homelab/traefik
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pass TLS bool from IngressRouteTCP to TCPService

Browse source
This commit is contained in:
Philipp 2024-12-17 10:12:04 +01:00 • committed by GitHub
parent 8983e45fcf
commit 189db8d990
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 103 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

46
docs/content/routing/providers/kubernetes-crd.md
View file

@ -1156,23 +1156,24 @@ Register the `IngressRouteTCP` [kind](../../reference/dynamic-configuration/kube
serversTransport: transport # [13] serversTransport: transport # [13]
nativeLB: true # [14] nativeLB: true # [14]
nodePortLB: true # [15] nodePortLB: true # [15]
tls: false # [16]
tls: # [16] tls: # [17]
secretName: supersecret # [17] secretName: supersecret # [18]
options: # [18] options: # [19]
name: opt # [19] name: opt # [20]
namespace: default # [20] namespace: default # [21]
certResolver: foo # [21] certResolver: foo # [22]
domains: # [22] domains: # [23]
- main: example.net # [23] - main: example.net # [24]
sans: # [24] sans: # [25]
- a.example.net - a.example.net
- b.example.net - b.example.net
passthrough: false # [25] passthrough: false # [26]
``` ```
| Ref | Attribute | Purpose | | Ref | Attribute | Purpose |
|------|-------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |------|-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [1] | `entryPoints` | List of [entrypoints](../routers/index.md#entrypoints_1) names | | [1] | `entryPoints` | List of [entrypoints](../routers/index.md#entrypoints_1) names |
| [2] | `routes` | List of routes | | [2] | `routes` | List of routes |
| [3] | `routes[n].match` | Defines the [rule](../routers/index.md#rule_1) of the underlying router | | [3] | `routes[n].match` | Defines the [rule](../routers/index.md#rule_1) of the underlying router |
@ -1187,17 +1188,18 @@ Register the `IngressRouteTCP` [kind](../../reference/dynamic-configuration/kube
| [12] | `services[n].proxyProtocol.version` | Defines the [PROXY protocol](../services/index.md#proxy-protocol) version | | [12] | `services[n].proxyProtocol.version` | Defines the [PROXY protocol](../services/index.md#proxy-protocol) version |
| [13] | `services[n].serversTransport` | Defines the reference to a [ServersTransportTCP](#kind-serverstransporttcp). The ServersTransport namespace is assumed to be the [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) namespace (see [ServersTransport reference](#serverstransport-reference)). | | [13] | `services[n].serversTransport` | Defines the reference to a [ServersTransportTCP](#kind-serverstransporttcp). The ServersTransport namespace is assumed to be the [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) namespace (see [ServersTransport reference](#serverstransport-reference)). |
| [14] | `services[n].nativeLB` | Controls, when creating the load-balancer, whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. | | [14] | `services[n].nativeLB` | Controls, when creating the load-balancer, whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. |
| [15] | `services[n].nodePortLB` | Controls, when creating the load-balancer, whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is | | [15] | `services[n].nodePortLB` | Controls, when creating the load-balancer, whether the LB's children are directly the nodes internal IPs when the service type is of type NodePort. |
| [16] | `tls` | Defines [TLS](../routers/index.md#tls_1) certificate configuration | | [16] | `services[n].tls` | Defines whether to use TLS when dialing with the target service. |
| [17] | `tls.secretName` | Defines the [secret](https://kubernetes.io/docs/concepts/configuration/secret/) name used to store the certificate (in the `IngressRoute` namespace) | | [17] | `tls` | Defines [TLS](../routers/index.md#tls_1) certificate configuration |
| [18] | `tls.options` | Defines the reference to a [TLSOption](#kind-tlsoption) | | [18] | `tls.secretName` | Defines the [secret](https://kubernetes.io/docs/concepts/configuration/secret/) name used to store the certificate (in the `IngressRoute` namespace) |
| [19] | `tls.options.name` | Defines the [TLSOption](#kind-tlsoption) name | | [19] | `tls.options` | Defines the reference to a [TLSOption](#kind-tlsoption) |
| [20] | `tls.options.namespace` | Defines the [TLSOption](#kind-tlsoption) namespace | | [20] | `tls.options.name` | Defines the [TLSOption](#kind-tlsoption) name |
| [21] | `tls.certResolver` | Defines the reference to a [CertResolver](../routers/index.md#certresolver_1) | | [21] | `tls.options.namespace` | Defines the [TLSOption](#kind-tlsoption) namespace |
