feat(common): add traefik middlewares (#30529)
**Description** <!-- Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change. --> ⚒️ Fixes # <!--(issue)--> **⚙️ Type of change** - [x] ⚙️ Feature/App addition - [ ] 🪛 Bugfix - [ ] ⚠️ Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] 🔃 Refactor of current code **🧪 How Has This Been Tested?** <!-- Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration --> **📃 Notes:** <!-- Please enter any other relevant information here --> **✔️ Checklist:** - [x] ⚖️ My code follows the style guidelines of this project - [x] 👀 I have performed a self-review of my own code - [x] #️⃣ I have commented my code, particularly in hard-to-understand areas - [x] 📄 I have made corresponding changes to the documentation - [x] ⚠️ My changes generate no new warnings - [x] 🧪 I have added tests to this description that prove my fix is effective or that my feature works - [x] ⬆️ I increased versions for any altered app according to semantic versioning - [x] I made sure the title starts with `feat(chart-name):`, `fix(chart-name):` or `chore(chart-name):` **➕ App addition** If this PR is an app addition please make sure you have done the following. - [ ] 🖼️ I have added an icon in the Chart's root directory called `icon.png` --- _Please don't blindly check all the boxes. Read them and only check those that apply. Those checkboxes are there for the reviewer to see what is this all about and the status of this PR with a quick glance._
This commit is contained in:
Stavros Kois
@@ -7,7 +7,7 @@ apiVersion: v2
|
||||
appVersion: unknown
|
||||
dependencies:
|
||||
- name: common
|
||||
version: ~25.3.0
|
||||
version: ~25.4.0
|
||||
repository: file://../common/
|
||||
condition: ""
|
||||
alias: ""
|
||||
|
||||
@@ -0,0 +1,132 @@
|
||||
suite: middlewares metadata test
|
||||
templates:
|
||||
- common.yaml
|
||||
chart:
|
||||
appVersion: &appVer v9.9.9
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with middlewares created with labels and annotations
|
||||
set:
|
||||
label1: label1
|
||||
label2: global_label2
|
||||
annotation1: annotation1
|
||||
annotation2: global_annotation2
|
||||
global:
|
||||
labels:
|
||||
g_label1: global_label1
|
||||
g_label2: "{{ .Values.label2 }}"
|
||||
annotations:
|
||||
g_annotation1: global_annotation1
|
||||
g_annotation2: "{{ .Values.annotation2 }}"
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: buffering
|
||||
labels:
|
||||
label1: "{{ .Values.label1 }}"
|
||||
label2: label2
|
||||
annotations:
|
||||
annotation1: "{{ .Values.annotation1 }}"
|
||||
annotation2: annotation2
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: metadata.annotations
|
||||
value:
|
||||
annotation1: annotation1
|
||||
annotation2: annotation2
|
||||
g_annotation1: global_annotation1
|
||||
g_annotation2: global_annotation2
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: metadata.labels
|
||||
value:
|
||||
app: common-test-1.0.0
|
||||
release: test-release-name
|
||||
helm-revision: "0"
|
||||
helm.sh/chart: common-test-1.0.0
|
||||
app.kubernetes.io/name: common-test
|
||||
app.kubernetes.io/instance: test-release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/version: *appVer
|
||||
g_label1: global_label1
|
||||
g_label2: global_label2
|
||||
label1: label1
|
||||
label2: label2
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: metadata.namespace
|
||||
value: test-release-namespace
|
||||
|
||||
- it: should pass with middlewares created with namespace
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: buffering
|
||||
namespace: some-namespace
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: metadata.namespace
|
||||
value: some-namespace
|
||||
|
||||
- it: should pass with middlewares created with object namespace from tpl
|
||||
set:
|
||||
key: some-namespace
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: buffering
|
||||
namespace: "{{ .Values.key }}"
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: metadata.namespace
|
||||
value: some-namespace
|
||||
|
||||
- it: should pass with middlewares created with namespace from global with tpl
|
||||
set:
|
||||
key: global-namespace
|
||||
global:
|
||||
namespace: "{{ .Values.key }}"
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: buffering
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: metadata.namespace
|
||||
value: global-namespace
|
||||
|
||||
- it: should pass with middlewares created with namespace from root with tpl
|
||||
set:
|
||||
key: local-namespace
|
||||
namespace: "{{ .Values.key }}"
|
||||
global:
|
||||
namespace: global-namespace
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: buffering
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: metadata.namespace
|
||||
value: local-namespace
|
||||
@@ -0,0 +1,37 @@
|
||||
suite: add-prefix middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: add-prefix
|
||||
data:
|
||||
prefix: some-prefix
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
addPrefix:
|
||||
prefix: some-prefix
|
||||
|
||||
- it: should fail with missing prefix
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: add-prefix
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (add-prefix) - Expected [prefix] to be set
|
||||
@@ -0,0 +1,81 @@
|
||||
suite: basicAuth middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: basic-auth
|
||||
data:
|
||||
secret: some-secret
|
||||
my-middleware2:
|
||||
enabled: true
|
||||
type: basic-auth
|
||||
data:
|
||||
users:
|
||||
- username: some-username
|
||||
password: some-password
|
||||
- username: some-other-username
|
||||
password: some-other-password
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
basicAuth:
|
||||
secret: some-secret
|
||||
- documentIndex: &otherMiddlewareDoc 1
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *otherMiddlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
basicAuth:
|
||||
secret: test-release-name-common-test-my-middleware2
|
||||
- documentIndex: &secretDoc 2
|
||||
isKind:
|
||||
of: Secret
|
||||
- documentIndex: *secretDoc
|
||||
equal:
|
||||
path: metadata.name
|
||||
value: test-release-name-common-test-my-middleware2
|
||||
- documentIndex: *secretDoc
|
||||
matchRegex:
|
||||
path: stringData.users
|
||||
pattern: some-username:.+\nsome-other-username:.+
|
||||
|
||||
- it: should fail with missing both users and secret
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: basic-auth
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (basic-auth) - Expected at least one of [users] or [secret] to be set
|
||||
|
||||
- it: should fail with both secret and users set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: basic-auth
|
||||
data:
|
||||
secret: some-secret
|
||||
users:
|
||||
- username: some-username
|
||||
password: some-password
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (basic-auth) - Expected either [users] or [secret] to be set, but not both
|
||||
@@ -0,0 +1,71 @@
|
||||
suite: buffering middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: buffering
|
||||
data:
|
||||
maxRequestBodyBytes: 1024
|
||||
memRequestBodyBytes: 1024
|
||||
maxResponseBodyBytes: 1024
|
||||
memResponseBodyBytes: 1024
|
||||
retryExpression: some-expression
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
buffering:
|
||||
maxRequestBodyBytes: 1024
|
||||
memRequestBodyBytes: 1024
|
||||
maxResponseBodyBytes: 1024
|
||||
memResponseBodyBytes: 1024
|
||||
retryExpression: "some-expression"
|
||||
|
||||
- it: should pass with only maxRequestBodyBytes set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: buffering
|
||||
data:
|
||||
maxRequestBodyBytes: 1024
|
||||
asserts:
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
buffering:
|
||||
maxRequestBodyBytes: 1024
|
||||
|
||||
- it: should render 0 and non-null values
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: buffering
|
||||
data:
|
||||
maxRequestBodyBytes: 0
|
||||
memRequestBodyBytes: null
|
||||
maxResponseBodyBytes: 1024
|
||||
memResponseBodyBytes: 1024
|
||||
retryExpression: ""
|
||||
asserts:
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
buffering:
|
||||
maxRequestBodyBytes: 0
|
||||
maxResponseBodyBytes: 1024
|
||||
memResponseBodyBytes: 1024
|
||||
@@ -0,0 +1,42 @@
|
||||
suite: chain middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: chain
|
||||
data:
|
||||
middlewares:
|
||||
- name: some-name
|
||||
expandObjectName: false
|
||||
- name: some-other-name
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
chain:
|
||||
middlewares:
|
||||
- name: some-name
|
||||
- name: test-release-name-common-test-some-other-name
|
||||
|
||||
- it: should fail with missing middlewares
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: chain
|
||||
data:
|
||||
middlewares: []
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (chain) - Expected [middlewares] to be set
|
||||
@@ -0,0 +1,22 @@
|
||||
