Split implementations from generic code

2016-11-10 19:56:29 -03:00 · 2016-11-10 19:56:29 -03:00 · ed9a416b01
commit ed9a416b01
parent d1e8a629ca
107 changed files with 5777 additions and 3546 deletions
--- a/controllers/nginx/pkg/cmd/controller/main.go
+++ b/controllers/nginx/pkg/cmd/controller/main.go
@ -0,0 +1,60 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/golang/glog"
+
+	"k8s.io/ingress/core/pkg/ingress/controller"
+)
+
+func main() {
+	// start a new nginx controller
+	ngx := newNGINXController()
+	// create a custom Ingress controller using NGINX as backend
+	ic := controller.NewIngressController(ngx)
+	go handleSigterm(ic)
+	// start the controller
+	ic.Start()
+	// wait
+	glog.Infof("shutting down Ingress controller...")
+	for {
+		glog.Infof("Handled quit, awaiting pod deletion")
+		time.Sleep(30 * time.Second)
+	}
+}
+
+func handleSigterm(ic controller.Interface) {
+	signalChan := make(chan os.Signal, 1)
+	signal.Notify(signalChan, syscall.SIGTERM)
+	<-signalChan
+	glog.Infof("Received SIGTERM, shutting down")
+
+	exitCode := 0
+	if err := ic.Stop(); err != nil {
+		glog.Infof("Error during shutdown %v", err)
+		exitCode = 1
+	}
+
+	glog.Infof("Exiting with %v", exitCode)
+	os.Exit(exitCode)
+}
--- a/controllers/nginx/pkg/cmd/controller/nginx.go
+++ b/controllers/nginx/pkg/cmd/controller/nginx.go
@ -0,0 +1,266 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+
+	"github.com/golang/glog"
+
+	"k8s.io/ingress/core/pkg/ingress"
+	"k8s.io/ingress/core/pkg/ingress/defaults"
+
+	"k8s.io/ingress/controllers/nginx/pkg/config"
+	ngx_template "k8s.io/ingress/controllers/nginx/pkg/template"
+	"k8s.io/ingress/controllers/nginx/pkg/version"
+
+	"k8s.io/kubernetes/pkg/api"
+)
+
+var (
+	tmplPath = "/etc/nginx/template/nginx.tmpl"
+	cfgPath  = "/etc/nginx/nginx.conf"
+	binary   = "/usr/sbin/nginx"
+)
+
+// newNGINXController creates a new NGINX Ingress controller.
+// If the environment variable NGINX_BINARY exists it will be used
+// as source for nginx commands
+func newNGINXController() ingress.Controller {
+	ngx := os.Getenv("NGINX_BINARY")
+	if ngx == "" {
+		ngx = binary
+	}
+	n := NGINXController{binary: ngx}
+
+	var onChange func()
+	onChange = func() {
+		template, err := ngx_template.NewTemplate(tmplPath, onChange)
+		if err != nil {
+			// this error is different from the rest because it must be clear why nginx is not working
+			glog.Errorf(`
+-------------------------------------------------------------------------------
+Error loading new template : %v
+-------------------------------------------------------------------------------
+`, err)
+			return
+		}
+
+		n.t.Close()
+		n.t = template
+		glog.Info("new NGINX template loaded")
+	}
+
+	ngxTpl, err := ngx_template.NewTemplate(tmplPath, onChange)
+	if err != nil {
+		glog.Fatalf("invalid NGINX template: %v", err)
+	}
+
+	n.t = ngxTpl
+	return n
+}
+
+// NGINXController ...
+type NGINXController struct {
+	t *ngx_template.Template
+
+	binary string
+}
+
+// Start ...
+func (n NGINXController) Start() {
+	glog.Info("starting NGINX process...")
+	cmd := exec.Command(n.binary, "-c", cfgPath)
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	if err := cmd.Start(); err != nil {
+		glog.Fatalf("nginx error: %v", err)
+	}
+	if err := cmd.Wait(); err != nil {
+		glog.Errorf("nginx error: %v", err)
+	}
+}
+
+// Stop ...
+func (n NGINXController) Stop() error {
+	n.t.Close()
+	return exec.Command(n.binary, "-s", "stop").Run()
+}
+
+// Restart ...
+func (n NGINXController) Restart(data []byte) ([]byte, error) {
+	err := ioutil.WriteFile(cfgPath, data, 0644)
+	if err != nil {
+		return nil, err
+	}
+
+	return exec.Command(n.binary, "-s", "reload").CombinedOutput()
+}
+
+// Test checks is a file contains a valid NGINX configuration
+func (n NGINXController) Test(file string) *exec.Cmd {
+	return exec.Command(n.binary, "-t", "-c", file)
+}
+
+// UpstreamDefaults returns the nginx defaults
+func (n NGINXController) UpstreamDefaults() defaults.Backend {
+	d := config.NewDefault()
+	return d.Backend
+}
+
+// IsReloadRequired check if the new configuration file is different
+// from the current one.
