DevOps/truecharts
2
0
Fork 0
Code Issues Pull Requests Actions 30 Packages Projects Releases 1 Wiki Activity

feat(traefik): add support for proxyProtocol (#3593)

Browse Source 
* feat(traefik): add support for proxyProtocol

* whoops

* empty space

* proxyprot on all entrypoints

* whoops again

* no fixes here

* Update charts/stable/traefik/templates/_args.tpl

* formatting

Co-authored-by: Kjeld Schouten-Lebbing <kjeld@schouten-lebbing.nl>
This commit is contained in:
Stavros Kois
2022-08-27 22:58:46 +02:00
committed by GitHub
co-authored by Kjeld Schouten-Lebbing
parent 857b0a8302
commit 274c522df6
9 changed files with 147 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/scripts/build-catalog.sh
+10
View File
@@ -276,6 +276,16 @@ include_questions(){
/# Include{documentation}/ { for (i=0;i<n;++i) print a[i]; next } /# Include{documentation}/ { for (i=0;i<n;++i) print a[i]; next }
1' templates/questions/documentation.yaml ${target}/questions.yaml > "tmp${chartname}" && mv "tmp${chartname}" ${target}/questions.yaml 1' templates/questions/documentation.yaml ${target}/questions.yaml > "tmp${chartname}" && mv "tmp${chartname}" ${target}/questions.yaml
# Replace # Include{[forwardedHeaders]} with the standard forwardedHeaders codesnippet
awk 'NR==FNR { a[n++]=$0; next }
/# Include{forwardedHeaders}/ { for (i=0;i<n;++i) print a[i]; next }
1' templates/questions/traefik/forwardedHeaders.yaml ${target}/questions.yaml > "tmp${chartname}" && mv "tmp${chartname}" ${target}/questions.yaml
# Replace # Include{proxyProtocol} with the standard proxyProtocol codesnippet
awk 'NR==FNR { a[n++]=$0; next }
/# Include{proxyProtocol}/ { for (i=0;i<n;++i) print a[i]; next }
1' templates/questions/traefik/proxyProtocol.yaml ${target}/questions.yaml > "tmp${chartname}" && mv "tmp${chartname}" ${target}/questions.yaml
} }
export -f include_questions export -f include_questions
charts/stable/traefik/Chart.yaml
+1 -1
View File
@@ -23,7 +23,7 @@ sources:
- https://github.com/traefik/traefik-helm-chart - https://github.com/traefik/traefik-helm-chart
- https://traefik.io/ - https://traefik.io/
type: application type: application
version: 13.2.3 version: 13.3.0
annotations: annotations:
truecharts.org/catagories: | truecharts.org/catagories: |
- network - network
charts/stable/traefik/questions.yaml
+6 -90
View File
@@ -605,36 +605,8 @@ questions:
schema: schema:
type: string type: string
default: "websecure" default: "websecure"
- variable: forwardedHeaders # Include{forwardedHeaders}
label: "Accept Forwarded Headers" # Include{proxyProtocol}
schema:
additional_attrs: true
type: dict
attrs:
- variable: enabled
label: "Enable"
schema:
type: boolean
default: false
show_subquestions_if: true
subquestions:
- variable: trustedIPs
label: "Trusted IPs"
schema:
type: list
default: []
items:
- variable: trustedIPsEntry
label: ""
schema:
type: string
required: true
default: ""
- variable: insecureMode
label: "Insecure Mode"
schema:
type: boolean
default: false
- variable: websecure - variable: websecure
label: "websecure Entrypoints Configuration" label: "websecure Entrypoints Configuration"
schema: schema:
@@ -661,36 +633,8 @@ questions:
label: "Redirect to Entrypoint" label: "Redirect to Entrypoint"
schema: schema:
type: string type: string
- variable: forwardedHeaders # Include{forwardedHeaders}
label: "Accept Forwarded Headers" # Include{proxyProtocol}
schema:
additional_attrs: true
type: dict
attrs:
- variable: enabled
label: "Enable"
schema:
type: boolean
default: false
show_subquestions_if: true
subquestions:
- variable: trustedIPs
label: "Trusted IPs"
schema:
type: list
default: []
items:
- variable: trustedIPsEntry
label: ""
schema:
type: string
required: true
default: ""
- variable: insecureMode
label: "Insecure Mode"
schema:
type: boolean
default: false
- variable: tls - variable: tls
label: "websecure Entrypoints Configuration" label: "websecure Entrypoints Configuration"
schema: schema:
@@ -763,36 +707,8 @@ questions:
label: "Redirect to Entrypoint" label: "Redirect to Entrypoint"
schema: schema:
type: string type: string
- variable: forwardedHeaders # Include{forwardedHeaders}
label: "Accept Forwarded Headers" # Include{proxyProtocol}
schema:
additional_attrs: true
type: dict
attrs:
- variable: enabled
label: "Enable"
schema:
type: boolean
default: false
show_subquestions_if: true
subquestions:
- variable: trustedIPs
label: "Trusted IPs"
schema:
type: list
default: []
