e.annotations[sessionAffinity].Parse(ing)
+	return val.(*sessionaffinity.AffinityConfig)
+}
+
+func (e *annotationExtractor) CertificateAuth(ing *extensions.Ingress) *authtls.AuthSSLConfig {
+	val, err := e.annotations[certificateAuth].Parse(ing)
+	if errors.IsMissingAnnotations(err) {
+		return nil
+	}
+
+	if err != nil {
+		glog.Errorf("error parsing certificate auth: %v", err)
+	}
+	secure := val.(*authtls.AuthSSLConfig)
+	return secure
+}
+
+func (e *annotationExtractor) ServerSnippet(ing *extensions.Ingress) string {
+	val, _ := e.annotations[serverSnippet].Parse(ing)
+	return val.(string)
+}

pkg/ingress/controller/annotations_test.go

@@ -0,0 +1,270 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"testing"
+
+	apiv1 "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+
+	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+)
+
+const (
+	annotationSecureUpstream     = "ingress.kubernetes.io/secure-backends"
+	annotationSecureVerifyCACert = "ingress.kubernetes.io/secure-verify-ca-secret"
+	annotationUpsMaxFails        = "ingress.kubernetes.io/upstream-max-fails"
+	annotationUpsFailTimeout     = "ingress.kubernetes.io/upstream-fail-timeout"
+	annotationPassthrough        = "ingress.kubernetes.io/ssl-passthrough"
+	annotationAffinityType       = "ingress.kubernetes.io/affinity"
+	annotationAffinityCookieName = "ingress.kubernetes.io/session-cookie-name"
+	annotationAffinityCookieHash = "ingress.kubernetes.io/session-cookie-hash"
+)
+
+type mockCfg struct {
+	MockSecrets  map[string]*apiv1.Secret
+	MockServices map[string]*apiv1.Service
+}
+
+func (m mockCfg) GetDefaultBackend() defaults.Backend {
+	return defaults.Backend{}
+}
+
+func (m mockCfg) GetSecret(name string) (*apiv1.Secret, error) {
+	return m.MockSecrets[name], nil
+}
+
+func (m mockCfg) GetService(name string) (*apiv1.Service, error) {
+	return m.MockServices[name], nil
+}
+
+func (m mockCfg) GetAuthCertificate(name string) (*resolver.AuthSSLCert, error) {
+	if secret, _ := m.GetSecret(name); secret != nil {
+		return &resolver.AuthSSLCert{
+			Secret:     name,
+			CAFileName: "/opt/ca.pem",
+			PemSHA:     "123",
+		}, nil
+	}
+	return nil, nil
+}
+
+func TestAnnotationExtractor(t *testing.T) {
+	ec := newAnnotationExtractor(mockCfg{})
+	ing := buildIngress()
+
+	m := ec.Extract(ing)
+	// the map at least should contains HealthCheck and Proxy information (defaults)
+	if _, ok := m["HealthCheck"]; !ok {
+		t.Error("expected HealthCheck annotation")
+	}
+	if _, ok := m["Proxy"]; !ok {
+		t.Error("expected Proxy annotation")
+	}
+}
+
+func buildIngress() *extensions.Ingress {
+	defaultBackend := extensions.IngressBackend{
+		ServiceName: "default-backend",
+		ServicePort: intstr.FromInt(80),
+	}
+
+	return &extensions.Ingress{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "foo",
+			Namespace: apiv1.NamespaceDefault,
+		},
+		Spec: extensions.IngressSpec{
+			Backend: &extensions.IngressBackend{
+				ServiceName: "default-backend",
+				ServicePort: intstr.FromInt(80),
+			},
+			Rules: []extensions.IngressRule{
+				{
+					Host: "foo.bar.com",
+					IngressRuleValue: extensions.IngressRuleValue{
+						HTTP: &extensions.HTTPIngressRuleValue{
+							Paths: []extensions.HTTPIngressPath{
+								{
+									Path:    "/foo",
+									Backend: defaultBackend,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func TestSecureUpstream(t *testing.T) {
+	ec := newAnnotationExtractor(mockCfg{})
+	ing := buildIngress()
+
+	fooAnns := []struct {
+		annotations map[string]string
+		er          bool
+	}{
+		{map[string]string{annotationSecureUpstream: "true"}, true},
+		{map[string]string{annotationSecureUpstream: "false"}, false},
+		{map[string]string{annotationSecureUpstream + "_no": "true"}, false},
+		{map[string]string{}, false},
+		{nil, false},
+	}
+
+	for _, foo := range fooAnns {
+		ing.SetAnnotations(foo.annotations)
+		r := ec.SecureUpstream(ing)
+		if r.Secure != foo.er {
+			t.Errorf("Returned %v but expected %v", r, foo.er)
+		}
+	}
+}
+
+func TestSecureVerifyCACert(t *testing.T) {
+	ec := newAnnotationExtractor(mockCfg{
+		MockSecrets: map[string]*apiv1.Secret{
+			"default/secure-verify-ca": {
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "secure-verify-ca",
+				},
+			},
+		},
+	})
+
+	anns := []struct {
+		it          int
+		annotations map[string]string
+		exists      bool
+	}{
+		{1, map[string]string{annotationSecureUpstream: "true", annotationSecureVerifyCACert: "not"}, false},
+		{2, map[string]string{annotationSecureUpstream: "false", annotationSecureVerifyCACert: "secure-verify-ca"}, false},
+		{3, map[string]string{annotationSecureUpstream: "true", annotationSecureVerifyCACert: "secure-verify-ca"}, true},
+		{4, map[string]string{annotationSecureUpstream: "true", annotationSecureVerifyCACert + "_not": "secure-verify-ca"}, false},
+		{5, map[string]string{annotationSecureUpstream: "true"}, false},
+		{6, map[string]string{}, false},
+		{7, nil, false},
+	}
+
+	for _, ann := range anns {
+		ing := buildIngress()
+		ing.SetAnnotations(ann.annotations)
+		res := ec.SecureUpstream(ing)
+		if (res.CACert.CAFileName != "") != ann.exists {
+			t.Errorf("Expected exists was %v on iteration %v", ann.exists, ann.it)
+		}
+	}
+}
+
+func TestHealthCheck(t *testing.T) {
+	ec := newAnnotationExtractor(mockCfg{})
+	ing := buildIngress()
+
+	fooAnns := []struct {
+		annotations map[string]string
+		eumf        int
+		euft        int
+	}{
+		{map[string]string{annotationUpsMaxFails: "3", annotationUpsFailTimeout: "10"}, 3, 10},
+		{map[string]string{annotationUpsMaxFails: "3"}, 3, 0},
+		{map[string]string{annotationUpsFailTimeout: "10"}, 0, 10},
+		{map[string]string{}, 0, 0},
+		{nil, 0, 0},
+	}
+
+	for _, foo := range fooAnns {
+		ing.SetAnnotations(foo.annotations)
+		r := ec.HealthCheck(ing)
+		if r == nil {
+			t.Errorf("Returned nil but expected a healthcheck.Upstream")
+			continue
+		}
+
+		if r.FailTimeout != foo.euft {
+			t.Errorf("Returned %d but expected %d for FailTimeout", r.FailTimeout, foo.euft)
+		}
+
+		if r.MaxFails != foo.eumf {
+			t.Errorf("Returned %d but expected %d for MaxFails", r.MaxFails, foo.eumf)
+		}
+	}
+}
+
+func TestSSLPassthrough(t *testing.T) {
+	ec := newAnnotationExtractor(mockCfg{})
+	ing := buildIngress()
+
+	fooAnns := []struct {
+		annotations map[string]string
+		er          bool
+	}{
+		{map[string]string{annotationPassthrough: "true"}, true},
+		{map[string]string{annotationPassthrough: "false"}, false},
+		{map[string]string{annotationPassthrough + "_no": "true"}, false},
+		{map[string]string{}, false},
+		{nil, false},
+	}
+
+	for _, foo := range fooAnns {
+		ing.SetAnnotations(foo.annotations)
+		r := ec.SSLPassthrough(ing)
+		if r != foo.er {
+			t.Errorf("Returned %v but expected %v", r, foo.er)
+		}
+	}
+}
+
+func TestAffinitySession(t *testing.T) {
+	ec := newAnnotationExtractor(mockCfg{})
+	ing := buildIngress()
+
+	fooAnns := []struct {
+		annotations  map[string]string
+		affinitytype string
+		hash         string
+		name         string
+	}{
+		{map[string]string{annotationAffinityType: "cookie", annotationAffinityCookieHash: "md5", annotationAffinityCookieName: "route"}, "cookie", "md5", "route"},
+		{map[string]string{annotationAffinityType: "cookie", annotationAffinityCookieHash: "xpto", annotationAffinityCookieName: "route1"}, "cookie", "md5", "route1"},
+		{map[string]string{annotationAffinityType: "cookie", annotationAffinityCookieHash: "", annotationAffinityCookieName: ""}, "cookie", "md5", "INGRESSCOOKIE"},
+		{map[string]string{}, "", "", ""},
+		{nil, "", "", ""},
+	}
+
+	for _, foo := range fooAnns {
+		ing.SetAnnotations(foo.annotations)
+		r := ec.SessionAffinity(ing)
+		t.Logf("Testing pass %v %v %v", foo.affinitytype, foo.hash, foo.name)
+		if r == nil {
+			t.Errorf("Returned nil but expected a SessionAffinity.AffinityConfig")
+			continue
+		}
+
+		if r.CookieConfig.Hash != foo.hash {
+			t.Errorf("Returned %v but expected %v for Hash", r.CookieConfig.Hash, foo.hash)
+		}
+
+		if r.CookieConfig.Name != foo.name {
+			t.Errorf("Returned %v but expected %v for Name", r.CookieConfig.Name, foo.name)
+		}
+	}
+}

pkg/ingress/controller/backend_ssl.go

@@ -0,0 +1,173 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+
+	"github.com/golang/glog"
+
+	apiv1 "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	"k8s.io/client-go/tools/cache"
+
+	"k8s.io/ingress-nginx/pkg/ingress"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/class"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/pkg/net/ssl"
+)
+
+// syncSecret keeps in sync Secrets used by Ingress rules with the files on
+// disk to allow copy of the content of the secret to disk to be used
+// by external processes.
+func (ic *GenericController) syncSecret(key string) {
+	glog.V(3).Infof("starting syncing of secret %v", key)
+
+	cert, err := ic.getPemCertificate(key)
+	if err != nil {
+		glog.Warningf("error obtaining PEM from secret %v: %v", key, err)
+		return
+	}
+
+	// create certificates and add or update the item in the store
+	cur, exists := ic.sslCertTracker.Get(key)
+	if exists {
+		s := cur.(*ingress.SSLCert)
+		if reflect.DeepEqual(s, cert) {
+			// no need to update
+			return
+		}
+		glog.Infof("updating secret %v in the local store", key)
+		ic.sslCertTracker.Update(key, cert)
+		// this update must trigger an update
+		// (like an update event from a change in Ingress)
+		ic.syncQueue.Enqueue(&extensions.Ingress{})
+		return
+	}
+
+	glog.Infof("adding secret %v to the local store", key)
+	ic.sslCertTracker.Add(key, cert)
+	// this update must trigger an update
+	// (like an update event from a change in Ingress)
+	ic.syncQueue.Enqueue(&extensions.Ingress{})
+}
+
+// getPemCertificate receives a secret, and creates a ingress.SSLCert as return.
+// It parses the secret and verifies if it's a keypair, or a 'ca.crt' secret only.
+func (ic *GenericController) getPemCertificate(secretName string) (*ingress.SSLCert, error) {
+	secret, err := ic.listers.Secret.GetByName(secretName)
+	if err != nil {
+		return nil, fmt.Errorf("error retrieving secret %v: %v", secretName, err)
+	}
+
+	cert, okcert := secret.Data[apiv1.TLSCertKey]
+	key, okkey := secret.Data[apiv1.TLSPrivateKeyKey]
+	ca := secret.Data["ca.crt"]
+
+	// namespace/secretName -> namespace-secretName
+	nsSecName := strings.Replace(secretName, "/", "-", -1)
+
+	var s *ingress.SSLCert
+	if okcert && okkey {
+		if cert == nil {
+			return nil, fmt.Errorf("secret %v has no 'tls.crt'", secretName)
+		}
+		if key == nil {
+			return nil, fmt.Errorf("secret %v has no 'tls.key'", secretName)
+		}
+
+		// If 'ca.crt' is also present, it will allow this secret to be used in the
+		// 'ingress.kubernetes.io/auth-tls-secret' annotation
+		s, err = ssl.AddOrUpdateCertAndKey(nsSecName, cert, key, ca)
+		if err != nil {
+			return nil, fmt.Errorf("unexpected error creating pem file: %v", err)
+		}
+
+		glog.V(3).Infof("found 'tls.crt' and 'tls.key', configuring %v as a TLS Secret (CN: %v)", secretName, s.CN)
+		if ca != nil {
+			glog.V(3).Infof("found 'ca.crt', secret %v can also be used for Certificate Authentication", secretName)
+		}
+
+	} else if ca != nil {
+		s, err = ssl.AddCertAuth(nsSecName, ca)
+
+		if err != nil {
+			return nil, fmt.Errorf("unexpected error creating pem file: %v", err)
+		}
+
+		// makes this secret in 'syncSecret' to be used for Certificate Authentication
+		// this does not enable Certificate Authentication
+		glog.V(3).Infof("found only 'ca.crt', configuring %v as an Certificate Authentication Secret", secretName)
+
+	} else {
+		return nil, fmt.Errorf("no keypair or CA cert could be found in %v", secretName)
+	}
+
+	s.Name = secret.Name
+	s.Namespace = secret.Namespace
+	return s, nil
+}
+
+// checkMissingSecrets verify if one or more ingress rules contains a reference
+// to a secret that is not present in the local secret store.
+// In this case we call syncSecret.
+func (ic *GenericController) checkMissingSecrets() {
+	for _, obj := range ic.listers.Ingress.List() {
+		ing := obj.(*extensions.Ingress)
+
+		if !class.IsValid(ing, ic.cfg.IngressClass, ic.cfg.DefaultIngressClass) {
+			continue
+		}
+
+		for _, tls := range ing.Spec.TLS {
+			if tls.SecretName == "" {
+				continue
+			}
+
+			key := fmt.Sprintf("%v/%v", ing.Namespace, tls.SecretName)
+			if _, ok := ic.sslCertTracker.Get(key); !ok {
+				ic.syncSecret(key)
+			}
+		}
+
+		key, _ := parser.GetStringAnnotation("ingress.kubernetes.io/auth-tls-secret", ing)
+		if key == "" {
+			continue
+		}
+
+		if _, ok := ic.sslCertTracker.Get(key); !ok {
+			ic.syncSecret(key)
+		}
+	}
+}
+
+// sslCertTracker holds a store of referenced Secrets in Ingress rules
+type sslCertTracker struct {
+	cache.ThreadSafeStore
+}
+
+func newSSLCertTracker() *sslCertTracker {
+	return &sslCertTracker{
+		cache.NewThreadSafeStore(cache.Indexers{}, cache.Indices{}),
+	}
+}
+
+func (s *sslCertTracker) DeleteAll(key string) {
+	s.Delete(key)
+}