+func (n NGINXController) IsReloadRequired(data []byte) bool {
+	in, err := os.Open(cfgPath)
+	if err != nil {
+		return false
+	}
+	src, err := ioutil.ReadAll(in)
+	in.Close()
+	if err != nil {
+		return false
+	}
+
+	if !bytes.Equal(src, data) {
+		tmpfile, err := ioutil.TempFile("", "nginx-cfg-diff")
+		if err != nil {
+			glog.Errorf("error creating temporal file: %s", err)
+			return false
+		}
+		defer tmpfile.Close()
+		err = ioutil.WriteFile(tmpfile.Name(), data, 0644)
+		if err != nil {
+			return false
+		}
+
+		diffOutput, err := diff(src, data)
+		if err != nil {
+			glog.Errorf("error computing diff: %s", err)
+			return true
+		}
+
+		if glog.V(2) {
+			glog.Infof("NGINX configuration diff\n")
+			glog.Infof("%v", string(diffOutput))
+		}
+		return len(diffOutput) > 0
+	}
+	return false
+}
+
+// Info return build information
+func (n NGINXController) Info() string {
+	return fmt.Sprintf("build version %v from repo %v commit %v", version.RELEASE, version.REPO, version.COMMIT)
+}
+
+// testTemplate checks if the NGINX configuration inside the byte array is valid
+// running the command "nginx -t" using a temporal file.
+func (n NGINXController) testTemplate(cfg []byte) error {
+	tmpfile, err := ioutil.TempFile("", "nginx-cfg")
+	if err != nil {
+		return err
+	}
+	defer tmpfile.Close()
+	ioutil.WriteFile(tmpfile.Name(), cfg, 0644)
+	out, err := n.Test(tmpfile.Name()).CombinedOutput()
+	if err != nil {
+		// this error is different from the rest because it must be clear why nginx is not working
+		return fmt.Errorf(`
+-------------------------------------------------------------------------------
+Error: %v
+%v
+-------------------------------------------------------------------------------
+`, err, string(out))
+	}
+
+	os.Remove(tmpfile.Name())
+	return nil
+}
+
+// OnUpdate is called by syncQueue in https://github.com/aledbf/ingress-controller/blob/master/pkg/ingress/controller/controller.go#L82
+// periodically to keep the configuration in sync.
+//
+// convert configmap to custom configuration object (different in each implementation)
+// write the custom template (the complexity depends on the implementation)
+// write the configuration file
+// returning nill implies the backend will be reloaded.
+// if an error is returned means requeue the update
+func (n NGINXController) OnUpdate(cmap *api.ConfigMap, ingressCfg ingress.Configuration) ([]byte, error) {
+	var longestName int
+	var serverNames int
+	for _, srv := range ingressCfg.Servers {
+		serverNames += len([]byte(srv.Name))
+		if longestName < len(srv.Name) {
+			longestName = len(srv.Name)
+		}
+	}
+
+	cfg := ngx_template.ReadConfig(cmap)
+
+	// NGINX cannot resize the has tables used to store server names.
+	// For this reason we check if the defined size defined is correct
+	// for the FQDN defined in the ingress rules adjusting the value
+	// if is required.
+	// https://trac.nginx.org/nginx/ticket/352
+	// https://trac.nginx.org/nginx/ticket/631
+	nameHashBucketSize := nextPowerOf2(longestName)
+	if nameHashBucketSize > cfg.ServerNameHashBucketSize {
+		glog.V(3).Infof("adjusting ServerNameHashBucketSize variable from %v to %v",
+			cfg.ServerNameHashBucketSize, nameHashBucketSize)
+		cfg.ServerNameHashBucketSize = nameHashBucketSize
+	}
+	serverNameHashMaxSize := nextPowerOf2(serverNames)
+	if serverNameHashMaxSize > cfg.ServerNameHashMaxSize {
+		glog.V(3).Infof("adjusting ServerNameHashMaxSize variable from %v to %v",
+			cfg.ServerNameHashMaxSize, serverNameHashMaxSize)
+		cfg.ServerNameHashMaxSize = serverNameHashMaxSize
+	}
+
+	conf := make(map[string]interface{})
+	// adjust the size of the backlog
+	conf["backlogSize"] = sysctlSomaxconn()
+	conf["upstreams"] = ingressCfg.Upstreams
+	conf["passthroughUpstreams"] = ingressCfg.PassthroughUpstreams
+	conf["servers"] = ingressCfg.Servers
+	conf["tcpUpstreams"] = ingressCfg.TCPUpstreams
+	conf["udpUpstreams"] = ingressCfg.UDPUpstreams
+	conf["healthzURL"] = ingressCfg.HealthzURL
+	conf["defResolver"] = cfg.Resolver
+	conf["sslDHParam"] = ""
+	conf["customErrors"] = len(cfg.CustomHTTPErrors) > 0
+	conf["cfg"] = ngx_template.StandarizeKeyNames(cfg)
+
+	return n.t.Write(conf, n.testTemplate)
+}
+
+// http://graphics.stanford.edu/~seander/bithacks.html#RoundUpPowerOf2
+// https://play.golang.org/p/TVSyCcdxUh
+func nextPowerOf2(v int) int {
+	v--
+	v |= v >> 1
+	v |= v >> 2
+	v |= v >> 4
+	v |= v >> 8
+	v |= v >> 16
+	v++
+
+	return v
+}
--- a/controllers/nginx/pkg/cmd/controller/utils.go
+++ b/controllers/nginx/pkg/cmd/controller/utils.go
@ -0,0 +1,62 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"io/ioutil"
+	"os"
+	"os/exec"
+
+	"k8s.io/kubernetes/pkg/util/sysctl"
+
+	"github.com/golang/glog"
+)
+
+// sysctlSomaxconn returns the value of net.core.somaxconn, i.e.