suite: compress middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: compress
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
compress: {}
|
||||
@@ -0,0 +1,22 @@
|
||||
suite: contentType middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: content-type
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
contentType: {}
|
||||
@@ -0,0 +1,106 @@
|
||||
suite: forward-auth middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with values
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: forward-auth
|
||||
data:
|
||||
address: some-address
|
||||
authResponseHeadersRegex: some-regex
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- some-header
|
||||
authRequestHeaders:
|
||||
- some-header
|
||||
tls:
|
||||
insecureSkipVerify: true
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
forwardAuth:
|
||||
address: some-address
|
||||
authResponseHeadersRegex: some-regex
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- some-header
|
||||
authRequestHeaders:
|
||||
- some-header
|
||||
tls:
|
||||
insecureSkipVerify: true
|
||||
|
||||
- it: should fail with missing address
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: forward-auth
|
||||
data:
|
||||
authResponseHeadersRegex: some-regex
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (forward-auth) - Expected [address] to be set
|
||||
|
||||
- it: should fail with invalid authResponseHeaders
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: forward-auth
|
||||
data:
|
||||
address: some-address
|
||||
authResponseHeaders: some-header
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (forward-auth) - Expected [authResponseHeaders] to be a list, but got [string]
|
||||
|
||||
- it: should fail with invalid authRequestHeaders
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: forward-auth
|
||||
data:
|
||||
address: some-address
|
||||
authRequestHeaders: some-header
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (forward-auth) - Expected [authRequestHeaders] to be a list, but got [string]
|
||||
|
||||
- it: should fail with invalid tls.insecureSkipVerify
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: forward-auth
|
||||
data:
|
||||
address: some-address
|
||||
tls:
|
||||
insecureSkipVerify: some-value
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (forward-auth) - Expected [tls.insecureSkipVerify] to be a boolean, but got [string]
|
||||
|
||||
- it: should fail with invalid trustForwardHeader
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: forward-auth
|
||||
data:
|
||||
address: some-address
|
||||
trustForwardHeader: some-value
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (forward-auth) - Expected [trustForwardHeader] to be a boolean, but got [string]
|
||||
@@ -0,0 +1,119 @@
|
||||
suite: headers middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: headers
|
||||
data:
|
||||
customRequestHeaders:
|
||||
some-name: some-value
|
||||
some-other-name: some-other-value
|
||||
customResponseHeaders:
|
||||
some-name: some-value
|
||||
some-other-name: some-other-value
|
||||
accessControlAllowCredentials: true
|
||||
accessControlAllowHeaders:
|
||||
- some-header
|
||||
- some-other-header
|
||||
accessControlAllowMethods:
|
||||
- GET
|
||||
- DELETE
|
||||
accessControlAllowOriginList:
|
||||
- some-origin
|
||||
- some-other-origin
|
||||
accessControlAllowOriginListRegex:
|
||||
- some-origin-regex
|
||||
- some-other-origin-regex
|
||||
accessControlExposeHeaders:
|
||||
- some-header
|
||||
- some-other-header
|
||||
accessControlMaxAge: 1000
|
||||
addVaryHeader: true
|
||||
allowedHosts:
|
||||
- some-host
|
||||
- some-other-host
|
||||
hostsProxyHeaders:
|
||||
- some-header
|
||||
- some-other-header
|
||||
sslProxyHeaders:
|
||||
some-header: some-value
|
||||
some-other-header: some-other-value
|
||||
stsSeconds: 1000
|
||||
stsIncludeSubdomains: true
|
||||
stsPreload: true
|
||||
forceSTSHeader: true
|
||||
frameDeny: true
|
||||
customFrameOptionsValue: some-value
|
||||
contentTypeNosniff: true
|
||||
browserXssFilter: true
|
||||
customBrowserXSSValue: some-value
|
||||
contentSecurityPolicy: some-value
|
||||
contentSecurityPolicyReportOnly: true
|
||||
publicKey: some-public-key
|
||||
referrerPolicy: some-referrer-policy
|
||||
permissionsPolicy: some-permissions-policy
|
||||
isDevelopment: true
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
headers:
|
||||
customRequestHeaders:
|
||||
some-name: some-value
|
||||
some-other-name: some-other-value
|
||||
customResponseHeaders:
|
||||
some-name: some-value
|
||||
some-other-name: some-other-value
|
||||
accessControlAllowCredentials: true
|
||||
accessControlAllowHeaders:
|
||||
- some-header
|
||||
- some-other-header
|
||||
accessControlAllowMethods:
|
||||
- GET
|
||||
- DELETE
|
||||
accessControlAllowOriginList:
|
||||
- some-origin
|
||||
- some-other-origin
|
||||
accessControlAllowOriginListRegex:
|
||||
- some-origin-regex
|
||||
- some-other-origin-regex
|
||||
accessControlExposeHeaders:
|
||||
- some-header
|
||||
- some-other-header
|
||||
accessControlMaxAge: 1000
|
||||
addVaryHeader: true
|
||||
allowedHosts:
|
||||
- some-host
|
||||
- some-other-host
|
||||
hostsProxyHeaders:
|
||||
- some-header
|
||||
- some-other-header
|
||||
sslProxyHeaders:
|
||||
some-header: some-value
|
||||
some-other-header: some-other-value
|
||||
stsSeconds: 1000
|
||||
stsIncludeSubdomains: true
|
||||
stsPreload: true
|
||||
forceSTSHeader: true
|
||||
frameDeny: true
|
||||
customFrameOptionsValue: some-value
|
||||
contentTypeNosniff: true
|
||||
browserXssFilter: true
|
||||
customBrowserXSSValue: some-value
|
||||
contentSecurityPolicy: some-value
|
||||
contentSecurityPolicyReportOnly: true
|
||||
publicKey: some-public-key
|
||||
referrerPolicy: some-referrer-policy
|
||||
permissionsPolicy: some-permissions-policy
|
||||
isDevelopment: true
|
||||
@@ -0,0 +1,62 @@
|
||||
suite: ip-allow-list middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: ip-allow-list
|
||||
data:
|
||||
sourceRange:
|
||||
- some-source-range
|
||||
ipStrategy:
|
||||
depth: 1
|
||||
excludedIPs:
|
||||
- some-excluded-ip
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
ipAllowList:
|
||||
sourceRange:
|
||||
- some-source-range
|
||||
ipStrategy:
|
||||
depth: 1
|
||||
excludedIPs:
|
||||
- some-excluded-ip
|
||||
|
||||
- it: should fail with invalid sourceRange
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: ip-allow-list
|
||||
data:
|
||||
sourceRange: some-source-range
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (ip-allow-list) - Expected [sourceRange] to be a list, but got [string]
|
||||
|
||||
- it: should fail with invalid ipStrategy.excludedIPs
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: ip-allow-list
|
||||
data:
|
||||
sourceRange:
|
||||
- some-source-range
|
||||
ipStrategy:
|
||||
excludedIPs: some-excluded-ip
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (ip-allow-list) - Expected [ipStrategy.excludedIPs] to be a list, but got [string]
|
||||
@@ -0,0 +1,177 @@
|
||||
suite: plugin-bouncer middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-bouncer
|
||||
data:
|
||||
enabled: true
|
||||
logLevel: DEBUG
|
||||
updateIntervalSeconds: 60
|
||||
updateMaxFailure: 0
|
||||
defaultDecisionSeconds: 60
|
||||
httpTimeoutSeconds: 10
|
||||
crowdsecMode: live
|
||||
crowdsecAppsecEnabled: false
|
||||
crowdsecAppsecHost: crowdsec:7422
|
||||
crowdsecAppsecFailureBlock: true
|
||||
crowdsecAppsecUnreachableBlock: true
|
||||
crowdsecLapiKey: privateKey-foo
|
||||
crowdsecLapiHost: crowdsec:8080
|
||||
crowdsecLapiScheme: http
|
||||
crowdsecLapiTLSInsecureVerify: false
|
||||
crowdsecCapiMachineId: login
|
||||
crowdsecCapiPassword: password
|
||||
crowdsecCapiScenarios:
|
||||
- crowdsecurity/http-path-traversal-probing
|
||||
- crowdsecurity/http-xss-probing
|
||||
- crowdsecurity/http-generic-bf
|
||||
forwardedHeadersTrustedIPs:
|
||||
- 10.0.10.23/32
|
||||
- 10.0.20.0/24
|
||||
clientTrustedIPs:
|
||||
- 192.168.1.0/24
|
||||
forwardedHeadersCustomName: X-Custom-Header
|
||||
remediationHeadersCustomName: cs-remediation
|
||||
redisCacheEnabled: false
|
||||
redisCacheHost: "redis:6379"
|
||||
redisCachePassword: password
|
||||
redisCacheDatabase: "5"
|
||||
crowdsecLapiTLSCertificateAuthority: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
|
||||
...
|
||||
Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
|
||||
-----END CERTIFICATE-----
|
||||
crowdsecLapiTLSCertificateBouncer: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEHjCCAwagAwIBAgIUOBTs1eqkaAUcPplztUr2xRapvNAwDQYJKoZIhvcNAQEL
|
||||
...
|
||||
RaXAnYYUVRblS1jmePemh388hFxbmrpG2pITx8B5FMULqHoj11o2Rl0gSV6tHIHz
|
||||
N2U=
|
||||
-----END CERTIFICATE-----
|
||||
crowdsecLapiTLSCertificateBouncerKey: |-
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEogIBAAKCAQEAtYQnbJqifH+ZymePylDxGGLIuxzcAUU4/ajNj+qRAdI/Ux3d
|
||||
...
