Add possibility to set a protocol #3648

SantoDE · 2018-07-19T20:38:20Z

What does this PR do?

Adds posibility to set a custom protocol for an ingress with the K8s provider

Motivation

Fixes #3641

More

Added/updated tests
Added/updated documentation

Additional Notes

I'm official dumb and screwed the other pr :)

dtomcej · 2018-07-19T22:33:43Z

docs/configuration/backends/kubernetes.md

@@ -159,7 +159,8 @@ The following general annotations are applicable on the Ingress object:
 | `traefik.ingress.kubernetes.io/whitelist-source-range: "1.2.3.0/24, fe80::/16"` | A comma-separated list of IP ranges permitted for access (6).                                                     |
 | `ingress.kubernetes.io/whitelist-x-forwarded-for: "true"`                       | Use `X-Forwarded-For` header as valid source of IP for the white list.                                            |
 | `traefik.ingress.kubernetes.io/app-root: "/index.html"`                         | Redirects all requests for `/` to the defined path. (4)                                                           |
-| `traefik.ingress.kubernetes.io/service-weights: <YML>`                          | Set ingress backend weights specified as percentage or decimal numbers in YAML. (5)                               |
+| `traefik.ingress.kubernetes.io/service-weights: <YML>`                          | Set ingress backend weights specified as percentage or decimal numbers in YAML. (5)            
+| `ingress.kubernetes.io/protocol: <NAME>`                                        | Set the protocol Traefik will use to communicate with pods 


Needs a . after pods

dtomcej · 2018-07-19T22:34:03Z

docs/configuration/backends/kubernetes.md

@@ -256,7 +257,7 @@ The following annotations are applicable on the Service object associated with a
 | `traefik.ingress.kubernetes.io/load-balancer-method: drr`                | Override the default `wrr` load balancer algorithm.                                                                                                                                   |
 | `traefik.ingress.kubernetes.io/max-conn-amount: 10`                      | Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                               |
 | `traefik.ingress.kubernetes.io/max-conn-extractor-func: client.ip`       | Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect. |
-| `traefik.ingress.kubernetes.io/session-cookie-name: <NAME>`              | Manually set the cookie name for sticky sessions.                                                                                                                                     |
+| `traefik.ingress.kubernetes.io/session-cookie-name: <NAME>`              | Manually set the cookie name for sticky sessions.                                                                                                                                     | 


Does this need to be here?

SantoDE · 2018-07-20T06:01:27Z

Morning @dtomcej,

requested changes applied :)

yue9944882 · 2018-07-20T10:56:11Z

docs/configuration/backends/kubernetes.md

@@ -159,7 +159,8 @@ The following general annotations are applicable on the Ingress object:
 | `traefik.ingress.kubernetes.io/whitelist-source-range: "1.2.3.0/24, fe80::/16"` | A comma-separated list of IP ranges permitted for access (6).                                                     |
 | `ingress.kubernetes.io/whitelist-x-forwarded-for: "true"`                       | Use `X-Forwarded-For` header as valid source of IP for the white list.                                            |
 | `traefik.ingress.kubernetes.io/app-root: "/index.html"`                         | Redirects all requests for `/` to the defined path. (4)                                                           |
-| `traefik.ingress.kubernetes.io/service-weights: <YML>`                          | Set ingress backend weights specified as percentage or decimal numbers in YAML. (5)                               |
+| `traefik.ingress.kubernetes.io/service-weights: <YML>`                          | Set ingress backend weights specified as percentage or decimal numbers in YAML. (5)            
+| `ingress.kubernetes.io/protocol: <NAME>`                                        | Set the protocol Traefik will use to communicate with pods.


i thought ingress model is only for http/https protocol. this annotation allows users to set their own arbitrary protocol. some potential danger for operation engineers?🧐 Or some hacky users might abuse it?

@yue9944882 The issue here is that h2c runs over http, but uses its own protocol. All of the other providers have the traefik.protocol label, but the k8s provider does not. This allows users to specify h2c as a backend protocol so h2c will work as is does with other providers. Although your point about potential abuse is valid.