| [22] | `tls.domains` | List of [domains](../routers/index.md#domains_1) | | [22] | `tls.certResolver` | Defines the reference to a [CertResolver](../routers/index.md#certresolver_1) |
| [23] | `tls.domains[n].main` | Defines the main domain name | | [23] | `tls.domains` | List of [domains](../routers/index.md#domains_1) |
| [24] | `tls.domains[n].sans` | List of SANs (alternative domains) | | [24] | `tls.domains[n].main` | Defines the main domain name |
| [25] | `tls.passthrough` | If `true`, delegates the TLS termination to the backend | | [25] | `tls.domains[n].sans` | List of SANs (alternative domains) |
| [26] | `tls.passthrough` | If `true`, delegates the TLS termination to the backend |
??? example "Declaring an IngressRouteTCP" ??? example "Declaring an IngressRouteTCP"

16
pkg/provider/kubernetes/crd/fixtures/tcp/with_tls_service.yml Normal file
View file

@ -0,0 +1,16 @@
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
name: test.route
namespace: default
spec:
entryPoints:
- foo
routes:
- match: HostSNI(`foo.com`)
services:
- name: whoamitcp
port: 8000
tls: true

5
pkg/provider/kubernetes/crd/kubernetes_tcp.go
View file

@ -257,6 +257,7 @@ func (p *Provider) loadTCPServers(client Client, namespace string, svc traefikv1
if addr.Type == corev1.NodeInternalIP { if addr.Type == corev1.NodeInternalIP {
servers = append(servers, dynamic.TCPServer{ servers = append(servers, dynamic.TCPServer{
Address: net.JoinHostPort(addr.Address, strconv.Itoa(int(svcPort.NodePort))), Address: net.JoinHostPort(addr.Address, strconv.Itoa(int(svcPort.NodePort))),
TLS: svc.TLS,
}) })
} }
} }
@ -272,6 +273,7 @@ func (p *Provider) loadTCPServers(client Client, namespace string, svc traefikv1
if service.Spec.Type == corev1.ServiceTypeExternalName { if service.Spec.Type == corev1.ServiceTypeExternalName {
servers = append(servers, dynamic.TCPServer{ servers = append(servers, dynamic.TCPServer{
Address: net.JoinHostPort(service.Spec.ExternalName, strconv.Itoa(int(svcPort.Port))), Address: net.JoinHostPort(service.Spec.ExternalName, strconv.Itoa(int(svcPort.Port))),
TLS: svc.TLS,
}) })
} else { } else {
nativeLB := p.NativeLBByDefault nativeLB := p.NativeLBByDefault
@ -284,7 +286,7 @@ func (p *Provider) loadTCPServers(client Client, namespace string, svc traefikv1
return nil, fmt.Errorf("getting native Kubernetes Service address: %w", err) return nil, fmt.Errorf("getting native Kubernetes Service address: %w", err)
} }
return []dynamic.TCPServer{{Address: address}}, nil return []dynamic.TCPServer{{Address: address, TLS: svc.TLS}}, nil
} }
endpointSlices, err := client.GetEndpointSlicesForService(namespace, svc.Name) endpointSlices, err := client.GetEndpointSlicesForService(namespace, svc.Name)
@ -318,6 +320,7 @@ func (p *Provider) loadTCPServers(client Client, namespace string, svc traefikv1
addresses[address] = struct{}{} addresses[address] = struct{}{}
servers = append(servers, dynamic.TCPServer{ servers = append(servers, dynamic.TCPServer{
Address: net.JoinHostPort(address, strconv.Itoa(int(port))), Address: net.JoinHostPort(address, strconv.Itoa(int(port))),
TLS: svc.TLS,
}) })
} }
} }

44
pkg/provider/kubernetes/crd/kubernetes_test.go
View file

@ -111,6 +111,50 @@ func TestLoadIngressRouteTCPs(t *testing.T) {
TLS: &dynamic.TLSConfiguration{}, TLS: &dynamic.TLSConfiguration{},
}, },
}, },
{
desc: "Simple Ingress Route, with foo entrypoint, tls encryption to service",
paths: []string{"tcp/services.yml", "tcp/with_tls_service.yml"},
expected: &dynamic.Configuration{
UDP: &dynamic.UDPConfiguration{
Routers: map[string]*dynamic.UDPRouter{},
Services: map[string]*dynamic.UDPService{},
},
HTTP: &dynamic.HTTPConfiguration{
Routers: map[string]*dynamic.Router{},
Middlewares: map[string]*dynamic.Middleware{},
Services: map[string]*dynamic.Service{},
ServersTransports: map[string]*dynamic.ServersTransport{},
},
TCP: &dynamic.TCPConfiguration{
Routers: map[string]*dynamic.TCPRouter{
"default-test.route-fdd3e9338e47a45efefc": {
EntryPoints: []string{"foo"},
Service: "default-test.route-fdd3e9338e47a45efefc",
Rule: "HostSNI(`foo.com`)",
},
},
Middlewares: map[string]*dynamic.TCPMiddleware{},
Services: map[string]*dynamic.TCPService{
"default-test.route-fdd3e9338e47a45efefc": {
LoadBalancer: &dynamic.TCPServersLoadBalancer{
Servers: []dynamic.TCPServer{
{
Address: "10.10.0.1:8000",
TLS: true,
},
{
Address: "10.10.0.2:8000",
TLS: true,
},
},
},
},
},
ServersTransports: map[string]*dynamic.TCPServersTransport{},
},
TLS: &dynamic.TLSConfiguration{},
},
},
{ {
desc: "Simple Ingress Route, with foo entrypoint and middleware", desc: "Simple Ingress Route, with foo entrypoint and middleware",
paths: []string{"tcp/services.yml", "tcp/with_middleware.yml"}, paths: []string{"tcp/services.yml", "tcp/with_middleware.yml"},