Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds middlewares examples for k8s. #4713

Merged
merged 2 commits into from
Apr 3, 2019
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 6 additions & 5 deletions docs/content/middlewares/addprefix.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,17 +12,18 @@ The AddPrefix middleware updates the URL Path of the request before forwarding i
```yaml tab="Docker"
# Prefixing with /foo
labels:
- "traefik.http.middlewares.add-bar.addprefix.prefix=/foo"
- "traefik.http.middlewares.add-foo.addprefix.prefix=/foo"
```

```yaml tab="Kubernetes"
# Prefixing with /foo
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: addprefix
name: add-foo
spec:
addprefix:
prefix: /bar
addPrefix:
prefix: /foo
```

```toml tab="File"
Expand All @@ -34,6 +35,6 @@ spec:

## Configuration Options

### prefix
### `prefix`

`prefix` is the string to add before the current path in the requested URL. It should include the leading slash (`/`).
57 changes: 43 additions & 14 deletions docs/content/middlewares/basicauth.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,15 +12,30 @@ The BasicAuth middleware is a quick way to restrict access to your services to k
```yaml tab="Docker"
# Declaring the user list
labels:
- "traefik.http.middlewares.declared-users-only.basicauth.users=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"
- "traefik.http.middlewares.test-auth.basicauth.users=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"
```

```yaml tab="Kubernetes"
# Declaring the user list
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: test-auth
spec:
basicAuth:
users:
- test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
- test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0
```

```toml tab="File"
# Declaring the user list
[http.middlewares]
[http.middlewares.test-auth.basicauth]
users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
"test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"]
users = [
"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
"test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
]
```

## Configuration Options
Expand All @@ -33,15 +48,15 @@ Passwords must be encoded using MD5, SHA1, or BCrypt.

Use `htpasswd` to generate the passwords.

### users
### `users`

The `users` option is an array of authorized users. Each user will be declared using the `name:encoded-password` format.

!!! Note

If both `users` and `usersFile` are provided, the two are merged. The content of `usersFile` has precedence over `users`.

### usersFile
### `usersFile`

The `usersFile` option is the path to an external file that contains the authorized users for the middleware.

Expand All @@ -58,22 +73,36 @@ The file content is a list of `name:encoded-password`.

If both `users` and `usersFile` are provided, the two are merged. The content of `usersFile` has precedence over `users`.

### realm
### `realm`

You can customize the realm for the authentication with the `realm` option. The default value is `traefik`.

### headerField
### `headerField`

You can customize the header field for the authenticated user using the `headerField`option.

??? example "File -- Passing Authenticated Users to Services Via Headers"
```yaml tab="Docker"
labels:
- "traefik.http.middlewares.my-auth.basicauth.headerField=X-WebAuth-User"
```

```toml
[http.middlewares.my-auth.basicauth]
usersFile = "path-to-file.ext"
headerField = "X-WebAuth-User" # header for the authenticated user
```
```yaml tab="Kubernetes"
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: my-auth
spec:
basicAuth:
# ...
headerField: X-WebAuth-User
```

```toml tab="File"
[http.middlewares.my-auth.basicauth]
# ...
headerField = "X-WebAuth-User"
```

### removeHeader
### `removeHeader`

Set the `removeHeader` option to `true` to remove the authorization header before forwarding the request to your service. (Default value is `false`.)
25 changes: 18 additions & 7 deletions docs/content/middlewares/buffering.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,39 +16,50 @@ This can help services deal with large data (multipart/form-data for example), a
```yaml tab="Docker"
# Sets the maximum request body to 2Mb
labels:
- "traefik.http.middlewares.2Mb-memory.buffering.maxRequestBodyBytes=250000"
- "traefik.http.middlewares.limit.buffering.maxRequestBodyBytes=250000"
```

```yaml tab="Kubernetes"
# Sets the maximum request body to 2Mb
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: limit
spec:
buffering:
maxRequestBodyBytes: 250000
```