items:
- variable: trustedIPsEntry
label: ""
schema:
type: string
required: true
default: ""
- variable: insecureMode
label: "Insecure Mode"
schema:
type: boolean
default: false
# Include{ingressRoot} # Include{ingressRoot}
- variable: main - variable: main
label: "Main Ingress" label: "Main Ingress"
charts/stable/traefik/templates/_args.tpl
+11
View File
@@ -67,6 +67,17 @@ args:
- "--providers.kubernetesingress.ingressclass={{ .Release.Name }}" - "--providers.kubernetesingress.ingressclass={{ .Release.Name }}"
{{- end }} {{- end }}
{{- range $entrypoint, $config := $ports }} {{- range $entrypoint, $config := $ports }}
{{/* add args for proxyProtocol support */}}
{{- if $config.proxyProtocol }}
{{- if $config.proxyProtocol.enabled }}
{{- if $config.proxyProtocol.insecureMode }}
- "--entrypoints.{{ $entrypoint }}.proxyProtocol.insecure"
{{- end }}
{{- if not ( empty $config.proxyProtocol.trustedIPs ) }}
- "--entrypoints.{{ $entrypoint }}.proxyProtocol.trustedIPs={{ join "," $config.proxyProtocol.trustedIPs }}"
{{- end }}
{{- end }}
{{- end }}
{{/* add args for forwardedHeaders support */}} {{/* add args for forwardedHeaders support */}}
{{- if $config.forwardedHeaders.enabled }} {{- if $config.forwardedHeaders.enabled }}
{{- if not ( empty $config.forwardedHeaders.trustedIPs ) }} {{- if not ( empty $config.forwardedHeaders.trustedIPs ) }}
charts/stable/traefik/values.yaml
+23 -3
View File
@@ -152,6 +152,9 @@ service:
# -- Forwarded Headers should never be enabled on Main entrypoint # -- Forwarded Headers should never be enabled on Main entrypoint
forwardedHeaders: forwardedHeaders:
enabled: false enabled: false
# -- Proxy Protocol should never be enabled on Main entrypoint
proxyProtocol:
enabled: false
tcp: tcp:
enabled: true enabled: true
type: LoadBalancer type: LoadBalancer
@@ -161,6 +164,8 @@ service:
port: 9080 port: 9080
protocol: HTTP protocol: HTTP
redirectTo: websecure redirectTo: websecure
# Options: Empty, 0 (ingore), or positive int
# redirectPort:
# -- Configure (Forwarded Headers)[https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers] Support # -- Configure (Forwarded Headers)[https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers] Support
forwardedHeaders: forwardedHeaders:
enabled: false enabled: false
@@ -168,8 +173,13 @@ service:
trustedIPs: [] trustedIPs: []
# -- Trust all forwarded headers # -- Trust all forwarded headers
insecureMode: false insecureMode: false
# Options: Empty, 0 (ingore), or positive int # -- Configure (Proxy Protocol Headers)[https://doc.traefik.io/traefik/routing/entrypoints/#proxyprotocol] Support
# redirectPort: proxyProtocol:
enabled: false
# -- Only IPs in trustedIPs will lead to remote client address replacement
trustedIPs: []
# -- Trust every incoming connection
insecureMode: false
websecure: websecure:
enabled: true enabled: true
port: 9443 port: 9443
@@ -181,6 +191,13 @@ service:
trustedIPs: [] trustedIPs: []
# -- Trust all forwarded headers # -- Trust all forwarded headers
insecureMode: false insecureMode: false
# -- Configure (Proxy Protocol Headers)[https://doc.traefik.io/traefik/routing/entrypoints/#proxyprotocol] Support
proxyProtocol:
enabled: false
# -- Only IPs in trustedIPs will lead to remote client address replacement
trustedIPs: []
# -- Trust every incoming connection
insecureMode: false
# tcpexample: # tcpexample:
# enabled: true # enabled: true
# targetPort: 9443 # targetPort: 9443
@@ -207,6 +224,9 @@ service:
# -- Forwarded Headers should never be enabled on Metrics entrypoint # -- Forwarded Headers should never be enabled on Metrics entrypoint
forwardedHeaders: forwardedHeaders:
enabled: false enabled: false
# -- Proxy Protocol should never be enabled on Metrics entrypoint
proxyProtocol:
enabled: false
udp: udp:
enabled: false enabled: false
@@ -328,7 +348,7 @@ middlewares:
redirectRegex: [] redirectRegex: []
# - name: redirectRegexName # - name: redirectRegexName
# regex: putregexhere # regex: putregexhere
# replacement: repslacementurlhere # replacement: replacementurlhere
# permanent: false # permanent: false
stripPrefixRegex: [] stripPrefixRegex: []
# - name: stripPrefixRegexName # - name: stripPrefixRegexName
cspell.config.yaml
+21
View File
@@ -4,20 +4,25 @@ words:
- allowtransparency - allowtransparency
- APITOKEN - APITOKEN
- appname - appname
- appnamehere
- Authentik - Authentik
- Authexample
- authkey - authkey
- autoconnect - autoconnect
- AUTOSYNC - AUTOSYNC