pkg/ingress/controller/backend_ssl_test.go

@@ -0,0 +1,234 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"encoding/base64"
+	"fmt"
+	"io/ioutil"
+	"testing"
+
+	apiv1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	testclient "k8s.io/client-go/kubernetes/fake"
+	cache_client "k8s.io/client-go/tools/cache"
+	"k8s.io/client-go/util/flowcontrol"
+
+	"k8s.io/ingress-nginx/pkg/ingress"
+	"k8s.io/ingress-nginx/pkg/ingress/store"
+	"k8s.io/ingress-nginx/pkg/task"
+	"k8s.io/kubernetes/pkg/api"
+)
+
+const (
+	// openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=nginxsvc/O=nginxsvc"
+	tlsCrt    = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURIekNDQWdlZ0F3SUJBZ0lKQU1KZld6Mm81cWVnTUEwR0NTcUdTSWIzRFFFQkN3VUFNQ1l4RVRBUEJnTlYKQkFNTUNHNW5hVzU0YzNaak1SRXdEd1lEVlFRS0RBaHVaMmx1ZUhOMll6QWVGdzB4TnpBME1URXdNakF3TlRCYQpGdzB5TnpBME1Ea3dNakF3TlRCYU1DWXhFVEFQQmdOVkJBTU1DRzVuYVc1NGMzWmpNUkV3RHdZRFZRUUtEQWh1CloybHVlSE4yWXpDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTUgzVTYvY3ArODAKU3hJRjltSnlUcGI5RzBodnhsM0JMaGdQWDBTWjZ3d1lISGJXeTh2dmlCZjVwWTdvVHd0b2FPaTN1VFNsL2RtVwpvUi9XNm9GVWM5a2l6NlNXc3p6YWRXL2l2Q21LMmxOZUFVc2gvaXY0aTAvNXlreDJRNXZUT2tVL1dra2JPOW1OCjdSVTF0QW1KT3M0T1BVc3hZZkw2cnJJUzZPYktHS2UvYUVkek9QS2NPMDJ5NUxDeHM0TFhhWDIzU1l6TG1XYVAKYVZBallrN1NRZm1xUm5mYlF4RWlpaDFQWTFRRXgxWWs0RzA0VmtHUitrSVVMaWF0L291ZjQxY0dXRTZHMTF4NQpkV1BHeS9XcGtqRGlaM0UwekdNZnJBVUZibnErN1dhRTJCRzVoUVV3ZG9SQUtWTnMzaVhLRlRkT3hoRll5bnBwCjA3cDJVNS96ZHRrQ0F3RUFBYU5RTUU0d0hRWURWUjBPQkJZRUZCL2U5UnVna0Mwc0VNTTZ6enRCSjI1U1JxalMKTUI4R0ExVWRJd1FZTUJhQUZCL2U5UnVna0Mwc0VNTTZ6enRCSjI1U1JxalNNQXdHQTFVZEV3UUZNQU1CQWY4dwpEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBRys4MXdaSXRuMmFWSlFnejNkNmJvZW1nUXhSSHpaZDhNc1IrdFRvCnpJLy9ac1Nwc2FDR3F0TkdTaHVGKzB3TVZ4NjlpQ3lJTnJJb2J4K29NTHBsQzFQSk9uektSUUdvZEhYNFZaSUwKVlhxSFd2VStjK3ZtT0QxUEt3UjcwRi9rTXk2Yk4xMVI2amhIZ3RPZGdLKzdRczhRMVlUSC9RS2dMd3RJTFRHRwpTZlYxWFlmbnF1TXlZKzFzck00U3ZRSmRzdmFUQmJkZHE2RllpdjhXZFpIaG51ZGlSODdZcFgzOUlTSlFkOXF2CnR6OGthZTVqQVFEUWFiZnFsVWZNT1hmUnhyei96S2NvN3dMeWFMWTh1eVhEWUVIZmlHRWdablV0RjgxVlhDZUIKeU80UERBR0FuVmlXTndFM0NZcGI4RkNGelMyaVVVMDJaQWJRajlvUnYyUWNON1E9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
+	tlsKey    = "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRREI5MU92M0tmdk5Fc1MKQmZaaWNrNlcvUnRJYjhaZHdTNFlEMTlFbWVzTUdCeDIxc3ZMNzRnWCthV082RThMYUdqb3Q3azBwZjNabHFFZgoxdXFCVkhQWklzK2tsck04Mm5WdjRyd3BpdHBUWGdGTElmNHIrSXRQK2NwTWRrT2IwenBGUDFwSkd6dlpqZTBWCk5iUUppVHJPRGoxTE1XSHkrcTZ5RXVqbXloaW52MmhIY3pqeW5EdE5zdVN3c2JPQzEybDl0MG1NeTVsbWoybFEKSTJKTzBrSDVxa1ozMjBNUklvb2RUMk5VQk1kV0pPQnRPRlpCa2ZwQ0ZDNG1yZjZMbitOWEJsaE9odGRjZVhWagp4c3YxcVpJdzRtZHhOTXhqSDZ3RkJXNTZ2dTFtaE5nUnVZVUZNSGFFUUNsVGJONGx5aFUzVHNZUldNcDZhZE82CmRsT2Y4M2JaQWdNQkFBRUNnZ0VBRGU1WW1XSHN3ZFpzcWQrNXdYcGFRS2Z2SkxXNmRwTmdYeVFEZ0tiWlplWDUKYldPaUFZU3pycDBra2U0SGQxZEphYVdBYk5LYk45eUV1QWUwa2hOaHVxK3dZQzdlc3JreUJCWXgwMzRBamtwTApKMzFLaHhmejBZdXNSdStialg2UFNkZnlBUnd1b1VKN1M3R3V1NXlhbDZBWU1PVmNGcHFBbjVPU0hMbFpLZnNLClN3NXZyM3NKUjNyOENNWVZoUmQ0citGam9lMXlaczJhUHl2bno5c0U3T0ZCSVRGSVBKcE4veG53VUNpWW5vSEMKV2F2TzB5RCtPeTUyN2hBQ1FwaFVMVjRaZXV2bEZwd2ZlWkZveUhnc2YrM1FxeGhpdGtJb3NGakx2Y0xlL2xjZwpSVHNRUnU5OGJNUTdSakJpYU5kaURadjBaWEMvUUMvS054SEw0bXgxTFFLQmdRRHVDY0pUM2JBZmJRY2YvSGh3CjNxRzliNE9QTXpwOTl2ajUzWU1hZHo5Vlk1dm9RR3RGeFlwbTBRVm9MR1lkQ3BHK0lXaDdVVHBMV0JUeGtMSkYKd3EwcEFmRVhmdHB0anhmcyt0OExWVUFtSXJiM2hwUjZDUjJmYjFJWVZRWUJ4dUdzN0hWMmY3NnRZMVAzSEFnNwpGTDJNTnF3ZDd5VmlsVXdSTVptcmJKV3Qwd0tCZ1FEUW1qZlgzc1NWSWZtN1FQaVQvclhSOGJMM1B3V0lNa3NOCldJTVRYeDJmaG0vd0hOL0pNdCtEK2VWbGxjSXhLMmxSYlNTQ1NwU2hzRUVsMHNxWHZUa1FFQnJxN3RFZndRWU0KbGxNbDJQb0ovV2E5c2VYSTAzWWRNeC94Vm5sbzNaUG9MUGg4UmtKekJTWkhnMlB6cCs0VmlnUklBcGdYMXo3TwpMbHg0SEVtaEl3S0JnUURES1RVdVZYL2xCQnJuV3JQVXRuT2RRU1IzNytSeENtQXZYREgxTFBlOEpxTFkxSmdlCjZFc0U2VEtwcWwwK1NrQWJ4b0JIT3QyMGtFNzdqMHJhYnpaUmZNb1NIV3N3a0RWcGtuWDBjTHpiaDNMRGxvOTkKVHFQKzUrSkRHTktIK210a3Y2bStzaFcvU3NTNHdUN3VVWjdtcXB5TEhsdGtiRXVsZlNra3B5NUJDUUtCZ0RmUwpyVk1GZUZINGI1NGV1dWJQNk5Rdi9CYVNOT2JIbnJJSmw3b2RZQTRLcWZYMXBDVnhpY01Gb3MvV2pjc2V0T1puCmNMZTFRYVVyUjZQWmp3R2dUNTd1MEdWQ1Y1QkoxVmFVKzlkTEEwNmRFMXQ4T2VQT1F2TjVkUGplalVyMDBObjIKL3VBeTVTRm1wV0hKMVh1azJ0L0V1WFNUelNQRUpEaUV5NVlRNjl0RkFvR0JBT2tDcW1jVGZGYlpPTjJRK2JqdgpvVmQvSFpLR3YrbEhqcm5maVlhODVxcUszdWJmb0FSNGppR3V3TThqc3hZZW8vb0hQdHJDTkxINndsYlZNTUFGCmlRZG80ZUF3S0xxRHo1MUx4U2hMckwzUUtNQ1FuZVhkT0VjaEdqSW9zRG5Zekd5RTBpSzJGbWNvWHVSQU1QOHgKWDFreUlkazdENDFxSjQ5WlM1OEdBbXlLCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K"
+	tlscaName = "ca.crt"
+)
+
+type MockQueue struct {
+	cache_client.Store
+	Synced bool
+}
+
+func (f *MockQueue) HasSynced() bool {
+	return f.Synced
+}
+
+func (f *MockQueue) AddIfNotPresent(obj interface{}) error {
+	return nil
+}
+
+func (f *MockQueue) Pop(process cache_client.PopProcessFunc) (interface{}, error) {
+	return nil, nil
+}
+
+func (f *MockQueue) Close() {
+	// just mock
+}
+
+func buildSimpleClientSetForBackendSSL() *testclient.Clientset {
+	return testclient.NewSimpleClientset()
+}
+
+func buildIngListenerForBackendSSL() store.IngressLister {
+	ingLister := store.IngressLister{}
+	ingLister.Store = cache_client.NewStore(cache_client.DeletionHandlingMetaNamespaceKeyFunc)
+	return ingLister
+}
+
+func buildSecretForBackendSSL() *apiv1.Secret {
+	return &apiv1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "foo_secret",
+			Namespace: api.NamespaceDefault,
+		},
+	}
+}
+
+func buildSecrListerForBackendSSL() store.SecretLister {
+	secrLister := store.SecretLister{}
+	secrLister.Store = cache_client.NewStore(cache_client.DeletionHandlingMetaNamespaceKeyFunc)
+
+	return secrLister
+}
+
+func buildListers() *ingress.StoreLister {
+	sl := &ingress.StoreLister{}
+	sl.Ingress.Store = buildIngListenerForBackendSSL()
+	sl.Secret.Store = buildSecrListerForBackendSSL()
+	return sl
+}
+
+func buildControllerForBackendSSL() cache_client.Controller {
+	cfg := &cache_client.Config{
+		Queue: &MockQueue{Synced: true},
+	}
+
+	return cache_client.New(cfg)
+}
+
+func buildGenericControllerForBackendSSL() *GenericController {
+	gc := &GenericController{
+		syncRateLimiter: flowcontrol.NewTokenBucketRateLimiter(0.3, 1),
+		cfg: &Configuration{
+			Client: buildSimpleClientSetForBackendSSL(),
+		},
+		listers:        buildListers(),
+		sslCertTracker: newSSLCertTracker(),
+	}
+
+	gc.syncQueue = task.NewTaskQueue(gc.syncIngress)
+	return gc
+}
+
+func buildCrtKeyAndCA() ([]byte, []byte, []byte, error) {
+	// prepare
+	td, err := ioutil.TempDir("", "ssl")
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("error occurs while creating temp directory: %v", err)
+	}
+	ingress.DefaultSSLDirectory = td
+
+	dCrt, err := base64.StdEncoding.DecodeString(tlsCrt)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	dKey, err := base64.StdEncoding.DecodeString(tlsKey)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	dCa := dCrt
+
+	return dCrt, dKey, dCa, nil
+}
+
+func TestSyncSecret(t *testing.T) {
+	// prepare for test
+	dCrt, dKey, dCa, err := buildCrtKeyAndCA()
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	foos := []struct {
+		tn            string
+		secretName    string
+		Data          map[string][]byte
+		expectSuccess bool
+	}{
+		{"getPemCertificate_error", "default/foo_secret", map[string][]byte{api.TLSPrivateKeyKey: dKey}, false},
+		{"normal_test", "default/foo_secret", map[string][]byte{api.TLSCertKey: dCrt, api.TLSPrivateKeyKey: dKey, tlscaName: dCa}, true},
+	}
+
+	for _, foo := range foos {
+		t.Run(foo.tn, func(t *testing.T) {
+			ic := buildGenericControllerForBackendSSL()
+
+			// init secret for getPemCertificate
+			secret := buildSecretForBackendSSL()
+			secret.SetNamespace("default")
+			secret.SetName("foo_secret")
+			secret.Data = foo.Data
+			ic.listers.Secret.Add(secret)
+
+			key := "default/foo_secret"
+			// for add
+			ic.syncSecret(key)
+			if foo.expectSuccess {
+				// validate
+				_, exist := ic.sslCertTracker.Get(key)
+				if !exist {
+					t.Errorf("Failed to sync secret: %s", foo.secretName)
+				} else {
+					// for update
+					ic.syncSecret(key)
+				}
+			}
+		})
+	}
+}
+
+func TestGetPemCertificate(t *testing.T) {
+	// prepare
+	dCrt, dKey, dCa, err := buildCrtKeyAndCA()
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	foos := []struct {
+		tn         string
+		secretName string
+		Data       map[string][]byte
+		eErr       bool
+	}{
+		{"sceret_not_exist", "default/foo_secret_not_exist", nil, true},
+		{"data_not_complete_all_not_exist", "default/foo_secret", map[string][]byte{}, true},
+		{"data_not_complete_TLSCertKey_not_exist", "default/foo_secret", map[string][]byte{api.TLSPrivateKeyKey: dKey, tlscaName: dCa}, false},
+		{"data_not_complete_TLSCertKeyAndCA_not_exist", "default/foo_secret", map[string][]byte{api.TLSPrivateKeyKey: dKey}, true},
+		{"data_not_complete_TLSPrivateKeyKey_not_exist", "default/foo_secret", map[string][]byte{api.TLSCertKey: dCrt, tlscaName: dCa}, false},
+		{"data_not_complete_TLSPrivateKeyKeyAndCA_not_exist", "default/foo_secret", map[string][]byte{api.TLSCertKey: dCrt}, true},
+		{"data_not_complete_CA_not_exist", "default/foo_secret", map[string][]byte{api.TLSCertKey: dCrt, api.TLSPrivateKeyKey: dKey}, false},
+		{"normal_test", "default/foo_secret", map[string][]byte{api.TLSCertKey: dCrt, api.TLSPrivateKeyKey: dKey, tlscaName: dCa}, false},
+	}
+
+	for _, foo := range foos {
+		t.Run(foo.tn, func(t *testing.T) {
+			ic := buildGenericControllerForBackendSSL()
+			secret := buildSecretForBackendSSL()
+			secret.Data = foo.Data
+			ic.listers.Secret.Add(secret)
+			sslCert, err := ic.getPemCertificate(foo.secretName)
+
+			if foo.eErr {
+				if err == nil {
+					t.Fatal("Expected error")
+				}
+			} else {
+				if err != nil {
+					t.Fatalf("Unexpected error: %v", err)
+				}
+
+				if sslCert == nil {
+					t.Error("Expected an ingress.SSLCert")
+				}
+			}
+		})
+	}
+}