|
||||
ic5cDRo6/VD3CS3MYzyBcibaGaV34nr0G/pI+KEqkYChzk/PZRA=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
captchaProvider: hcaptcha
|
||||
captchaSiteKey: FIXME
|
||||
captchaSecretKey: FIXME
|
||||
captchaGracePeriodSeconds: 1800
|
||||
captchaHTMLFilePath: /captcha.html
|
||||
banHTMLFilePath: /ban.html
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
plugin:
|
||||
bouncer:
|
||||
enabled: true
|
||||
logLevel: DEBUG
|
||||
updateIntervalSeconds: 60
|
||||
updateMaxFailure: 0
|
||||
defaultDecisionSeconds: 60
|
||||
httpTimeoutSeconds: 10
|
||||
crowdsecMode: live
|
||||
crowdsecAppsecEnabled: false
|
||||
crowdsecAppsecHost: crowdsec:7422
|
||||
crowdsecAppsecFailureBlock: true
|
||||
crowdsecAppsecUnreachableBlock: true
|
||||
crowdsecLapiKey: privateKey-foo
|
||||
crowdsecLapiHost: crowdsec:8080
|
||||
crowdsecLapiScheme: http
|
||||
crowdsecLapiTLSInsecureVerify: false
|
||||
crowdsecCapiMachineId: login
|
||||
crowdsecCapiPassword: password
|
||||
crowdsecCapiScenarios:
|
||||
- crowdsecurity/http-path-traversal-probing
|
||||
- crowdsecurity/http-xss-probing
|
||||
- crowdsecurity/http-generic-bf
|
||||
forwardedHeadersTrustedIPs:
|
||||
- 10.0.10.23/32
|
||||
- 10.0.20.0/24
|
||||
clientTrustedIPs:
|
||||
- 192.168.1.0/24
|
||||
forwardedHeadersCustomName: X-Custom-Header
|
||||
remediationHeadersCustomName: cs-remediation
|
||||
redisCacheEnabled: false
|
||||
redisCacheHost: "redis:6379"
|
||||
redisCachePassword: password
|
||||
redisCacheDatabase: "5"
|
||||
crowdsecLapiTLSCertificateAuthority: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
|
||||
...
|
||||
Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
|
||||
-----END CERTIFICATE-----
|
||||
crowdsecLapiTLSCertificateBouncer: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEHjCCAwagAwIBAgIUOBTs1eqkaAUcPplztUr2xRapvNAwDQYJKoZIhvcNAQEL
|
||||
...
|
||||
RaXAnYYUVRblS1jmePemh388hFxbmrpG2pITx8B5FMULqHoj11o2Rl0gSV6tHIHz
|
||||
N2U=
|
||||
-----END CERTIFICATE-----
|
||||
crowdsecLapiTLSCertificateBouncerKey: |-
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEogIBAAKCAQEAtYQnbJqifH+ZymePylDxGGLIuxzcAUU4/ajNj+qRAdI/Ux3d
|
||||
...
|
||||
ic5cDRo6/VD3CS3MYzyBcibaGaV34nr0G/pI+KEqkYChzk/PZRA=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
captchaProvider: hcaptcha
|
||||
captchaSiteKey: FIXME
|
||||
captchaSecretKey: FIXME
|
||||
captchaGracePeriodSeconds: 1800
|
||||
captchaHTMLFilePath: /captcha.html
|
||||
banHTMLFilePath: /ban.html
|
||||
|
||||
- it: should pass with pluginName set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-bouncer
|
||||
data:
|
||||
pluginName: traefik-bouncer-test
|
||||
enabled: true
|
||||
asserts:
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
plugin:
|
||||
traefik-bouncer-test:
|
||||
enabled: true
|
||||
|
||||
- it: should fail with missing enabled
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-bouncer
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (plugin-bouncer) - Expected [enabled] to be set
|
||||
|
||||
- it: should fail with invalid enabled
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-bouncer
|
||||
data:
|
||||
enabled: some-value
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (plugin-bouncer) - Expected [enabled] to be a boolean, but got [string]
|
||||
@@ -0,0 +1,101 @@
|
||||
suite: plugin-geoblock middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-geoblock
|
||||
data:
|
||||
api: https://api.geoblock.org/v2/geoblock
|
||||
allowLocalRequests: true
|
||||
logLocalRequests: true
|
||||
logAllowedRequests: true
|
||||
logApiRequests: true
|
||||
apiTimeoutMs: 1000
|
||||
cacheSize: 1000
|
||||
forceMonthlyUpdate: true
|
||||
allowUnknownCountries: true
|
||||
unknownCountryApiResponse: some-value
|
||||
blackListMode: true
|
||||
silentStartUp: true
|
||||
addCountryHeader: true
|
||||
countries:
|
||||
- some-country
|
||||
- some-other-country
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
plugin:
|
||||
GeoBlock:
|
||||
allowLocalRequests: true
|
||||
logLocalRequests: true
|
||||
logAllowedRequests: true
|
||||
logApiRequests: true
|
||||
api: https://api.geoblock.org/v2/geoblock
|
||||
apiTimeoutMs: 1000
|
||||
cacheSize: 1000
|
||||
forceMonthlyUpdate: true
|
||||
allowUnknownCountries: true
|
||||
unknownCountryApiResponse: some-value
|
||||
blackListMode: true
|
||||
silentStartUp: true
|
||||
addCountryHeader: true
|
||||
countries:
|
||||
- some-country
|
||||
- some-other-country
|
||||
|
||||
- it: should pass with pluginName set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-geoblock
|
||||
data:
|
||||
pluginName: traefik-geoblock-test
|
||||
api: https://api.geoblock.org/v2/geoblock
|
||||
countries:
|
||||
- some-country
|
||||
- some-other-country
|
||||
asserts:
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
plugin:
|
||||
traefik-geoblock-test:
|
||||
api: https://api.geoblock.org/v2/geoblock
|
||||
countries:
|
||||
- some-country
|
||||
- some-other-country
|
||||
|
||||
- it: should fail with missing api
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-geoblock
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (plugin-geoblock) - Expected [api] to be set
|
||||
|
||||
- it: should fail with missing countries
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-geoblock
|
||||
data:
|
||||
api: https://api.geoblock.org/v2/geoblock
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (plugin-geoblock) - Expected [countries] to be set
|
||||
@@ -0,0 +1,57 @@
|
||||
suite: plugin-mod-security middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-mod-security
|
||||
data:
|
||||
modSecurityUrl: some-url
|
||||
timeoutMillis: 1000
|
||||
maxBodySize: 1024
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
plugin:
|
||||
traefik-modsecurity-plugin:
|
||||
modSecurityUrl: some-url
|
||||
timeoutMillis: 1000
|
||||
maxBodySize: 1024
|
||||
|
||||
- it: should pass with pluginName set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-mod-security
|
||||
data:
|
||||
pluginName: traefik-mod-security-test
|
||||
modSecurityUrl: some-url
|
||||
asserts:
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
plugin:
|
||||
traefik-mod-security-test:
|
||||
modSecurityUrl: some-url
|
||||
|
||||
- it: should fail with missing modSecurityUrl
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-mod-security
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (modsecurity) - Expected [modSecurityUrl] to be set
|
||||
@@ -0,0 +1,61 @@
|
||||
suite: plugin-real-ip middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-real-ip
|
||||
data:
|
||||
excludednets:
|
||||
- some-excluded-net
|
||||
- some-other-excluded-net
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
plugin:
|
||||
traefik-real-ip:
|
||||
excludednets:
|
||||
- some-excluded-net
|
||||
- some-other-excluded-net
|
||||
|
||||
- it: should pass with pluginName set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-real-ip
|
||||
data:
|
||||
pluginName: traefik-real-ip-test
|
||||
excludednets:
|
||||
- some-excluded-net
|
||||
- some-other-excluded-net
|
||||
asserts:
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
plugin:
|
||||
traefik-real-ip-test:
|
||||
excludednets:
|
||||
- some-excluded-net
|
||||
- some-other-excluded-net
|
||||
|
||||
- it: should fail with missing excludednets
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-real-ip
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (real-ip) - Expected [excludednets] to be set
|
||||
+125
@@ -0,0 +1,125 @@
|
||||
suite: plugin-rewrite-response-headers middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-rewrite-response-headers
|
||||
data:
|
||||
rewrites:
|
||||
- header: some-header
|
||||
regex: some-regex
|
||||
replacement: some-replacement
|
||||
- header: some-other-header
|
||||
regex: some-other-regex
|
||||
replacement: some-other-replacement
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
plugin:
|
||||
rewriteResponseHeaders:
|
||||
rewrites:
|
||||
- header: some-header
|
||||
regex: some-regex
|
||||
replacement: some-replacement
|
||||
- header: some-other-header
|
||||
regex: some-other-regex
|
||||
replacement: some-other-replacement
|
||||
|
||||
- it: should pass with pluginName set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-rewrite-response-headers
|
||||
data:
|
||||
pluginName: traefik-rewrite-response-headers-test
|
||||
rewrites:
|
||||
- header: some-header
|
||||
regex: some-regex
|
||||
replacement: some-replacement
|
||||
asserts:
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
plugin:
|
||||
traefik-rewrite-response-headers-test:
|
||||
rewrites:
|
||||
- header: some-header
|
||||
regex: some-regex
|
||||
replacement: some-replacement
|
||||
|
||||
- it: should fail with missing header
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-rewrite-response-headers
|
||||
data:
|
||||
rewrites:
|
||||
- regex: some-regex
|
||||
replacement: some-replacement
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (rewrite-response-headers) - Expected [header] to be set for rewrite [0]
|
||||
|
||||
- it: should fail with missing regex
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-rewrite-response-headers
|
||||
data:
|
||||
rewrites:
|
||||
- header: some-header
|
||||
replacement: some-replacement
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (rewrite-response-headers) - Expected [regex] to be set for rewrite [0]
|
||||
|
||||
- it: should fail with missing replacement
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-rewrite-response-headers
|
||||
data:
|
||||
rewrites:
|
||||
- header: some-header
|
||||
regex: some-regex
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (rewrite-response-headers) - Expected [replacement] to be set for rewrite [0]
|
||||
|
||||
- it: should fail with missing rewrites
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-rewrite-response-headers
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (rewrite-response-headers) - Expected [rewrites] to be set
|
||||
|
||||
- it: should fail with invalid rewrites
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-rewrite-response-headers
|
||||
data:
|
||||
rewrites: some-value
