add ServersTransport on services

2020-09-11 15:40:03 +02:00 · 2020-09-11 15:40:03 +02:00 · 76f42a3013
commit 76f42a3013
parent 6075f7e8fd
64 changed files with 2359 additions and 242 deletions
--- a/docs/content/providers/kubernetes-crd.md
+++ b/docs/content/providers/kubernetes-crd.md
@ -57,7 +57,7 @@ Previous versions of Traefik used a [KV store](https://docs.traefik.io/v1.7/conf

 If you require LetsEncrypt with HA in a kubernetes environment, we recommend using [TraefikEE](https://containo.us/traefikee/) where distributed LetsEncrypt is a supported feature.

-If you are wanting to continue to run Traefik Community Edition, LetsEncrypt HA can be achieved by using a Certificate Controller such as [Cert-Manager](https://docs.cert-manager.io/en/latest/index.html).
+If you want to continue to run Traefik Community Edition, LetsEncrypt HA can be achieved by using a Certificate Controller such as [Cert-Manager](https://docs.cert-manager.io/en/latest/index.html).
 When using Cert-Manager to manage certificates, it will create secrets in your namespaces that can be referenced as TLS secrets in your [ingress objects](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls).
 When using the Traefik Kubernetes CRD Provider, unfortunately Cert-Manager cannot interface directly with the CRDs _yet_, but this is being worked on by our team.
 A workaround is to enable the [Kubernetes Ingress provider](./kubernetes-ingress.md) to allow Cert-Manager to create ingress objects to complete the challenges.
--- a/docs/content/reference/dynamic-configuration/file.toml
+++ b/docs/content/reference/dynamic-configuration/file.toml
@ -38,6 +38,7 @@
    [http.services.Service01]
      [http.services.Service01.loadBalancer]
        passHostHeader = true
+        serversTransport = "foobar"
        [http.services.Service01.loadBalancer.sticky]
          [http.services.Service01.loadBalancer.sticky.cookie]
            name = "foobar"
@ -264,6 +265,41 @@
    [http.middlewares.Middleware22]
      [http.middlewares.Middleware22.stripPrefixRegex]
        regex = ["foobar", "foobar"]
+  [http.serversTransports]
+    [http.serversTransports.ServersTransport0]
+      serverName = "foobar"
+      insecureSkipVerify = true
+      rootCAs = ["foobar", "foobar"]
+      maxIdleConnsPerHost = 42
+
+      [[http.serversTransports.ServersTransport0.certificates]]
+        certFile = "foobar"
+        keyFile = "foobar"
+
+      [[http.serversTransports.ServersTransport0.certificates]]
+        certFile = "foobar"
+        keyFile = "foobar"
+      [http.serversTransports.ServersTransport0.forwardingTimeouts]
+        dialTimeout = "42s"
+        responseHeaderTimeout = "42s"
+        idleConnTimeout = "42s"
+    [http.serversTransports.ServersTransport1]
+      serverName = "foobar"
+      insecureSkipVerify = true
+      rootCAs = ["foobar", "foobar"]
+      maxIdleConnsPerHost = 42
+
+      [[http.serversTransports.ServersTransport1.certificates]]
+        certFile = "foobar"
+        keyFile = "foobar"
+
+      [[http.serversTransports.ServersTransport1.certificates]]
+        certFile = "foobar"
+        keyFile = "foobar"
+      [http.serversTransports.ServersTransport1.forwardingTimeouts]
+        dialTimeout = "42s"
+        responseHeaderTimeout = "42s"
+        idleConnTimeout = "42s"