pkg/ingress/controller/launch.go

@@ -0,0 +1,319 @@
+package controller
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"net/http"
+	"net/http/pprof"
+	"os"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/golang/glog"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"github.com/spf13/pflag"
+
+	apiv1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apiserver/pkg/server/healthz"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+
+	"k8s.io/ingress-nginx/pkg/ingress"
+	"k8s.io/ingress-nginx/pkg/k8s"
+)
+
+// NewIngressController returns a configured Ingress controller
+func NewIngressController(backend ingress.Controller) *GenericController {
+	var (
+		flags = pflag.NewFlagSet("", pflag.ExitOnError)
+
+		apiserverHost = flags.String("apiserver-host", "", "The address of the Kubernetes Apiserver "+
+			"to connect to in the format of protocol://address:port, e.g., "+
+			"http://localhost:8080. If not specified, the assumption is that the binary runs inside a "+
+			"Kubernetes cluster and local discovery is attempted.")
+		kubeConfigFile = flags.String("kubeconfig", "", "Path to kubeconfig file with authorization and master location information.")
+
+		defaultSvc = flags.String("default-backend-service", "",
+			`Service used to serve a 404 page for the default backend. Takes the form
+    	namespace/name. The controller uses the first node port of this Service for
+    	the default backend.`)
+
+		ingressClass = flags.String("ingress-class", "",
+			`Name of the ingress class to route through this controller.`)
+
+		configMap = flags.String("configmap", "",
+			`Name of the ConfigMap that contains the custom configuration to use`)
+
+		publishSvc = flags.String("publish-service", "",
+			`Service fronting the ingress controllers. Takes the form
+ 		namespace/name. The controller will set the endpoint records on the
+ 		ingress objects to reflect those on the service.`)
+
+		tcpConfigMapName = flags.String("tcp-services-configmap", "",
+			`Name of the ConfigMap that contains the definition of the TCP services to expose.
+		The key in the map indicates the external port to be used. The value is the name of the
+		service with the format namespace/serviceName and the port of the service could be a
+		number of the name of the port.
+		The ports 80 and 443 are not allowed as external ports. This ports are reserved for the backend`)
+
+		udpConfigMapName = flags.String("udp-services-configmap", "",
+			`Name of the ConfigMap that contains the definition of the UDP services to expose.
+		The key in the map indicates the external port to be used. The value is the name of the
+		service with the format namespace/serviceName and the port of the service could be a
+		number of the name of the port.`)
+
+		resyncPeriod = flags.Duration("sync-period", 600*time.Second,
+			`Relist and confirm cloud resources this often. Default is 10 minutes`)
+
+		watchNamespace = flags.String("watch-namespace", apiv1.NamespaceAll,
+			`Namespace to watch for Ingress. Default is to watch all namespaces`)
+
+		healthzPort = flags.Int("healthz-port", 10254, "port for healthz endpoint.")
+
+		profiling = flags.Bool("profiling", true, `Enable profiling via web interface host:port/debug/pprof/`)
+
+		defSSLCertificate = flags.String("default-ssl-certificate", "", `Name of the secret
+		that contains a SSL certificate to be used as default for a HTTPS catch-all server`)
+
+		defHealthzURL = flags.String("health-check-path", "/healthz", `Defines
+		the URL to be used as health check inside in the default server in NGINX.`)
+
+		updateStatus = flags.Bool("update-status", true, `Indicates if the
+		ingress controller should update the Ingress status IP/hostname. Default is true`)
+
+		electionID = flags.String("election-id", "ingress-controller-leader", `Election id to use for status update.`)
+
+		forceIsolation = flags.Bool("force-namespace-isolation", false,
+			`Force namespace isolation. This flag is required to avoid the reference of secrets or
+		configmaps located in a different namespace than the specified in the flag --watch-namespace.`)
+
+		disableNodeList = flags.Bool("disable-node-list", false,
+			`Disable querying nodes. If --force-namespace-isolation is true, this should also be set.`)
+
+		updateStatusOnShutdown = flags.Bool("update-status-on-shutdown", true, `Indicates if the
+		ingress controller should update the Ingress status IP/hostname when the controller
+		is being stopped. Default is true`)
+
+		sortBackends = flags.Bool("sort-backends", false,
+			`Defines if backends and it's endpoints should be sorted`)
+	)
+
+	flags.AddGoFlagSet(flag.CommandLine)
+	backend.ConfigureFlags(flags)
+	flags.Parse(os.Args)
+	backend.OverrideFlags(flags)
+
+	flag.Set("logtostderr", "true")
+
+	glog.Info(backend.Info())
+
+	if *ingressClass != "" {
+		glog.Infof("Watching for ingress class: %s", *ingressClass)
+	}
+
+	if *defaultSvc == "" {
+		glog.Fatalf("Please specify --default-backend-service")
+	}
+
+	kubeClient, err := createApiserverClient(*apiserverHost, *kubeConfigFile)
+	if err != nil {
+		handleFatalInitError(err)
+	}
+
+	ns, name, err := k8s.ParseNameNS(*defaultSvc)
+	if err != nil {
+		glog.Fatalf("invalid format for service %v: %v", *defaultSvc, err)
+	}
+
+	_, err = kubeClient.Core().Services(ns).Get(name, metav1.GetOptions{})
+	if err != nil {
+		if strings.Contains(err.Error(), "cannot get services in the namespace") {
+			glog.Fatalf("✖ It seems the cluster it is running with Authorization enabled (like RBAC) and there is no permissions for the ingress controller. Please check the configuration")
+		}
+		glog.Fatalf("no service with name %v found: %v", *defaultSvc, err)
+	}
+	glog.Infof("validated %v as the default backend", *defaultSvc)
+
+	if *publishSvc != "" {
+		ns, name, err := k8s.ParseNameNS(*publishSvc)
+		if err != nil {
+			glog.Fatalf("invalid service format: %v", err)
+		}
+
+		svc, err := kubeClient.CoreV1().Services(ns).Get(name, metav1.GetOptions{})
+		if err != nil {
+			glog.Fatalf("unexpected error getting information about service %v: %v", *publishSvc, err)
+		}
+
+		if len(svc.Status.LoadBalancer.Ingress) == 0 {
+			if len(svc.Spec.ExternalIPs) > 0 {
+				glog.Infof("service %v validated as assigned with externalIP", *publishSvc)
+			} else {
+				// We could poll here, but we instead just exit and rely on k8s to restart us
+				glog.Fatalf("service %s does not (yet) have ingress points", *publishSvc)
+			}
+		} else {
+			glog.Infof("service %v validated as source of Ingress status", *publishSvc)
+		}
+	}
+
+	if *watchNamespace != "" {
+		_, err = kubeClient.CoreV1().Namespaces().Get(*watchNamespace, metav1.GetOptions{})
+		if err != nil {
+			glog.Fatalf("no watchNamespace with name %v found: %v", *watchNamespace, err)
+		}
+	}
+
+	if resyncPeriod.Seconds() < 10 {
+		glog.Fatalf("resync period (%vs) is too low", resyncPeriod.Seconds())
+	}
+
+	err = os.MkdirAll(ingress.DefaultSSLDirectory, 0655)
+	if err != nil {
+		glog.Errorf("Failed to mkdir SSL directory: %v", err)
+	}
+
+	config := &Configuration{
+		UpdateStatus:            *updateStatus,
+		ElectionID:              *electionID,
+		Client:                  kubeClient,
+		ResyncPeriod:            *resyncPeriod,
+		DefaultService:          *defaultSvc,
+		IngressClass:            *ingressClass,
+		DefaultIngressClass:     backend.DefaultIngressClass(),
+		Namespace:               *watchNamespace,
+		ConfigMapName:           *configMap,
+		TCPConfigMapName:        *tcpConfigMapName,
+		UDPConfigMapName:        *udpConfigMapName,
+		DefaultSSLCertificate:   *defSSLCertificate,
+		DefaultHealthzURL:       *defHealthzURL,
+		PublishService:          *publishSvc,
+		Backend:                 backend,
+		ForceNamespaceIsolation: *forceIsolation,
+		DisableNodeList:         *disableNodeList,
+		UpdateStatusOnShutdown:  *updateStatusOnShutdown,
+		SortBackends:            *sortBackends,
+	}
+
+	ic := newIngressController(config)
+	go registerHandlers(*profiling, *healthzPort, ic)
+	return ic
+}
+
+func registerHandlers(enableProfiling bool, port int, ic *GenericController) {
+	mux := http.NewServeMux()
+	// expose health check endpoint (/healthz)
+	healthz.InstallHandler(mux,
+		healthz.PingHealthz,
+		ic.cfg.Backend,
+	)
+
+	mux.Handle("/metrics", promhttp.Handler())
+
+	mux.HandleFunc("/build", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		b, _ := json.Marshal(ic.Info())
+		w.Write(b)
+	})
+
+	mux.HandleFunc("/stop", func(w http.ResponseWriter, r *http.Request) {
+		err := syscall.Kill(syscall.Getpid(), syscall.SIGTERM)
+		if err != nil {
+			glog.Errorf("unexpected error: %v", err)
+		}
+	})
+
+	if enableProfiling {
+		mux.HandleFunc("/debug/pprof/", pprof.Index)
+		mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
+		mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
+		mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
+	}
+
+	server := &http.Server{
+		Addr:    fmt.Sprintf(":%v", port),
+		Handler: mux,
+	}
+	glog.Fatal(server.ListenAndServe())
+}
+
+const (
+	// High enough QPS to fit all expected use cases. QPS=0 is not set here, because
+	// client code is overriding it.
+	defaultQPS = 1e6
+	// High enough Burst to fit all expected use cases. Burst=0 is not set here, because
+	// client code is overriding it.
+	defaultBurst = 1e6
+)
+
+// buildConfigFromFlags builds REST config based on master URL and kubeconfig path.
+// If both of them are empty then in cluster config is used.
+func buildConfigFromFlags(masterURL, kubeconfigPath string) (*rest.Config, error) {
+	if kubeconfigPath == "" && masterURL == "" {
+		kubeconfig, err := rest.InClusterConfig()
+		if err != nil {
+			return nil, err
+		}
+
+		return kubeconfig, nil
+	}
+
+	return clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
+		&clientcmd.ClientConfigLoadingRules{ExplicitPath: kubeconfigPath},
+		&clientcmd.ConfigOverrides{
+			ClusterInfo: clientcmdapi.Cluster{
+				Server: masterURL,
+			},
+		}).ClientConfig()
+}
+
+// createApiserverClient creates new Kubernetes Apiserver client. When kubeconfig or apiserverHost param is empty
+// the function assumes that it is running inside a Kubernetes cluster and attempts to
+// discover the Apiserver. Otherwise, it connects to the Apiserver specified.
+//
+// apiserverHost param is in the format of protocol://address:port/pathPrefix, e.g.http://localhost:8001.
+// kubeConfig location of kubeconfig file
+func createApiserverClient(apiserverHost string, kubeConfig string) (*kubernetes.Clientset, error) {
+	cfg, err := buildConfigFromFlags(apiserverHost, kubeConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	cfg.QPS = defaultQPS
+	cfg.Burst = defaultBurst
+	cfg.ContentType = "application/vnd.kubernetes.protobuf"
+
+	glog.Infof("Creating API client for %s", cfg.Host)
+
+	client, err := kubernetes.NewForConfig(cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	v, err := client.Discovery().ServerVersion()
+	if err != nil {
+		return nil, err
+	}
+
+	glog.Infof("Running in Kubernetes Cluster version v%v.%v (%v) - git (%v) commit %v - platform %v",
+		v.Major, v.Minor, v.GitVersion, v.GitTreeState, v.GitCommit, v.Platform)
+
+	return client, nil
+}
+
+/**
+ * Handles fatal init error that prevents server from doing any work. Prints verbose error
+ * message and quits the server.
+ */
+func handleFatalInitError(err error) {
+	glog.Fatalf("Error while initializing connection to Kubernetes apiserver. "+
+		"This most likely means that the cluster is misconfigured (e.g., it has "+
+		"invalid apiserver certificates or service accounts configuration). Reason: %s\n"+
+		"Refer to the troubleshooting guide for more information: "+
+		"https://github.com/kubernetes/ingress/blob/master/docs/troubleshooting.md", err)
+}

pkg/ingress/controller/listers.go

@@ -0,0 +1,236 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"fmt"
+	"reflect"
+
+	"github.com/golang/glog"
+
+	apiv1 "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/client-go/tools/cache"
+	fcache "k8s.io/client-go/tools/cache/testing"
+
+	"k8s.io/ingress-nginx/pkg/ingress"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/class"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+)
+
+type cacheController struct {
+	Ingress   cache.Controller
+	Endpoint  cache.Controller
+	Service   cache.Controller
+	Node      cache.Controller
+	Secret    cache.Controller
+	Configmap cache.Controller
+}
+
+func (c *cacheController) Run(stopCh chan struct{}) {
+	go c.Ingress.Run(stopCh)
+	go c.Endpoint.Run(stopCh)
+	go c.Service.Run(stopCh)
+	go c.Node.Run(stopCh)
+	go c.Secret.Run(stopCh)
+	go c.Configmap.Run(stopCh)
+
+	// Wait for all involved caches to be synced, before processing items from the queue is started
+	if !cache.WaitForCacheSync(stopCh,
+		c.Ingress.HasSynced,
+		c.Endpoint.HasSynced,
+		c.Service.HasSynced,
+		c.Node.HasSynced,
+		c.Secret.HasSynced,
+		c.Configmap.HasSynced,
+	) {
+		runtime.HandleError(fmt.Errorf("Timed out waiting for caches to sync"))
+	}
+}
+
+func (ic *GenericController) createListers(disableNodeLister bool) (*ingress.StoreLister, *cacheController) {
+	// from here to the end of the method all the code is just boilerplate
+	// required to watch Ingress, Secrets, ConfigMaps and Endoints.
+	// This is used to detect new content, updates or removals and act accordingly
+	ingEventHandler := cache.ResourceEventHandlerFuncs{
+		AddFunc: func(obj interface{}) {
+			addIng := obj.(*extensions.Ingress)
+			if !class.IsValid(addIng, ic.cfg.IngressClass, ic.cfg.DefaultIngressClass) {
+				a, _ := parser.GetStringAnnotation(class.IngressKey, addIng)
+				glog.Infof("ignoring add for ingress %v based on annotation %v with value %v", addIng.Name, class.IngressKey, a)
+				return
+			}
+			ic.recorder.Eventf(addIng, apiv1.EventTypeNormal, "CREATE", fmt.Sprintf("Ingress %s/%s", addIng.Namespace, addIng.Name))
+			ic.syncQueue.Enqueue(obj)
+		},
+		DeleteFunc: func(obj interface{}) {
+			delIng, ok := obj.(*extensions.Ingress)
+			if !ok {
+				// If we reached here it means the ingress was deleted but its final state is unrecorded.
+				tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
+				if !ok {
+					glog.Errorf("couldn't get object from tombstone %#v", obj)
+					return
+				}
+				delIng, ok = tombstone.Obj.(*extensions.Ingress)
+				if !ok {
+					glog.Errorf("Tombstone contained object that is not an Ingress: %#v", obj)
+					return
+				}
+			}
+			if !class.IsValid(delIng, ic.cfg.IngressClass, ic.cfg.DefaultIngressClass) {
+				glog.Infof("ignoring delete for ingress %v based on annotation %v", delIng.Name, class.IngressKey)
+				return
+			}
+			ic.recorder.Eventf(delIng, apiv1.EventTypeNormal, "DELETE", fmt.Sprintf("Ingress %s/%s", delIng.Namespace, delIng.Name))
+			ic.syncQueue.Enqueue(obj)
+		},
+		UpdateFunc: func(old, cur interface{}) {
+			oldIng := old.(*extensions.Ingress)
+			curIng := cur.(*extensions.Ingress)
+			validOld := class.IsValid(oldIng, ic.cfg.IngressClass, ic.cfg.DefaultIngressClass)
+			validCur := class.IsValid(curIng, ic.cfg.IngressClass, ic.cfg.DefaultIngressClass)
+			if !validOld && validCur {
+				glog.Infof("creating ingress %v based on annotation %v", curIng.Name, class.IngressKey)
+				ic.recorder.Eventf(curIng, apiv1.EventTypeNormal, "CREATE", fmt.Sprintf("Ingress %s/%s", curIng.Namespace, curIng.Name))
+			} else if validOld && !validCur {
+				glog.Infof("removing ingress %v based on annotation %v", curIng.Name, class.IngressKey)
+				ic.recorder.Eventf(curIng, apiv1.EventTypeNormal, "DELETE", fmt.Sprintf("Ingress %s/%s", curIng.Namespace, curIng.Name))
+			} else if validCur && !reflect.DeepEqual(old, cur) {
+				ic.recorder.Eventf(curIng, apiv1.EventTypeNormal, "UPDATE", fmt.Sprintf("Ingress %s/%s", curIng.Namespace, curIng.Name))
+			}
+
+			ic.syncQueue.Enqueue(cur)
+		},
+	}
+
+	secrEventHandler := cache.ResourceEventHandlerFuncs{
+		UpdateFunc: func(old, cur interface{}) {
+			if !reflect.DeepEqual(old, cur) {
+				sec := cur.(*apiv1.Secret)
+				key := fmt.Sprintf("%v/%v", sec.Namespace, sec.Name)
+				ic.syncSecret(key)
+			}
+		},
+		DeleteFunc: func(obj interface{}) {
+			sec, ok := obj.(*apiv1.Secret)
+			if !ok {
+				// If we reached here it means the secret was deleted but its final state is unrecorded.
+				tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
+				if !ok {
+					glog.Errorf("couldn't get object from tombstone %#v", obj)
+					return
+				}
+				sec, ok = tombstone.Obj.(*apiv1.Secret)
+				if !ok {
+					glog.Errorf("Tombstone contained object that is not a Secret: %#v", obj)
+					return
+				}
+			}
+			key := fmt.Sprintf("%v/%v", sec.Namespace, sec.Name)
+			ic.sslCertTracker.DeleteAll(key)
+			ic.syncQueue.Enqueue(key)
+		},
+	}
+
+	eventHandler := cache.ResourceEventHandlerFuncs{
+		AddFunc: func(obj interface{}) {
+			ic.syncQueue.Enqueue(obj)
+		},
+		DeleteFunc: func(obj interface{}) {
+			ic.syncQueue.Enqueue(obj)
+		},
+		UpdateFunc: func(old, cur interface{}) {
+			oep := old.(*apiv1.Endpoints)
+			ocur := cur.(*apiv1.Endpoints)
+			if !reflect.DeepEqual(ocur.Subsets, oep.Subsets) {
+				ic.syncQueue.Enqueue(cur)
+			}
+		},
+	}
+
+	mapEventHandler := cache.ResourceEventHandlerFuncs{
+		AddFunc: func(obj interface{}) {
+			upCmap := obj.(*apiv1.ConfigMap)
+			mapKey := fmt.Sprintf("%s/%s", upCmap.Namespace, upCmap.Name)
+			if mapKey == ic.cfg.ConfigMapName {
+				glog.V(2).Infof("adding configmap %v to backend", mapKey)
+				ic.cfg.Backend.SetConfig(upCmap)
+				ic.setForceReload(true)
+			}
+		},
+		UpdateFunc: func(old, cur interface{}) {
+			if !reflect.DeepEqual(old, cur) {
+				upCmap := cur.(*apiv1.ConfigMap)
+				mapKey := fmt.Sprintf("%s/%s", upCmap.Namespace, upCmap.Name)
+				if mapKey == ic.cfg.ConfigMapName {
+					glog.V(2).Infof("updating configmap backend (%v)", mapKey)
+					ic.cfg.Backend.SetConfig(upCmap)
+					ic.setForceReload(true)
+				}
+				// updates to configuration configmaps can trigger an update
+				if mapKey == ic.cfg.ConfigMapName || mapKey == ic.cfg.TCPConfigMapName || mapKey == ic.cfg.UDPConfigMapName {
+					ic.recorder.Eventf(upCmap, apiv1.EventTypeNormal, "UPDATE", fmt.Sprintf("ConfigMap %v", mapKey))
+					ic.syncQueue.Enqueue(cur)
+				}
+			}
+		},
+	}
+
+	watchNs := apiv1.NamespaceAll
+	if ic.cfg.ForceNamespaceIsolation && ic.cfg.Namespace != apiv1.NamespaceAll {
+		watchNs = ic.cfg.Namespace
+	}
+
+	lister := &ingress.StoreLister{}
+
+	controller := &cacheController{}
+
+	lister.Ingress.Store, controller.Ingress = cache.NewInformer(
+		cache.NewListWatchFromClient(ic.cfg.Client.ExtensionsV1beta1().RESTClient(), "ingresses", ic.cfg.Namespace, fields.Everything()),
+		&extensions.Ingress{}, ic.cfg.ResyncPeriod, ingEventHandler)
+
+	lister.Endpoint.Store, controller.Endpoint = cache.NewInformer(
+		cache.NewListWatchFromClient(ic.cfg.Client.CoreV1().RESTClient(), "endpoints", ic.cfg.Namespace, fields.Everything()),
+		&apiv1.Endpoints{}, ic.cfg.ResyncPeriod, eventHandler)
+
+	lister.Secret.Store, controller.Secret = cache.NewInformer(
+		cache.NewListWatchFromClient(ic.cfg.Client.CoreV1().RESTClient(), "secrets", watchNs, fields.Everything()),
+		&apiv1.Secret{}, ic.cfg.ResyncPeriod, secrEventHandler)
+
+	lister.ConfigMap.Store, controller.Configmap = cache.NewInformer(
+		cache.NewListWatchFromClient(ic.cfg.Client.CoreV1().RESTClient(), "configmaps", watchNs, fields.Everything()),
+		&apiv1.ConfigMap{}, ic.cfg.ResyncPeriod, mapEventHandler)
+
+	lister.Service.Store, controller.Service = cache.NewInformer(
+		cache.NewListWatchFromClient(ic.cfg.Client.CoreV1().RESTClient(), "services", ic.cfg.Namespace, fields.Everything()),
+		&apiv1.Service{}, ic.cfg.ResyncPeriod, cache.ResourceEventHandlerFuncs{})
+
+	var nodeListerWatcher cache.ListerWatcher
+	if disableNodeLister {
+		nodeListerWatcher = fcache.NewFakeControllerSource()
+	} else {
+		nodeListerWatcher = cache.NewListWatchFromClient(ic.cfg.Client.CoreV1().RESTClient(), "nodes", apiv1.NamespaceAll, fields.Everything())
+	}
+	lister.Node.Store, controller.Node = cache.NewInformer(
+		nodeListerWatcher,
+		&apiv1.Node{}, ic.cfg.ResyncPeriod, cache.ResourceEventHandlerFuncs{})
+
+	return lister, controller
+}