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (rewrite-response-headers) - Expected [rewrites] to be a list, but got [string]
|
||||
@@ -0,0 +1,77 @@
|
||||
suite: plugin-theme-park middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-theme-park
|
||||
data:
|
||||
app: sonarr
|
||||
theme: dark
|
||||
baseUrl: https://example.com
|
||||
addons:
|
||||
- some-addon
|
||||
- some-other-addon
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
plugin:
|
||||
traefik-themepark:
|
||||
app: sonarr
|
||||
theme: dark
|
||||
baseUrl: https://example.com
|
||||
addons:
|
||||
- some-addon
|
||||
- some-other-addon
|
||||
|
||||
- it: should pass with pluginName set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-theme-park
|
||||
data:
|
||||
app: sonarr
|
||||
theme: dark
|
||||
pluginName: traefik-themepark-test
|
||||
asserts:
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
plugin:
|
||||
traefik-themepark-test:
|
||||
app: sonarr
|
||||
theme: dark
|
||||
|
||||
- it: should fail with missing app
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-theme-park
|
||||
data:
|
||||
theme: dark
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (themepark) - Expected [app] to be set
|
||||
|
||||
- it: should fail with missing theme
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: plugin-theme-park
|
||||
data:
|
||||
app: sonarr
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (themepark) - Expected [theme] to be set
|
||||
@@ -0,0 +1,35 @@
|
||||
suite: compress middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: rate-limit
|
||||
data:
|
||||
average: 1000
|
||||
burst: 2000
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
rateLimit:
|
||||
average: 1000
|
||||
burst: 2000
|
||||
- it: should fail with missing average and burst
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: rate-limit
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (rate-limit) - Expected either [average] or [burst] to be set
|
||||
@@ -0,0 +1,69 @@
|
||||
suite: redirectRegex middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: redirect-regex
|
||||
data:
|
||||
regex: some-regex
|
||||
replacement: some-replacement
|
||||
permanent: true
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
redirectRegex:
|
||||
regex: some-regex
|
||||
replacement: some-replacement
|
||||
permanent: true
|
||||
|
||||
- it: should fail with missing regex
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: redirect-regex
|
||||
data:
|
||||
replacement: some-replacement
|
||||
permanent: true
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (redirect-regex) - Expected [regex] to be set
|
||||
|
||||
- it: should fail with missing replacement
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: redirect-regex
|
||||
data:
|
||||
regex: some-regex
|
||||
permanent: true
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (redirect-regex) - Expected [replacement] to be set
|
||||
|
||||
- it: should fail with invalid permanent
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: redirect-regex
|
||||
data:
|
||||
regex: some-regex
|
||||
replacement: some-replacement
|
||||
permanent: some-value
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (redirect-regex) - Expected [permanent] to be a boolean, but got [string]
|
||||
@@ -0,0 +1,52 @@
|
||||
suite: redirectScheme middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: redirect-scheme
|
||||
data:
|
||||
scheme: https
|
||||
permanent: true
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
redirectScheme:
|
||||
scheme: https
|
||||
permanent: true
|
||||
|
||||
- it: should fail with missing scheme
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: redirect-scheme
|
||||
data:
|
||||
permanent: true
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (redirect-scheme) - Expected [scheme] to be set
|
||||
|
||||
- it: should fail with invalid permanent
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: redirect-scheme
|
||||
data:
|
||||
scheme: https
|
||||
permanent: some-value
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (redirect-scheme) - Expected [permanent] to be a boolean, but got [string]
|
||||
@@ -0,0 +1,51 @@
|
||||
suite: replacePathRegex middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: replace-path-regex
|
||||
data:
|
||||
regex: /some-path
|
||||
replacement: /some-replacement
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
replacePathRegex:
|
||||
regex: /some-path
|
||||
replacement: /some-replacement
|
||||
|
||||
- it: should fail with missing regex
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: replace-path-regex
|
||||
data:
|
||||
replacement: /some-replacement
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (replace-path-regex) - Expected [regex] to be set
|
||||
|
||||
- it: should fail with missing replacement
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: replace-path-regex
|
||||
data:
|
||||
regex: /some-path
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (replace-path-regex) - Expected [replacement] to be set
|
||||
@@ -0,0 +1,37 @@
|
||||
suite: replacePath middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: replace-path
|
||||
data:
|
||||
path: /some-path
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
replacePath:
|
||||
path: /some-path
|
||||
|
||||
- it: should fail with missing path
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: replace-path
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (replace-path) - Expected [path] to be set
|
||||
@@ -0,0 +1,39 @@
|
||||
suite: retry middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: retry
|
||||
data:
|
||||
attempts: 3
|
||||
initialInterval: 1000
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
retry:
|
||||
attempts: 3
|
||||
initialInterval: 1000
|
||||
|
||||
- it: should fail with missing attempts
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: retry
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (retry) - Expected [attempts] to be set
|
||||
@@ -0,0 +1,57 @@
|
||||
suite: stripPrefix middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: strip-prefix
|
||||
data:
|
||||
forceSlash: true
|
||||
prefix:
|
||||
- /some-prefix
|
||||
- /some-other-prefix
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
stripPrefix:
|
||||
forceSlash: true
|
||||
prefix:
|
||||
- /some-prefix
|
||||
- /some-other-prefix
|
||||
|
||||
- it: should fail with missing prefix
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: strip-prefix
|
||||
data:
|
||||
prefix: []
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (strip-prefix) - Expected [prefix] to be set
|
||||
|
||||
- it: should fail with invalid forceSlash
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: strip-prefix
|
||||
data:
|
||||
prefix:
|
||||
- /some-prefix
|
||||
forceSlash: some-value
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (strip-prefix) - Expected [forceSlash] to be a boolean, but got [string]
|
||||
@@ -0,0 +1,41 @@
|
||||
suite: stripPrefixRegex middleware test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should pass with all set
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: strip-prefix-regex
|
||||
data:
|
||||
regex:
|
||||
- some-regex
|
||||
- some-other-regex
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
stripPrefixRegex:
|
||||
regex:
|
||||
- some-regex
|
||||
- some-other-regex
|
||||
|
||||
- it: should fail with missing regex
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: strip-prefix-regex
|
||||
data:
|
||||
regex: []
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware (strip-prefix-regex) - Expected [regex] to be set
|
||||
@@ -0,0 +1,57 @@
|
||||
suite: middleware name test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should generate correct name
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware1:
|
||||
enabled: true
|
||||
type: buffering
|
||||
data:
|
||||
foo: bar
|
||||
my-middleware2:
|
||||
enabled: true
|
||||
type: buffering
|
||||
data:
|
||||
foo: bar
|
||||
my-middleware3:
|
||||
enabled: true
|
||||
type: buffering
|
||||
expandObjectName: false
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- documentIndex: &middlewareDoc 0
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *middlewareDoc
|
||||
isAPIVersion:
|
||||
of: traefik.io/v1alpha1
|
||||
- documentIndex: *middlewareDoc
|
||||
equal:
|
||||
path: metadata.name
|
||||
value: test-release-name-common-test-my-middleware1
|
||||
- documentIndex: &otherMiddlewareDoc 1
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *otherMiddlewareDoc
|
||||
isAPIVersion:
|
||||
of: traefik.io/v1alpha1
|
||||
- documentIndex: *otherMiddlewareDoc
|
||||
equal:
|
||||
path: metadata.name
|
||||
value: test-release-name-common-test-my-middleware2
|
||||
- documentIndex: &otherMiddlewareDoc2 2
|
||||
isKind:
|
||||
of: Middleware
|
||||
- documentIndex: *otherMiddlewareDoc2
|
||||
isAPIVersion:
|
||||
of: traefik.io/v1alpha1
|
||||
- documentIndex: *otherMiddlewareDoc2
|
||||
equal:
|
||||
path: metadata.name
|
||||
value: my-middleware3
|
||||
@@ -0,0 +1,103 @@
|
||||
suite: middleware validation test
|
||||
templates:
|
||||
- common.yaml
|
||||
release:
|
||||
name: test-release-name
|
||||
namespace: test-release-namespace
|
||||
tests:
|
||||
- it: should fail with name longer than 253 characters
|
||||
set:
|
||||
middlewares:
|
||||
? my-middleware-super-long-name-that-is-longer-than-253-characters-my-middleware-super-long-name-that-is-longer-than-253-characters-my-middleware-super-long-name-that-is-longer-than-253-characters-my-middleware-super-long-long-long-long-long-long-long-long-name
|
||||
: enabled: true
|
||||
type: buffering
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Name [test-release-name-common-test-my-middleware-super-long-name-that-is-longer-than-253-characters-my-middleware-super-long-name-that-is-longer-than-253-characters-my-middleware-super-long-name-that-is-longer-than-253-characters-my-middleware-super-long-long-long-long-long-long-long-long-name] is not valid. Must start and end with an alphanumeric lowercase character. It can contain '-'. And must be at most 253 characters.