- backupname - backupname
- basicauthexample
- bazarr - bazarr
- bugfixer's - bugfixer's
- bungeecord - bungeecord
- chainname
- cheatsheet - cheatsheet
- cloudflared - cloudflared
- Cloudflareddns - Cloudflareddns
- collabora - collabora
- configfile - configfile
- configmap - configmap
- containo
- daemonset - daemonset
- dbcreds - dbcreds
- dbengine - dbengine
@@ -27,6 +32,7 @@ words:
- dockerized - dockerized
- duplicati - duplicati
- dynmap - dynmap
- Entrypoints
- eptgmk - eptgmk
- Fireshare - Fireshare
- fullname - fullname
@@ -39,6 +45,10 @@ words:
- hyperconverged - hyperconverged
- hyperthread - hyperthread
- iban - iban
- ingressclasses
- ingressroutes
- ingressroutetcps
- ingressrouteudps
- integrationsenabled - integrationsenabled
- ipaddr - ipaddr
- ixcert - ixcert
@@ -66,6 +76,8 @@ words:
- mediafiles - mediafiles
- meshroom - meshroom
- metallb - metallb
- middlewares
- middlewaretcps
- Mikrotik - Mikrotik
- milicpu - milicpu
- minecraft - minecraft
@@ -94,6 +106,7 @@ words:
- Preload - Preload
- proto - proto
- puid - puid
- putregexhere
- pvcname - pvcname
- pvcpath - pvcpath
- quotum - quotum
@@ -105,11 +118,13 @@ words:
- RECORDTYPES - RECORDTYPES
- registeringats - registeringats
- reneg - reneg
- replacementurlhere
- resolv - resolv
- sabnzbd - sabnzbd
- schouten - schouten
- selfsigned - selfsigned
- SERVERCONFIG - SERVERCONFIG
- serverstransports
- serviceexpert - serviceexpert
- smallblock - smallblock
- sonarr - sonarr
@@ -131,7 +146,13 @@ words:
- targetport - targetport
- tccr - tccr
- teamspeak - teamspeak
- testpassword
- testuser
- themenamehere
- tlsoptions
- tlsstores
- traefik - traefik
- traefikservices
- truecharts - truecharts
- truenas - truenas
- truetool - truetool
templates/questions/traefik/forwardedHeaders.yaml
+32
View File
@@ -0,0 +1,32 @@
- variable: forwardedHeaders
label: Accept Forwarded Headers
schema:
additional_attrs: true
type: dict
attrs:
- variable: enabled
label: Enable
schema:
type: boolean
default: false
show_subquestions_if: true
subquestions:
- variable: trustedIPs
label: Trusted IPs
description: Trust Forwarded Headers from specific IPs.
schema:
type: list
default: []
items:
- variable: trustedIPsEntry
label: ""
schema:
type: string
required: true
default: ""
- variable: insecureMode
label: Insecure Mode
description: Always Trust Forwarded Headers
schema:
type: boolean
default: false
templates/questions/traefik/proxyProtocol.yaml
+33
View File
@@ -0,0 +1,33 @@
- variable: proxyProtocol
label: Accept Proxy Protocol connections
description: If Proxy Protocol header parsing is enabled for the entry point, this entry point can accept connections with or without Proxy Protocol headers.
schema:
additional_attrs: true
type: dict
attrs:
- variable: enabled
label: Enable
schema:
type: boolean
default: false
show_subquestions_if: true
subquestions:
- variable: trustedIPs
label: Trusted IPs
description: Only IPs in trustedIPs will lead to remote client address replacement
schema:
type: list
default: []
items:
- variable: trustedIPsEntry
label: ""
schema:
type: string
required: true
default: ""
- variable: insecureMode
label: Insecure Mode
description: Trust every incoming connection
schema:
type: boolean
default: false
tools/build-release.sh
+10
View File
@@ -368,6 +368,16 @@ include_questions(){
/# Include{documentation}/ { for (i=0;i<n;++i) print a[i]; next } /# Include{documentation}/ { for (i=0;i<n;++i) print a[i]; next }
1' templates/questions/documentation.yaml ${target}/questions.yaml > "tmp${chartname}" && mv "tmp${chartname}" ${target}/questions.yaml 1' templates/questions/documentation.yaml ${target}/questions.yaml > "tmp${chartname}" && mv "tmp${chartname}" ${target}/questions.yaml
# Replace # Include{[forwardedHeaders]} with the standard forwardedHeaders codesnippet
awk 'NR==FNR { a[n++]=$0; next }
/# Include{forwardedHeaders}/ { for (i=0;i<n;++i) print a[i]; next }
1' templates/questions/traefik/forwardedHeaders.yaml ${target}/questions.yaml > "tmp${chartname}" && mv "tmp${chartname}" ${target}/questions.yaml
# Replace # Include{proxyProtocol} with the standard proxyProtocol codesnippet
awk 'NR==FNR { a[n++]=$0; next }
/# Include{proxyProtocol}/ { for (i=0;i<n;++i) print a[i]; next }
1' templates/questions/traefik/proxyProtocol.yaml ${target}/questions.yaml > "tmp${chartname}" && mv "tmp${chartname}" ${target}/questions.yaml
} }
export -f include_questions export -f include_questions