+// maximum number of connections that can be queued for acceptance
+// http://nginx.org/en/docs/http/ngx_http_core_module.html#listen
+func sysctlSomaxconn() int {
+	maxConns, err := sysctl.New().GetSysctl("net/core/somaxconn")
+	if err != nil || maxConns < 512 {
+		glog.V(3).Infof("system net.core.somaxconn=%v (using system default)", maxConns)
+		return 511
+	}
+
+	return maxConns
+}
+
+func diff(b1, b2 []byte) ([]byte, error) {
+	f1, err := ioutil.TempFile("", "a")
+	if err != nil {
+		return nil, err
+	}
+	defer f1.Close()
+	defer os.Remove(f1.Name())
+
+	f2, err := ioutil.TempFile("", "b")
+	if err != nil {
+		return nil, err
+	}
+	defer f2.Close()
+	defer os.Remove(f2.Name())
+
+	f1.Write(b1)
+	f2.Write(b2)
+
+	out, _ := exec.Command("diff", "-u", f1.Name(), f2.Name()).CombinedOutput()
+	return out, nil
+}
--- a/controllers/nginx/pkg/cmd/controller/utils_test.go
+++ b/controllers/nginx/pkg/cmd/controller/utils_test.go
@ -0,0 +1,41 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import "testing"
+
+func TestDiff(t *testing.T) {
+	tests := []struct {
+		a     []byte
+		b     []byte
+		empty bool
+	}{
+		{[]byte(""), []byte(""), true},
+		{[]byte("a"), []byte("a"), true},
+		{[]byte("a"), []byte("b"), false},
+	}
+
+	for _, test := range tests {
+		b, err := diff(test.a, test.b)
+		if err != nil {
+			t.Fatalf("unexpected error returned: %v", err)
+		}
+		if len(b) == 0 && !test.empty {
+			t.Fatalf("expected empty but returned %s", b)
+		}
+	}
+}
--- a/controllers/nginx/pkg/config/config.go
+++ b/controllers/nginx/pkg/config/config.go
@ -0,0 +1,266 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"runtime"
+
+	"k8s.io/ingress/core/pkg/ingress/defaults"
+
+	"github.com/golang/glog"
+)
+
+const (
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
+	// Sets the maximum allowed size of the client request body
+	bodySize = "1m"
+
+	// http://nginx.org/en/docs/ngx_core_module.html#error_log
+	// Configures logging level [debug | info | notice | warn | error | crit | alert | emerg]
+	// Log levels above are listed in the order of increasing severity
+	errorLevel = "notice"
+
+	// HTTP Strict Transport Security (often abbreviated as HSTS) is a security feature (HTTP header)
+	// that tell browsers that it should only be communicated with using HTTPS, instead of using HTTP.
+	// https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
+	// max-age is the time, in seconds, that the browser should remember that this site is only to be accessed using HTTPS.
+	hstsMaxAge = "15724800"
+
+	// If UseProxyProtocol is enabled defIPCIDR defines the default the IP/network address of your external load balancer
+	defIPCIDR = "0.0.0.0/0"
+
+	gzipTypes = "application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component"
+
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size
+	// Sets the size of the buffer used for sending data.
+	// 4k helps NGINX to improve TLS Time To First Byte (TTTFB)
+	// https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/
+	sslBufferSize = "4k"
+
+	// Enabled ciphers list to enabled. The ciphers are specified in the format understood by the OpenSSL library
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers
+	sslCiphers = "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
+
+	// SSL enabled protocols to use
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols
+	sslProtocols = "TLSv1 TLSv1.1 TLSv1.2"
+
+	// Time during which a client may reuse the session parameters stored in a cache.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_timeout
+	sslSessionTimeout = "10m"
+
+	// Size of the SSL shared cache between all worker processes.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
+	sslSessionCacheSize = "10m"
+)
+
+var (
+	// SSLDirectory contains the mounted secrets with SSL certificates, keys and
+	SSLDirectory = "/etc/ingress-controller/ssl"
+)
+
+// Configuration represents the content of nginx.conf file
+type Configuration struct {
+	defaults.Backend
+
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
+	// Sets the maximum allowed size of the client request body
+	BodySize string `structs:"body-size,omitempty"`
+
+	// EnableDynamicTLSRecords enables dynamic TLS record sizes
+	// https://blog.cloudflare.com/optimizing-tls-over-tcp-to-reduce-latency
+	// By default this is enabled
+	EnableDynamicTLSRecords bool `structs:"enable-dynamic-tls-records"`
+
+	// EnableSPDY enables spdy and use ALPN and NPN to advertise the availability of the two protocols
+	// https://blog.cloudflare.com/open-sourcing-our-nginx-http-2-spdy-code
+	// By default this is enabled
+	EnableSPDY bool `structs:"enable-spdy"`
+
+	// EnableStickySessions enabled sticky sessions using cookies
+	// https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng
+	// By default this is disabled
+	EnableStickySessions bool `structs:"enable-sticky-sessions,omitempty"`
+
+	// EnableVtsStatus allows the replacement of the default status page with a third party module named
+	// nginx-module-vts - https://github.com/vozlt/nginx-module-vts
+	// By default this is disabled
+	EnableVtsStatus bool `structs:"enable-vts-status,omitempty"`
+
+	VtsStatusZoneSize string `structs:"vts-status-zone-size,omitempty"`
+
+	// RetryNonIdempotent since 1.9.13 NGINX will not retry non-idempotent requests (POST, LOCK, PATCH)
+	// in case of an error. The previous behavior can be restored using the value true
+	RetryNonIdempotent bool `structs:"retry-non-idempotent"`
+
+	// http://nginx.org/en/docs/ngx_core_module.html#error_log
+	// Configures logging level [debug | info | notice | warn | error | crit | alert | emerg]
+	// Log levels above are listed in the order of increasing severity
+	ErrorLogLevel string `structs:"error-log-level,omitempty"`
+
+	// Enables or disables the header HSTS in servers running SSL
+	HSTS bool `structs:"hsts,omitempty"`
+
+	// Enables or disables the use of HSTS in all the subdomains of the servername
+	// Default: true
+	HSTSIncludeSubdomains bool `structs:"hsts-include-subdomains,omitempty"`
+
+	// HTTP Strict Transport Security (often abbreviated as HSTS) is a security feature (HTTP header)
+	// that tell browsers that it should only be communicated with using HTTPS, instead of using HTTP.