|
||||
|
||||
- it: should fail with name starting with underscore
|
||||
set:
|
||||
middlewares:
|
||||
_my-middleware:
|
||||
enabled: true
|
||||
type: buffering
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Name [test-release-name-common-test-_my-middleware] is not valid. Must start and end with an alphanumeric lowercase character. It can contain '-'. And must be at most 253 characters.
|
||||
|
||||
- it: should fail with namespace longer than 63 characters
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware:
|
||||
enabled: true
|
||||
type: buffering
|
||||
namespace: my-extra-super-duper-long-name-that-is-longer-than-63-characters
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware - Namespace [my-extra-super-duper-long-name-that-is-longer-than-63-characters] is not valid. Must start and end with an alphanumeric lowercase character. It can contain '-'. And must be at most 63 characters.
|
||||
|
||||
- it: should fail with labels not a dict
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware:
|
||||
enabled: true
|
||||
type: buffering
|
||||
labels: "not a dict"
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware - Expected [labels] to be a dictionary, but got [string]
|
||||
|
||||
- it: should fail with annotations not a dict
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware:
|
||||
enabled: true
|
||||
type: buffering
|
||||
annotations: "not a dict"
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware - Expected [annotations] to be a dictionary, but got [string]
|
||||
|
||||
- it: should fail with data not a dict
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware:
|
||||
enabled: true
|
||||
type: buffering
|
||||
data: "not a dict"
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware - Expected [data] to be a dictionary, but got [string]
|
||||
|
||||
- it: should fail with empty enabled
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware:
|
||||
enabled:
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware - Expected the defined key [enabled] in [middlewares.my-middleware] to not be empty
|
||||
|
||||
- it: should fail with empty type
|
||||
set:
|
||||
middlewares:
|
||||
my-middleware:
|
||||
enabled: true
|
||||
type:
|
||||
data:
|
||||
foo: bar
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Middleware - Expected [type] to be set
|
||||
@@ -48,4 +48,4 @@ sources:
|
||||
- https://hub.docker.com/_/
|
||||
- https://hub.docker.com/r/mikefarah/yq
|
||||
type: library
|
||||
version: 25.3.1
|
||||
version: 25.4.0
|
||||
|
||||
@@ -0,0 +1,46 @@
|
||||
{{/* Traefik Middleware Class */}}
|
||||
{{/* Call this template:
|
||||
{{ include "tc.v1.common.class.traefik.middleware" (dict "rootCtx" $ "objectData" $objectData) }}
|
||||
|
||||
rootCtx: The root context of the chart.
|
||||
objectData:
|
||||
name: The name of the middleware.
|
||||
labels: The labels of the middleware.
|
||||
annotations: The annotations of the middleware.
|
||||
data: The data of the middleware.
|
||||
namespace: The namespace of the middleware. (Optional)
|
||||
*/}}
|
||||
|
||||
{{- define "tc.v1.common.class.traefik.middleware" -}}
|
||||
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
|
||||
{{- $typeClassMap := (include "tc.v1.common.lib.traefik.middlewares.map" $) | fromJson -}}
|
||||
|
||||
{{- if not (hasKey $typeClassMap $objectData.type) -}}
|
||||
{{- fail (printf "Traefik - Middleware [%s] is not supported. Supported middlewares are [%s]" $objectData.type (keys $typeClassMap | join ", ")) -}}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: {{ $objectData.name }}
|
||||
namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Middleware") }}
|
||||
{{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}}
|
||||
{{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }}
|
||||
labels:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end -}}
|
||||
{{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}}
|
||||
{{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }}
|
||||
annotations:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- /*
|
||||
Nothing goes after the include, each middleware can also render other manifests.
|
||||
For the same reason indentation must be handled by each middleware.
|
||||
*/ -}}
|
||||
{{- include (get $typeClassMap $objectData.type) (dict "rootCtx" $rootCtx "objectData" $objectData) -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,58 @@
|
||||
{{- define "tc.v1.common.lib.traefik.middlewares.map" -}}
|
||||
{{- $typeClassMap := dict
|
||||
"add-prefix" "tc.v1.common.class.traefik.middleware.addPrefix"
|
||||
"basic-auth" "tc.v1.common.class.traefik.middleware.basicAuth"
|
||||
"buffering" "tc.v1.common.class.traefik.middleware.buffering"
|
||||
"chain" "tc.v1.common.class.traefik.middleware.chain"
|
||||
"compress" "tc.v1.common.class.traefik.middleware.compress"
|
||||
"content-type" "tc.v1.common.class.traefik.middleware.contentType"
|
||||
"forward-auth" "tc.v1.common.class.traefik.middleware.forwardAuth"
|
||||
"headers" "tc.v1.common.class.traefik.middleware.headers"
|
||||
"ip-allow-list" "tc.v1.common.class.traefik.middleware.ipAllowList"
|
||||
"rate-limit" "tc.v1.common.class.traefik.middleware.rateLimit"
|
||||
"redirect-regex" "tc.v1.common.class.traefik.middleware.redirectRegex"
|
||||
"redirect-scheme" "tc.v1.common.class.traefik.middleware.redirectScheme"
|
||||
"replace-path" "tc.v1.common.class.traefik.middleware.replacePath"
|
||||
"replace-path-regex" "tc.v1.common.class.traefik.middleware.replacePathRegex"
|
||||
"retry" "tc.v1.common.class.traefik.middleware.retry"
|
||||
"strip-prefix" "tc.v1.common.class.traefik.middleware.stripPrefix"
|
||||
"strip-prefix-regex" "tc.v1.common.class.traefik.middleware.stripPrefixRegex"
|
||||
|
||||
"plugin-bouncer" "tc.v1.common.class.traefik.middleware.pluginBouncer"
|
||||
"plugin-geoblock" "tc.v1.common.class.traefik.middleware.pluginGeoblock"
|
||||
"plugin-mod-security" "tc.v1.common.class.traefik.middleware.pluginModSecurity"
|
||||
"plugin-real-ip" "tc.v1.common.class.traefik.middleware.pluginRealIP"
|
||||
"plugin-rewrite-response-headers" "tc.v1.common.class.traefik.middleware.pluginRewriteResponseHeaders"
|
||||
"plugin-theme-park" "tc.v1.common.class.traefik.middleware.pluginThemePark"
|
||||
-}}
|
||||
|
||||
{{- $typeClassMap | toJson -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Only render if its not <nil> and has a value of 0 or greater */}}
|
||||
{{- define "tc.v1.common.class.traefik.middleware.helper.int" -}}
|
||||
{{- $key := .key -}}
|
||||
{{- $value := .value -}}
|
||||
|
||||
{{- if and (not (kindIs "invalid" $value)) (ge ($value | int) 0) -}}
|
||||
{{- $key }}: {{ $value }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "tc.v1.common.class.traefik.middleware.helper.bool" -}}
|
||||
{{- $key := .key -}}
|
||||
{{- $value := .value | toString -}}
|
||||
|
||||
{{- if or (eq $value "true") (eq $value "false") -}}
|
||||
{{- $key }}: {{ $value }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "tc.v1.common.class.traefik.middleware.helper.string" -}}
|
||||
{{- $key := .key -}}
|
||||
{{- $value := .value | toString -}}
|
||||
|
||||
{{- if and $value (ne $value "<nil>") -}}
|
||||
{{- $key }}: {{ $value | quote }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{/* Middleware Validation */}}
|
||||
{{/* Call this template:
|
||||
{{ include "tc.v1.common.lib.traefik.middleware.validation" (dict "objectData" $objectData) -}}
|
||||
objectData:
|
||||
labels: The labels of the middleware.
|
||||
annotations: The annotations of the middleware.
|
||||
data: The data of the middleware.