 [tcp]
  [tcp.routers]
--- a/docs/content/reference/dynamic-configuration/file.yaml
+++ b/docs/content/reference/dynamic-configuration/file.yaml
@ -70,6 +70,7 @@ http:
        passHostHeader: true
        responseForwarding:
          flushInterval: foobar
+        serversTransport: foobar
    Service02:
      mirroring:
        service: foobar
@ -301,6 +302,39 @@ http:
        regex:
        - foobar
        - foobar
+  serversTransports:
+    ServersTransport0:
+      serverName: foobar
+      insecureSkipVerify: true
+      rootCAs:
+      - foobar
+      - foobar
+      certificates:
+      - certFile: foobar
+        keyFile: foobar
+      - certFile: foobar
+        keyFile: foobar
+      maxIdleConnsPerHost: 42
+      forwardingTimeouts:
+        dialTimeout: 42s
+        responseHeaderTimeout: 42s
+        idleConnTimeout: 42s
+    ServersTransport1:
+      serverName: foobar
+      insecureSkipVerify: true
+      rootCAs:
+      - foobar
+      - foobar
+      certificates:
+      - certFile: foobar
+        keyFile: foobar
+      - certFile: foobar
+        keyFile: foobar
+      maxIdleConnsPerHost: 42
+      forwardingTimeouts:
+        dialTimeout: 42s
+        responseHeaderTimeout: 42s
+        idleConnTimeout: 42s
 tcp:
  routers:
    TCPRouter0:
--- a/docs/content/reference/dynamic-configuration/kubernetes-crd-definition.yml
+++ b/docs/content/reference/dynamic-configuration/kubernetes-crd-definition.yml
@ -101,3 +101,18 @@ spec:
    plural: traefikservices
    singular: traefikservice
  scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serverstransports.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: ServersTransport
+    plural: serverstransports
+    singular: serverstransport
+  scope: Namespaced
--- a/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml
+++ b/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml
@ -40,6 +40,7 @@ rules:
      - ingressrouteudps
      - tlsoptions
      - tlsstores
+      - serverstransports
    verbs:
      - get
      - list
--- a/docs/content/reference/dynamic-configuration/kubernetes-crd-resource.yml
+++ b/docs/content/reference/dynamic-configuration/kubernetes-crd-resource.yml
@ -186,3 +186,25 @@ spec:
    clientAuthType: foobar
  sniStrict: true
  preferServerCipherSuites: true
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: ServersTransport
+metadata:
+  name: mytransport
+  namespace: default
+
+spec:
+  serverName: foobar
+  insecureSkipVerify: true
+  rootCAsSecrets:
+    - foobar
+    - foobar
+  certificatesSecrets:
+    - foobar
+    - foobar
+  maxIdleConnsPerHost: 1
+  forwardingTimeouts:
+    dialTimeout: 42s
+    responseHeaderTimeout: 42s
+    idleConnTimeout: 42s
--- a/docs/content/reference/dynamic-configuration/kv-ref.md
+++ b/docs/content/reference/dynamic-configuration/kv-ref.md
@ -159,6 +159,30 @@
 | `traefik/http/routers/Router1/tls/domains/1/sans/0` | `foobar` |
 | `traefik/http/routers/Router1/tls/domains/1/sans/1` | `foobar` |
 | `traefik/http/routers/Router1/tls/options` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/certificates/0/certFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/certificates/0/keyFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/certificates/1/certFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/certificates/1/keyFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/dialTimeout` | `42s` |
+| `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/idleConnTimeout` | `42s` |
+| `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/responseHeaderTimeout` | `42s` |
+| `traefik/http/serversTransports/ServersTransport0/insecureSkipVerify` | `true` |
+| `traefik/http/serversTransports/ServersTransport0/maxIdleConnsPerHost` | `42` |
+| `traefik/http/serversTransports/ServersTransport0/rootCAs/0` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/rootCAs/1` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/serverName` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/certificates/0/certFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/certificates/0/keyFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/certificates/1/certFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/certificates/1/keyFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/dialTimeout` | `42s` |
+| `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/idleConnTimeout` | `42s` |
+| `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/responseHeaderTimeout` | `42s` |
+| `traefik/http/serversTransports/ServersTransport1/insecureSkipVerify` | `true` |
+| `traefik/http/serversTransports/ServersTransport1/maxIdleConnsPerHost` | `42` |
+| `traefik/http/serversTransports/ServersTransport1/rootCAs/0` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/rootCAs/1` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/serverName` | `foobar` |
 | `traefik/http/services/Service01/loadBalancer/healthCheck/followRedirects` | `true` |
 | `traefik/http/services/Service01/loadBalancer/healthCheck/headers/name0` | `foobar` |
 | `traefik/http/services/Service01/loadBalancer/healthCheck/headers/name1` | `foobar` |
@ -172,6 +196,7 @@
 | `traefik/http/services/Service01/loadBalancer/responseForwarding/flushInterval` | `foobar` |
 | `traefik/http/services/Service01/loadBalancer/servers/0/url` | `foobar` |
 | `traefik/http/services/Service01/loadBalancer/servers/1/url` | `foobar` |
+| `traefik/http/services/Service01/loadBalancer/serversTransport` | `foobar` |
 | `traefik/http/services/Service01/loadBalancer/sticky/cookie/httpOnly` | `true` |
 | `traefik/http/services/Service01/loadBalancer/sticky/cookie/name` | `foobar` |
 | `traefik/http/services/Service01/loadBalancer/sticky/cookie/sameSite` | `foobar` |
--- a/docs/content/routing/providers/kubernetes-crd.md
+++ b/docs/content/routing/providers/kubernetes-crd.md
@ -1488,9 +1488,9 @@ or referencing TLS stores in the [`IngressRoute`](#kind-ingressroute) / [`Ingres
        secretName: mySecret                      # [1]
    ```