@SantoDE what do you think about instead of blindly assigning the value to protocol, running it through a select/switch with acceptable protocols? http/https/h2c so that someone can't add http://myinjectionsite.com/endpoint.php http as the protocol ;)

SantoDE · 2018-07-21T08:01:59Z

Hey @yue9944882 , @dtomcej

thanks for your concerns. I added a switch to only accept wanted protocols. :-)

timoreimann · 2018-07-21T23:42:42Z

provider/kubernetes/kubernetes.go

@@ -1029,3 +1040,8 @@ func getRateLimit(i *extensionsv1beta1.Ingress) *types.RateLimit {

 	return rateLimit
 }
+
+func getProtocol(i *extensionsv1beta1.Ingress) string {


This function seems unused. I suppose we can just remove it?

timoreimann · 2018-07-21T23:46:21Z

provider/kubernetes/kubernetes.go

+							protocol = allowedProtocolHTTPS
+						case allowedProtocolH2C:
+							protocol = allowedProtocolH2C
+						default:


I'm not too much of a fan of falling back to some default value for the case where the user entered invalid data. How about indicating an error and skipping the offending Ingress if the given annotation value is unsupported?

That's also how we seem to handle things in most other cases of the Kubernetes provider.

timoreimann · 2018-07-21T23:52:14Z

provider/kubernetes/kubernetes.go

+						case allowedProtocolH2C:
+							protocol = allowedProtocolH2C
+						default:
+							protocol = label.DefaultProtocol


Assuming we hit line 314 and have protocol be https: Aren't we overwriting the value to http again if the annotation is missing or empty (as the default of http will be returned to getStringValue, thereby causing our default switch case to apply)?

timoreimann · 2018-07-21T23:54:27Z

provider/kubernetes/kubernetes_test.go

+					iHost("protocol"),
+					iPaths(onePath(iPath("/valid"), iBackend("service1", intstr.FromInt(80))))),
+			),
+		),


How about adding the test case where we don't use port 443 (i.e., protocol is set to http) but explicitly specify the https protocol through the annotation?

I added some more tests:)

SantoDE · 2018-07-23T12:08:33Z

Hey @dtomcej and @timoreimann ,

I addressed your feedback :)

dtomcej

LGTM

timoreimann · 2018-07-23T23:54:28Z

provider/kubernetes/kubernetes.go

+						case label.DefaultProtocol:
+							protocol = label.DefaultProtocol
+						default:
+							log.Errorf("Invalid protocol %s specified for Ingress %s - skipping", getStringValue(i.Annotations, annotationKubernetesProtocol, protocol), i.Name)


I think it's clearer (and, when in doubt, more correct because it's independent of the calling function's implementation) to use annotationKubernetesProtocol instead of getStringValue(i.Annotations, annotationKubernetesProtocol, protocol).

timoreimann · 2018-07-23T23:55:28Z

provider/kubernetes/kubernetes.go

+						case label.DefaultProtocol:
+							protocol = label.DefaultProtocol
+						default:
+							log.Errorf("Invalid protocol %s specified for Ingress %s - skipping", getStringValue(i.Annotations, annotationKubernetesProtocol, protocol), i.Name)


Please include the namespace when describing the Ingress like we do it here.

timoreimann · 2018-07-25T20:56:19Z

provider/kubernetes/kubernetes.go

+						case allowedProtocolH2C:
+							protocol = allowedProtocolH2C
+						case label.DefaultProtocol:
+							protocol = label.DefaultProtocol


The switch statement can be simplified to:

protocol = getStringValue(i.Annotations, annotationKubernetesProtocol, protocol) switch protocol { case allowedProtocolHTTPS: case allowedProtocolH2C: case label.DefaultProtocol: default: log.Errorf(...) }

timoreimann

LGTM, thanks. 👍

mmatur

LGTM 👏
Thanks @SantoDE

SantoDE added this to the 1.7 milestone Jul 19, 2018

SantoDE requested a review from a team as a code owner July 19, 2018 20:38

traefiker added area/provider/k8s/ingress size/S status/0-needs-triage labels Jul 19, 2018

SantoDE added kind/enhancement a new or improved feature. status/2-needs-review and removed status/0-needs-triage labels Jul 19, 2018

SantoDE force-pushed the feature/set_protocol_k8s branch from 3ffc407 to 5005fc1 Compare July 19, 2018 20:39