|
||||
*/}}
|
||||
|
||||
{{- define "tc.v1.common.lib.traefik.middleware.validation" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
|
||||
{{- if not $objectData.type -}}
|
||||
{{- fail "Middleware - Expected [type] to be set" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $objectData.data -}}
|
||||
{{- if not (kindIs "map" $objectData.data) -}}
|
||||
{{- fail (printf "Middleware - Expected [data] to be a dictionary, but got [%v]" (kindOf $objectData.data)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.addPrefix" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
|
||||
{{- if not $mw.prefix -}}
|
||||
{{- fail "Middleware (add-prefix) - Expected [prefix] to be set" -}}
|
||||
{{- end }}
|
||||
addPrefix:
|
||||
prefix: {{ $mw.prefix }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,35 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.basicAuth" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $rootCtx -}}
|
||||
{{- $mw := $objectData.data -}}
|
||||
|
||||
{{- $secret := $mw.secret | default "" -}}
|
||||
{{- $users := list -}}
|
||||
{{- $secretData := dict -}}
|
||||
|
||||
{{- if and $mw.users $mw.secret -}}
|
||||
{{- fail "Middleware (basic-auth) - Expected either [users] or [secret] to be set, but not both" -}}
|
||||
{{- end -}}
|
||||
{{- if and (not $mw.users) (not $mw.secret) -}}
|
||||
{{- fail "Middleware (basic-auth) - Expected at least one of [users] or [secret] to be set" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.users -}}
|
||||
{{- $secret = $objectData.name -}}
|
||||
{{- range $userData := $mw.users -}}
|
||||
{{- $users = append $users (htpasswd $userData.username $userData.password) -}}
|
||||
{{- end -}}
|
||||
{{- $secretData = (dict
|
||||
"name" $objectData.name
|
||||
"labels" ($objectData.labels | default dict)
|
||||
"annotations" ($objectData.annotations | default dict)
|
||||
"data" (dict "users" ($users | join "\n"))) -}}
|
||||
{{- end }}
|
||||
basicAuth:
|
||||
secret: {{ $secret }}
|
||||
{{- if $secretData -}}
|
||||
{{- include "tc.v1.common.class.secret" (dict "rootCtx" $rootCtx "objectData" $secretData) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.buffering" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data }}
|
||||
buffering:
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "maxRequestBodyBytes" "value" $mw.maxRequestBodyBytes) | nindent 4 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "memRequestBodyBytes" "value" $mw.memRequestBodyBytes) | nindent 4 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "maxResponseBodyBytes" "value" $mw.maxResponseBodyBytes) | nindent 4 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "memResponseBodyBytes" "value" $mw.memResponseBodyBytes) | nindent 4 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "retryExpression" "value" $mw.retryExpression) | nindent 4 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.chain" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
{{- if not $mw.middlewares -}}
|
||||
{{- fail "Middleware (chain) - Expected [middlewares] to be set" -}}
|
||||
{{- end }}
|
||||
chain:
|
||||
middlewares:
|
||||
{{- range $m := $mw.middlewares -}}
|
||||
{{- $objectName := $m.name -}}
|
||||
{{- $expandName := (include "tc.v1.common.lib.util.expandName" (dict
|
||||
"rootCtx" $ "objectData" $m "key" "middlewares"
|
||||
"name" $objectName "caller" "Middleware (chain)"
|
||||
)) -}}
|
||||
|
||||
{{- if eq $expandName "true" -}}
|
||||
{{- $objectName = (printf "%s-%s" $fullname $objectName) -}}
|
||||
{{- end }}
|
||||
- name: {{ $objectName }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,7 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.compress" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data }}
|
||||
compress: {}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,7 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.contentType" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data }}
|
||||
contentType: {}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,58 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.forwardAuth" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
|
||||
{{- if hasKey $mw "trustForwardHeader" -}}
|
||||
{{- if not (kindIs "bool" $mw.trustForwardHeader) -}}
|
||||
{{- fail (printf "Middleware (forward-auth) - Expected [trustForwardHeader] to be a boolean, but got [%s]" (kindOf $mw.trustForwardHeader)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if and $mw.tls (hasKey $mw.tls "insecureSkipVerify") -}}
|
||||
{{- if not (kindIs "bool" $mw.tls.insecureSkipVerify) -}}
|
||||
{{- fail (printf "Middleware (forward-auth) - Expected [tls.insecureSkipVerify] to be a boolean, but got [%s]" (kindOf $mw.tls.insecureSkipVerify)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.authResponseHeaders -}}
|
||||
{{- if not (kindIs "slice" $mw.authResponseHeaders) -}}
|
||||
{{- fail (printf "Middleware (forward-auth) - Expected [authResponseHeaders] to be a list, but got [%s]" (kindOf $mw.authResponseHeaders)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- with $mw.authRequestHeaders -}}
|
||||
{{- if not (kindIs "slice" $mw.authRequestHeaders) -}}
|
||||
{{- fail (printf "Middleware (forward-auth) - Expected [authRequestHeaders] to be a list, but got [%s]" (kindOf $mw.authRequestHeaders)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not $mw.address -}}
|
||||
{{- fail "Middleware (forward-auth) - Expected [address] to be set" -}}
|
||||
{{- end }}
|
||||
forwardAuth:
|
||||
address: {{ $mw.address }}
|
||||
trustForwardHeader: {{ $mw.trustForwardHeader }}
|
||||
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "authResponseHeadersRegex" "value" $mw.authResponseHeadersRegex) | nindent 4 }}
|
||||
|
||||
{{- if $mw.authResponseHeaders }}
|
||||
authResponseHeaders:
|
||||
{{- range $mw.authResponseHeaders }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.authRequestHeaders }}
|
||||
authRequestHeaders:
|
||||
{{- range $mw.authRequestHeaders }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.tls }}
|
||||
tls:
|
||||
insecureSkipVerify: {{ $mw.tls.insecureSkipVerify }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,128 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.headers" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data }}
|
||||
headers:
|
||||
{{- if $mw.customRequestHeaders }}
|
||||
customRequestHeaders:
|
||||
{{- range $k, $v := $mw.customRequestHeaders }}
|
||||
{{ $k }}: {{ $v }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.customResponseHeaders }}
|
||||
customResponseHeaders:
|
||||
{{- range $k, $v := $mw.customResponseHeaders }}
|
||||
{{ $k }}: {{ $v }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if hasKey $mw "accessControlAllowCredentials" }}
|
||||
accessControlAllowCredentials: {{ $mw.accessControlAllowCredentials }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.accessControlAllowHeaders }}
|
||||
accessControlAllowHeaders:
|
||||
{{- range $mw.accessControlAllowHeaders }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.accessControlAllowMethods }}
|
||||
accessControlAllowMethods:
|
||||
{{- range $mw.accessControlAllowMethods }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.accessControlAllowOriginList }}
|
||||
accessControlAllowOriginList:
|
||||
{{- range $mw.accessControlAllowOriginList }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.accessControlAllowOriginListRegex }}
|
||||
accessControlAllowOriginListRegex:
|
||||
{{- range $mw.accessControlAllowOriginListRegex }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.accessControlExposeHeaders }}
|
||||
accessControlExposeHeaders:
|
||||
{{- range $mw.accessControlExposeHeaders }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.accessControlMaxAge }}
|
||||
accessControlMaxAge: {{ $mw.accessControlMaxAge }}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "addVaryHeader" "value" $mw.addVaryHeader) | nindent 4 }}
|
||||
|
||||
{{- if $mw.allowedHosts }}
|
||||
allowedHosts:
|
||||
{{- range $mw.allowedHosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.hostsProxyHeaders }}
|
||||
hostsProxyHeaders:
|
||||
{{- range $mw.hostsProxyHeaders }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.sslProxyHeaders }}
|
||||
sslProxyHeaders:
|
||||
{{- range $k, $v := $mw.sslProxyHeaders }}
|
||||
{{ $k }}: {{ $v }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.stsSeconds }}
|
||||
stsSeconds: {{ $mw.stsSeconds }}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "stsIncludeSubdomains" "value" $mw.stsIncludeSubdomains) | nindent 4 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "stsPreload" "value" $mw.stsPreload) | nindent 4 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "forceSTSHeader" "value" $mw.forceSTSHeader) | nindent 4 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "frameDeny" "value" $mw.frameDeny) | nindent 4 }}
|
||||
|
||||
{{- if $mw.customFrameOptionsValue }}
|
||||
customFrameOptionsValue: {{ $mw.customFrameOptionsValue }}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "contentTypeNosniff" "value" $mw.contentTypeNosniff) | nindent 4 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "browserXssFilter" "value" $mw.browserXssFilter) | nindent 4 }}
|
||||
|
||||
{{- if $mw.customBrowserXSSValue }}
|
||||
customBrowserXSSValue: {{ $mw.customBrowserXSSValue }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.contentSecurityPolicy }}
|
||||
contentSecurityPolicy: {{ $mw.contentSecurityPolicy }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.contentSecurityPolicyReportOnly }}
|
||||
contentSecurityPolicyReportOnly: {{ $mw.contentSecurityPolicyReportOnly }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.publicKey }}
|
||||
publicKey: {{ $mw.publicKey }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.referrerPolicy }}
|
||||
