homelab/traefik
1
0
Fork 0
Code Activity

Disable Cross-Namespace by default for IngressRoute provider

Browse source
This commit is contained in:
Daniel Tomcej 2021-07-13 02:48:05 -06:00 • committed by GitHub
parent 14499cd6e5
commit 3072354ca5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
8 changed files with 23 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

13
pkg/provider/kubernetes/crd/kubernetes.go
View file

@ -42,18 +42,13 @@ type Provider struct {
Token string `description:"Kubernetes bearer token (not needed for in-cluster client)." json:"token,omitempty" toml:"token,omitempty" yaml:"token,omitempty"`
CertAuthFilePath string `description:"Kubernetes certificate authority file path (not needed for in-cluster client)." json:"certAuthFilePath,omitempty" toml:"certAuthFilePath,omitempty" yaml:"certAuthFilePath,omitempty"`
Namespaces []string `description:"Kubernetes namespaces." json:"namespaces,omitempty" toml:"namespaces,omitempty" yaml:"namespaces,omitempty" export:"true"`
AllowCrossNamespace *bool `description:"Allow cross namespace resource reference." json:"allowCrossNamespace,omitempty" toml:"allowCrossNamespace,omitempty" yaml:"allowCrossNamespace,omitempty" export:"true"`
AllowCrossNamespace bool `description:"Allow cross namespace resource reference." json:"allowCrossNamespace,omitempty" toml:"allowCrossNamespace,omitempty" yaml:"allowCrossNamespace,omitempty" export:"true"`
LabelSelector string `description:"Kubernetes label selector to use." json:"labelSelector,omitempty" toml:"labelSelector,omitempty" yaml:"labelSelector,omitempty" export:"true"`
IngressClass string `description:"Value of kubernetes.io/ingress.class annotation to watch for." json:"ingressClass,omitempty" toml:"ingressClass,omitempty" yaml:"ingressClass,omitempty" export:"true"`
ThrottleDuration ptypes.Duration `description:"Ingress refresh throttle duration" json:"throttleDuration,omitempty" toml:"throttleDuration,omitempty" yaml:"throttleDuration,omitempty" export:"true"`
lastConfiguration safe.Safe
}
// SetDefaults sets the default values.
func (p *Provider) SetDefaults() {
p.AllowCrossNamespace = func(b bool) *bool { return &b }(true)
}
func (p *Provider) newK8sClient(ctx context.Context) (*clientWrapper, error) {
_, err := labels.Parse(p.LabelSelector)
if err != nil {
@ -103,7 +98,7 @@ func (p *Provider) Provide(configurationChan chan<- dynamic.Message, pool *safe.
return err
}
if p.AllowCrossNamespace == nil || *p.AllowCrossNamespace {
if p.AllowCrossNamespace {
logger.Warn("Cross-namespace reference between IngressRoutes and resources is enabled, please ensure that this is expected (see AllowCrossNamespace option)")
}
@ -826,7 +821,7 @@ func throttleEvents(ctx context.Context, throttleDuration time.Duration, pool *s
return eventsChanBuffered
}
func isNamespaceAllowed(allowCrossNamespace *bool, parentNamespace, namespace string) bool {
func isNamespaceAllowed(allowCrossNamespace bool, parentNamespace, namespace string) bool {
// If allowCrossNamespace option is not defined the default behavior is to allow cross namespace references.
return allowCrossNamespace == nil || *allowCrossNamespace || parentNamespace == namespace
return allowCrossNamespace || parentNamespace == namespace
}

2
pkg/provider/kubernetes/crd/kubernetes_http.go
View file

@ -173,7 +173,7 @@ func (p *Provider) makeMiddlewareKeys(ctx context.Context, ingRouteNamespace str
type configBuilder struct {
client Client
allowCrossNamespace *bool
allowCrossNamespace bool
}
// buildTraefikService creates the configuration for the traefik service defined in tService,

12
pkg/provider/kubernetes/crd/kubernetes_test.go
View file

@ -1153,8 +1153,7 @@ func TestLoadIngressRouteTCPs(t *testing.T) {
return
}
p := Provider{IngressClass: test.ingressClass}
p.SetDefaults()
p := Provider{IngressClass: test.ingressClass, AllowCrossNamespace: true}
clientMock := newClientMock(test.paths...)
conf := p.loadConfigurationFromCRD(context.Background(), clientMock)
@ -3338,8 +3337,7 @@ func TestLoadIngressRoutes(t *testing.T) {
return
}
p := Provider{IngressClass: test.ingressClass}
p.SetDefaults()
p := Provider{IngressClass: test.ingressClass, AllowCrossNamespace: true}
clientMock := newClientMock(test.paths...)
conf := p.loadConfigurationFromCRD(context.Background(), clientMock)
@ -3655,8 +3653,7 @@ func TestLoadIngressRouteUDPs(t *testing.T) {
return
}
p := Provider{IngressClass: test.ingressClass}
p.SetDefaults()
p := Provider{IngressClass: test.ingressClass, AllowCrossNamespace: true}
clientMock := newClientMock(test.paths...)
conf := p.loadConfigurationFromCRD(context.Background(), clientMock)
@ -4439,9 +4436,8 @@ func TestCrossNamespace(t *testing.T) {
}
p := Provider{}
p.SetDefaults()
p.AllowCrossNamespace = func(b bool) *bool { return &b }(test.allowCrossNamespace)
p.AllowCrossNamespace = test.allowCrossNamespace
conf := p.loadConfigurationFromCRD(context.Background(), client)
assert.Equal(t, test.expected, conf)
})