+	// https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
+	// max-age is the time, in seconds, that the browser should remember that this site is only to be
+	// accessed using HTTPS.
+	HSTSMaxAge string `structs:"hsts-max-age,omitempty"`
+
+	// Time during which a keep-alive client connection will stay open on the server side.
+	// The zero value disables keep-alive client connections
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout
+	KeepAlive int `structs:"keep-alive,omitempty"`
+
+	// Maximum number of simultaneous connections that can be opened by each worker process
+	// http://nginx.org/en/docs/ngx_core_module.html#worker_connections
+	MaxWorkerConnections int `structs:"max-worker-connections,omitempty"`
+
+	// Sets the bucket size for the map variables hash tables.
+	// Default value depends on the processor’s cache line size.
+	// http://nginx.org/en/docs/http/ngx_http_map_module.html#map_hash_bucket_size
+	MapHashBucketSize int `structs:"map-hash-bucket-size,omitempty"`
+
+	// If UseProxyProtocol is enabled ProxyRealIPCIDR defines the default the IP/network address
+	// of your external load balancer
+	ProxyRealIPCIDR string `structs:"proxy-real-ip-cidr,omitempty"`
+
+	// Maximum size of the server names hash tables used in server names, map directive’s values,
+	// MIME types, names of request header strings, etcd.
+	// http://nginx.org/en/docs/hash.html
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_max_size
+	ServerNameHashMaxSize int `structs:"server-name-hash-max-size,omitempty"`
+
+	// Size of the bucket for the server names hash tables
+	// http://nginx.org/en/docs/hash.html
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_bucket_size
+	ServerNameHashBucketSize int `structs:"server-name-hash-bucket-size,omitempty"`
+
+	// Enabled ciphers list to enabled. The ciphers are specified in the format understood by
+	// the OpenSSL library
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers
+	SSLCiphers string `structs:"ssl-ciphers,omitempty"`
+
+	// Base64 string that contains Diffie-Hellman key to help with "Perfect Forward Secrecy"
+	// https://www.openssl.org/docs/manmaster/apps/dhparam.html
+	// https://wiki.mozilla.org/Security/Server_Side_TLS#DHE_handshake_and_dhparam
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam
+	SSLDHParam string `structs:"ssl-dh-param,omitempty"`
+
+	// SSL enabled protocols to use
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols
+	SSLProtocols string `structs:"ssl-protocols,omitempty"`
+
+	// Enables or disables the use of shared SSL cache among worker processes.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
+	SSLSessionCache bool `structs:"ssl-session-cache,omitempty"`
+
+	// Size of the SSL shared cache between all worker processes.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
+	SSLSessionCacheSize string `structs:"ssl-session-cache-size,omitempty"`
+
+	// Enables or disables session resumption through TLS session tickets.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets
+	SSLSessionTickets bool `structs:"ssl-session-tickets,omitempty"`
+
+	// Time during which a client may reuse the session parameters stored in a cache.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_timeout
+	SSLSessionTimeout string `structs:"ssl-session-timeout,omitempty"`
+
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size
+	// Sets the size of the buffer used for sending data.
+	// 4k helps NGINX to improve TLS Time To First Byte (TTTFB)
+	// https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/
+	SSLBufferSize string `structs:"ssl-buffer-size,omitempty"`
+
+	// Enables or disables the use of the PROXY protocol to receive client connection
+	// (real IP address) information passed through proxy servers and load balancers
+	// such as HAproxy and Amazon Elastic Load Balancer (ELB).
+	// https://www.nginx.com/resources/admin-guide/proxy-protocol/
+	UseProxyProtocol bool `structs:"use-proxy-protocol,omitempty"`
+
+	// Enables or disables the use of the nginx module that compresses responses using the "gzip" method
+	// http://nginx.org/en/docs/http/ngx_http_gzip_module.html
+	UseGzip bool `structs:"use-gzip,omitempty"`
+
+	// Enables or disables the HTTP/2 support in secure connections
+	// http://nginx.org/en/docs/http/ngx_http_v2_module.html
+	// Default: true
+	UseHTTP2 bool `structs:"use-http2,omitempty"`
+
+	// MIME types in addition to "text/html" to compress. The special value “*” matches any MIME type.