referrerPolicy: {{ $mw.referrerPolicy }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.permissionsPolicy }}
|
||||
permissionsPolicy: {{ $mw.permissionsPolicy }}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "isDevelopment" "value" $mw.isDevelopment) | nindent 4 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,38 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.ipAllowList" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
|
||||
{{- if $mw.sourceRange -}}
|
||||
{{- if not (kindIs "slice" $mw.sourceRange) -}}
|
||||
{{- fail (printf "Middleware (ip-allow-list) - Expected [sourceRange] to be a list, but got [%s]" (kindOf $mw.sourceRange)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.ipStrategy -}}
|
||||
{{- if $mw.ipStrategy.excludedIPs -}}
|
||||
{{- if not (kindIs "slice" $mw.ipStrategy.excludedIPs) -}}
|
||||
{{- fail (printf "Middleware (ip-allow-list) - Expected [ipStrategy.excludedIPs] to be a list, but got [%s]" (kindOf $mw.ipStrategy.excludedIPs)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
ipAllowList:
|
||||
{{- if $mw.sourceRange }}
|
||||
sourceRange:
|
||||
{{- range $mw.sourceRange }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $mw.ipStrategy }}
|
||||
ipStrategy:
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "depth" "value" $mw.ipStrategy.depth) | nindent 6 }}
|
||||
{{- if $mw.ipStrategy.excludedIPs }}
|
||||
excludedIPs:
|
||||
{{- range $mw.ipStrategy.excludedIPs }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,70 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.pluginBouncer" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
|
||||
{{/* This has to match with the name of the plugin given on the traefik CLI */}}
|
||||
{{- $mwName := "bouncer" -}}
|
||||
{{- if $mw.pluginName -}}
|
||||
{{- $mwName = $mw.pluginName -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey $mw "enabled") -}}
|
||||
{{- fail "Middleware (plugin-bouncer) - Expected [enabled] to be set" -}}
|
||||
{{- end -}}
|
||||
{{- if not (kindIs "bool" $mw.enabled) -}}
|
||||
{{- fail (printf "Middleware (plugin-bouncer) - Expected [enabled] to be a boolean, but got [%s]" (kindOf $mw.enabled)) -}}
|
||||
{{- end }}
|
||||
plugin:
|
||||
{{ $mwName }}:
|
||||
enabled: {{ $mw.enabled }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "logLevel" "value" $mw.logLevel) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "updateIntervalSeconds" "value" $mw.updateIntervalSeconds) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "updateMaxFailure" "value" $mw.updateMaxFailure) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "defaultDecisionSeconds" "value" $mw.defaultDecisionSeconds) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "httpTimeoutSeconds" "value" $mw.httpTimeoutSeconds) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "crowdsecMode" "value" $mw.crowdsecMode) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "crowdsecAppsecEnabled" "value" $mw.crowdsecAppsecEnabled) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "crowdsecAppsecHost" "value" $mw.crowdsecAppsecHost) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "crowdsecAppsecFailureBlock" "value" $mw.crowdsecAppsecFailureBlock) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "crowdsecAppsecUnreachableBlock" "value" $mw.crowdsecAppsecUnreachableBlock) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "crowdsecLapiKey" "value" $mw.crowdsecLapiKey) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "crowdsecLapiHost" "value" $mw.crowdsecLapiHost) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "crowdsecLapiScheme" "value" $mw.crowdsecLapiScheme) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "crowdsecLapiTLSInsecureVerify" "value" $mw.crowdsecLapiTLSInsecureVerify) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "crowdsecCapiMachineId" "value" $mw.crowdsecCapiMachineId) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "crowdsecCapiPassword" "value" $mw.crowdsecCapiPassword) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "forwardedHeadersCustomName" "value" $mw.forwardedHeadersCustomName) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "remediationHeadersCustomName" "value" $mw.remediationHeadersCustomName) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "redisCacheEnabled" "value" $mw.redisCacheEnabled) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "redisCacheHost" "value" $mw.redisCacheHost) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "redisCachePassword" "value" $mw.redisCachePassword) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "redisCacheDatabase" "value" $mw.redisCacheDatabase) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "crowdsecLapiTLSCertificateAuthority" "value" $mw.crowdsecLapiTLSCertificateAuthority) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "crowdsecLapiTLSCertificateBouncer" "value" $mw.crowdsecLapiTLSCertificateBouncer) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "crowdsecLapiTLSCertificateBouncerKey" "value" $mw.crowdsecLapiTLSCertificateBouncerKey) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "captchaProvider" "value" $mw.captchaProvider) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "captchaSiteKey" "value" $mw.captchaSiteKey) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "captchaSecretKey" "value" $mw.captchaSecretKey) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "captchaGracePeriodSeconds" "value" $mw.captchaGracePeriodSeconds) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "captchaHTMLFilePath" "value" $mw.captchaHTMLFilePath) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "banHTMLFilePath" "value" $mw.banHTMLFilePath) | nindent 6 }}
|
||||
{{- if $mw.crowdsecCapiScenarios }}
|
||||
crowdsecCapiScenarios:
|
||||
{{- range $mw.crowdsecCapiScenarios }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- if $mw.forwardedHeadersTrustedIPs }}
|
||||
forwardedHeadersTrustedIPs:
|
||||
{{- range $mw.forwardedHeadersTrustedIPs }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- if $mw.clientTrustedIPs }}
|
||||
clientTrustedIPs:
|
||||
{{- range $mw.clientTrustedIPs }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,37 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.pluginGeoblock" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
|
||||
{{/* This has to match with the name of the plugin given on the traefik CLI */}}
|
||||
{{- $mwName := "GeoBlock" -}}
|
||||
{{- if $mw.pluginName -}}
|
||||
{{- $mwName = $mw.pluginName -}}
|
||||
{{- end -}}
|
||||
{{- if not $mw.api -}}
|
||||
{{- fail "Middleware (plugin-geoblock) - Expected [api] to be set" -}}
|
||||
{{- end -}}
|
||||
{{- if not $mw.countries -}}
|
||||
{{- fail "Middleware (plugin-geoblock) - Expected [countries] to be set" -}}
|
||||
{{- end }}
|
||||
plugin:
|
||||
{{ $mwName }}:
|
||||
api: {{ $mw.api }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "allowLocalRequests" "value" $mw.allowLocalRequests) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "logLocalRequests" "value" $mw.logLocalRequests) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "logAllowedRequests" "value" $mw.logAllowedRequests) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "logApiRequests" "value" $mw.logApiRequests) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "apiTimeoutMs" "value" $mw.apiTimeoutMs) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "cacheSize" "value" $mw.cacheSize) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "forceMonthlyUpdate" "value" $mw.forceMonthlyUpdate) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "allowUnknownCountries" "value" $mw.allowUnknownCountries) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "unknownCountryApiResponse" "value" $mw.unknownCountryApiResponse) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "blackListMode" "value" $mw.blackListMode) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "silentStartUp" "value" $mw.silentStartUp) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "addCountryHeader" "value" $mw.addCountryHeader) | nindent 6 }}
|
||||
countries:
|
||||
{{- range $mw.countries }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.pluginModSecurity" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
|
||||
{{/* This has to match with the name of the plugin given on the traefik CLI */}}
|
||||
{{- $mwName := "traefik-modsecurity-plugin" -}}
|
||||
{{- if $mw.pluginName -}}
|
||||
{{- $mwName = $mw.pluginName -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not $mw.modSecurityUrl -}}
|
||||
{{- fail "Middleware (modsecurity) - Expected [modSecurityUrl] to be set" -}}
|
||||
{{- end }}
|
||||
plugin:
|
||||
{{ $mwName }}:
|
||||
modSecurityUrl: {{ $mw.modSecurityUrl }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "timeoutMillis" "value" $mw.timeoutMillis) | nindent 6 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "maxBodySize" "value" $mw.maxBodySize) | nindent 6 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.pluginRealIP" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
|
||||
{{/* This has to match with the name of the plugin given on the traefik CLI */}}
|
||||
{{- $mwName := "traefik-real-ip" -}}
|
||||
{{- if $mw.pluginName -}}
|
||||
{{- $mwName = $mw.pluginName -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not $mw.excludednets -}}
|
||||
{{- fail "Middleware (real-ip) - Expected [excludednets] to be set" -}}
|
||||
{{- end }}
|
||||
plugin:
|
||||
{{ $mwName }}:
|
||||
excludednets:
|
||||
{{- range $mw.excludednets }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
+40
@@ -0,0 +1,40 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.pluginRewriteResponseHeaders" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
|
||||
{{/* This has to match with the name of the plugin given on the traefik CLI */}}