-| Ref | Attribute                   | Purpose                                                                                                                                                                    |
-|-----|-----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| [1] | `secretName`                | The name of the referenced Kubernetes [Secret](https://kubernetes.io/docs/concepts/configuration/secret/) that holds the default certificate for the store.                                                                             |
+| Ref | Attribute    | Purpose                                                                                                                                                     |
+|-----|--------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [1] | `secretName` | The name of the referenced Kubernetes [Secret](https://kubernetes.io/docs/concepts/configuration/secret/) that holds the default certificate for the store. |

 ??? example "Declaring and referencing a TLSStore"
   
@ -1537,6 +1537,84 @@ or referencing TLS stores in the [`IngressRoute`](#kind-ingressroute) / [`Ingres
      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
    ```

+### Kind: `ServersTransport`
+
+`ServersTransport` is the CRD implementation of a [ServersTransport](../services/index.md#serverstransport).
+
+!!! important "Default serversTransport"
+    If no `serversTransport` is specified, the `default@internal` will be used. 
+    The `default@internal` serversTransport is created from the [static configuration](../overview.md#transport-configuration). 
+
+!!! info "ServersTransport Attributes"
+   
+    ```yaml tab="TLSStore"
+    apiVersion: traefik.containo.us/v1alpha1
+    kind: ServersTransport
+    metadata:
+      name: mytransport
+      namespace: default
+    
+    spec:
+      serverName: foobar               # [1]
+      insecureSkipVerify: true         # [2]
+      rootCAsSecrets:                  # [3]
+        - foobar
+        - foobar
+      certificatesSecrets:             # [4]
+        - foobar
+        - foobar
+      maxIdleConnsPerHost: 1           # [5]
+      forwardingTimeouts:              # [6]
+        dialTimeout: 42s               # [7]
+        responseHeaderTimeout: 42s     # [8]
+        idleConnTimeout: 42s           # [9]
+    ```
+
+| Ref | Attribute               | Purpose                                                                                                                                              |
+|-----|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [1] | `serverName`            | ServerName used to contact the server.                                                                                                               |
+| [2] | `insecureSkipVerify`    | Disable SSL certificate verification.                                                                                                                |
+| [3] | `rootCAsSecrets`        | Add cert file for self-signed certificate.                                                                                                           |
+| [4] | `certificatesSecrets`   | Certificates for mTLS.                                                                                                                               |
+| [5] | `maxIdleConnsPerHost`   | If non-zero, controls the maximum idle (keep-alive) to keep per-host. If zero, `defaultMaxIdleConnsPerHost` is used.                                 |
+| [6] | `forwardingTimeouts`    | Timeouts for requests forwarded to the backend servers.                                                                                              |
+| [7] | `dialTimeout`           | The amount of time to wait until a connection to a backend server can be established. If zero, no timeout exists.                                    |
+| [8] | `responseHeaderTimeout` | The amount of time to wait for a server's response headers after fully writing the request (including its body, if any). If zero, no timeout exists. |
+| [9] | `idleConnTimeout`       | The maximum period for which an idle HTTP keep-alive connection will remain open before closing itself.                                              |
+
+??? example "Declaring and referencing a ServersTransport"
+   
+    ```yaml tab="ServersTransport"
+    apiVersion: traefik.containo.us/v1alpha1
+    kind: ServersTransport
+    metadata:
+      name: mytransport
+      namespace: default
+    
+    spec:
+      serverName: example.org
+      insecureSkipVerify: true
+    ```
+    
+    ```yaml tab="IngressRoute"
+    apiVersion: traefik.containo.us/v1alpha1
+    kind: IngressRoute
+    metadata:
+      name: testroute
+      namespace: default
+    
+    spec:
+      entryPoints:
+        - web
+      routes:
+      - match: Host(`example.com`)
+        kind: Rule
+        services:
+        - name: whoami
+          port: 80
+          serversTransport: mytransport
+    ```
+
 ## Further

