From b669981018476eb75666d201254a3a0bb868913f Mon Sep 17 00:00:00 2001
From: Romain <rtribotte@users.noreply.github.com>
Date: Fri, 23 May 2025 14:56:05 +0200
Subject: [PATCH] Fix panic for ingress with backend resource

Co-authored-by: Kevin Pollet <pollet.kevin@gmail.com>
---
 .../Ingress-with-backend-resource.yml         | 18 ++++++++++++++
 .../fixtures/Ingress-without-backend.yml      | 15 ++++++++++++
 pkg/provider/kubernetes/ingress/kubernetes.go | 20 +++++++++-------
 .../kubernetes/ingress/kubernetes_test.go     | 24 +++++++++++++++++++
 4 files changed, 68 insertions(+), 9 deletions(-)
 create mode 100644 pkg/provider/kubernetes/ingress/fixtures/Ingress-with-backend-resource.yml
 create mode 100644 pkg/provider/kubernetes/ingress/fixtures/Ingress-without-backend.yml

diff --git a/pkg/provider/kubernetes/ingress/fixtures/Ingress-with-backend-resource.yml b/pkg/provider/kubernetes/ingress/fixtures/Ingress-with-backend-resource.yml
new file mode 100644
index 000000000..fa113eae8
--- /dev/null
+++ b/pkg/provider/kubernetes/ingress/fixtures/Ingress-with-backend-resource.yml
@@ -0,0 +1,18 @@
+kind: Ingress
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: ""
+  namespace: testing
+
+spec:
+  rules:
+  - host: traefik.tchouk
+    http:
+      paths:
+      - path: /bar
+        backend:
+          resource:
+            kind: Service
+            name: service1
+        pathType: Prefix
+
diff --git a/pkg/provider/kubernetes/ingress/fixtures/Ingress-without-backend.yml b/pkg/provider/kubernetes/ingress/fixtures/Ingress-without-backend.yml
new file mode 100644
index 000000000..58a4cb4e6
--- /dev/null
+++ b/pkg/provider/kubernetes/ingress/fixtures/Ingress-without-backend.yml
@@ -0,0 +1,15 @@
+kind: Ingress
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: ""
+  namespace: testing
+
+spec:
+  rules:
+  - host: traefik.tchouk
+    http:
+      paths:
+      - path: /bar
+        backend: {}
+        pathType: Prefix
+
diff --git a/pkg/provider/kubernetes/ingress/kubernetes.go b/pkg/provider/kubernetes/ingress/kubernetes.go
index f83b37d45..77184492b 100644
--- a/pkg/provider/kubernetes/ingress/kubernetes.go
+++ b/pkg/provider/kubernetes/ingress/kubernetes.go
@@ -300,6 +300,17 @@ func (p *Provider) loadConfigurationFromIngresses(ctx context.Context, client Cl
 			}
 
 			for _, pa := range rule.HTTP.Paths {
+				if pa.Backend.Resource != nil {
+					// https://kubernetes.io/docs/concepts/services-networking/ingress/#resource-backend
+					log.FromContext(ctxIngress).Error("Resource backends are not supported")
+					continue
+				}
+
+				if pa.Backend.Service == nil {
+					log.FromContext(ctxIngress).Error("Missing service definition")
+					continue
+				}
+
 				service, err := p.loadService(client, ingress.Namespace, pa.Backend)
 				if err != nil {
 					log.FromContext(ctxIngress).
@@ -516,15 +527,6 @@ func getTLSConfig(tlsConfigs map[string]*tls.CertAndStores) []*tls.CertAndStores
 }
 
 func (p *Provider) loadService(client Client, namespace string, backend netv1.IngressBackend) (*dynamic.Service, error) {
-	if backend.Resource != nil {
-		// https://kubernetes.io/docs/concepts/services-networking/ingress/#resource-backend
-		return nil, errors.New("resource backends are not supported")
-	}
-
-	if backend.Service == nil {
-		return nil, errors.New("missing service definition")
-	}
-
 	service, exists, err := client.GetService(namespace, backend.Service.Name)
 	if err != nil {
 		return nil, err
diff --git a/pkg/provider/kubernetes/ingress/kubernetes_test.go b/pkg/provider/kubernetes/ingress/kubernetes_test.go
index e999e14b7..8780d83c7 100644
--- a/pkg/provider/kubernetes/ingress/kubernetes_test.go
+++ b/pkg/provider/kubernetes/ingress/kubernetes_test.go
@@ -469,6 +469,30 @@ func TestLoadConfigurationFromIngresses(t *testing.T) {
 				},
 			},
 		},
+		{
+			desc:               "Ingress with backend resource",
+			allowEmptyServices: true,
+			expected: &dynamic.Configuration{
+				TCP: &dynamic.TCPConfiguration{},
+				HTTP: &dynamic.HTTPConfiguration{
+					Middlewares: map[string]*dynamic.Middleware{},
+					Routers:     map[string]*dynamic.Router{},
+					Services:    map[string]*dynamic.Service{},
+				},
+			},
+		},
+		{
+			desc:               "Ingress without backend",
+			allowEmptyServices: true,
+			expected: &dynamic.Configuration{
+				TCP: &dynamic.TCPConfiguration{},
+				HTTP: &dynamic.HTTPConfiguration{
+					Middlewares: map[string]*dynamic.Middleware{},
+					Routers:     map[string]*dynamic.Router{},
+					Services:    map[string]*dynamic.Service{},
+				},
+			},
+		},
 		{
 			desc: "Ingress with one service without endpoint",
 			expected: &dynamic.Configuration{