homelab/traefik
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Disable ExternalName Services by default on Kubernetes providers

Browse source
This commit is contained in:
Daniel Tomcej 2021-07-13 04:54:09 -06:00 • committed by GitHub
parent 10ab39c33b
commit 3c1ed0d9b2
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
19 changed files with 637 additions and 102 deletions
Download patch file Download diff file Expand all files Collapse all files

11
pkg/provider/kubernetes/crd/kubernetes_http.go
View file

@ -49,7 +49,7 @@ func (p *Provider) loadIngressRouteConfiguration(ctx context.Context, client Cli
ingressName = ingressRoute.GenerateName
}
cb := configBuilder{client, p.AllowCrossNamespace}
cb := configBuilder{client: client, allowCrossNamespace: p.AllowCrossNamespace, allowExternalNameServices: p.AllowExternalNameServices}
for _, route := range ingressRoute.Spec.Routes {
if route.Kind != "Rule" {
@ -172,8 +172,9 @@ func (p *Provider) makeMiddlewareKeys(ctx context.Context, ingRouteNamespace str
}
type configBuilder struct {
client Client
allowCrossNamespace bool
client Client
allowCrossNamespace bool
allowExternalNameServices bool
}
// buildTraefikService creates the configuration for the traefik service defined in tService,
@ -322,6 +323,10 @@ func (c configBuilder) loadServers(parentNamespace string, svc v1alpha1.LoadBala
var servers []dynamic.Server
if service.Spec.Type == corev1.ServiceTypeExternalName {
if !c.allowExternalNameServices {
return nil, fmt.Errorf("externalName services not allowed: %s/%s", namespace, sanitizedName)
}
protocol, err := parseServiceProtocol(svc.Scheme, svcPort.Name, svcPort.Port)
if err != nil {
return nil, err