pkg/ingress/controller/metrics.go

@@ -0,0 +1,84 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+
+	"k8s.io/ingress-nginx/pkg/ingress"
+)
+
+const (
+	ns             = "ingress_controller"
+	operation      = "count"
+	reloadLabel    = "reloads"
+	sslLabelExpire = "ssl_expire_time_seconds"
+	sslLabelHost   = "host"
+)
+
+func init() {
+	prometheus.MustRegister(reloadOperation)
+	prometheus.MustRegister(reloadOperationErrors)
+	prometheus.MustRegister(sslExpireTime)
+
+}
+
+var (
+	reloadOperation = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: ns,
+			Name:      "success",
+			Help:      "Cumulative number of Ingress controller reload operations",
+		},
+		[]string{operation},
+	)
+	reloadOperationErrors = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: ns,
+			Name:      "errors",
+			Help:      "Cumulative number of Ingress controller errors during reload operations",
+		},
+		[]string{operation},
+	)
+	sslExpireTime = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Namespace: ns,
+			Name:      sslLabelExpire,
+			Help: "Number of seconds since 1970 to the SSL Certificate expire. An example to check if this " +
+				"certificate will expire in 10 days is: \"ingress_controller_ssl_expire_time_seconds < (time() + (10 * 24 * 3600))\"",
+		},
+		[]string{sslLabelHost},
+	)
+)
+
+func incReloadCount() {
+	reloadOperation.WithLabelValues(reloadLabel).Inc()
+}
+
+func incReloadErrorCount() {
+	reloadOperationErrors.WithLabelValues(reloadLabel).Inc()
+}
+
+func setSSLExpireTime(servers []*ingress.Server) {
+
+	for _, s := range servers {
+		if s.Hostname != defServerName {
+			sslExpireTime.WithLabelValues(s.Hostname).Set(float64(s.SSLExpireTime.Unix()))
+		}
+	}
+
+}

pkg/ingress/controller/util.go

@@ -0,0 +1,55 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"github.com/golang/glog"
+
+	"github.com/imdario/mergo"
+
+	api "k8s.io/api/core/v1"
+
+	"k8s.io/ingress-nginx/pkg/ingress"
+)
+
+// DeniedKeyName name of the key that contains the reason to deny a location
+const DeniedKeyName = "Denied"
+
+// newUpstream creates an upstream without servers.
+func newUpstream(name string) *ingress.Backend {
+	return &ingress.Backend{
+		Name:      name,
+		Endpoints: []ingress.Endpoint{},
+		Service:   &api.Service{},
+		SessionAffinity: ingress.SessionAffinityConfig{
+			CookieSessionAffinity: ingress.CookieSessionAffinity{
+				Locations: make(map[string][]string),
+			},
+		},
+	}
+}
+
+func mergeLocationAnnotations(loc *ingress.Location, anns map[string]interface{}) {
+	if _, ok := anns[DeniedKeyName]; ok {
+		loc.Denied = anns[DeniedKeyName].(error)
+	}
+	delete(anns, DeniedKeyName)
+	err := mergo.Map(loc, anns)
+	if err != nil {
+		glog.Errorf("unexpected error merging extracted annotations in location type: %v", err)
+	}
+}

pkg/ingress/controller/util_test.go

@@ -0,0 +1,82 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/ingress-nginx/pkg/ingress"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/auth"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/authreq"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/ipwhitelist"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/proxy"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/ratelimit"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/redirect"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/rewrite"
+)
+
+type fakeError struct{}
+
+func (fe *fakeError) Error() string {
+	return "fakeError"
+}
+
+func TestMergeLocationAnnotations(t *testing.T) {
+	// initial parameters
+	loc := ingress.Location{}
+	annotations := map[string]interface{}{
+		"Path":               "/checkpath",
+		"IsDefBackend":       true,
+		"Backend":            "foo_backend",
+		"BasicDigestAuth":    auth.BasicDigest{},
+		DeniedKeyName:        &fakeError{},
+		"EnableCORS":         true,
+		"ExternalAuth":       authreq.External{},
+		"RateLimit":          ratelimit.RateLimit{},
+		"Redirect":           redirect.Redirect{},
+		"Rewrite":            rewrite.Redirect{},
+		"Whitelist":          ipwhitelist.SourceRange{},
+		"Proxy":              proxy.Configuration{},
+		"UsePortInRedirects": true,
+	}
+
+	// create test table
+	type fooMergeLocationAnnotationsStruct struct {
+		fName string
+		er    interface{}
+	}
+	fooTests := []fooMergeLocationAnnotationsStruct{}
+	for name, value := range annotations {
+		fva := fooMergeLocationAnnotationsStruct{name, value}
+		fooTests = append(fooTests, fva)
+	}
+
+	// execute test
+	mergeLocationAnnotations(&loc, annotations)
+
+	// check result
+	for _, foo := range fooTests {
+		fv := reflect.ValueOf(loc).FieldByName(foo.fName).Interface()
+		if !reflect.DeepEqual(fv, foo.er) {
+			t.Errorf("Returned %v but expected %v for the field %s", fv, foo.er, foo.fName)
+		}
+	}
+	if _, ok := annotations[DeniedKeyName]; ok {
+		t.Errorf("%s should be removed after mergeLocationAnnotations", DeniedKeyName)
+	}
+}

pkg/ingress/defaults/main.go

@@ -0,0 +1,109 @@
+package defaults
+
+import "net"
+
+// Backend defines the mandatory configuration that an Ingress controller must provide
+// The reason of this requirements is the annotations are generic. If some implementation do not supports
+// one or more annotations it just can provides defaults
+type Backend struct {
+	// AppRoot contains the AppRoot for apps that doesn't exposes its content in the 'root' context
+	AppRoot string `json:"app-root"`
+
+	// enables which HTTP codes should be passed for processing with the error_page directive
+	// http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_intercept_errors
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#error_page
+	// By default this is disabled
+	CustomHTTPErrors []int `json:"custom-http-errors,-"`
+
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
+	// Sets the maximum allowed size of the client request body
+	ProxyBodySize string `json:"proxy-body-size"`
+
+	// Defines a timeout for establishing a connection with a proxied server.
+	// It should be noted that this timeout cannot usually exceed 75 seconds.
+	// http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout
+	ProxyConnectTimeout int `json:"proxy-connect-timeout"`
+
+	// Timeout in seconds for reading a response from the proxied server. The timeout is set only between
+	// two successive read operations, not for the transmission of the whole response
+	// http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout
+	ProxyReadTimeout int `json:"proxy-read-timeout"`
+
+	// Timeout in seconds for transmitting a request to the proxied server. The timeout is set only between
+	// two successive write operations, not for the transmission of the whole request.
+	// http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout
+	ProxySendTimeout int `json:"proxy-send-timeout"`
+
+	// Sets the size of the buffer used for reading the first part of the response received from the
+	// proxied server. This part usually contains a small response header.
+	// http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size)
+	ProxyBufferSize string `json:"proxy-buffer-size"`
+
+	// Sets a text that should be changed in the path attribute of the “Set-Cookie” header fields of
+	// a proxied server response.
+	// http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_path
+	ProxyCookiePath string `json:"proxy-cookie-path"`
+
+	// Sets a text that should be changed in the domain attribute of the “Set-Cookie” header fields
+	// of a proxied server response.
+	// http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_domain
+	ProxyCookieDomain string `json:"proxy-cookie-domain"`
+
+	// Specifies in which cases a request should be passed to the next server.
+	// http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream
+	ProxyNextUpstream string `json:"proxy-next-upstream"`
+
+	// Parameters for proxy-pass directive (eg. Apache web server).
+	ProxyPassParams string `json:"proxy-pass-params"`
+
+	// Enables or disables buffering of a client request body.
+	// http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_request_buffering
+	ProxyRequestBuffering string `json:"proxy-request-buffering"`
+
+	// Name server/s used to resolve names of upstream servers into IP addresses.
+	// The file /etc/resolv.conf is used as DNS resolution configuration.
+	Resolver []net.IP
+
+	// SkipAccessLogURLs sets a list of URLs that should not appear in the NGINX access log
+	// This is useful with urls like `/health` or `health-check` that make "complex" reading the logs
+	// By default this list is empty
+	SkipAccessLogURLs []string `json:"skip-access-log-urls,-"`
+
+	// Enables or disables the redirect (301) to the HTTPS port
+	SSLRedirect bool `json:"ssl-redirect"`
+
+	// Enables or disables the redirect (301) to the HTTPS port even without TLS cert
+	// This is useful if doing SSL offloading outside of cluster eg AWS ELB
+	ForceSSLRedirect bool `json:"force-ssl-redirect"`
+
+	// Enables or disables the specification of port in redirects
+	// Default: false
+	UsePortInRedirects bool `json:"use-port-in-redirects"`
+
+	// Number of unsuccessful attempts to communicate with the server that should happen in the
+	// duration set by the fail_timeout parameter to consider the server unavailable
+	// http://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream
+	// Default: 0, ie use platform liveness probe
+	UpstreamMaxFails int `json:"upstream-max-fails"`
+
+	// Time during which the specified number of unsuccessful attempts to communicate with
+	// the server should happen to consider the server unavailable
+	// http://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream
+	// Default: 0, ie use platform liveness probe
+	UpstreamFailTimeout int `json:"upstream-fail-timeout"`
+
+	// WhitelistSourceRange allows limiting access to certain client addresses
+	// http://nginx.org/en/docs/http/ngx_http_access_module.html
+	WhitelistSourceRange []string `json:"whitelist-source-range,-"`
+
+	// Limits the rate of response transmission to a client.
+	// The rate is specified in bytes per second. The zero value disables rate limiting.
+	// The limit is set per a request, and so if a client simultaneously opens two connections,
+	// the overall rate will be twice as much as the specified limit.
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#limit_rate
+	LimitRate int `json:"limit-rate"`
+
+	// Sets the initial amount after which the further transmission of a response to a client will be rate limited.
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#limit_rate_after
+	LimitRateAfter int `json:"limit-rate-after"`
+}

pkg/ingress/doc.go

@@ -0,0 +1,71 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ingress
+
+// This package contains the interface is required to implement to build an Ingress controller
+// A dummy implementation could be
+//
+// func main() {
+//  dc := newDummyController()
+//	controller.NewIngressController(dc)
+//	glog.Infof("shutting down Ingress controller...")
+// }
+//
+//where newDummyController returns and implementation of the Controller interface:
+//
+// func newDummyController() ingress.Controller {
+//   return &DummyController{}
+// }
+//
+// type DummyController struct {
+// }
+//
+// func (dc DummyController) Reload(data []byte) ([]byte, error) {
+//   err := ioutil.WriteFile("/arbitrary-path", data, 0644)
+//   if err != nil {
+//     return nil, err
+//   }
+//
+//   return exec.Command("some command", "--reload").CombinedOutput()
+// }
+//
+// func (dc DummyController) Test(file string) *exec.Cmd {
+//     return exec.Command("some command", "--config-file", file)
+// }
+//
+// func (dc DummyController) OnUpdate(*api.ConfigMap, Configuration) ([]byte, error) {
+//     return []byte(`<string containing a configuration file>`)
+// }
+//
+// func (dc DummyController) BackendDefaults() defaults.Backend {
+//     return ingress.NewStandardDefaults()
+// }
+//
+// func (n DummyController) Name() string {
+// 	   return "dummy Controller"
+// }
+//
+// func (n DummyController) Check(_ *http.Request) error {
+//     return nil
+// }
+//
+// func (dc DummyController) Info() *BackendInfo {
+//     Name: "dummy",
+//   Release: "0.0.0",
+//   Build: "git-00000000",
+//   Repository: "git://foo.bar.com",
+// }

pkg/ingress/errors/errors.go

@@ -0,0 +1,93 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package errors
+
+import (
+	"fmt"
+
+	"github.com/pkg/errors"
+)
+
+var (
+	// ErrMissingAnnotations the ingress rule does not contain annotations
+	// This is an error only when annotations are being parsed
+	ErrMissingAnnotations = errors.New("ingress rule without annotations")
+
+	// ErrInvalidAnnotationName the ingress rule does contains an invalid
+	// annotation name
+	ErrInvalidAnnotationName = errors.New("invalid annotation name")
+)
+
+// NewInvalidAnnotationContent returns a new InvalidContent error
+func NewInvalidAnnotationContent(name string, val interface{}) error {
+	return InvalidContent{
+		Name: fmt.Sprintf("the annotation %v does not contain a valid value (%v)", name, val),
+	}
+}
+
+// NewLocationDenied returns a new LocationDenied error
+func NewLocationDenied(reason string) error {
+	return LocationDenied{
+		Reason: errors.Errorf("Location denied, reason: %v", reason),
+	}
+}
+
+// InvalidContent error
+type InvalidContent struct {
+	Name string
+}
+
+func (e InvalidContent) Error() string {
+	return e.Name
+}
+
+// LocationDenied error
+type LocationDenied struct {
+	Reason error
+}
+
+func (e LocationDenied) Error() string {
+	return e.Reason.Error()
+}
+
+// IsLocationDenied checks if the err is an error which
+// indicates a location should return HTTP code 503
+func IsLocationDenied(e error) bool {
+	_, ok := e.(LocationDenied)
+	return ok
+}
+
+// IsMissingAnnotations checks if the err is an error which
+// indicates the ingress does not contain annotations
+func IsMissingAnnotations(e error) bool {
+	return e == ErrMissingAnnotations
+}
+
+// IsInvalidContent checks if the err is an error which
+// indicates an annotations value is not valid
+func IsInvalidContent(e error) bool {
+	_, ok := e.(InvalidContent)
+	return ok
+}
+
+func New(m string) error {
+	return errors.New(m)
+}
+
+func Errorf(format string, args ...interface{}) error {
+	return errors.Errorf(format, args)
+}

