8000 Chery Pick #3139 #3157 (#3180) · nginx/kubernetes-ingress@1bc1a21 · GitHub
[go: up one dir, main page]
Skip to content

Commit 1bc1a21

Browse files
haywoodshciarams87tomasohaodha
authored
Chery Pick #3139 #3157 (#3180)
* Remove all IPV6 listeners in ingress resources with -disable-ipv6 command line (#3139) * Remove ipv6 listeners in ingress upstream with command line argument Co-authored-by: Venktesh <ve.patel@f5.com> (cherry picked from commit 4e6caf0) * Fix typo in Action.Proxy.ResponseHeaders (#3157) Corrected bool to []string in Action.Proxy.ResponseHeaders section (cherry picked from commit 4824823) Co-authored-by: Ciara Stacke <18287516+ciarams87@users.noreply.github.com> Co-authored-by: tomasohaodha <86358393+tomasohaodha@users.noreply.github.com>
1 parent 302e2bf commit 1bc1a21

File tree

6 files changed

+121
-10
lines changed

6 files changed

+121
-10
lines changed

‎docs/content/configuration/virtualserver-and-virtualserverroute-resources.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -631,7 +631,7 @@ The ResponseHeaders field modifies the headers of the response to the client.
631631
{{% table %}}
632632
|Field | Description | Type | Required |
633633
| ---| ---| ---| --- |
634-
|``hide`` | The headers that will not be passed* in the response to the client from a proxied upstream server. See the [proxy_hide_header](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header) directive for more information. | ``bool`` | No |
634+
|``hide`` | The headers that will not be passed* in the response to the client from a proxied upstream server. See the [proxy_hide_header](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header) directive for more information. | ``[]string`` | No |
635635
|``pass`` | Allows passing the hidden header fields* to the client from a proxied upstream server. See the [proxy_pass_header](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass_header) directive for more information. | ``[]string`` | No |
636636
|``ignore`` | Disables processing of certain headers** to the client from a proxied upstream server. See the [proxy_ignore_headers](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ignore_headers) directive for more information. | ``[]string`` | No |
637637
|``add`` | Adds headers to the response to the client. | [[]addHeader](#addheader) | No |

‎internal/configs/ingress.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,7 @@ func generateNginxCfg(ingEx *IngressEx, apResources *AppProtectResources, dosRes
156156
AppProtectEnable: cfgParams.AppProtectEnable,
157157
AppProtectLogEnable: cfgParams.AppProtectLogEnable,
158158
SpiffeCerts: cfgParams.SpiffeServerCerts,
159+
DisableIPV6: staticParams.DisableIPV6,
159160
}
160161

161162
warnings := addSSLConfig(&server, ingEx.Ingress, rule.Host, ingEx.Ingress.Spec.TLS, ingEx.SecretRefs, isWildcardEnabled)

‎internal/configs/ingress_test.go‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,25 @@ func TestGenerateNginxCfgWithWildcardTLSSecret(t *testing.T) {
152152
}
153153
}
154154

155+
func TestGenerateNginxCfgWithIPV6Disabled(t *testing.T) {
156+
t.Parallel()
157+
cafeIngressEx := createCafeIngressEx()
158+
isPlus := false
159+
configParams := NewDefaultConfigParams(isPlus)
160+
161+
expected := createExpectedConfigForCafeIngressEx(isPlus)
162+
expected.Servers[0].DisableIPV6 = true
163+
164+
result, warnings := generateNginxCfg(&cafeIngressEx, nil, nil, false, configParams, isPlus, false, &StaticConfigParams{DisableIPV6: true}, false)
165+
166+
if !cmp.Equal(expected, result) {
167+
t.Errorf("generateNginxCfg() returned unexpected result (-want +got):\n%s", cmp.Diff(expected, result))
168+
}
169+
if len(warnings) != 0 {
170+
t.Errorf("generateNginxCfg() returned warnings: %v", warnings)
171+
}
172+
}
173+
155174
func TestPathOrDefaultReturnDefault(t *testing.T) {
156175
t.Parallel()
157176
path := ""

‎internal/configs/version1/config.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ type IngressNginxConfig struct {
1515
Keepalive string
1616
Ingress Ingress
1717
SpiffeClientCerts bool
18 67E6 -
DisableIPV6 bool
1918
}
2019

2120
// Ingress holds information about an Ingress resource.

‎tests/suite/resources_utils.py‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ def scale_deployment(v1: CoreV1Api, apps_v1_api: AppsV1Api, name, namespace, val
239239
now = time.time()
240240
wait_until_all_pods_are_ready(v1, namespace)
241241
later = time.time()
242-
print(f"All pods came up in {int(later-now)} seconds")
242+
print(f"All pods came up in {int(later - now)} seconds")
243243

244244
elif value == 0:
245245
replica_num = (apps_v1_api.read_namespaced_deployment_scale(name, namespace)).spec.replicas
@@ -933,14 +933,16 @@ def clear_file_contents(v1: CoreV1Api, file_path, pod_name, pod_namespace):
933933
)
934934