```toml tab="File"
# Sets the maximum request body to 2Mb
[http.middlewares]
[http.middlewares.2Mb-limit.buffering]
[http.middlewares.limit.buffering]
maxRequestBodyBytes = 250000
```

## Configuration Options

### maxRequestBodyBytes
### `maxRequestBodyBytes`

With the `maxRequestBodyBytes` option, you can configure the maximum allowed body size for the request (in Bytes).

If the request exceeds the allowed size, the request is not forwarded to the service and the client gets a `413 (Request Entity Too Large) response.

### memRequestBodyBytes
### `memRequestBodyBytes`

You can configure a thresold (in Bytes) from which the request will be buffered on disk instead of in memory with the `memRequestBodyBytes` option.

### maxResponseBodyBytes
### `maxResponseBodyBytes`

With the `maxReesponseBodyBytes` option, you can configure the maximum allowed response size from the service (in Bytes).

If the response exceeds the allowed size, it is not forwarded to the client. The client gets a `413 (Request Entity Too Large) response` instead.

### memResponseBodyBytes
### `memResponseBodyBytes`

You can configure a thresold (in Bytes) from which the response will be buffered on disk instead of in memory with the `memResponseBodyBytes` option.

### retryExpression
### `retryExpression`

You can have the Buffering middleware replay the request with the help of the `retryExpression` option.

Expand Down
131 changes: 102 additions & 29 deletions docs/content/middlewares/chain.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Chain

When One Isn't Enougth
When One Isn't Enough
{: .subtitle }

![Chain](../assets/img/middleware/chain.png)
Expand All @@ -10,31 +10,104 @@ It makes reusing the same groups easier.

## Configuration Example

??? example "A Chain for WhiteList, BasicAuth, and HTTPS"

```toml
# ...
[http.routers]
[http.routers.router1]
service = "service1"
middlewares = ["secured"]
rule = "Host: mydomain"

[http.middlewares]
[http.middlewares.secured.Chain]
middlewares = ["https-only", "known-ips", "auth-users"]

[http.middlewares.auth-users.BasicAuth]
users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"]
[http.middlewares.https-only.SchemeRedirect]
scheme = "https"
[http.middlewares.known-ips.ipWhiteList]
sourceRange = ["192.168.1.7", "x.x.x.x", "x.x.x.x"]

[http.services]
[http.services.service1]
[http.services.service1.LoadBalancer]
[[http.services.service1.LoadBalancer.Servers]]
URL = "http://127.0.0.1:80"
Weight = 1
```
Example "A Chain for WhiteList, BasicAuth, and HTTPS"

```yaml tab="Docker"
labels:
- "traefik.http.routers.router1.service=service1"
- "traefik.http.routers.router1.middlewares=secured"
- "traefik.http.routers.router1.rule=Host(`mydomain`)"
- "traefik.http.middlewares.secured.chain.middlewares=https-only,known-ips,auth-users"
- "traefik.http.middlewares.auth-users.basicauth.users=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
- "traefik.http.middlewares.https-only.schemeredirect.scheme=https"
- "traefik.http.middlewares.known-ips.ipwhitelist.sourceRange=192.168.1.7,127.0.0.1/32"
- "http.services.service1.loadbalancer.server.port=80"
```

```yaml tab="Kubernetes"
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: test
namespace: default

spec:
entryPoints:
- web

routes:
- match: Host(`mydomain`)
kind: Rule
services:
- name: whoami
port: 80
middlewares:
- name: secured
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: secured
spec:
chain:
middlewares:
- https-only
- known-ips
- auth-users
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: auth-users
spec:
basicAuth:
users:
- test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: https-only
spec:
schemeRedirect:
scheme: https
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: known-ips
spec:
ipWhiteList:
sourceRange:
- 192.168.1.7
- 127.0.0.1/32
```

```toml tab="File"
# ...
[http.routers]
[http.routers.router1]
service = "service1"
middlewares = ["secured"]
rule = "Host(`mydomain`)"

[http.middlewares]
[http.middlewares.secured.Chain]
middlewares = ["https-only", "known-ips", "auth-users"]

[http.middlewares.auth-users.BasicAuth]
users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"]

[http.middlewares.https-only.SchemeRedirect]
scheme = "https"

[http.middlewares.known-ips.ipWhiteList]
sourceRange = ["192.168.1.7", "127.0.0.1/32"]

[http.services]
[http.services.service1]
[http.services.service1.LoadBalancer]
[[http.services.service1.LoadBalancer.Servers]]
URL = "http://127.0.0.1:80"
Weight = 1
```