pkg/ingress/errors/errors_test.go

@@ -0,0 +1,52 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package errors
+
+import "testing"
+
+func TestIsLocationDenied(t *testing.T) {
+	err := NewLocationDenied("demo")
+	if !IsLocationDenied(err) {
+		t.Error("expected true")
+	}
+	if IsLocationDenied(nil) {
+		t.Error("expected false")
+	}
+}
+
+func TestIsMissingAnnotations(t *testing.T) {
+	if !IsMissingAnnotations(ErrMissingAnnotations) {
+		t.Error("expected true")
+	}
+}
+
+func TestInvalidContent(t *testing.T) {
+	if IsInvalidContent(ErrMissingAnnotations) {
+		t.Error("expected false")
+	}
+	err := NewInvalidAnnotationContent("demo", "")
+	if !IsInvalidContent(err) {
+		t.Error("expected true")
+	}
+	if IsInvalidContent(nil) {
+		t.Error("expected false")
+	}
+	err = NewLocationDenied("demo")
+	if IsInvalidContent(err) {
+		t.Error("expected false")
+	}
+}

pkg/ingress/resolver/main.go

@@ -0,0 +1,74 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resolver
+
+import (
+	apiv1 "k8s.io/api/core/v1"
+
+	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+)
+
+// DefaultBackend has a method that returns the backend
+// that must be used as default
+type DefaultBackend interface {
+	GetDefaultBackend() defaults.Backend
+}
+
+// Secret has a method that searches for secrets contenating
+// the namespace and name using a the character /
+type Secret interface {
+	GetSecret(string) (*apiv1.Secret, error)
+}
+
+// AuthCertificate resolves a given secret name into an SSL certificate.
+// The secret must contain 3 keys named:
+//   ca.crt: contains the certificate chain used for authentication
+type AuthCertificate interface {
+	GetAuthCertificate(string) (*AuthSSLCert, error)
+}
+
+// Service has a method that searches for services contenating
+// the namespace and name using a the character /
+type Service interface {
+	GetService(string) (*apiv1.Service, error)
+}
+
+// AuthSSLCert contains the necessary information to do certificate based
+// authentication of an ingress location
+type AuthSSLCert struct {
+	// Secret contains the name of the secret this was fetched from
+	Secret string `json:"secret"`
+	// CAFileName contains the path to the secrets 'ca.crt'
+	CAFileName string `json:"caFilename"`
+	// PemSHA contains the SHA1 hash of the 'ca.crt' or combinations of (tls.crt, tls.key, tls.crt) depending on certs in secret
+	PemSHA string `json:"pemSha"`
+}
+
+// Equal tests for equality between two AuthSSLCert types
+func (asslc1 *AuthSSLCert) Equal(assl2 *AuthSSLCert) bool {
+	if asslc1.Secret != assl2.Secret {
+		return false
+	}
+	if asslc1.CAFileName != assl2.CAFileName {
+		return false
+	}
+	if asslc1.PemSHA != assl2.PemSHA {
+		return false
+	}
+
+	return true
+}

pkg/ingress/sort_ingress.go

@@ -0,0 +1,50 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ingress
+
+import (
+	"crypto/x509"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// SSLCert describes a SSL certificate to be used in a server
+type SSLCert struct {
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	Certificate       *x509.Certificate `json:"certificate,omitempty"`
+	// CAFileName contains the path to the file with the root certificate
+	CAFileName string `json:"caFileName"`
+	// PemFileName contains the path to the file with the certificate and key concatenated
+	PemFileName string `json:"pemFileName"`
+	// FullChainPemFileName contains the path to the file with the certificate and key concatenated
+	// This certificate contains the full chain (ca + intermediates + cert)
+	FullChainPemFileName string `json:"fullChainPemFileName"`
+	// PemSHA contains the sha1 of the pem file.
+	// This is used to detect changes in the secret that contains the certificates
+	PemSHA string `json:"pemSha"`
+	// CN contains all the common names defined in the SSL certificate
+	CN []string `json:"cn"`
+	// ExpiresTime contains the expiration of this SSL certificate in timestamp format
+	ExpireTime time.Time `json:"expires"`
+}
+
+// GetObjectKind implements the ObjectKind interface as a noop
+func (s SSLCert) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}

pkg/ingress/sort_ingress_test.go

@@ -0,0 +1,38 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ingress
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestGetObjectKindForSSLCert(t *testing.T) {
+	fk := &SSLCert{
+		ObjectMeta:  metav1.ObjectMeta{},
+		CAFileName:  "ca_file",
+		PemFileName: "pemfile",
+		PemSHA:      "pem_sha",
+		CN:          []string{},
+	}
+
+	r := fk.GetObjectKind()
+	if r == nil {
+		t.Errorf("Returned nil but expected a valid ObjectKind")
+	}
+}

pkg/ingress/status/status.go

@@ -0,0 +1,399 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package status
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/golang/glog"
+	"github.com/pkg/errors"
+
+	pool "gopkg.in/go-playground/pool.v3"
+	apiv1 "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/util/wait"
+	clientset "k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/tools/leaderelection"
+	"k8s.io/client-go/tools/leaderelection/resourcelock"
+	"k8s.io/client-go/tools/record"
+	"k8s.io/kubernetes/pkg/kubelet/util/sliceutils"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/class"
+	"k8s.io/ingress-nginx/pkg/ingress/store"
+	"k8s.io/ingress-nginx/pkg/k8s"
+	"k8s.io/ingress-nginx/pkg/task"
+)
+
+const (
+	updateInterval = 60 * time.Second
+)
+
+// Sync ...
+type Sync interface {
+	Run(stopCh <-chan struct{})
+	Shutdown()
+}
+
+// Config ...
+type Config struct {
+	Client clientset.Interface
+
+	PublishService string
+
+	ElectionID string
+
+	UpdateStatusOnShutdown bool
+
+	IngressLister store.IngressLister
+
+	DefaultIngressClass string
+	IngressClass        string
+
+	// CustomIngressStatus allows to set custom values in Ingress status
+	CustomIngressStatus func(*extensions.Ingress) []apiv1.LoadBalancerIngress
+}
+
+// statusSync keeps the status IP in each Ingress rule updated executing a periodic check
+// in all the defined rules. To simplify the process leader election is used so the update
+// is executed only in one node (Ingress controllers can be scaled to more than one)
+// If the controller is running with the flag --publish-service (with a valid service)
+// the IP address behind the service is used, if not the source is the IP/s of the node/s
+type statusSync struct {
+	Config
+	// pod contains runtime information about this pod
+	pod *k8s.PodInfo
+
+	elector *leaderelection.LeaderElector
+	// workqueue used to keep in sync the status IP/s
+	// in the Ingress rules
+	syncQueue *task.Queue
+}
+
+// Run starts the loop to keep the status in sync
+func (s statusSync) Run(stopCh <-chan struct{}) {
+	go s.elector.Run()
+	go wait.Forever(s.update, updateInterval)
+	go s.syncQueue.Run(time.Second, stopCh)
+	<-stopCh
+}
+
+func (s *statusSync) update() {
+	// send a dummy object to the queue to force a sync
+	s.syncQueue.Enqueue("sync status")
+}
+
+// Shutdown stop the sync. In case the instance is the leader it will remove the current IP
+// if there is no other instances running.
+func (s statusSync) Shutdown() {
+	go s.syncQueue.Shutdown()
+	// remove IP from Ingress
+	if !s.elector.IsLeader() {
+		return
+	}
+
+	if !s.UpdateStatusOnShutdown {
+		glog.Warningf("skipping update of status of Ingress rules")
+		return
+	}
+
+	glog.Infof("updating status of Ingress rules (remove)")
+
+	addrs, err := s.runningAddresses()
+	if err != nil {
+		glog.Errorf("error obtaining running IPs: %v", addrs)
+		return
+	}
+
+	if len(addrs) > 1 {
+		// leave the job to the next leader
+		glog.Infof("leaving status update for next leader (%v)", len(addrs))
+		return
+	}
+
+	if s.isRunningMultiplePods() {
+		glog.V(2).Infof("skipping Ingress status update (multiple pods running - another one will be elected as master)")
+		return
+	}
+
+	glog.Infof("removing address from ingress status (%v)", addrs)
+	s.updateStatus([]apiv1.LoadBalancerIngress{})
+}
+
+func (s *statusSync) sync(key interface{}) error {
+	if s.syncQueue.IsShuttingDown() {
+		glog.V(2).Infof("skipping Ingress status update (shutting down in progress)")
+		return nil
+	}
+
+	if !s.elector.IsLeader() {
+		glog.V(2).Infof("skipping Ingress status update (I am not the current leader)")
+		return nil
+	}
+
+	addrs, err := s.runningAddresses()
+	if err != nil {
+		return err
+	}
+	s.updateStatus(sliceToStatus(addrs))
+
+	return nil
+}
+
+func (s statusSync) keyfunc(input interface{}) (interface{}, error) {
+	return input, nil
+}
+
+// NewStatusSyncer returns a new Sync instance
+func NewStatusSyncer(config Config) Sync {
+	pod, err := k8s.GetPodDetails(config.Client)
+	if err != nil {
+		glog.Fatalf("unexpected error obtaining pod information: %v", err)
+	}
+
+	st := statusSync{
+		pod: pod,
+
+		Config: config,
+	}
+	st.syncQueue = task.NewCustomTaskQueue(st.sync, st.keyfunc)
+
+	// we need to use the defined ingress class to allow multiple leaders
+	// in order to update information about ingress status
+	electionID := fmt.Sprintf("%v-%v", config.ElectionID, config.DefaultIngressClass)
+	if config.IngressClass != "" {
+		electionID = fmt.Sprintf("%v-%v", config.ElectionID, config.IngressClass)
+	}
+
+	callbacks := leaderelection.LeaderCallbacks{
+		OnStartedLeading: func(stop <-chan struct{}) {
+			glog.V(2).Infof("I am the new status update leader")
+		},
+		OnStoppedLeading: func() {
+			glog.V(2).Infof("I am not status update leader anymore")
+		},
+		OnNewLeader: func(identity string) {
+			glog.Infof("new leader elected: %v", identity)
+		},
+	}
+
+	broadcaster := record.NewBroadcaster()
+	hostname, _ := os.Hostname()
+
+	recorder := broadcaster.NewRecorder(scheme.Scheme, apiv1.EventSource{
+		Component: "ingress-leader-elector",
+		Host:      hostname,
+	})
+
+	lock := resourcelock.ConfigMapLock{
+		ConfigMapMeta: metav1.ObjectMeta{Namespace: pod.Namespace, Name: electionID},
+		Client:        config.Client.CoreV1(),
+		LockConfig: resourcelock.ResourceLockConfig{
+			Identity:      pod.Name,
+			EventRecorder: recorder,
+		},
+	}
+
+	ttl := 30 * time.Second
+	le, err := leaderelection.NewLeaderElector(leaderelection.LeaderElectionConfig{
+		Lock:          &lock,
+		LeaseDuration: ttl,
+		RenewDeadline: ttl / 2,
+		RetryPeriod:   ttl / 4,
+		Callbacks:     callbacks,
+	})
+
+	if err != nil {
+		glog.Fatalf("unexpected error starting leader election: %v", err)
+	}
+
+	st.elector = le
+	return st
+}
+
+// runningAddresses returns a list of IP addresses and/or FQDN where the
+// ingress controller is currently running
+func (s *statusSync) runningAddresses() ([]string, error) {
+	if s.PublishService != "" {
+		ns, name, _ := k8s.ParseNameNS(s.PublishService)
+		svc, err := s.Client.CoreV1().Services(ns).Get(name, metav1.GetOptions{})
+		if err != nil {
+			return nil, err
+		}
+
+		addrs := []string{}
+		for _, ip := range svc.Status.LoadBalancer.Ingress {
+			if ip.IP == "" {
+				addrs = append(addrs, ip.Hostname)
+			} else {
+				addrs = append(addrs, ip.IP)
+			}
+		}
+		for _, ip := range svc.Spec.ExternalIPs {
+			addrs = append(addrs, ip)
+		}
+
+		return addrs, nil
+	}
+
+	// get information about all the pods running the ingress controller
+	pods, err := s.Client.CoreV1().Pods(s.pod.Namespace).List(metav1.ListOptions{
+		LabelSelector: labels.SelectorFromSet(s.pod.Labels).String(),
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	addrs := []string{}
+	for _, pod := range pods.Items {
+		name := k8s.GetNodeIP(s.Client, pod.Spec.NodeName)
+		if !sliceutils.StringInSlice(name, addrs) {
+			addrs = append(addrs, name)
+		}
+	}
+	return addrs, nil
+}
+
+func (s *statusSync) isRunningMultiplePods() bool {
+	pods, err := s.Client.CoreV1().Pods(s.pod.Namespace).List(metav1.ListOptions{
+		LabelSelector: labels.SelectorFromSet(s.pod.Labels).String(),
+	})
+	if err != nil {
+		return false
+	}
+
+	return len(pods.Items) > 1
+}
+
+// sliceToStatus converts a slice of IP and/or hostnames to LoadBalancerIngress
+func sliceToStatus(endpoints []string) []apiv1.LoadBalancerIngress {
+	lbi := []apiv1.LoadBalancerIngress{}
+	for _, ep := range endpoints {
+		if net.ParseIP(ep) == nil {
+			lbi = append(lbi, apiv1.LoadBalancerIngress{Hostname: ep})
+		} else {
+			lbi = append(lbi, apiv1.LoadBalancerIngress{IP: ep})
+		}
+	}
+
+	sort.SliceStable(lbi, func(a, b int) bool {
+		return lbi[a].IP < lbi[b].IP
+	})
+
+	return lbi
+}
+
+// updateStatus changes the status information of Ingress rules
+// If the backend function CustomIngressStatus returns a value different
+// of nil then it uses the returned value or the newIngressPoint values
+func (s *statusSync) updateStatus(newIngressPoint []apiv1.LoadBalancerIngress) {
+	ings := s.IngressLister.List()
+
+	p := pool.NewLimited(10)
+	defer p.Close()
+
+	batch := p.Batch()
+
+	for _, cur := range ings {
+		ing := cur.(*extensions.Ingress)
+
+		if !class.IsValid(ing, s.Config.IngressClass, s.Config.DefaultIngressClass) {
+			continue
+		}
+
+		batch.Queue(runUpdate(ing, newIngressPoint, s.Client, s.CustomIngressStatus))
+	}
+
+	batch.QueueComplete()
+	batch.WaitAll()
+}
+
+func runUpdate(ing *extensions.Ingress, status []apiv1.LoadBalancerIngress,
+	client clientset.Interface,
+	statusFunc func(*extensions.Ingress) []apiv1.LoadBalancerIngress) pool.WorkFunc {
+	return func(wu pool.WorkUnit) (interface{}, error) {
+		if wu.IsCancelled() {
+			return nil, nil
+		}
+
+		addrs := status
+		ca := statusFunc(ing)
+		if ca != nil {
+			addrs = ca
+		}
+		sort.SliceStable(addrs, lessLoadBalancerIngress(addrs))
+
+		curIPs := ing.Status.LoadBalancer.Ingress
+		sort.SliceStable(curIPs, lessLoadBalancerIngress(curIPs))
+
+		if ingressSliceEqual(addrs, curIPs) {
+			glog.V(3).Infof("skipping update of Ingress %v/%v (no change)", ing.Namespace, ing.Name)
+			return true, nil
+		}
+
+		ingClient := client.Extensions().Ingresses(ing.Namespace)
+
+		currIng, err := ingClient.Get(ing.Name, metav1.GetOptions{})
+		if err != nil {
+			return nil, errors.Wrap(err, fmt.Sprintf("unexpected error searching Ingress %v/%v", ing.Namespace, ing.Name))
+		}
+
+		glog.Infof("updating Ingress %v/%v status to %v", currIng.Namespace, currIng.Name, addrs)
+		currIng.Status.LoadBalancer.Ingress = addrs
+		_, err = ingClient.UpdateStatus(currIng)
+		if err != nil {
+			glog.Warningf("error updating ingress rule: %v", err)
+		}
+
+		return true, nil
+	}
+}
+
+func lessLoadBalancerIngress(addrs []apiv1.LoadBalancerIngress) func(int, int) bool {
+	return func(a, b int) bool {
+		switch strings.Compare(addrs[a].Hostname, addrs[b].Hostname) {
+		case -1:
+			return true
+		case 1:
+			return false
+		}
+		return addrs[a].IP < addrs[b].IP
+	}
+}
+
+func ingressSliceEqual(lhs, rhs []apiv1.LoadBalancerIngress) bool {
+	if len(lhs) != len(rhs) {
+		return false
+	}
+
+	for i := range lhs {
+		if lhs[i].IP != rhs[i].IP {
+			return false
+		}
+		if lhs[i].Hostname != rhs[i].Hostname {
+			return false
+		}
+	}
+	return true
+}

