DevOps/truecharts
2
0
Fork 0
Code Issues Pull Requests Actions 27 Packages Projects Releases 1 Wiki Activity

feat(common): BREAKING CHANGE change traefik middleware logic (#31498)

Browse Source 
**Description**
This PR changes how ingress handles traefik integration middlewares


Should finally complete: #28999

Fixes: #28999

Also Fixes: #28996 
Due to removing fixed middlewares completely

**⚙️ Type of change**

- [x] ⚙️ Feature/App addition
- [ ] 🪛 Bugfix
- [x] ⚠️ Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [x] 🔃 Refactor of current code

**🧪 How Has This Been Tested?**
<!--
Please describe the tests that you ran to verify your changes. Provide
instructions so we can reproduce. Please also list any relevant details
for your test configuration
-->

**📃 Notes:**
<!-- Please enter any other relevant information here -->

**✔️ Checklist:**

- [ ] ⚖️ My code follows the style guidelines of this project
- [ ] 👀 I have performed a self-review of my own code
- [ ] #️⃣ I have commented my code, particularly in hard-to-understand
areas
- [ ] 📄 I have made corresponding changes to the documentation
- [ ] ⚠️ My changes generate no new warnings
- [ ] 🧪 I have added tests to this description that prove my fix is
effective or that my feature works
- [ ] ⬆️ I increased versions for any altered app according to semantic
versioning
- [ ] I made sure the title starts with `feat(chart-name):`,
`fix(chart-name):` or `chore(chart-name):`

**➕ App addition**

If this PR is an app addition please make sure you have done the
following.

- [ ] 🖼️ I have added an icon in the Chart's root directory called
`icon.png`

---

_Please don't blindly check all the boxes. Read them and only check
those that apply.
Those checkboxes are there for the reviewer to see what is this all
about and
the status of this PR with a quick glance._