+	// Responses with the “text/html” type are always compressed if UseGzip is enabled
+	GzipTypes string `structs:"gzip-types,omitempty"`
+
+	// Defines the number of worker processes. By default auto means number of available CPU cores
+	// http://nginx.org/en/docs/ngx_core_module.html#worker_processes
+	WorkerProcesses int `structs:"worker-processes,omitempty"`
+}
+
+// NewDefault returns the default configuration contained
+// in the file default-conf.json
+func NewDefault() Configuration {
+	cfg := Configuration{
+		BodySize:                bodySize,
+		EnableDynamicTLSRecords: true,
+		EnableSPDY:              false,
+		ErrorLogLevel:           errorLevel,
+		HSTS:                    true,
+		HSTSIncludeSubdomains:    true,
+		HSTSMaxAge:               hstsMaxAge,
+		GzipTypes:                gzipTypes,
+		KeepAlive:                75,
+		MaxWorkerConnections:     16384,
+		MapHashBucketSize:        64,
+		ProxyRealIPCIDR:          defIPCIDR,
+		ServerNameHashMaxSize:    512,
+		ServerNameHashBucketSize: 64,
+		SSLBufferSize:            sslBufferSize,
+		SSLCiphers:               sslCiphers,
+		SSLProtocols:             sslProtocols,
+		SSLSessionCache:          true,
+		SSLSessionCacheSize:      sslSessionCacheSize,
+		SSLSessionTickets:        true,
+		SSLSessionTimeout:        sslSessionTimeout,
+		UseProxyProtocol:         false,
+		UseGzip:                  true,
+		WorkerProcesses:          runtime.NumCPU(),
+		VtsStatusZoneSize:        "10m",
+		UseHTTP2:                 true,
+		Backend: defaults.Backend{
+			ProxyConnectTimeout:  5,
+			ProxyReadTimeout:     60,
+			ProxySendTimeout:     60,
+			ProxyBufferSize:      "4k",
+			SSLRedirect:          true,
+			CustomHTTPErrors:     []int{},
+			WhitelistSourceRange: []string{},
+			SkipAccessLogURLs:    []string{},
+		},
+	}
+
+	if glog.V(5) {
+		cfg.ErrorLogLevel = "debug"
+	}
+
+	return cfg
+}
--- a/controllers/nginx/pkg/template/configmap.go
+++ b/controllers/nginx/pkg/template/configmap.go
@ -0,0 +1,122 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package template
+
+import (
+	"strconv"
+	"strings"
+
+	"github.com/golang/glog"
+	"github.com/imdario/mergo"
+
+	"github.com/fatih/structs"
+	"github.com/mitchellh/mapstructure"
+	go_camelcase "github.com/segmentio/go-camelcase"
+
+	"k8s.io/ingress/controllers/nginx/pkg/config"
+	"k8s.io/ingress/core/pkg/ingress/defaults"
+
+	"k8s.io/kubernetes/pkg/api"
+)
+
+const (
+	customHTTPErrors     = "custom-http-errors"
+	skipAccessLogUrls    = "skip-access-log-urls"
+	whitelistSourceRange = "whitelist-source-range"
+)
+
+// StandarizeKeyNames ...
+func StandarizeKeyNames(data interface{}) map[string]interface{} {
+	return fixKeyNames(structs.Map(data))
+}
+
+// ReadConfig obtains the configuration defined by the user merged with the defaults.
+func ReadConfig(conf *api.ConfigMap) config.Configuration {
+	if len(conf.Data) == 0 {
+		return config.NewDefault()
+	}
+
+	var errors []int
+	var skipUrls []string
+	var whitelist []string
+
+	if val, ok := conf.Data[customHTTPErrors]; ok {
+		delete(conf.Data, customHTTPErrors)
+		for _, i := range strings.Split(val, ",") {
+			j, err := strconv.Atoi(i)
+			if err != nil {
+				glog.Warningf("%v is not a valid http code: %v", i, err)
+			} else {
+				errors = append(errors, j)
+			}
+		}
+	}
+	if val, ok := conf.Data[skipAccessLogUrls]; ok {
+		delete(conf.Data, skipAccessLogUrls)
+		skipUrls = strings.Split(val, ",")
+	}
+	if val, ok := conf.Data[whitelistSourceRange]; ok {
+		delete(conf.Data, whitelistSourceRange)
+		whitelist = append(whitelist, strings.Split(val, ",")...)