 Also see the [full example](../../user-guides/crd-acme/index.md) with Let's Encrypt.
--- a/docs/content/routing/services/index.md
+++ b/docs/content/routing/services/index.md
@ -460,6 +460,33 @@ By default, `passHostHeader` is true.
            passHostHeader: false
    ```

+#### ServersTransport
+
+`serversTransport` allows to reference a ServersTransport configuration for the communication between Traefik and your servers.
+
+??? example "Specify a transport -- Using the [File Provider](../../providers/file.md)"
+
+    ```toml tab="TOML"
+    ## Dynamic configuration
+    [http.services]
+      [http.services.Service01]
+        [http.services.Service01.loadBalancer]
+          serversTransport = "mytransport"
+    ```
+
+    ```yaml tab="YAML"
+    ## Dynamic configuration
+    http:
+      services:
+        Service01:
+          loadBalancer:
+            serversTransport = "mytransport"
+    ```
+
+!!! info default serversTransport
+    If no serversTransport is specified, the `default@internal` will be used. 
+    The `default@internal` serversTransport is created from the [static configuration](../overview.md#transport-configuration). 
+
 #### Response Forwarding

 This section is about configuring how Traefik forwards the response from the backend server to the client.
@ -492,6 +519,301 @@ Below are the available options for the Response Forwarding mechanism:
              flushInterval: 1s
    ```