---------

Signed-off-by: Kjeld Schouten <info@kjeldschouten.nl>
Signed-off-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com>
Co-authored-by: Stavros Kois <s.kois@outlook.com>
Co-authored-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com>
This commit is contained in:
Kjeld Schouten
2025-02-01 23:33:59 +01:00
committed by GitHub
co-authored by Stavros Kois Stavros Kois
parent a759873bf5
commit 5ef1dd6055
6 changed files with 111 additions and 481 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/library/common-test/Chart.yaml
+1 -1
View File
@@ -7,7 +7,7 @@ apiVersion: v2
appVersion: unknown
dependencies:
- name: common
version: ~25.6.0
version: ~26.0.0
repository: file://../common/
condition: ""
alias: ""
charts/library/common-test/tests/ingress/traefik_test.yaml
+43 -220
View File
@@ -6,28 +6,10 @@ chart:
release:
name: test-release-name
namespace: test-release-namespace
kubernetesProvider:
scheme:
"traefik.io/v1alpha1/Middleware":
namespaced: true
gvr:
group: "traefik.io"
version: "v1alpha1"
resource: "middlewares"
objects:
- kind: Middleware
apiVersion: traefik.io/v1alpha1
metadata:
name: my-test-middleware
namespace: other-test-release-namespace
tests:
- it: should pass with ingress created with annotations from traefik
set:
global: &global
traefik:
fixedMiddlewares:
- name: chain-basic
namespace: test-release-namespace
service: &service
my-service:
enabled: true
@@ -37,6 +19,11 @@ tests:
enabled: true
primary: true
port: 80
ingressMiddlewares: &ingressMiddlewares
traefik:
my-compress:
enabled: true
type: compress
ingress:
my-ingress:
enabled: true
@@ -45,8 +32,17 @@ tests:
- host: test-host
paths:
- path: /test-path
integrations:
traefik:
middlewares:
- name: my-compress
- name: some-existing-middleware-on-this-namespace
expandObjectName: false
- name: some-existing-middleware-on-other-namespace
namespace: some-namespace
expandObjectName: false
asserts:
- documentIndex: &ingressDoc 1
- documentIndex: &ingressDoc 2
isKind:
of: Ingress
- documentIndex: *ingressDoc
@@ -59,7 +55,7 @@ tests:
content:
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-chain-basic@kubernetescrd
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-test-release-name-common-test-my-compress@kubernetescrd,test-release-namespace-some-existing-middleware-on-this-namespace@kubernetescrd,some-namespace-some-existing-middleware-on-other-namespace@kubernetescrd
- documentIndex: *ingressDoc
matchRegex:
path: metadata.annotations.checksum/secrets
@@ -76,6 +72,7 @@ tests:
- it: should pass with ingress created without traefik annotations when traefik false
set:
service: *service
ingressMiddlewares: *ingressMiddlewares
ingress:
my-ingress:
enabled: true
@@ -98,118 +95,12 @@ tests:
content:
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-chain-basic@kubernetescrd
- it: should replace local fixedMiddlewares when allowCors true
set:
service: *service
global:
traefik:
fixedMiddlewares:
- name: chain-basic
namespace: test-release-namespace
allowCorsMiddlewares:
- name: tc-opencors-chain
namespace: test-release-namespace
ingress:
my-ingress:
enabled: true
primary: true
integrations:
traefik:
enabled: true
allowCors: true
fixedMiddlewares:
- name: some-fixed-middleware
namespace: test-release-namespace
hosts: *hosts
asserts:
- documentIndex: *ingressDoc
isKind:
of: Ingress
- documentIndex: *ingressDoc
equal:
path: metadata.name
value: test-release-name-common-test
- documentIndex: *ingressDoc
isSubset:
path: metadata.annotations
content:
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-tc-opencors-chain@kubernetescrd
- it: should replace global fixedMiddlewares when allowCors true
set:
service: *service
global:
traefik:
fixedMiddlewares:
- name: chain-basic
namespace: test-release-namespace
allowCorsMiddlewares:
- name: tc-opencors-chain
namespace: test-release-namespace
ingress:
my-ingress:
enabled: true
primary: true
integrations:
traefik:
enabled: true
allowCors: true
hosts: *hosts
asserts:
- documentIndex: *ingressDoc
isKind:
of: Ingress
- documentIndex: *ingressDoc
equal:
path: metadata.name
value: test-release-name-common-test
- documentIndex: *ingressDoc
isSubset:
path: metadata.annotations
content:
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-tc-opencors-chain@kubernetescrd
- it: should replace global fixedMiddlewares when local fixedMiddlewares is defined
set:
service: *service