+	}
+
+	to := config.Configuration{}
+	to.Backend = defaults.Backend{
+		CustomHTTPErrors:     filterErrors(errors),
+		SkipAccessLogURLs:    skipUrls,
+		WhitelistSourceRange: whitelist,
+	}
+	def := config.NewDefault()
+	if err := mergo.Merge(&to, def); err != nil {
+		glog.Warningf("unexpected error merging defaults: %v", err)
+	}
+
+	metadata := &mapstructure.Metadata{}
+	decoder, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
+		TagName:          "structs",
+		Result:           &to,
+		WeaklyTypedInput: true,
+		Metadata:         metadata,
+	})
+
+	err = decoder.Decode(conf.Data)
+	if err != nil {
+		glog.Infof("%v", err)
+	}
+	return to
+}
+
+func filterErrors(codes []int) []int {
+	var fa []int
+	for _, code := range codes {
+		if code > 299 && code < 600 {
+			fa = append(fa, code)
+		} else {
+			glog.Warningf("error code %v is not valid for custom error pages", code)
+		}
+	}
+
+	return fa
+}
+
+func fixKeyNames(data map[string]interface{}) map[string]interface{} {
+	fixed := make(map[string]interface{})
+	for k, v := range data {
+		fixed[go_camelcase.Camelcase(k)] = v
+	}
+	return fixed
+}
--- a/controllers/nginx/pkg/template/configmap_test.go
+++ b/controllers/nginx/pkg/template/configmap_test.go
@ -0,0 +1,83 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package template
+
+import (
+	"testing"
+
+	"k8s.io/ingress/controllers/nginx/pkg/config"
+)
+
+func TestStandarizeKeyNames(t *testing.T) {
+}
+
+func TestFilterErrors(t *testing.T) {
+	e := filterErrors([]int{200, 300, 345, 500, 555, 999})
+	if len(e) != 4 {
+		t.Errorf("expected 4 elements but %v returned", len(e))
+	}
+}
+
+func TestFixKeyNames(t *testing.T) {
+	d := map[string]interface{}{
+		"one":                   "one",
+		"one-example":           "oneExample",
+		"aMore-complex_example": "aMoreComplexExample",
+		"a": "a",
+	}
+
+	fixed := fixKeyNames(d)
+	for k, v := range fixed {
+		if k != v {
+			t.Errorf("expected %v but retuned %v", v, k)
+		}
+	}
+}
+
+type testStruct struct {
+	ProxyReadTimeout  int      `structs:"proxy-read-timeout,omitempty"`
+	ProxySendTimeout  int      `structs:"proxy-send-timeout,omitempty"`
+	CustomHTTPErrors  []int    `structs:"custom-http-errors"`
+	SkipAccessLogURLs []string `structs:"skip-access-log-urls,-"`
+	NoTag             string
+}
+
+var decodedData = &testStruct{
+	1,
+	2,
+	[]int{300, 400},
+	[]string{"/log"},
+	"",
+}
+
+func TestMergeConfigMapToStruct(t *testing.T) {
+	/*conf := &api.ConfigMap{
+		Data: map[string]string{
+			"custom-http-errors":   "300,400",
+			"proxy-read-timeout":   "1",
+			"proxy-send-timeout":   "2",
+			"skip-access-log-urls": "/log",
+		},
+	}*/
+	def := config.NewDefault()
+	def.CustomHTTPErrors = []int{300, 400}
+	def.SkipAccessLogURLs = []string{"/log"}
+	//to := ReadConfig(conf)
+	//if !reflect.DeepEqual(def, to) {
+	//	t.Errorf("expected %v but retuned %v", def, to)
+	//}
+}
--- a/controllers/nginx/pkg/template/template.go
+++ b/controllers/nginx/pkg/template/template.go
@ -0,0 +1,300 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package template
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"os/exec"
+	"strings"
+	text_template "text/template"
+
+	"github.com/golang/glog"
+
+	"k8s.io/ingress/core/pkg/ingress"
+	"k8s.io/ingress/core/pkg/watch"
+)
+
+const (
+	slash         = "/"
+	defBufferSize = 65535
+)
+
+// Template ...
+type Template struct {
+	tmpl      *text_template.Template
+	fw        watch.FileWatcher
+	s         int
+	tmplBuf   *bytes.Buffer
+	outCmdBuf *bytes.Buffer
+}
+
+//NewTemplate returns a new Template instance or an
+//error if the specified template file contains errors
+func NewTemplate(file string, onChange func()) (*Template, error) {
+	tmpl, err := text_template.New("nginx.tmpl").Funcs(funcMap).ParseFiles(file)
+	if err != nil {
+		return nil, err
+	}
+	fw, err := watch.NewFileWatcher(file, onChange)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Template{
+		tmpl:      tmpl,
+		fw:        fw,
+		s:         defBufferSize,
+		tmplBuf:   bytes.NewBuffer(make([]byte, 0, defBufferSize)),
+		outCmdBuf: bytes.NewBuffer(make([]byte, 0, defBufferSize)),
+	}, nil
+}
+
+// Close removes the file watcher
+func (t *Template) Close() {
+	t.fw.Close()
+}
+
+// Write populates a buffer using a template with NGINX configuration
+// and the servers and upstreams created by Ingress rules
+func (t *Template) Write(conf map[string]interface{},
+	isValidTemplate func([]byte) error) ([]byte, error) {
+
+	defer t.tmplBuf.Reset()
+	defer t.outCmdBuf.Reset()
+
+	if glog.V(3) {
+		b, err := json.Marshal(conf)
+		if err != nil {
+			glog.Errorf("unexpected error: %v", err)
+		}
+		glog.Infof("NGINX configuration: %v", string(b))
+	}
+
+	err := t.tmpl.Execute(t.tmplBuf, conf)
+
+	if t.s < t.tmplBuf.Cap() {
+		glog.V(2).Infof("adjusting template buffer size from %v to %v", t.s, t.tmplBuf.Cap())
+		t.s = t.tmplBuf.Cap()
+		t.tmplBuf = bytes.NewBuffer(make([]byte, 0, t.tmplBuf.Cap()))
+		t.outCmdBuf = bytes.NewBuffer(make([]byte, 0, t.outCmdBuf.Cap()))
+	}
+
+	// squeezes multiple adjacent empty lines to be single