|
||||
{{- $mwName := "rewriteResponseHeaders" -}}
|
||||
{{- if $mw.pluginName -}}
|
||||
{{- $mwName = $mw.pluginName -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not $mw.rewrites -}}
|
||||
{{- fail "Middleware (rewrite-response-headers) - Expected [rewrites] to be set" -}}
|
||||
{{- end }}
|
||||
|
||||
{{- if not (kindIs "slice" $mw.rewrites) -}}
|
||||
{{- fail (printf "Middleware (rewrite-response-headers) - Expected [rewrites] to be a list, but got [%s]" (kindOf $mw.rewrites)) -}}
|
||||
{{- end }}
|
||||
|
||||
{{- range $index, $config := $mw.rewrites -}}
|
||||
{{- if not $config.header -}}
|
||||
{{- fail (printf "Middleware (rewrite-response-headers) - Expected [header] to be set for rewrite [%v]" $index) -}}
|
||||
{{- end -}}
|
||||
{{- if not $config.regex -}}
|
||||
{{- fail (printf "Middleware (rewrite-response-headers) - Expected [regex] to be set for rewrite [%v]" $index) -}}
|
||||
{{- end -}}
|
||||
{{- if not $config.replacement -}}
|
||||
{{- fail (printf "Middleware (rewrite-response-headers) - Expected [replacement] to be set for rewrite [%v]" $index) -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
plugin:
|
||||
{{ $mwName }}:
|
||||
rewrites:
|
||||
{{- range $index, $rewriteResponseHeader := $mw.rewrites }}
|
||||
- header: {{ $rewriteResponseHeader.header }}
|
||||
regex: {{ $rewriteResponseHeader.regex | quote }}
|
||||
replacement: {{ $rewriteResponseHeader.replacement | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.pluginThemePark" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
|
||||
{{/* This has to match with the name of the plugin given on the traefik CLI */}}
|
||||
{{- $mwName := "traefik-themepark" -}}
|
||||
{{- if $mw.pluginName -}}
|
||||
{{- $mwName = $mw.pluginName -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not $mw.app -}}
|
||||
{{- fail "Middleware (themepark) - Expected [app] to be set" -}}
|
||||
{{- end -}}
|
||||
{{- if not $mw.theme -}}
|
||||
{{- fail "Middleware (themepark) - Expected [theme] to be set" -}}
|
||||
{{- end }}
|
||||
plugin:
|
||||
{{ $mwName }}:
|
||||
app: {{ $mw.app }}
|
||||
theme: {{ $mw.theme }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.string" (dict "key" "baseUrl" "value" $mw.baseUrl) | nindent 6 }}
|
||||
{{- if $mw.addons }}
|
||||
addons:
|
||||
{{- range $mw.addons }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.rateLimit" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
|
||||
{{- if and (not $mw.average) (not $mw.burst) -}}
|
||||
{{- fail "Middleware (rate-limit) - Expected either [average] or [burst] to be set" -}}
|
||||
{{- end }}
|
||||
rateLimit:
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "average" "value" $mw.average) | nindent 4 }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "burst" "value" $mw.burst) | nindent 4 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.redirectRegex" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
{{- if not $mw.regex -}}
|
||||
{{- fail "Middleware (redirect-regex) - Expected [regex] to be set" -}}
|
||||
{{- end -}}
|
||||
{{- if not $mw.replacement -}}
|
||||
{{- fail "Middleware (redirect-regex) - Expected [replacement] to be set" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if hasKey $mw "permanent" -}}
|
||||
{{- if not (kindIs "bool" $mw.permanent) -}}
|
||||
{{- fail (printf "Middleware (redirect-regex) - Expected [permanent] to be a boolean, but got [%s]" (kindOf $mw.permanent)) -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
redirectRegex:
|
||||
regex: {{ $mw.regex }}
|
||||
replacement: {{ $mw.replacement }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "permanent" "value" $mw.permanent) | nindent 4 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.redirectScheme" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
{{- if not $mw.scheme -}}
|
||||
{{- fail "Middleware (redirect-scheme) - Expected [scheme] to be set" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if hasKey $mw "permanent" -}}
|
||||
{{- if not (kindIs "bool" $mw.permanent) -}}
|
||||
{{- fail (printf "Middleware (redirect-scheme) - Expected [permanent] to be a boolean, but got [%s]" (kindOf $mw.permanent)) -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
redirectScheme:
|
||||
scheme: {{ $mw.scheme }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "permanent" "value" $mw.permanent) | nindent 4 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,11 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.replacePath" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
{{- if not $mw.path -}}
|
||||
{{- fail "Middleware (replace-path) - Expected [path] to be set" -}}
|
||||
{{- end }}
|
||||
replacePath:
|
||||
path: {{ $mw.path }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.replacePathRegex" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
{{- if not $mw.regex -}}
|
||||
{{- fail "Middleware (replace-path-regex) - Expected [regex] to be set" -}}
|
||||
{{- end -}}
|
||||
{{- if not $mw.replacement -}}
|
||||
{{- fail "Middleware (replace-path-regex) - Expected [replacement] to be set" -}}
|
||||
{{- end }}
|
||||
replacePathRegex:
|
||||
regex: {{ $mw.regex }}
|
||||
replacement: {{ $mw.replacement }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.retry" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
{{- if not $mw.attempts -}}
|
||||
{{- fail "Middleware (retry) - Expected [attempts] to be set" -}}
|
||||
{{- end }}
|
||||
retry:
|
||||
attempts: {{ $mw.attempts }}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.int" (dict "key" "initialInterval" "value" $mw.initialInterval) | nindent 4 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.stripPrefix" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
{{- if not $mw.prefix -}}
|
||||
{{- fail "Middleware (strip-prefix) - Expected [prefix] to be set" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if hasKey $mw "forceSlash" -}}
|
||||
{{- if not (kindIs "bool" $mw.forceSlash) -}}
|
||||
{{- fail (printf "Middleware (strip-prefix) - Expected [forceSlash] to be a boolean, but got [%s]" (kindOf $mw.forceSlash)) -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
stripPrefix:
|
||||
prefix:
|
||||
{{- range $mw.prefix }}
|
||||
- {{ . | quote }}
|
||||
{{- end -}}
|
||||
{{- include "tc.v1.common.class.traefik.middleware.helper.bool" (dict "key" "forceSlash" "value" $mw.forceSlash) | nindent 4 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- define "tc.v1.common.class.traefik.middleware.stripPrefixRegex" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $rootCtx := .rootCtx -}}
|
||||
|
||||
{{- $mw := $objectData.data -}}
|
||||
{{- if not $mw.regex -}}
|
||||
{{- fail "Middleware (strip-prefix-regex) - Expected [regex] to be set" -}}
|
||||
{{- end }}
|
||||
stripPrefixRegex:
|
||||
regex:
|
||||
{{- range $mw.regex }}
|
||||
- {{ . | quote }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -46,6 +46,9 @@
|
||||
{{/* Render volumeSnapshotClass(s) */}}
|
||||
{{- include "tc.v1.common.spawner.volumesnapshotclass" . | nindent 0 -}}
|
||||
|
||||
{{/* Render Middleware(s) */}}
|
||||
{{- include "tc.v1.common.spawner.traefik.middleware" . | nindent 0 -}}
|
||||
|
||||
{{/* Render ingress(s) */}}
|
||||
{{- include "tc.v1.common.spawner.ingress" . | nindent 0 -}}
|
||||
|
||||
|
||||
@@ -0,0 +1,48 @@
|
||||
{{/* Traefik Middleware Spawner */}}
|
||||
{{/* Call this template:
|
||||
{{ include "tc.v1.common.spawner.configmap" $ -}}
|
||||
*/}}
|
||||
|
||||
{{- define "tc.v1.common.spawner.traefik.middleware" -}}
|
||||
{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}}
|
||||
|
||||
{{- range $name, $middleware := .Values.middlewares -}}
|
||||
|
||||
{{- $enabled := (include "tc.v1.common.lib.util.enabled" (dict
|
||||
"rootCtx" $ "objectData" $middleware
|
||||
"name" $name "caller" "Middleware"
|
||||
"key" "middlewares")) -}}
|
||||
|
||||
{{- if eq $enabled "true" -}}
|
||||
|
||||
{{/* Create a copy of the middleware */}}
|
||||
{{- $objectData := (mustDeepCopy $middleware) -}}
|
||||
|
||||
{{- $objectName := $name -}}
|
||||
|
||||
{{- $expandName := (include "tc.v1.common.lib.util.expandName" (dict
|
||||
"rootCtx" $ "objectData" $objectData
|
||||
"name" $name "caller" "Middleware"
|
||||
"key" "middlewares")) -}}
|
||||
|
||||
{{- if eq $expandName "true" -}}
|
||||
{{- $objectName = (printf "%s-%s" $fullname $name) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Perform validations */}} {{/* Middleware have a max name length of 253 */}}
|
||||
{{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName "length" 253) -}}
|
||||
{{- include "tc.v1.common.lib.traefik.middleware.validation" (dict "objectData" $objectData) -}}
|
||||
{{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $objectData "caller" "Middleware") -}}
|
||||
|
||||
{{/* Set the name of the middleware */}}
|
||||
{{- $_ := set $objectData "name" $objectName -}}
|
||||
{{- $_ := set $objectData "shortName" $name -}}
|
||||
|
||||
{{/* Call class to create the object */}}
|
||||
{{- include "tc.v1.common.class.traefik.middleware" (dict "rootCtx" $ "objectData" $objectData) -}}
|
||||
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
@@ -235,6 +235,20 @@ credentials:
|
||||
# ## Is used in cases where things are encrypted by a backup utility
|
||||
# encrKey: ""
|
||||
|
||||
middlewares: {}
|
||||
# basic-auth:
|
||||
# type: basicAuth
|
||||
# data:
|
||||
# # middleware specific data ie
|
||||
# users:
|
||||
# - username: user1
|
||||
# password: password1
|
||||
# some-other-middleware:
|
||||
# type: someOtherMiddleware
|
||||
# data:
|
||||
# # middleware specific data ie
|
||||
# someOtherMiddlewareData: someOtherMiddlewareData
|
||||
|
||||
# -- (docs/persistence/README.md)
|
||||
persistence:
|
||||
shared:
|
||||
|
||||
Reference in New Issue
Block a user