SantoDE mentioned this pull request Jul 19, 2018

Backend protocol selection for Kubernetes provider #3641

Closed

dtomcej suggested changes Jul 19, 2018

View reviewed changes

traefiker added the contributor/waiting-for-corrections label Jul 19, 2018

timoreimann changed the title ~~add posibility to set a protocol~~ add possibility to set a protocol Jul 20, 2018

yue9944882 reviewed Jul 20, 2018

View reviewed changes

SantoDE force-pushed the feature/set_protocol_k8s branch from 932ea0c to ed373cd Compare July 21, 2018 08:02

timoreimann suggested changes Jul 21, 2018

View reviewed changes

dtomcej approved these changes Jul 23, 2018

View reviewed changes

traefiker removed the contributor/waiting-for-corrections label Jul 23, 2018

timoreimann suggested changes Jul 25, 2018

View reviewed changes

traefiker added the contributor/waiting-for-corrections label Jul 25, 2018

SantoDE mentioned this pull request Jul 29, 2018

A gRPC application with HTTP (h2c) for Kubernetes ingress does not work #3518

Closed

mmatur changed the title ~~add possibility to set a protocol~~ Add possibility to set a protocol Jul 30, 2018

timoreimann approved these changes Jul 31, 2018

View reviewed changes

traefiker removed the contributor/waiting-for-corrections label Jul 31, 2018

mmatur approved these changes Jul 31, 2018

View reviewed changes

mmatur added status/3-needs-merge and removed status/2-needs-review labels Jul 31, 2018

traefiker added the status/4-merge-in-progress label Jul 31, 2018

Manuel Laufenberg added 4 commits July 31, 2018 13:40

add posibility to set a protocol

6dd10fe

address feedback

47eb068

validate set protocl

900e60b

aadd more unit tests and remove unused function

1bfeb5b

traefiker force-pushed the feature/set_protocol_k8s branch from 58ed6c4 to 8548fa0 Compare July 31, 2018 13:40

traefiker added bot/need-human-merge and removed status/4-merge-in-progress labels Jul 31, 2018

mmatur removed the bot/need-human-merge label Jul 31, 2018

traefiker added the bot/need-human-merge label Jul 31, 2018

add feedback

4c5ac16

mmatur force-pushed the feature/set_protocol_k8s branch from 8548fa0 to 4c5ac16 Compare July 31, 2018 14:32

mmatur removed the bot/need-human-merge label Jul 31, 2018

traefiker merged commit 09b489a into traefik:v1.7 Jul 31, 2018

traefiker removed the status/3-needs-merge label Jul 31, 2018

SantoDE deleted the feature/set_protocol_k8s branch October 12, 2018 09:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add possibility to set a protocol #3648

Add possibility to set a protocol #3648

SantoDE commented Jul 19, 2018

dtomcej Jul 19, 2018

dtomcej Jul 19, 2018

SantoDE commented Jul 20, 2018

yue9944882 Jul 20, 2018 •

edited

Loading

dtomcej Jul 20, 2018 •

edited by ldez

Loading

SantoDE commented Jul 21, 2018

timoreimann Jul 21, 2018

timoreimann Jul 21, 2018

timoreimann Jul 21, 2018

timoreimann Jul 21, 2018

SantoDE Jul 23, 2018

SantoDE commented Jul 23, 2018

dtomcej left a comment

timoreimann Jul 23, 2018

timoreimann Jul 23, 2018

timoreimann Jul 25, 2018

timoreimann left a comment

mmatur left a comment

Add possibility to set a protocol #3648

Add possibility to set a protocol #3648

Conversation

SantoDE commented Jul 19, 2018

What does this PR do?

Motivation

More

Additional Notes

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SantoDE commented Jul 20, 2018

yue9944882 Jul 20, 2018 • edited Loading

Choose a reason for hiding this comment

dtomcej Jul 20, 2018 • edited by ldez Loading

Choose a reason for hiding this comment

SantoDE commented Jul 21, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SantoDE commented Jul 23, 2018

dtomcej left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

timoreimann left a comment

Choose a reason for hiding this comment

mmatur left a comment

Choose a reason for hiding this comment

yue9944882 Jul 20, 2018 •

edited

Loading

dtomcej Jul 20, 2018 •

edited by ldez

Loading