+	// spaced this is to avoid the use of regular expressions
+	cmd := exec.Command("/ingress-controller/clean-nginx-conf.sh")
+	cmd.Stdin = t.tmplBuf
+	cmd.Stdout = t.outCmdBuf
+	if err := cmd.Run(); err != nil {
+		glog.Warningf("unexpected error cleaning template: %v", err)
+		return t.tmplBuf.Bytes(), nil
+	}
+
+	content := t.outCmdBuf.Bytes()
+	err = isValidTemplate(content)
+	if err != nil {
+		return nil, err
+	}
+
+	return content, nil
+}
+
+var (
+	funcMap = text_template.FuncMap{
+		"empty": func(input interface{}) bool {
+			check, ok := input.(string)
+			if ok {
+				return len(check) == 0
+			}
+			return true
+		},
+		"buildLocation":            buildLocation,
+		"buildAuthLocation":        buildAuthLocation,
+		"buildProxyPass":           buildProxyPass,
+		"buildRateLimitZones":      buildRateLimitZones,
+		"buildRateLimit":           buildRateLimit,
+		"getSSPassthroughUpstream": getSSPassthroughUpstream,
+
+		"contains":  strings.Contains,
+		"hasPrefix": strings.HasPrefix,
+		"hasSuffix": strings.HasSuffix,
+		"toUpper":   strings.ToUpper,
+		"toLower":   strings.ToLower,
+	}
+)
+
+func getSSPassthroughUpstream(input interface{}) string {
+	s, ok := input.(*ingress.Server)
+	if !ok {
+		return ""
+	}
+
+	return s.Name
+}
+
+// buildLocation produces the location string, if the ingress has redirects
+// (specified through the ingress.kubernetes.io/rewrite-to annotation)
+func buildLocation(input interface{}) string {
+	location, ok := input.(*ingress.Location)
+	if !ok {
+		return slash
+	}
+
+	path := location.Path
+	if len(location.Redirect.Target) > 0 && location.Redirect.Target != path {
+		return fmt.Sprintf("~* %s", path)
+	}
+
+	return path
+}
+
+func buildAuthLocation(input interface{}) string {
+	location, ok := input.(*ingress.Location)
+	if !ok {
+		return ""
+	}
+
+	if location.ExternalAuth.URL == "" {
+		return ""
+	}
+
+	str := base64.URLEncoding.EncodeToString([]byte(location.Path))
+	// avoid locations containing the = char
+	str = strings.Replace(str, "=", "", -1)
+	return fmt.Sprintf("/_external-auth-%v", str)
+}
+
+// buildProxyPass produces the proxy pass string, if the ingress has redirects
+// (specified through the ingress.kubernetes.io/rewrite-to annotation)
+// If the annotation ingress.kubernetes.io/add-base-url:"true" is specified it will
+// add a base tag in the head of the response from the service
+func buildProxyPass(input interface{}) string {
+	location, ok := input.(*ingress.Location)
+	if !ok {
+		return ""
+	}
+
+	path := location.Path
+
+	proto := "http"
+	if location.SecureUpstream {
+		proto = "https"
+	}
+	// defProxyPass returns the default proxy_pass, just the name of the upstream
+	defProxyPass := fmt.Sprintf("proxy_pass %s://%s;", proto, location.Upstream.Name)
+	// if the path in the ingress rule is equals to the target: no special rewrite
+	if path == location.Redirect.Target {
+		return defProxyPass
+	}
+
+	if path != slash && !strings.HasSuffix(path, slash) {
+		path = fmt.Sprintf("%s/", path)
+	}
+
+	if len(location.Redirect.Target) > 0 {
+		abu := ""
+		if location.Redirect.AddBaseURL {
+			bPath := location.Redirect.Target
+			if !strings.HasSuffix(bPath, slash) {
+				bPath = fmt.Sprintf("%s/", bPath)
+			}
+
+			abu = fmt.Sprintf(`subs_filter '<head(.*)>' '<head$1><base href="$scheme://$server_name%v">' r;
+	subs_filter '<HEAD(.*)>' '<HEAD$1><base href="$scheme://$server_name%v">' r;
+	`, bPath, bPath)
+		}
+
+		if location.Redirect.Target == slash {
+			// special case redirect to /
+			// ie /something to /
+			return fmt.Sprintf(`
+	rewrite %s(.*) /$1 break;
+	rewrite %s / break;
+	proxy_pass %s://%s;
+	%v`, path, location.Path, proto, location.Upstream.Name, abu)
+		}
+
+		return fmt.Sprintf(`
+	rewrite %s(.*) %s/$1 break;
+	proxy_pass %s://%s;
+	%v`, path, location.Redirect.Target, proto, location.Upstream.Name, abu)
+	}
+
+	// default proxy_pass
+	return defProxyPass
+}
+
+// buildRateLimitZones produces an array of limit_conn_zone in order to allow
+// rate limiting of request. Each Ingress rule could have up to two zones, one
+// for connection limit by IP address and other for limiting request per second
+func buildRateLimitZones(input interface{}) []string {
+	zones := []string{}
+
+	servers, ok := input.([]*ingress.Server)
+	if !ok {
+		return zones
+	}
+
+	for _, server := range servers {
+		for _, loc := range server.Locations {
+
+			if loc.RateLimit.Connections.Limit > 0 {
+				zone := fmt.Sprintf("limit_conn_zone $binary_remote_addr zone=%v:%vm;",
+					loc.RateLimit.Connections.Name,
+					loc.RateLimit.Connections.SharedSize)
+				zones = append(zones, zone)
+			}
+
+			if loc.RateLimit.RPS.Limit > 0 {
+				zone := fmt.Sprintf("limit_conn_zone $binary_remote_addr zone=%v:%vm rate=%vr/s;",
+					loc.RateLimit.Connections.Name,
+					loc.RateLimit.Connections.SharedSize,
+					loc.RateLimit.Connections.Limit)
+				zones = append(zones, zone)
+			}
+		}
+	}
+
+	return zones
+}
+
+// buildRateLimit produces an array of limit_req to be used inside the Path of
+// Ingress rules. The order: connections by IP first and RPS next.