global: *global
ingress:
my-ingress:
enabled: true
primary: true
integrations:
traefik:
enabled: true
fixedMiddlewares:
- name: some-fixed-middleware
namespace: test-release-namespace
hosts: *hosts
asserts:
- documentIndex: *ingressDoc
isKind:
of: Ingress
- documentIndex: *ingressDoc
equal:
path: metadata.name
value: test-release-name-common-test
- documentIndex: *ingressDoc
isSubset:
path: metadata.annotations
content:
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-some-fixed-middleware@kubernetescrd
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-test-release-name-common-test-my-compress@kubernetescrd
- it: should override default entrypoint(s)
set:
service: *service
global: *global
ingressMiddlewares: *ingressMiddlewares
ingress:
my-ingress:
enabled: true
@@ -220,6 +111,8 @@ tests:
entrypoints:
- web
- websecure
middlewares:
- name: my-compress
hosts: *hosts
asserts:
- documentIndex: *ingressDoc
@@ -235,35 +128,12 @@ tests:
content:
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-chain-basic@kubernetescrd
- it: should not contain fixed middlewares when are disabled
set:
service: *service
ingress:
my-ingress:
enabled: true
primary: true
integrations:
traefik:
enabled: true
enableFixedMiddlewares: false
hosts: *hosts
asserts:
- documentIndex: *ingressDoc
isKind:
of: Ingress
- documentIndex: *ingressDoc
isSubset:
path: metadata.annotations
content:
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-test-release-name-common-test-my-compress@kubernetescrd
- it: should add the defined middlewares to the ingress
set:
service: *service
global: *global
ingressMiddlewares: *ingressMiddlewares
ingress:
my-ingress:
enabled: true
@@ -272,10 +142,10 @@ tests:
traefik:
enabled: true
middlewares:
- name: some-middleware
- name: my-compress
namespace: test-release-namespace
- name: some-other-middleware
namespace: test-release-namespace
namespace: test-other-release-namespace
hosts: *hosts
asserts:
- documentIndex: *ingressDoc
@@ -294,12 +164,12 @@ tests:
content:
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-chain-basic@kubernetescrd,test-release-namespace-some-middleware@kubernetescrd,test-release-namespace-some-other-middleware@kubernetescrd
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-test-release-name-common-test-my-compress@kubernetescrd,test-other-release-namespace-test-release-name-common-test-some-other-middleware@kubernetescrd
- it: should add the the tls annotation
set:
service: *service
global: *global
ingressMiddlewares: *ingressMiddlewares
ingress:
my-ingress:
enabled: true
@@ -310,6 +180,8 @@ tests:
forceTLS: true
entrypoints:
- web
middlewares:
- name: my-compress
hosts: *hosts
asserts:
- documentIndex: *ingressDoc
@@ -328,12 +200,12 @@ tests:
content:
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.entrypoints: web
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-chain-basic@kubernetescrd
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-test-release-name-common-test-my-compress@kubernetescrd
- it: should not add the the tls annotation
set:
service: *service
global: *global
ingressMiddlewares: *ingressMiddlewares
ingress:
my-ingress:
enabled: true
@@ -344,6 +216,8 @@ tests:
forceTLS: false
entrypoints:
- web
middlewares:
- name: my-compress
hosts: *hosts
asserts:
- documentIndex: *ingressDoc
@@ -361,42 +235,7 @@ tests:
path: metadata.annotations
content:
traefik.ingress.kubernetes.io/router.entrypoints: web
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-chain-basic@kubernetescrd
- it: should pass when a middleware does not have a namespace but exists as an object (can be looked up)
set:
service: *service
global: *global
ingress:
my-ingress1:
enabled: true
primary: true
integrations:
traefik:
enabled: true
entrypoints:
- websecure
middlewares:
- name: my-test-middleware
hosts: *hosts
asserts:
- documentIndex: *ingressDoc
isKind:
of: Ingress
- documentIndex: *ingressDoc
isKind:
of: Ingress
- documentIndex: *ingressDoc
equal:
path: metadata.name
value: test-release-name-common-test
- documentIndex: *ingressDoc
isSubset:
path: metadata.annotations
content:
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-chain-basic@kubernetescrd,other-test-release-namespace-my-test-middleware@kubernetescrd
traefik.ingress.kubernetes.io/router.middlewares: test-release-namespace-test-release-name-common-test-my-compress@kubernetescrd