pkg/ingress/status/status_test.go

@@ -0,0 +1,463 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package status
+
+import (
+	"os"
+	"testing"
+	"time"
+
+	apiv1 "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	testclient "k8s.io/client-go/kubernetes/fake"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/kubernetes/pkg/api"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/class"
+	"k8s.io/ingress-nginx/pkg/ingress/store"
+	"k8s.io/ingress-nginx/pkg/k8s"
+	"k8s.io/ingress-nginx/pkg/task"
+)
+
+func buildLoadBalancerIngressByIP() []apiv1.LoadBalancerIngress {
+	return []apiv1.LoadBalancerIngress{
+		{
+			IP:       "10.0.0.1",
+			Hostname: "foo1",
+		},
+		{
+			IP:       "10.0.0.2",
+			Hostname: "foo2",
+		},
+		{
+			IP:       "10.0.0.3",
+			Hostname: "",
+		},
+		{
+			IP:       "",
+			Hostname: "foo4",
+		},
+	}
+}
+
+func buildSimpleClientSet() *testclient.Clientset {
+	return testclient.NewSimpleClientset(
+		&apiv1.PodList{Items: []apiv1.Pod{
+			{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "foo1",
+					Namespace: apiv1.NamespaceDefault,
+					Labels: map[string]string{
+						"lable_sig": "foo_pod",
+					},
+				},
+				Spec: apiv1.PodSpec{
+					NodeName: "foo_node_2",
+				},
+			},
+			{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "foo2",
+					Namespace: apiv1.NamespaceDefault,
+					Labels: map[string]string{
+						"lable_sig": "foo_no",
+					},
+				},
+			},
+			{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "foo3",
+					Namespace: api.NamespaceSystem,
+					Labels: map[string]string{
+						"lable_sig": "foo_pod",
+					},
+				},
+				Spec: apiv1.PodSpec{
+					NodeName: "foo_node_2",
+				},
+			},
+		}},
+		&apiv1.ServiceList{Items: []apiv1.Service{
+			{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "foo",
+					Namespace: apiv1.NamespaceDefault,
+				},
+				Status: apiv1.ServiceStatus{
+					LoadBalancer: apiv1.LoadBalancerStatus{
+						Ingress: buildLoadBalancerIngressByIP(),
+					},
+				},
+			},
+			{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "foo_non_exist",
+					Namespace: apiv1.NamespaceDefault,
+				},
+			},
+		}},
+		&apiv1.NodeList{Items: []apiv1.Node{
+			{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "foo_node_1",
+				},
+				Status: apiv1.NodeStatus{
+					Addresses: []apiv1.NodeAddress{
+						{
+							Type:    apiv1.NodeInternalIP,
+							Address: "10.0.0.1",
+						}, {
+							Type:    apiv1.NodeExternalIP,
+							Address: "10.0.0.2",
+						},
+					},
+				},
+			},
+			{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "foo_node_2",
+				},
+				Status: apiv1.NodeStatus{
+					Addresses: []apiv1.NodeAddress{
+						{
+							Type:    apiv1.NodeInternalIP,
+							Address: "11.0.0.1",
+						},
+						{
+							Type:    apiv1.NodeExternalIP,
+							Address: "11.0.0.2",
+						},
+					},
+				},
+			},
+		}},
+		&apiv1.EndpointsList{Items: []apiv1.Endpoints{
+			{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "ingress-controller-leader",
+					Namespace: apiv1.NamespaceDefault,
+					SelfLink:  "/api/v1/namespaces/default/endpoints/ingress-controller-leader",
+				},
+			}}},
+		&extensions.IngressList{Items: buildExtensionsIngresses()},
+	)
+}
+
+func fakeSynFn(interface{}) error {
+	return nil
+}
+
+func buildExtensionsIngresses() []extensions.Ingress {
+	return []extensions.Ingress{
+		{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "foo_ingress_1",
+				Namespace: apiv1.NamespaceDefault,
+			},
+			Status: extensions.IngressStatus{
+				LoadBalancer: apiv1.LoadBalancerStatus{
+					Ingress: []apiv1.LoadBalancerIngress{
+						{
+							IP:       "10.0.0.1",
+							Hostname: "foo1",
+						},
+					},
+				},
+			},
+		},
+		{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "foo_ingress_different_class",
+				Namespace: api.NamespaceDefault,
+				Annotations: map[string]string{
+					class.IngressKey: "no-nginx",
+				},
+			},
+			Status: extensions.IngressStatus{
+				LoadBalancer: apiv1.LoadBalancerStatus{
+					Ingress: []apiv1.LoadBalancerIngress{
+						{
+							IP:       "0.0.0.0",
+							Hostname: "foo.bar.com",
+						},
+					},
+				},
+			},
+		},
+		{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "foo_ingress_2",
+				Namespace: apiv1.NamespaceDefault,
+			},
+			Status: extensions.IngressStatus{
+				LoadBalancer: apiv1.LoadBalancerStatus{
+					Ingress: []apiv1.LoadBalancerIngress{},
+				},
+			},
+		},
+	}
+}
+
+func buildIngressListener() store.IngressLister {
+	s := cache.NewStore(cache.MetaNamespaceKeyFunc)
+	s.Add(&extensions.Ingress{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "foo_ingress_non_01",
+			Namespace: apiv1.NamespaceDefault,
+		}})
+	s.Add(&extensions.Ingress{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "foo_ingress_1",
+			Namespace: apiv1.NamespaceDefault,
+		},
+		Status: extensions.IngressStatus{
+			LoadBalancer: apiv1.LoadBalancerStatus{
+				Ingress: buildLoadBalancerIngressByIP(),
+			},
+		},
+	})
+
+	return store.IngressLister{Store: s}
+}
+
+func buildStatusSync() statusSync {
+	return statusSync{
+		pod: &k8s.PodInfo{
+			Name:      "foo_base_pod",
+			Namespace: apiv1.NamespaceDefault,
+			Labels: map[string]string{
+				"lable_sig": "foo_pod",
+			},
+		},
+		syncQueue: task.NewTaskQueue(fakeSynFn),
+		Config: Config{
+			Client:         buildSimpleClientSet(),
+			PublishService: apiv1.NamespaceDefault + "/" + "foo",
+			IngressLister:  buildIngressListener(),
+			CustomIngressStatus: func(*extensions.Ingress) []apiv1.LoadBalancerIngress {
+				return nil
+			},
+		},
+	}
+}
+
+func TestStatusActions(t *testing.T) {
+	// make sure election can be created
+	os.Setenv("POD_NAME", "foo1")
+	os.Setenv("POD_NAMESPACE", apiv1.NamespaceDefault)
+	c := Config{
+		Client:                 buildSimpleClientSet(),
+		PublishService:         "",
+		IngressLister:          buildIngressListener(),
+		DefaultIngressClass:    "nginx",
+		IngressClass:           "",
+		UpdateStatusOnShutdown: true,
+		CustomIngressStatus: func(*extensions.Ingress) []apiv1.LoadBalancerIngress {
+			return nil
+		},
+	}
+	// create object
+	fkSync := NewStatusSyncer(c)
+	if fkSync == nil {
+		t.Fatalf("expected a valid Sync")
+	}
+
+	fk := fkSync.(statusSync)
+
+	ns := make(chan struct{})
+	// start it and wait for the election and syn actions
+	go fk.Run(ns)
+	//  wait for the election
+	time.Sleep(100 * time.Millisecond)
+	// execute sync
+	fk.sync("just-test")
+	// PublishService is empty, so the running address is: ["11.0.0.2"]
+	// after updated, the ingress's ip should only be "11.0.0.2"
+	newIPs := []apiv1.LoadBalancerIngress{{
+		IP: "11.0.0.2",
+	}}
+	fooIngress1, err1 := fk.Client.Extensions().Ingresses(apiv1.NamespaceDefault).Get("foo_ingress_1", metav1.GetOptions{})
+	if err1 != nil {
+		t.Fatalf("unexpected error")
+	}
+	fooIngress1CurIPs := fooIngress1.Status.LoadBalancer.Ingress
+	if !ingressSliceEqual(fooIngress1CurIPs, newIPs) {
+		t.Fatalf("returned %v but expected %v", fooIngress1CurIPs, newIPs)
+	}
+
+	// execute shutdown
+	fk.Shutdown()
+	// ingress should be empty
+	newIPs2 := []apiv1.LoadBalancerIngress{}
+	fooIngress2, err2 := fk.Client.Extensions().Ingresses(apiv1.NamespaceDefault).Get("foo_ingress_1", metav1.GetOptions{})
+	if err2 != nil {
+		t.Fatalf("unexpected error")
+	}
+	fooIngress2CurIPs := fooIngress2.Status.LoadBalancer.Ingress
+	if !ingressSliceEqual(fooIngress2CurIPs, newIPs2) {
+		t.Fatalf("returned %v but expected %v", fooIngress2CurIPs, newIPs2)
+	}
+
+	oic, err := fk.Client.Extensions().Ingresses(api.NamespaceDefault).Get("foo_ingress_different_class", metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("unexpected error")
+	}
+	if oic.Status.LoadBalancer.Ingress[0].IP != "0.0.0.0" && oic.Status.LoadBalancer.Ingress[0].Hostname != "foo.bar.com" {
+		t.Fatalf("invalid ingress status for rule with different class")
+	}
+
+	// end test
+	ns <- struct{}{}
+}
+
+func TestCallback(t *testing.T) {
+	buildStatusSync()
+}
+
+func TestKeyfunc(t *testing.T) {
+	fk := buildStatusSync()
+	i := "foo_base_pod"
+	r, err := fk.keyfunc(i)
+
+	if err != nil {
+		t.Fatalf("unexpected error")
+	}
+	if r != i {
+		t.Errorf("returned %v but expected %v", r, i)
+	}
+}
+
+func TestRunningAddresessWithPublishService(t *testing.T) {
+	fk := buildStatusSync()
+
+	r, _ := fk.runningAddresses()
+	if r == nil {
+		t.Fatalf("returned nil but expected valid []string")
+	}
+	rl := len(r)
+	if len(r) != 4 {
+		t.Errorf("returned %v but expected %v", rl, 4)
+	}
+}
+
+func TestRunningAddresessWithPods(t *testing.T) {
+	fk := buildStatusSync()
+	fk.PublishService = ""
+
+	r, _ := fk.runningAddresses()
+	if r == nil {
+		t.Fatalf("returned nil but expected valid []string")
+	}
+	rl := len(r)
+	if len(r) != 1 {
+		t.Fatalf("returned %v but expected %v", rl, 1)
+	}
+	rv := r[0]
+	if rv != "11.0.0.2" {
+		t.Errorf("returned %v but expected %v", rv, "11.0.0.2")
+	}
+}
+
+/*
+TODO: this test requires a refactoring
+func TestUpdateStatus(t *testing.T) {
+	fk := buildStatusSync()
+	newIPs := buildLoadBalancerIngressByIP()
+	fk.updateStatus(newIPs)
+
+	fooIngress1, err1 := fk.Client.Extensions().Ingresses(apiv1.NamespaceDefault).Get("foo_ingress_1", metav1.GetOptions{})
+	if err1 != nil {
+		t.Fatalf("unexpected error")
+	}
+	fooIngress1CurIPs := fooIngress1.Status.LoadBalancer.Ingress
+	if !ingressSliceEqual(fooIngress1CurIPs, newIPs) {
+		t.Fatalf("returned %v but expected %v", fooIngress1CurIPs, newIPs)
+	}
+
+	fooIngress2, err2 := fk.Client.Extensions().Ingresses(apiv1.NamespaceDefault).Get("foo_ingress_2", metav1.GetOptions{})
+	if err2 != nil {
+		t.Fatalf("unexpected error")
+	}
+	fooIngress2CurIPs := fooIngress2.Status.LoadBalancer.Ingress
+	if !ingressSliceEqual(fooIngress2CurIPs, []apiv1.LoadBalancerIngress{}) {
+		t.Fatalf("returned %v but expected %v", fooIngress2CurIPs, []apiv1.LoadBalancerIngress{})
+	}
+}
+*/
+func TestSliceToStatus(t *testing.T) {
+	fkEndpoints := []string{
+		"10.0.0.1",
+		"2001:db8::68",
+		"opensource-k8s-ingress",
+	}
+
+	r := sliceToStatus(fkEndpoints)
+
+	if r == nil {
+		t.Fatalf("returned nil but expected a valid []apiv1.LoadBalancerIngress")
+	}
+	rl := len(r)
+	if rl != 3 {
+		t.Fatalf("returned %v but expected %v", rl, 3)
+	}
+	re1 := r[0]
+	if re1.Hostname != "opensource-k8s-ingress" {
+		t.Fatalf("returned %v but expected %v", re1, apiv1.LoadBalancerIngress{Hostname: "opensource-k8s-ingress"})
+	}
+	re2 := r[1]
+	if re2.IP != "10.0.0.1" {
+		t.Fatalf("returned %v but expected %v", re2, apiv1.LoadBalancerIngress{IP: "10.0.0.1"})
+	}
+	re3 := r[2]
+	if re3.IP != "2001:db8::68" {
+		t.Fatalf("returned %v but expected %v", re3, apiv1.LoadBalancerIngress{IP: "2001:db8::68"})
+	}
+}
+
+func TestIngressSliceEqual(t *testing.T) {
+	fk1 := buildLoadBalancerIngressByIP()
+	fk2 := append(buildLoadBalancerIngressByIP(), apiv1.LoadBalancerIngress{
+		IP:       "10.0.0.5",
+		Hostname: "foo5",
+	})
+	fk3 := buildLoadBalancerIngressByIP()
+	fk3[0].Hostname = "foo_no_01"
+	fk4 := buildLoadBalancerIngressByIP()
+	fk4[2].IP = "11.0.0.3"
+
+	fooTests := []struct {
+		lhs []apiv1.LoadBalancerIngress
+		rhs []apiv1.LoadBalancerIngress
+		er  bool
+	}{
+		{fk1, fk1, true},
+		{fk2, fk1, false},
+		{fk3, fk1, false},
+		{fk4, fk1, false},
+		{fk1, nil, false},
+		{nil, nil, true},
+		{[]apiv1.LoadBalancerIngress{}, []apiv1.LoadBalancerIngress{}, true},
+	}
+
+	for _, fooTest := range fooTests {
+		r := ingressSliceEqual(fooTest.lhs, fooTest.rhs)
+		if r != fooTest.er {
+			t.Errorf("returned %v but expected %v", r, fooTest.er)
+		}
+	}
+}