+func buildRateLimit(input interface{}) []string {
+	limits := []string{}
+
+	loc, ok := input.(*ingress.Location)
+	if !ok {
+		return limits
+	}
+
+	if loc.RateLimit.Connections.Limit > 0 {
+		limit := fmt.Sprintf("limit_conn %v %v;",
+			loc.RateLimit.Connections.Name, loc.RateLimit.Connections.Limit)
+		limits = append(limits, limit)
+	}
+
+	if loc.RateLimit.RPS.Limit > 0 {
+		limit := fmt.Sprintf("limit_req zone=%v burst=%v nodelay;",
+			loc.RateLimit.Connections.Name, loc.RateLimit.Connections.Burst)
+		limits = append(limits, limit)
+	}
+
+	return limits
+}
--- a/controllers/nginx/pkg/template/template_test.go
+++ b/controllers/nginx/pkg/template/template_test.go
@ -0,0 +1,99 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package template
+
+import (
+	"strings"
+	"testing"
+
+	"k8s.io/ingress/core/pkg/ingress"
+	"k8s.io/ingress/core/pkg/ingress/annotations/rewrite"
+)
+
+var (
+	tmplFuncTestcases = map[string]struct {
+		Path       string
+		Target     string
+		Location   string
+		ProxyPass  string
+		AddBaseURL bool
+	}{
+		"invalid redirect / to /": {"/", "/", "/", "proxy_pass http://upstream-name;", false},
+		"redirect / to /jenkins": {"/", "/jenkins", "~* /",
+			`
+	rewrite /(.*) /jenkins/$1 break;
+	proxy_pass http://upstream-name;
+	`, false},
+		"redirect /something to /": {"/something", "/", "~* /something", `
+	rewrite /something/(.*) /$1 break;
+	rewrite /something / break;
+	proxy_pass http://upstream-name;
+	`, false},
+		"redirect /something-complex to /not-root": {"/something-complex", "/not-root", "~* /something-complex", `
+	rewrite /something-complex/(.*) /not-root/$1 break;
+	proxy_pass http://upstream-name;
+	`, false},
+		"redirect / to /jenkins and rewrite": {"/", "/jenkins", "~* /", `
+	rewrite /(.*) /jenkins/$1 break;
+	proxy_pass http://upstream-name;
+	subs_filter '<head(.*)>' '<head$1><base href="$scheme://$server_name/jenkins/">' r;
+	subs_filter '<HEAD(.*)>' '<HEAD$1><base href="$scheme://$server_name/jenkins/">' r;
+	`, true},
+		"redirect /something to / and rewrite": {"/something", "/", "~* /something", `
+	rewrite /something/(.*) /$1 break;
+	rewrite /something / break;
+	proxy_pass http://upstream-name;
+	subs_filter '<head(.*)>' '<head$1><base href="$scheme://$server_name/">' r;
+	subs_filter '<HEAD(.*)>' '<HEAD$1><base href="$scheme://$server_name/">' r;
+	`, true},
+		"redirect /something-complex to /not-root and rewrite": {"/something-complex", "/not-root", "~* /something-complex", `
+	rewrite /something-complex/(.*) /not-root/$1 break;
+	proxy_pass http://upstream-name;
+	subs_filter '<head(.*)>' '<head$1><base href="$scheme://$server_name/not-root/">' r;
+	subs_filter '<HEAD(.*)>' '<HEAD$1><base href="$scheme://$server_name/not-root/">' r;
+	`, true},
+	}
+)
+
+func TestBuildLocation(t *testing.T) {
+	for k, tc := range tmplFuncTestcases {
+		loc := &ingress.Location{
+			Path:     tc.Path,
+			Redirect: rewrite.Redirect{Target: tc.Target, AddBaseURL: tc.AddBaseURL},
+		}
+
+		newLoc := buildLocation(loc)
+		if tc.Location != newLoc {
+			t.Errorf("%s: expected '%v' but returned %v", k, tc.Location, newLoc)
+		}
+	}
+}
+
+func TestBuildProxyPass(t *testing.T) {
+	for k, tc := range tmplFuncTestcases {
+		loc := &ingress.Location{
+			Path:     tc.Path,
+			Redirect: rewrite.Redirect{Target: tc.Target, AddBaseURL: tc.AddBaseURL},
+			Upstream: ingress.Upstream{Name: "upstream-name"},
+		}
+
+		pp := buildProxyPass(loc)
+		if !strings.EqualFold(tc.ProxyPass, pp) {
+			t.Errorf("%s: expected \n'%v'\nbut returned \n'%v'", k, tc.ProxyPass, pp)
+		}
+	}
+}
--- a/controllers/nginx/pkg/version/version.go
+++ b/controllers/nginx/pkg/version/version.go
@ -0,0 +1,26 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package version
+
+var (
+	// RELEASE returns the release version
+	RELEASE = "UNKNOWN"
+	// REPO returns the git repository URL
+	REPO = "UNKNOWN"
+	// COMMIT returns the short sha from git
+	COMMIT = "UNKNOWN"
+)