# Failures
- it: should fail with entrypoint not a slice
@@ -431,26 +270,9 @@ tests:
- failedTemplate:
errorMessage: Ingress - Expected [integrations.traefik.middlewares] to be a [slice], but got [string]
- it: should fail with fixedMiddlewares not a slice
set:
service: *service
ingress:
my-ingress1:
enabled: true
primary: true
integrations:
traefik:
enabled: true
fixedMiddlewares: "not a slice"
hosts: *hosts
asserts:
- failedTemplate:
errorMessage: Ingress - Expected [integrations.traefik.fixedMiddlewares] to be a [slice], but got [string]
- it: should fail with duplicate middlewares
set:
service: *service
global: *global
ingress:
my-ingress1:
enabled: true
@@ -461,6 +283,10 @@ tests:
middlewares:
- name: chain-basic
namespace: test-release-namespace
expandObjectName: false
- name: chain-basic
namespace: test-release-namespace
expandObjectName: false
hosts: *hosts
asserts:
- failedTemplate:
@@ -484,22 +310,19 @@ tests:
- failedTemplate:
errorMessage: Ingress - Combined traefik entrypoints contain duplicates [websecure, websecure]
- it: should fail when a middleware does not have a namespace (or failed to be looked up)
- it: should fail when a middleware uses the current namespace but is not defined under ingressMiddlewares.traefik
set:
service: *service
global: *global
ingress:
my-ingress1:
my-ingress:
enabled: true
primary: true
integrations:
traefik:
enabled: true
entrypoints:
- websecure
middlewares:
- name: some-middleware
- name: my-compress
hosts: *hosts
asserts:
- failedTemplate:
errorMessage: Ingress - Middleware [some-middleware] is not defined in any namespace. Middleware should be created first.
errorMessage: Ingress - Traefik Middleware [my-compress] is not defined under [ingressMiddlewares.traefik]
charts/library/common/Chart.yaml
+1 -1
View File
@@ -48,4 +48,4 @@ sources:
- https://hub.docker.com/_/
- https://hub.docker.com/r/mikefarah/yq
type: library
version: 25.6.0
version: 26.0.0
charts/library/common/templates/lib/ingress/integrations/_traefik.tpl
+24 -76
View File
@@ -2,6 +2,12 @@
{{- $objectData := .objectData -}}
{{- $rootCtx := .rootCtx -}}
{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $rootCtx -}}
{{- $ingMiddlewares := $rootCtx.Values.ingressMiddlewares -}}
{{- if $ingMiddlewares -}}
{{- $ingMiddlewares = $ingMiddlewares.traefik | default dict -}}
{{- end -}}
{{- $traefik := $objectData.integrations.traefik -}}
{{- $enabled := true -}}
@@ -11,37 +17,11 @@
{{- if $enabled -}}
{{- include "tc.v1.common.lib.ingress.integration.traefik.validate" (dict "objectData" $objectData) -}}
{{- $fixedMiddlewares := list -}}
{{- $allowCorsMiddlewares := list -}}
{{- $enableFixed := true -}}
{{- if (hasKey $rootCtx.Values.global "traefik") -}}
{{- $fixedMiddlewares = $rootCtx.Values.global.traefik.fixedMiddlewares -}}
{{- $allowCorsMiddlewares = $rootCtx.Values.global.traefik.allowCorsMiddlewares -}}
{{- end -}}
{{/* Override global (enable)fixedMiddlewares with local */}}
{{- if $traefik.fixedMiddlewares -}}
{{- $fixedMiddlewares = $traefik.fixedMiddlewares -}}
{{- end -}}
{{- if and (hasKey $traefik "enableFixedMiddlewares") (kindIs "bool" $traefik.enableFixedMiddlewares) -}}
{{- $enableFixed = $traefik.enableFixedMiddlewares -}}
{{- end -}}
{{/* Replace global and local fixed middlewares with the allowCorsMiddlewares */}}
{{- if $traefik.allowCors -}}
{{- $fixedMiddlewares = $allowCorsMiddlewares -}}
{{- end -}}
{{- $namespace := include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Traefik Integration") -}}
{{- $entrypoints := $traefik.entrypoints | default (list "websecure") -}}
{{- $middlewares := list -}}
{{/* Add the fixedMiddlewares */}}
{{- if and $enableFixed $fixedMiddlewares -}}
{{- $middlewares = concat $middlewares $fixedMiddlewares -}}
{{- end -}}
{{/* Add the user middlewares */}}
{{- if $traefik.middlewares -}}
{{- $middlewares = concat $middlewares $traefik.middlewares -}}
@@ -52,63 +32,36 @@
{{- fail (printf "Ingress - Combined traefik entrypoints contain duplicates [%s]" (join ", " $entrypoints)) -}}
{{- end -}}
{{- $lookupMiddlewares := list -}}
{{- $parsedMiddlewares := list -}}
{{- if $middlewares -}}
{{/* Only lookup if there are defined middlewares */}}
{{- $lookupMiddlewares := (lookup "traefik.io/v1alpha1" "Middleware" "" "") -}}
{{/* If there are items, re-assign the variable */}}
{{- if and $lookupMiddlewares $lookupMiddlewares.items -}}