pkg/ingress/store/main.go

@@ -0,0 +1,102 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package store
+
+import (
+	"fmt"
+
+	apiv1 "k8s.io/api/core/v1"
+	"k8s.io/client-go/tools/cache"
+)
+
+// IngressLister makes a Store that lists Ingress.
+type IngressLister struct {
+	cache.Store
+}
+
+// SecretsLister makes a Store that lists Secrets.
+type SecretLister struct {
+	cache.Store
+}
+
+// GetByName searches for a secret in the local secrets Store
+func (sl *SecretLister) GetByName(name string) (*apiv1.Secret, error) {
+	s, exists, err := sl.GetByKey(name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, fmt.Errorf("secret %v was not found", name)
+	}
+	return s.(*apiv1.Secret), nil
+}
+
+// ConfigMapLister makes a Store that lists Configmaps.
+type ConfigMapLister struct {
+	cache.Store
+}
+
+// GetByName searches for a configmap in the local configmaps Store
+func (cml *ConfigMapLister) GetByName(name string) (*apiv1.ConfigMap, error) {
+	s, exists, err := cml.GetByKey(name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, fmt.Errorf("configmap %v was not found", name)
+	}
+	return s.(*apiv1.ConfigMap), nil
+}
+
+// ServiceLister makes a Store that lists Services.
+type ServiceLister struct {
+	cache.Store
+}
+
+// GetByName searches for a service in the local secrets Store
+func (sl *ServiceLister) GetByName(name string) (*apiv1.Service, error) {
+	s, exists, err := sl.GetByKey(name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, fmt.Errorf("service %v was not found", name)
+	}
+	return s.(*apiv1.Service), nil
+}
+
+// NodeLister makes a Store that lists Nodes.
+type NodeLister struct {
+	cache.Store
+}
+
+// EndpointLister makes a Store that lists Endpoints.
+type EndpointLister struct {
+	cache.Store
+}
+
+// GetServiceEndpoints returns the endpoints of a service, matched on service name.
+func (s *EndpointLister) GetServiceEndpoints(svc *apiv1.Service) (ep apiv1.Endpoints, err error) {
+	for _, m := range s.Store.List() {
+		ep = *m.(*apiv1.Endpoints)
+		if svc.Name == ep.Name && svc.Namespace == ep.Namespace {
+			return ep, nil
+		}
+	}
+	err = fmt.Errorf("could not find endpoints for service: %v", svc.Name)
+	return
+}

pkg/ingress/type_equals_test.go

@@ -0,0 +1,73 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ingress
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestEqualConfiguration(t *testing.T) {
+	ap, _ := filepath.Abs("../../tests/manifests/configuration-a.json")
+	a, err := readJSON(ap)
+	if err != nil {
+		t.Errorf("unexpected error reading JSON file: %v", err)
+	}
+
+	bp, _ := filepath.Abs("../../tests/manifests/configuration-b.json")
+	b, err := readJSON(bp)
+	if err != nil {
+		t.Errorf("unexpected error reading JSON file: %v", err)
+	}
+
+	cp, _ := filepath.Abs("../../tests/manifests/configuration-c.json")
+	c, err := readJSON(cp)
+	if err != nil {
+		t.Errorf("unexpected error reading JSON file: %v", err)
+	}
+
+	if !a.Equal(b) {
+		t.Errorf("expected equal configurations (configuration-a.json and configuration-b.json)")
+	}
+
+	if !b.Equal(a) {
+		t.Errorf("expected equal configurations (configuration-b.json and configuration-a.json)")
+	}
+
+	if a.Equal(c) {
+		t.Errorf("expected equal configurations (configuration-a.json and configuration-c.json)")
+	}
+}
+
+func readJSON(p string) (*Configuration, error) {
+	f, err := os.Open(p)
+	if err != nil {
+		return nil, err
+	}
+
+	var c Configuration
+
+	d := json.NewDecoder(f)
+	err = d.Decode(&c)
+	if err != nil {
+		return nil, err
+	}
+
+	return &c, nil
+}

pkg/ingress/types.go

@@ -0,0 +1,376 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ingress
+
+import (
+	"time"
+
+	"github.com/spf13/pflag"
+
+	apiv1 "k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/apiserver/pkg/server/healthz"
+
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/auth"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/authreq"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/authtls"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/ipwhitelist"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/proxy"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/ratelimit"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/redirect"
+	"k8s.io/ingress-nginx/pkg/ingress/annotations/rewrite"
+	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+	"k8s.io/ingress-nginx/pkg/ingress/store"
+)
+
+var (
+	// DefaultSSLDirectory defines the location where the SSL certificates will be generated
+	// This directory contains all the SSL certificates that are specified in Ingress rules.
+	// The name of each file is <namespace>-<secret name>.pem. The content is the concatenated
+	// certificate and key.
+	DefaultSSLDirectory = "/ingress-controller/ssl"
+)
+
+// Controller holds the methods to handle an Ingress backend
+// TODO (#18): Make sure this is sufficiently supportive of other backends.
+type Controller interface {
+	// HealthzChecker returns is a named healthz check that returns the ingress
+	// controller status
+	healthz.HealthzChecker
+
+	// OnUpdate callback invoked from the sync queue https://k8s.io/ingress/core/blob/master/pkg/ingress/controller/controller.go#L387
+	// when an update occurs. This is executed frequently because Ingress
+	// controllers watches changes in:
+	// - Ingresses: main work
+	// - Secrets: referenced from Ingress rules with TLS configured
+	// - ConfigMaps: where the controller reads custom configuration
+	// - Services: referenced from Ingress rules and required to obtain
+	//	 information about ports and annotations
+	// - Endpoints: referenced from Services and what the backend uses
+	//	 to route traffic
+	// Any update to services, endpoints, secrets (only those referenced from Ingress)
+	// and ingress trigger the execution.
+	// Notifications of type Add, Update and Delete:
+	// https://github.com/kubernetes/kubernetes/blob/master/pkg/client/cache/controller.go#L164
+	//
+	// Configuration returns the translation from Ingress rules containing
+	// information about all the upstreams (service endpoints ) "virtual"
+	// servers (FQDN) and all the locations inside each server. Each
+	// location contains information about all the annotations were configured
+	// https://k8s.io/ingress/core/blob/master/pkg/ingress/types.go#L83
+	// The backend returns an error if was not possible to update the configuration.
+	//
+	OnUpdate(Configuration) error
+	// ConfigMap content of --configmap
+	SetConfig(*apiv1.ConfigMap)
+	// SetListers allows the access of store listers present in the generic controller
+	// This avoid the use of the kubernetes client.
+	SetListers(*StoreLister)
+	// BackendDefaults returns the minimum settings required to configure the
+	// communication to endpoints
+	BackendDefaults() defaults.Backend
+	// Info returns information about the ingress controller
+	Info() *BackendInfo
+	// ConfigureFlags allow to configure more flags before the parsing of
+	// command line arguments
+	ConfigureFlags(*pflag.FlagSet)
+	// OverrideFlags allow the customization of the flags in the backend
+	OverrideFlags(*pflag.FlagSet)
+	// DefaultIngressClass just return the default ingress class
+	DefaultIngressClass() string
+	// UpdateIngressStatus custom callback used to update the status in an Ingress rule
+	// This allows custom implementations
+	// If the function returns nil the standard functions will be executed.
+	UpdateIngressStatus(*extensions.Ingress) []apiv1.LoadBalancerIngress
+	// DefaultEndpoint returns the Endpoint to use as default when the
+	// referenced service does not exists. This should return the content
+	// of to the default backend
+	DefaultEndpoint() Endpoint
+}
+
+// StoreLister returns the configured stores for ingresses, services,
+// endpoints, secrets and configmaps.
+type StoreLister struct {
+	Ingress   store.IngressLister
+	Service   store.ServiceLister
+	Node      store.NodeLister
+	Endpoint  store.EndpointLister
+	Secret    store.SecretLister
+	ConfigMap store.ConfigMapLister
+}
+
+// BackendInfo returns information about the backend.
+// This fields contains information that helps to track issues or to
+// map the running ingress controller to source code
+type BackendInfo struct {
+	// Name returns the name of the backend implementation
+	Name string `json:"name"`
+	// Release returns the running version (semver)
+	Release string `json:"release"`
+	// Build returns information about the git commit
+	Build string `json:"build"`
+	// Repository return information about the git repository
+	Repository string `json:"repository"`
+}
+
+// Configuration holds the definition of all the parts required to describe all
+// ingresses reachable by the ingress controller (using a filter by namespace)
+type Configuration struct {
+	// Backends are a list of backends used by all the Ingress rules in the
+	// ingress controller. This list includes the default backend
+	Backends []*Backend `json:"backends,omitEmpty"`
+	// Servers
+	Servers []*Server `json:"servers,omitEmpty"`
+	// TCPEndpoints contain endpoints for tcp streams handled by this backend
+	// +optional
+	TCPEndpoints []L4Service `json:"tcpEndpoints,omitempty"`
+	// UDPEndpoints contain endpoints for udp streams handled by this backend
+	// +optional
+	UDPEndpoints []L4Service `json:"udpEndpoints,omitempty"`
+	// PassthroughBackend contains the backends used for SSL passthrough.
+	// It contains information about the associated Server Name Indication (SNI).
+	// +optional
+	PassthroughBackends []*SSLPassthroughBackend `json:"passthroughBackends,omitempty"`
+}
+
+// Backend describes one or more remote server/s (endpoints) associated with a service
+// +k8s:deepcopy-gen=true
+type Backend struct {
+	// Name represents an unique apiv1.Service name formatted as <namespace>-<name>-<port>
+	Name    string             `json:"name"`
+	Service *apiv1.Service     `json:"service,omitempty"`
+	Port    intstr.IntOrString `json:"port"`
+	// This indicates if the communication protocol between the backend and the endpoint is HTTP or HTTPS
+	// Allowing the use of HTTPS
+	// The endpoint/s must provide a TLS connection.
+	// The certificate used in the endpoint cannot be a self signed certificate
+	Secure bool `json:"secure"`
+	// SecureCACert has the filename and SHA1 of the certificate authorities used to validate
+	// a secured connection to the backend
+	SecureCACert resolver.AuthSSLCert `json:"secureCACert"`
+	// SSLPassthrough indicates that Ingress controller will delegate TLS termination to the endpoints.
+	SSLPassthrough bool `json:"sslPassthrough"`
+	// Endpoints contains the list of endpoints currently running
+	Endpoints []Endpoint `json:"endpoints,omitempty"`
+	// StickySessionAffinitySession contains the StickyConfig object with stickness configuration
+	SessionAffinity SessionAffinityConfig `json:"sessionAffinityConfig"`
+}
+
+// SessionAffinityConfig describes different affinity configurations for new sessions.
+// Once a session is mapped to a backend based on some affinity setting, it
+// retains that mapping till the backend goes down, or the ingress controller
+// restarts. Exactly one of these values will be set on the upstream, since multiple
+// affinity values are incompatible. Once set, the backend makes no guarantees
+// about honoring updates.
+// +k8s:deepcopy-gen=true
+type SessionAffinityConfig struct {
+	AffinityType          string                `json:"name"`
+	CookieSessionAffinity CookieSessionAffinity `json:"cookieSessionAffinity"`
+}
+
+// CookieSessionAffinity defines the structure used in Affinity configured by Cookies.
+// +k8s:deepcopy-gen=true
+type CookieSessionAffinity struct {
+	Name      string              `json:"name"`
+	Hash      string              `json:"hash"`
+	Locations map[string][]string `json:"locations,omitempty"`
+}
+
+// Endpoint describes a kubernetes endpoint in a backend
+// +k8s:deepcopy-gen=true
+type Endpoint struct {
+	// Address IP address of the endpoint
+	Address string `json:"address"`
+	// Port number of the TCP port
+	Port string `json:"port"`
+	// MaxFails returns the number of unsuccessful attempts to communicate
+	// allowed before this should be considered dow.
+	// Setting 0 indicates that the check is performed by a Kubernetes probe
+	MaxFails int `json:"maxFails"`
+	// FailTimeout returns the time in seconds during which the specified number
+	// of unsuccessful attempts to communicate with the server should happen
+	// to consider the endpoint unavailable
+	FailTimeout int `json:"failTimeout"`
+	// Target returns a reference to the object providing the endpoint
+	Target *apiv1.ObjectReference `json:"target,omipempty"`
+}
+
+// Server describes a website
+type Server struct {
+	// Hostname returns the FQDN of the server
+	Hostname string `json:"hostname"`
+	// SSLPassthrough indicates if the TLS termination is realized in
+	// the server or in the remote endpoint
+	SSLPassthrough bool `json:"sslPassthrough"`
+	// SSLCertificate path to the SSL certificate on disk
+	SSLCertificate string `json:"sslCertificate"`
+	// SSLFullChainCertificate path to the SSL certificate on disk
+	// This certificate contains the full chain (ca + intermediates + cert)
+	SSLFullChainCertificate string `json:"sslFullChainCertificate"`
+	// SSLExpireTime has the expire date of this certificate
+	SSLExpireTime time.Time `json:"sslExpireTime"`
+	// SSLPemChecksum returns the checksum of the certificate file on disk.
+	// There is no restriction in the hash generator. This checksim can be
+	// used to  determine if the secret changed without the use of file
+	// system notifications
+	SSLPemChecksum string `json:"sslPemChecksum"`
+	// Locations list of URIs configured in the server.
+	Locations []*Location `json:"locations,omitempty"`
+	// Alias return the alias of the server name
+	Alias string `json:"alias,omitempty"`
+	// RedirectFromToWWW returns if a redirect to/from prefix www is required
+	RedirectFromToWWW bool `json:"redirectFromToWWW,omitempty"`
+	// CertificateAuth indicates the this server requires mutual authentication
+	// +optional
+	CertificateAuth authtls.AuthSSLConfig `json:"certificateAuth"`
+
+	// ServerSnippet returns the snippet of server
+	// +optional
+	ServerSnippet string `json:"serverSnippet"`
+}
+
+// Location describes an URI inside a server.
+// Also contains additional information about annotations in the Ingress.
+//
+// Important:
+// The implementation of annotations is optional
+//
+// In some cases when more than one annotations is defined a particular order in the execution
+// is required.
+// The chain in the execution order of annotations should be:
+// - Whitelist
+// - RateLimit
+// - BasicDigestAuth
+// - ExternalAuth
+// - Redirect
+type Location struct {
+	// Path is an extended POSIX regex as defined by IEEE Std 1003.1,
+	// (i.e this follows the egrep/unix syntax, not the perl syntax)
+	// matched against the path of an incoming request. Currently it can
+	// contain characters disallowed from the conventional "path"
+	// part of a URL as defined by RFC 3986. Paths must begin with
+	// a '/'. If unspecified, the path defaults to a catch all sending
+	// traffic to the backend.
+	Path string `json:"path"`
+	// IsDefBackend indicates if service specified in the Ingress
+	// contains active endpoints or not. Returning true means the location
+	// uses the default backend.
+	IsDefBackend bool `json:"isDefBackend"`
+	// Ingress returns the ingress from which this location was generated
+	Ingress *extensions.Ingress `json:"ingress"`
+	// Backend describes the name of the backend to use.
+	Backend string `json:"backend"`
+	// Service describes the referenced services from the ingress
+	Service *apiv1.Service `json:"service,omitempty"`
+	// Port describes to which port from the service
+	Port intstr.IntOrString `json:"port"`
+	// Overwrite the Host header passed into the backend. Defaults to
+	// vhost of the incoming request.
+	// +optional
+	UpstreamVhost string `json:"upstream-vhost"`
+	// BasicDigestAuth returns authentication configuration for
+	// an Ingress rule.
+	// +optional
+	BasicDigestAuth auth.BasicDigest `json:"basicDigestAuth,omitempty"`
+	// Denied returns an error when this location cannot not be allowed
+	// Requesting a denied location should return HTTP code 403.
+	Denied error `json:"denied,omitempty"`
+	// EnableCORS indicates if path must support CORS
+	// +optional
+	EnableCORS bool `json:"enableCors,omitempty"`
+	// ExternalAuth indicates the access to this location requires
+	// authentication using an external provider
+	// +optional
+	ExternalAuth authreq.External `json:"externalAuth,omitempty"`
+	// RateLimit describes a limit in the number of connections per IP
+	// address or connections per second.
+	// The Redirect annotation precedes RateLimit
+	// +optional
+	RateLimit ratelimit.RateLimit `json:"rateLimit,omitempty"`
+	// Redirect describes a temporal o permanent redirection this location.
+	// +optional
+	Redirect redirect.Redirect `json:"redirect,omitempty"`
+	// Rewrite describes the redirection this location.
+	// +optional
+	Rewrite rewrite.Redirect `json:"rewrite,omitempty"`
+	// Whitelist indicates only connections from certain client
+	// addresses or networks are allowed.
+	// +optional
+	Whitelist ipwhitelist.SourceRange `json:"whitelist,omitempty"`
+	// Proxy contains information about timeouts and buffer sizes
+	// to be used in connections against endpoints
+	// +optional
+	Proxy proxy.Configuration `json:"proxy,omitempty"`
+	// UsePortInRedirects indicates if redirects must specify the port
+	// +optional
+	UsePortInRedirects bool `json:"usePortInRedirects"`
+	// VtsFilterKey contains the vts filter key on the location level
+	// https://github.com/vozlt/nginx-module-vts#vhost_traffic_status_filter_by_set_key
+	// +optional
+	VtsFilterKey string `json:"vtsFilterKey,omitempty"`
+	// ConfigurationSnippet contains additional configuration for the backend
+	// to be considered in the configuration of the location
+	ConfigurationSnippet string `json:"configurationSnippet"`
+	// ClientBodyBufferSize allows for the configuration of the client body
+	// buffer size for a specific location.
+	// +optional
+	ClientBodyBufferSize string `json:"clientBodyBufferSize,omitempty"`
+	// DefaultBackend allows the use of a custom default backend for this location.
+	// +optional
+	DefaultBackend *apiv1.Service `json:"defaultBackend,omitempty"`
+}
+
+// SSLPassthroughBackend describes a SSL upstream server configured
+// as passthrough (no TLS termination in the ingress controller)
+// The endpoints must provide the TLS termination exposing the required SSL certificate.
+// The ingress controller only pipes the underlying TCP connection
+type SSLPassthroughBackend struct {
+	Service *apiv1.Service     `json:"service,omitEmpty"`
+	Port    intstr.IntOrString `json:"port"`
+	// Backend describes the endpoints to use.
+	Backend string `json:"namespace,omitempty"`
+	// Hostname returns the FQDN of the server
+	Hostname string `json:"hostname"`
+}
+
+// L4Service describes a L4 Ingress service.
+type L4Service struct {
+	// Port external port to expose
+	Port int `json:"port"`
+	// Backend of the service
+	Backend L4Backend `json:"backend"`
+	// Endpoints active endpoints of the service
+	Endpoints []Endpoint `json:"endpoins,omitEmpty"`
+}
+
+// L4Backend describes the kubernetes service behind L4 Ingress service
+type L4Backend struct {
+	Port      intstr.IntOrString `json:"port"`
+	Name      string             `json:"name"`
+	Namespace string             `json:"namespace"`
+	Protocol  apiv1.Protocol     `json:"protocol"`
+	// +optional
+	ProxyProtocol ProxyProtocol `json:"proxyProtocol"`
+}
+
+// ProxyProtocol describes the proxy protocol configuration
+type ProxyProtocol struct {
+	Decode bool `json:"decode"`
+	Encode bool `json:"encode"`
+}