+### ServersTransport
+
+ServersTransport allows to configure the transport between Traefik and your servers.
+
+#### `ServerName`
+
+_Optional_
+
+`serverName` configure the server name that will be used for SNI.
+
+```toml tab="File (TOML)"
+## Dynamic configuration
+[http.serversTransports.mytransport]
+  serverName = "myhost"
+```
+
+```yaml tab="File (YAML)"
+## Dynamic configuration
+http:
+  serversTransports:
+    mytransport:
+      serverName: "myhost"
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: ServersTransport
+metadata:
+  name: mytransport
+  namespace: default
+
+spec:
+    serverName: "test"
+```
+
+#### `Certificates`
+
+_Optional_
+
+`certificates` is the list of certificates (as file paths, or data bytes)
+that will be set as client certificates for mTLS.
+
+```toml tab="File (TOML)"
+## Dynamic configuration
+[[http.serversTransports.mytransport.certificates]]
+  certFile = "foo.crt"
+  keyFile = "bar.crt"
+```
+
+```yaml tab="File (YAML)"
+## Dynamic configuration
+http:
+  serversTransports:
+    mytransport:
+      certficates:
+        - certFile: foo.crt
+          keyFile: bar.crt
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: ServersTransport
+metadata:
+  name: mytransport
+  namespace: default
+
+spec:
+    certificatesSecrets:
+    - mycert
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mycert
+    
+  data:
+    tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+    tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+```
+
+#### `insecureSkipVerify`
+
+_Optional_
+
+`insecureSkipVerify` disables SSL certificate verification.
+
+```toml tab="File (TOML)"
+## Dynamic configuration
+[http.serversTransports.mytransport]
+  insecureSkipVerify = true
+```
+
+```yaml tab="File (YAML)"
+## Dynamic configuration
+http:
+  serversTransports:
+    mytransport:
+      insecureSkipVerify: true
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: ServersTransport
+metadata:
+  name: mytransport
+  namespace: default
+
+spec:
+    insecureSkipVerify: true
+```
+
+#### `rootCAs`
+
+_Optional_
+
+`rootCAs` is the list of certificates (as file paths, or data bytes)
+that will be set as Root Certificate Authorities when using a self-signed TLS certificate.
+
+```toml tab="File (TOML)"
+## Dynamic configuration
+[http.serversTransports.mytransport]
+  rootCAs = ["foo.crt", "bar.crt"]
+```
+
+```yaml tab="File (YAML)"
+## Dynamic configuration
+http:
+  serversTransports:
+    mytransport:
+      rootCAs:
+        - foo.crt
+        - bar.crt
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: ServersTransport
+metadata:
+  name: mytransport
+  namespace: default
+
+spec:
+    rootCAsSecrets:
+    - myca
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: myca
+    
+  data:
+    tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+```
+
+#### `maxIdleConnsPerHost`
+
+_Optional, Default=2_
+
+If non-zero, `maxIdleConnsPerHost` controls the maximum idle (keep-alive) connections to keep per-host.
+
+```toml tab="File (TOML)"
+## Dynamic configuration
+[http.serversTransports.mytransport]
+  maxIdleConnsPerHost = 7
+```
+
+```yaml tab="File (YAML)"
+## Dynamic configuration
+http:
+  serversTransports:
+    mytransport:
+      maxIdleConnsPerHost: 7
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: ServersTransport
+metadata:
+  name: mytransport
+  namespace: default
+
+spec:
+    maxIdleConnsPerHost: 7
+```
+
+#### `forwardingTimeouts`
+
+`forwardingTimeouts` is about a number of timeouts relevant to when forwarding requests to the backend servers.
+
+##### `forwardingTimeouts.dialTimeout`
+
+_Optional, Default=30s_
+
+`dialTimeout` is the maximum duration allowed for a connection to a backend server to be established.
+Zero means no timeout.
+
+```toml tab="File (TOML)"
+## Dynamic configuration
+[http.serversTransports.mytransport.forwardingTimeouts]
+  dialTimeout = "1s"
+```
+
+```yaml tab="File (YAML)"
+## Dynamic configuration
+http:
+  serversTransports:
+    mytransport:
+      forwardingTimeouts:
+        dialTimeout: "1s"
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: ServersTransport
+metadata:
+  name: mytransport
+  namespace: default
+
+spec:
+    forwardingTimeouts:
+      dialTimeout: "1s"
+```
+
+##### `forwardingTimeouts.responseHeaderTimeout`
+
+_Optional, Default=0s_
+
+`responseHeaderTimeout`, if non-zero, specifies the amount of time to wait for a server's response headers
+after fully writing the request (including its body, if any).
+This time does not include the time to read the response body.
+Zero means no timeout.
+
+```toml tab="File (TOML)"
+## Dynamic configuration
+[http.serversTransports.mytransport.forwardingTimeouts]
+  responseHeaderTimeout = "1s"
+```
+
+```yaml tab="File (YAML)"
+## Dynamic configuration
+http:
+  serversTransports:
+    mytransport:
+      forwardingTimeouts:
+        responseHeaderTimeout: "1s"
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: ServersTransport
+metadata:
+  name: mytransport
+  namespace: default
+
+spec:
+    forwardingTimeouts:
+      responseHeaderTimeout: "1s"
+```
+
+##### `forwardingTimeouts.idleConnTimeout`
+
+_Optional, Default=90s_
+
+`idleConnTimeout`, is the maximum amount of time an idle (keep-alive) connection
+will remain idle before closing itself.
+Zero means no limit.
+
+```toml tab="File (TOML)"
+## Dynamic configuration
+[http.serversTransports.mytransport.forwardingTimeouts]
+  idleConnTimeout = "1s"
+```
+
+```yaml tab="File (YAML)"
+## Dynamic configuration
+http:
+  serversTransports:
+    mytransport:
+      forwardingTimeouts:
+        idleConnTimeout: "1s"
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: ServersTransport
+metadata:
+  name: mytransport
+  namespace: default
+
+spec:
+    forwardingTimeouts:
+      idleConnTimeout: "1s"
+```
+
 ### Weighted Round Robin (service)

 The WRR is able to load balance the requests between multiple services based on weights.