DevOps/truecharts
2
0
Fork 0
Code Issues Pull Requests Actions 26 Packages Projects Releases 1 Wiki Activity

feat(Traefik) add support for forwarded headers (#2604)

Browse Source 
* Add support for forwardedHeaders to Traefik

* Set ForwardedHeaders config at entrypoint

* Ignore forwarded headers on main entrypoint

Also bump minor version
This commit is contained in:
Ethan Leisinger
2022-05-04 17:53:21 +02:00
committed by GitHub
parent eab8439140
commit 37e0e4f43d
4 changed files with 122 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/core/traefik/Chart.yaml
+1 -1
View File
@@ -22,7 +22,7 @@ sources:
- https://github.com/traefik/traefik-helm-chart - https://github.com/traefik/traefik-helm-chart
- https://traefik.io/ - https://traefik.io/
type: application type: application
version: 11.1.8 version: 11.2.0
annotations: annotations:
truecharts.org/catagories: | truecharts.org/catagories: |
- network - network
charts/core/traefik/questions.yaml
+90 -1
View File
@@ -551,7 +551,6 @@ questions:
required: true required: true
default: "" default: ""
- variable: service - variable: service
group: "Networking and Services" group: "Networking and Services"
label: "Configure Service Entrypoint" label: "Configure Service Entrypoint"
@@ -676,6 +675,36 @@ questions:
schema: schema:
type: string type: string
default: "websecure" default: "websecure"
- variable: forwardedHeaders
label: "Accept Forwarded Headers"
schema:
additional_attrs: true
type: dict
attrs:
- variable: enabled
label: "Enable"
schema:
type: boolean
default: false
show_subquestions_if: true
subquestions:
- variable: trustedIPs
label: "Trusted IPs"
schema:
type: list
default: []
items:
- variable: trustedIPsEntry
label: ""
schema:
type: ipaddr
required: true
default: ""
- variable: insecureMode
label: "Insecure Mode"
schema:
type: boolean
default: false
- variable: websecure - variable: websecure
label: "websecure Entrypoints Configuration" label: "websecure Entrypoints Configuration"
schema: schema:
@@ -729,6 +758,36 @@ questions:
label: "Redirect to Entrypoint" label: "Redirect to Entrypoint"
schema: schema:
type: string type: string
- variable: forwardedHeaders
label: "Accept Forwarded Headers"
schema:
additional_attrs: true
type: dict
attrs:
- variable: enabled
label: "Enable"
schema:
type: boolean
default: false
show_subquestions_if: true
subquestions:
- variable: trustedIPs
label: "Trusted IPs"
schema:
type: list
default: []
items:
- variable: trustedIPsEntry
label: ""
schema:
type: ipaddr
required: true
default: ""
- variable: insecureMode
label: "Insecure Mode"
schema:
type: boolean
default: false
- variable: tls - variable: tls
label: "websecure Entrypoints Configuration" label: "websecure Entrypoints Configuration"
schema: schema:
@@ -801,6 +860,36 @@ questions:
label: "Redirect to Entrypoint" label: "Redirect to Entrypoint"
schema: schema:
type: string type: string
- variable: forwardedHeaders
label: "Accept Forwarded Headers"
schema:
additional_attrs: true
type: dict
attrs:
- variable: enabled
label: "Enable"
schema:
type: boolean
default: false
show_subquestions_if: true
subquestions:
- variable: trustedIPs
label: "Trusted IPs"
schema:
type: list
default: []
items:
- variable: trustedIPsEntry
label: ""
schema:
type: ipaddr
required: true
default: ""
- variable: insecureMode
label: "Insecure Mode"
schema:
type: boolean
default: false
- variable: ingress - variable: ingress
label: "" label: ""
group: "Ingress" group: "Ingress"
charts/core/traefik/templates/_args.tpl
+10
View File
@@ -64,6 +64,16 @@ args:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- range $entrypoint, $config := $ports }} {{- range $entrypoint, $config := $ports }}
{{/* add args for forwardedHeaders support */}}
{{- if $config.forwardedHeaders.enabled }}
{{- if not ( empty $config.forwardedHeaders.trustedIPs ) }}
- "--entrypoints.{{ $entrypoint }}.forwardedHeaders.trustedIPs={{ join "," $config.forwardedHeaders.trustedIPs }}"
{{- end }}
{{- if $config.forwardedHeaders.insecureMode }}
- "--entrypoints.{{ $entrypoint }}.forwardedHeaders.insecure"
{{- end }}
{{- end }}
{{/* end forwardedHeaders configuration */}}
{{- if $config.redirectTo }} {{- if $config.redirectTo }}
{{- $toPort := index $ports $config.redirectTo }} {{- $toPort := index $ports $config.redirectTo }}
- "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.to=:{{ $toPort.port }}" - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.to=:{{ $toPort.port }}"
charts/core/traefik/values.yaml
+21 -1
View File
@@ -146,6 +146,9 @@ service:
port: 9000 port: 9000
targetPort: 9000 targetPort: 9000
protocol: HTTP protocol: HTTP
# -- Forwarded Headers should never be enabled on Main entrypoint
forwardedHeaders:
enabled: false
tcp: tcp:
enabled: true enabled: true
type: LoadBalancer type: LoadBalancer
@@ -155,12 +158,26 @@ service:
port: 9080 port: 9080
protocol: HTTP protocol: HTTP
redirectTo: websecure redirectTo: websecure
# -- Configure (Forwarded Headers)[https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers] Support
forwardedHeaders:
enabled: false
# -- List of trusted IP and CIDR references
trustedIPs: []
# -- Trust all forwarded headers
insecureMode: false
# Options: Empty, 0 (ingore), or positive int # Options: Empty, 0 (ingore), or positive int
# redirectPort: # redirectPort:
websecure: websecure:
enabled: true enabled: true
port: 9443 port: 9443
protocol: HTTPS protocol: HTTPS
# -- Configure (Forwarded Headers)[https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers] Support
forwardedHeaders:
enabled: false
# -- List of trusted IP and CIDR references
trustedIPs: []
# -- Trust all forwarded headers
insecureMode: false
# tcpexample: # tcpexample:
# enabled: true # enabled: true
# targetPort: 9443 # targetPort: 9443
@@ -184,6 +201,9 @@ service:
port: 9180 port: 9180
targetPort: 9180 targetPort: 9180
protocol: HTTP protocol: HTTP
# -- Forwarded Headers should never be enabled on Metrics entrypoint
forwardedHeaders:
enabled: false
udp: udp:
enabled: false enabled: false
@@ -303,7 +323,7 @@ middlewares:
redirectRegex: [] redirectRegex: []
# - name: redirectRegexName # - name: redirectRegexName
# regex: putregexhere # regex: putregexhere
# replacement: replacementurlhere # replacement: repslacementurlhere
# permanent: false # permanent: false
stripPrefixRegex: [] stripPrefixRegex: []
# - name: stripPrefixRegexName # - name: stripPrefixRegexName