pkg/ingress/types_equals.go

@@ -0,0 +1,481 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ingress
+
+// Equal tests for equality between two BackendInfo types
+func (bi1 *BackendInfo) Equal(bi2 *BackendInfo) bool {
+	if bi1 == bi2 {
+		return true
+	}
+	if bi1 == nil || bi2 == nil {
+		return false
+	}
+	if bi1.Name != bi2.Name {
+		return false
+	}
+	if bi1.Release != bi2.Release {
+		return false
+	}
+	if bi1.Build != bi2.Build {
+		return false
+	}
+	if bi1.Repository != bi2.Repository {
+		return false
+	}
+
+	return true
+}
+
+// Equal tests for equality between two Configuration types
+func (c1 *Configuration) Equal(c2 *Configuration) bool {
+	if c1 == c2 {
+		return true
+	}
+	if c1 == nil || c2 == nil {
+		return false
+	}
+
+	if len(c1.Backends) != len(c2.Backends) {
+		return false
+	}
+
+	for _, c1b := range c1.Backends {
+		found := false
+		for _, c2b := range c2.Backends {
+			if c1b.Equal(c2b) {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+
+	if len(c1.Servers) != len(c2.Servers) {
+		return false
+	}
+
+	// Servers are sorted
+	for idx, c1s := range c1.Servers {
+		if !c1s.Equal(c2.Servers[idx]) {
+			return false
+		}
+	}
+
+	if len(c1.TCPEndpoints) != len(c2.TCPEndpoints) {
+		return false
+	}
+
+	for _, tcp1 := range c1.TCPEndpoints {
+		found := false
+		for _, tcp2 := range c2.TCPEndpoints {
+			if (&tcp1).Equal(&tcp2) {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+
+	if len(c1.UDPEndpoints) != len(c2.UDPEndpoints) {
+		return false
+	}
+
+	for _, udp1 := range c1.UDPEndpoints {
+		found := false
+		for _, udp2 := range c2.UDPEndpoints {
+			if (&udp1).Equal(&udp2) {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+
+	if len(c1.PassthroughBackends) != len(c2.PassthroughBackends) {
+		return false
+	}
+
+	for _, ptb1 := range c1.PassthroughBackends {
+		found := false
+		for _, ptb2 := range c2.PassthroughBackends {
+			if ptb1.Equal(ptb2) {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+
+	return true
+}
+
+// Equal tests for equality between two Backend types
+func (b1 *Backend) Equal(b2 *Backend) bool {
+	if b1 == b2 {
+		return true
+	}
+	if b1 == nil || b2 == nil {
+		return false
+	}
+	if b1.Name != b2.Name {
+		return false
+	}
+
+	if b1.Service != b2.Service {
+		if b1.Service == nil || b2.Service == nil {
+			return false
+		}
+		if b1.Service.GetNamespace() != b2.Service.GetNamespace() {
+			return false
+		}
+		if b1.Service.GetName() != b2.Service.GetName() {
+			return false
+		}
+		if b1.Service.GetResourceVersion() != b2.Service.GetResourceVersion() {
+			return false
+		}
+	}
+
+	if b1.Port != b2.Port {
+		return false
+	}
+	if b1.Secure != b2.Secure {
+		return false
+	}
+	if !(&b1.SecureCACert).Equal(&b2.SecureCACert) {
+		return false
+	}
+	if b1.SSLPassthrough != b2.SSLPassthrough {
+		return false
+	}
+	if !(&b1.SessionAffinity).Equal(&b2.SessionAffinity) {
+		return false
+	}
+
+	if len(b1.Endpoints) != len(b2.Endpoints) {
+		return false
+	}
+
+	for _, udp1 := range b1.Endpoints {
+		found := false
+		for _, udp2 := range b2.Endpoints {
+			if (&udp1).Equal(&udp2) {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+
+	return true
+}
+
+// Equal tests for equality between two SessionAffinityConfig types
+func (sac1 *SessionAffinityConfig) Equal(sac2 *SessionAffinityConfig) bool {
+	if sac1 == sac2 {
+		return true
+	}
+	if sac1 == nil || sac2 == nil {
+		return false
+	}
+	if sac1.AffinityType != sac2.AffinityType {
+		return false
+	}
+	if !(&sac1.CookieSessionAffinity).Equal(&sac2.CookieSessionAffinity) {
+		return false
+	}
+
+	return true
+}
+
+// Equal tests for equality between two CookieSessionAffinity types
+func (csa1 *CookieSessionAffinity) Equal(csa2 *CookieSessionAffinity) bool {
+	if csa1 == csa2 {
+		return true
+	}
+	if csa1 == nil || csa2 == nil {
+		return false
+	}
+	if csa1.Name != csa2.Name {
+		return false
+	}
+	if csa1.Hash != csa2.Hash {
+		return false
+	}
+
+	return true
+}
+
+// Equal checks the equality against an Endpoint
+func (e1 *Endpoint) Equal(e2 *Endpoint) bool {
+	if e1 == e2 {
+		return true
+	}
+	if e1 == nil || e2 == nil {
+		return false
+	}
+	if e1.Address != e2.Address {
+		return false
+	}
+	if e1.Port != e2.Port {
+		return false
+	}
+	if e1.MaxFails != e2.MaxFails {
+		return false
+	}
+	if e1.FailTimeout != e2.FailTimeout {
+		return false
+	}
+
+	if e1.Target != e2.Target {
+		if e1.Target == nil || e2.Target == nil {
+			return false
+		}
+		if e1.Target.UID != e2.Target.UID {
+			return false
+		}
+		if e1.Target.ResourceVersion != e2.Target.ResourceVersion {
+			return false
+		}
+	}
+
+	return true
+}
+
+// Equal tests for equality between two Server types
+func (s1 *Server) Equal(s2 *Server) bool {
+	if s1 == s2 {
+		return true
+	}
+	if s1 == nil || s2 == nil {
+		return false
+	}
+	if s1.Hostname != s2.Hostname {
+		return false
+	}
+	if s1.Alias != s2.Alias {
+		return false
+	}
+	if s1.SSLPassthrough != s2.SSLPassthrough {
+		return false
+	}
+	if s1.SSLCertificate != s2.SSLCertificate {
+		return false
+	}
+	if s1.SSLPemChecksum != s2.SSLPemChecksum {
+		return false
+	}
+	if !(&s1.CertificateAuth).Equal(&s2.CertificateAuth) {
+		return false
+	}
+	if s1.RedirectFromToWWW != s2.RedirectFromToWWW {
+		return false
+	}
+
+	if len(s1.Locations) != len(s2.Locations) {
+		return false
+	}
+
+	// Location are sorted
+	for idx, s1l := range s1.Locations {
+		if !s1l.Equal(s2.Locations[idx]) {
+			return false
+		}
+	}
+
+	return true
+}
+
+// Equal tests for equality between two Location types
+func (l1 *Location) Equal(l2 *Location) bool {
+	if l1 == l2 {
+		return true
+	}
+	if l1 == nil || l2 == nil {
+		return false
+	}
+	if l1.Path != l2.Path {
+		return false
+	}
+	if l1.IsDefBackend != l2.IsDefBackend {
+		return false
+	}
+	if l1.Backend != l2.Backend {
+		return false
+	}
+
+	if l1.Service != l2.Service {
+		if l1.Service == nil || l2.Service == nil {
+			return false
+		}
+		if l1.Service.GetNamespace() != l2.Service.GetNamespace() {
+			return false
+		}
+		if l1.Service.GetName() != l2.Service.GetName() {
+			return false
+		}
+		if l1.Service.GetResourceVersion() != l2.Service.GetResourceVersion() {
+			return false
+		}
+	}
+
+	if l1.Port.StrVal != l2.Port.StrVal {
+		return false
+	}
+	if !(&l1.BasicDigestAuth).Equal(&l2.BasicDigestAuth) {
+		return false
+	}
+	if l1.Denied != l2.Denied {
+		return false
+	}
+	if l1.EnableCORS != l2.EnableCORS {
+		return false
+	}
+	if !(&l1.ExternalAuth).Equal(&l2.ExternalAuth) {
+		return false
+	}
+	if !(&l1.RateLimit).Equal(&l2.RateLimit) {
+		return false
+	}
+	if !(&l1.Redirect).Equal(&l2.Redirect) {
+		return false
+	}
+	if !(&l1.Rewrite).Equal(&l2.Rewrite) {
+		return false
+	}
+	if !(&l1.Whitelist).Equal(&l2.Whitelist) {
+		return false
+	}
+	if !(&l1.Proxy).Equal(&l2.Proxy) {
+		return false
+	}
+	if l1.UsePortInRedirects != l2.UsePortInRedirects {
+		return false
+	}
+	if l1.ConfigurationSnippet != l2.ConfigurationSnippet {
+		return false
+	}
+	if l1.ClientBodyBufferSize != l2.ClientBodyBufferSize {
+		return false
+	}
+
+	return true
+}
+
+// Equal tests for equality between two SSLPassthroughBackend types
+func (ptb1 *SSLPassthroughBackend) Equal(ptb2 *SSLPassthroughBackend) bool {
+	if ptb1 == ptb2 {
+		return true
+	}
+	if ptb1 == nil || ptb2 == nil {
+		return false
+	}
+	if ptb1.Backend != ptb2.Backend {
+		return false
+	}
+	if ptb1.Hostname != ptb2.Hostname {
+		return false
+	}
+	if ptb1.Port != ptb2.Port {
+		return false
+	}
+
+	if ptb1.Service != ptb2.Service {
+		if ptb1.Service == nil || ptb2.Service == nil {
+			return false
+		}
+		if ptb1.Service.GetNamespace() != ptb2.Service.GetNamespace() {
+			return false
+		}
+		if ptb1.Service.GetName() != ptb2.Service.GetName() {
+			return false
+		}
+		if ptb1.Service.GetResourceVersion() != ptb2.Service.GetResourceVersion() {
+			return false
+		}
+	}
+
+	return true
+}
+
+// Equal tests for equality between two L4Service types
+func (e1 *L4Service) Equal(e2 *L4Service) bool {
+	if e1 == e2 {
+		return true
+	}
+	if e1 == nil || e2 == nil {
+		return false
+	}
+	if e1.Port != e2.Port {
+		return false
+	}
+	if !(&e1.Backend).Equal(&e2.Backend) {
+		return false
+	}
+	if len(e1.Endpoints) != len(e2.Endpoints) {
+		return false
+	}
+
+	for _, ep1 := range e1.Endpoints {
+		found := false
+		for _, ep2 := range e2.Endpoints {
+			if (&ep1).Equal(&ep2) {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+
+	return true
+}
+
+// Equal tests for equality between two L4Backend types
+func (l4b1 *L4Backend) Equal(l4b2 *L4Backend) bool {
+	if l4b1 == l4b2 {
+		return true
+	}
+	if l4b1 == nil || l4b2 == nil {
+		return false
+	}
+	if l4b1.Port != l4b2.Port {
+		return false
+	}
+	if l4b1.Name != l4b2.Name {
+		return false
+	}
+	if l4b1.Namespace != l4b2.Namespace {
+		return false
+	}
+	if l4b1.Protocol != l4b2.Protocol {
+		return false
+	}
+
+	return true
+}

pkg/ingress/zz_generated.types.go

@@ -0,0 +1,116 @@
+// +build !ignore_autogenerated
+
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// This file was autogenerated by deepcopy-gen. Do not edit it manually!
+
+package ingress
+
+import (
+	v1 "k8s.io/api/core/v1"
+	conversion "k8s.io/apimachinery/pkg/conversion"
+	reflect "reflect"
+)
+
+// GetGeneratedDeepCopyFuncs returns the generated funcs, since we aren't registering them.
+func GetGeneratedDeepCopyFuncs() []conversion.GeneratedDeepCopyFunc {
+	return []conversion.GeneratedDeepCopyFunc{
+		{Fn: DeepCopy__Backend, InType: reflect.TypeOf(&Backend{})},
+		{Fn: DeepCopy__CookieSessionAffinity, InType: reflect.TypeOf(&CookieSessionAffinity{})},
+		{Fn: DeepCopy__Endpoint, InType: reflect.TypeOf(&Endpoint{})},
+		{Fn: DeepCopy__SessionAffinityConfig, InType: reflect.TypeOf(&SessionAffinityConfig{})},
+	}
+}
+
+// DeepCopy__Backend is an autogenerated deepcopy function.
+func DeepCopy__Backend(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*Backend)
+		out := out.(*Backend)
+		*out = *in
+		if in.Service != nil {
+			in, out := &in.Service, &out.Service
+			if newVal, err := c.DeepCopy(*in); err != nil {
+				return err
+			} else {
+				*out = newVal.(*v1.Service)
+			}
+		}
+		if in.Endpoints != nil {
+			in, out := &in.Endpoints, &out.Endpoints
+			*out = make([]Endpoint, len(*in))
+			for i := range *in {
+				if err := DeepCopy__Endpoint(&(*in)[i], &(*out)[i], c); err != nil {
+					return err
+				}
+			}
+		}
+		if err := DeepCopy__SessionAffinityConfig(&in.SessionAffinity, &out.SessionAffinity, c); err != nil {
+			return err
+		}
+		return nil
+	}
+}
+
+// DeepCopy__CookieSessionAffinity is an autogenerated deepcopy function.
+func DeepCopy__CookieSessionAffinity(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*CookieSessionAffinity)
+		out := out.(*CookieSessionAffinity)
+		*out = *in
+		if in.Locations != nil {
+			in, out := &in.Locations, &out.Locations
+			*out = make(map[string][]string)
+			for key, val := range *in {
+				if newVal, err := c.DeepCopy(&val); err != nil {
+					return err
+				} else {
+					(*out)[key] = *newVal.(*[]string)
+				}
+			}
+		}
+		return nil
+	}
+}
+
+// DeepCopy__Endpoint is an autogenerated deepcopy function.
+func DeepCopy__Endpoint(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*Endpoint)
+		out := out.(*Endpoint)
+		*out = *in
+		if in.Target != nil {
+			in, out := &in.Target, &out.Target
+			*out = new(v1.ObjectReference)
+			**out = **in
+		}
+		return nil
+	}
+}
+
+// DeepCopy__SessionAffinityConfig is an autogenerated deepcopy function.
+func DeepCopy__SessionAffinityConfig(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*SessionAffinityConfig)
+		out := out.(*SessionAffinityConfig)
+		*out = *in
+		if err := DeepCopy__CookieSessionAffinity(&in.CookieSessionAffinity, &out.CookieSessionAffinity, c); err != nil {
+			return err
+		}
+		return nil
+	}
+}