{{- $lookupMiddlewares = $lookupMiddlewares.items -}}
{{- else -}} {{/* If there are no items, assign an empty list */}}
{{- $lookupMiddlewares = list -}}
{{- end -}}
{{/* Parse look-ed up middlewares */}}
{{- range $m := $lookupMiddlewares -}}
{{- $name := $m.metadata.name -}}
{{- $namespace := $m.metadata.namespace -}}
{{/* Create a smaller list with only the data we want */}}
{{- $parsedMiddlewares = mustAppend $parsedMiddlewares (dict "name" $name "namespace" $namespace) -}}
{{- end -}}
{{- end -}}
{{- $formattedMiddlewares := list -}}
{{- range $mid := $middlewares -}}
{{- $midNamespace := "" -}}
{{- $midNamespace := include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $mid "caller" "Traefik Integration") -}}
{{/* If a namespace is given, use that */}}
{{- if $mid.namespace -}}
{{- $midNamespace = $mid.namespace -}}
{{- end -}}
{{- $midName := $mid.name -}}
{{- $expandName := (include "tc.v1.common.lib.util.expandName" (dict
"rootCtx" $rootCtx "objectData" $mid
"name" $mid.name "caller" "Traefik Integration"
"key" "middlewares")) -}}
{{/* If no namespace is given, try to find it */}}
{{- if not $midNamespace -}}
{{- $found := false -}}
{{- range $p := $parsedMiddlewares -}}
{{- if eq $p.name $mid.name -}}
{{- if $found -}}
{{- fail (printf "Ingress - Middleware [%s] is defined in multiple namespaces. Explicitly specify [namespace]" $mid.name) -}}
{{- end -}}
{{- $found = true -}}
{{- $midNamespace = $p.namespace -}}
{{/*
Note: if the middleware defined in ingressMiddlewares.traefik has expandObjectName: false,
it has to also be set to false here
*/}}
{{- if eq $expandName "true" -}}
{{- if eq $namespace $midNamespace -}}
{{- if not (hasKey $ingMiddlewares $mid.name) -}}
{{- fail (printf "Ingress - Traefik Middleware [%s] is not defined under [ingressMiddlewares.traefik]" $mid.name) -}}
{{- end -}}
{{- end -}}
{{- if not $found -}}
{{/* This will also display when lookup is not supported (eg dry-run) */}}
{{- fail (printf "Ingress - Middleware [%s] is not defined in any namespace. Middleware should be created first." $mid.name) -}}
{{- end -}}
{{- $midName = (printf "%s-%s" $fullname $mid.name) -}}
{{- end -}}
{{/* Format middleware */}}
{{- $formattedMiddlewares = mustAppend $formattedMiddlewares (printf "%s-%s@kubernetescrd" $midNamespace $mid.name) -}}
{{- $formattedMiddlewares = mustAppend $formattedMiddlewares (printf "%s-%s@kubernetescrd" $midNamespace $midName) -}}
{{- end -}}
{{- if $formattedMiddlewares -}}
{{/* Make sure we dont have dupes */}}
{{/* Make sure we do not have dupes */}}
{{- if not (deepEqual (mustUniq $formattedMiddlewares) $formattedMiddlewares) -}}
{{- fail (printf "Ingress - Combined traefik middlewares contain duplicates [%s]" (join ", " $formattedMiddlewares)) -}}
{{- end -}}
@@ -143,10 +96,5 @@
{{- end -}}
{{- end -}}
{{- if $traefik.fixedMiddlewares -}}
{{- if not (kindIs "slice" $traefik.fixedMiddlewares) -}}
{{- fail (printf "Ingress - Expected [integrations.traefik.fixedMiddlewares] to be a [slice], but got [%s]" (kindOf $traefik.fixedMiddlewares)) -}}
{{- end -}}
{{- end -}}
{{- end -}}
charts/library/common/values.yaml
+1 -21
View File
@@ -63,32 +63,12 @@ global:
traefik:
# -- Adds traefik annotations to services (when needed)
addServiceAnnotations: true
# Enables or disables the fixed middlewares on all ingresses
# Can be overruled per ingress
enableFixedMiddlewares: true
# Applies middleware to all ingresses
# Can be overruled per ingress
fixedMiddlewares:
- name: chain-basic
# Optional, by default will try to
# "lookup" the namespace based on the name
namespace: ""
# The middlewares to apply if allowCors toggle is enabled
allowCorsMiddlewares:
- name: tc-opencors-chain
# Optional, by default will try to
# "lookup" the namespace based on the name
namespace: ""
# -- Minimum nodePort value
minNodePort: 9000
# -- Enable to stop most pods and containers including cnpg
# does not include stand-alone pods
stopAll: false
# -- Hook to disable having a common-dependency enabled.
# Primarily used to ensure we don't include common multiple times with nested dependencies
includeCommon: true
# -- Explicitly set a namespace for this chart only
namespace: ""
@@ -235,7 +215,7 @@ credentials:
# ## Is used in cases where things are encrypted by a backup utility
# encrKey: ""
ingressMiddlewares:
ingressMiddlewares:
traefik:
tc-basic-secure-headers:
enabled: false