935935

936-
def get_nginx_template_conf(v1: CoreV1Api, ingress_namespace) -> str:
936+
def get_nginx_template_conf(v1: CoreV1Api, ingress_namespace, ic_pod_name=None) -> str:
937937
"""
938938
Get contents of /etc/nginx/nginx.conf in the pod
939939
:param v1: CoreV1Api
940-
:param ingress_namespace:
940+
:param ingress_namespace: str
941+
:param ic_pod_name: str
941942
:return: str
942943
"""
943-
ic_pod_name = get_first_pod_name(v1, ingress_namespace)
944+
if ic_pod_name is None:
945+
ic_pod_name = get_first_pod_name(v1, ingress_namespace)
944946
file_path = "/etc/nginx/nginx.conf"
945947
return get_file_contents(v1, file_path, ic_pod_name, ingress_namespace)
946948

@@ -1117,7 +1119,7 @@ def create_ingress_controller(v1: CoreV1Api, apps_v1_api: AppsV1Api, cli_argumen
11171119
before = time.time()
11181120
wait_until_all_pods_are_ready(v1, namespace)
11191121
after = time.time()
1120-
print(f"All pods came up in {int(after-before)} seconds")
1122+
print(f"All pods came up in {int(after - before)} seconds")
11211123
print(f"Ingress Controller was created with name '{name}'")
11221124
return name
11231125

@@ -1160,7 +1162,7 @@ def create_dos_arbitrator(
11601162
before = time.time()
11611163
wait_until_all_pods_are_ready(v1, namespace)
11621164
after = time.time()
1163-
print(f"All pods came up in {int(after-before)} seconds")
1165+
print(f"All pods came up in {int(after - before)} seconds")
11641166
print(f"Dos arbitrator was created with name '{name}'")
11651167

11661168
print("create dos svc")

‎tests/suite/test_disable_ipv6.py‎

Lines changed: 92 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,26 @@
11
import pytest
2+
from settings import TEST_DATA
23
from suite.resources_utils import (
4+
create_example_app,
5+
create_items_from_yaml,
6+
create_secret_from_yaml,
7+
delete_common_app,
8+
delete_items_from_yaml,
9+
delete_secret,
10+
ensure_connection_to_public_endpoint,
311
get_first_pod_name,
12+
get_ingress_nginx_template_conf,
413
get_nginx_template_conf,
514
get_ts_nginx_template_conf,
615
wait_before_test,
16+
wait_until_all_pods_are_ready,
717
)
818
from suite.vs_vsr_resources_utils import get_vs_nginx_template_conf
19+
from suite.yaml_utils import get_name_from_yaml
920

1021

1122
@pytest.mark.vs
23+
@pytest.mark.ts
1224
@pytest.mark.parametrize(
1325
"crd_ingress_controller, virtual_server_setup, transport_server_setup",
1426
[
@@ -27,8 +39,8 @@
2739
],
2840
indirect=True,
2941
)
30-
class TestDisableIpv6:
31-
def test_ipv6_is_disabled(
42+
class TestDisableIpv6VsTs:
43+
def test_ipv6_listeners_not_in_config(
3244
self,
3345
kube_apis,
3446
ingress_controller_prerequisites,
@@ -56,3 +68,81 @@ def test_ipv6_is_disabled(
5668
assert "listen [::]:" not in nginx_config
5769
assert "listen [::]:" not in vs_config
5870
assert "listen [::]:" not in ts_config
71+
72+
73+
class IngressSetup:
74+
"""
75+
Encapsulate the ingress_setup details.
76+
77+
Attributes:
78+
ingress_name (str):
79+
ingress_pod_name (str):
80+
namespace (str):
81+
"""
82+
83+
def __init__(self, ingress_name, ingress_pod_name, namespace):
84+
self.ingress_name = ingress_name
85+
self.ingress_pod_name = ingress_pod_name
86+
self.namespace = namespace
87+
88+
89+
@pytest.fixture(scope="class")
90+
def ingress_setup(
91+
request,
92+
kube_apis,
93+
ingress_controller_prerequisites,
94+
ingress_controller_endpoint,
95+
ingress_controller,
96+
test_namespace,
97+
) -> IngressSetup:
98+
print("------------------------- Deploy Disable IPV6 Example -----------------------------------")
99+
secret_name = create_secret_from_yaml(kube_apis.v1, test_namespace, f"{TEST_DATA}/smoke/smoke-secret.yaml")
100+
create_items_from_yaml(kube_apis, f"{TEST_DATA}/smoke/standard/smoke-ingress.yaml", test_namespace)
101+
ingress_name = get_name_from_yaml(f"{TEST_DATA}/smoke/standard/smoke-ingress.yaml")
102+
create_example_app(kube_apis, "simple", test_namespace)
103+
wait_until_all_pods_are_ready(kube_apis.v1, test_namespace)
104+
105+
ensure_connection_to_public_endpoint(
106+
ingress_controller_endpoint.public_ip,
107+
ingress_controller_endpoint.port,
108+
ingress_controller_endpoint.port_ssl,
109+
)
110+
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
111+
112+
def fin():
113+
print("Clean up the Disable IPV6 Application:")
114+
delete_common_app(kube_apis, "simple", test_namespace)
115+
delete_items_from_yaml(kube_apis, f"{TEST_DATA}/smoke/standard/smoke-ingress.yaml", test_namespace)
116+
delete_secret(kube_apis.v1, secret_name, test_namespace)
117+
118+
request.addfinalizer(fin)
119+
120+
return IngressSetup(ingress_name, ic_pod_name, test_namespace)
121+
122+
123+
@pytest.mark.ingresses
124+
@pytest.mark.parametrize(
125+
"ingress_controller",
126+
[
127+
pytest.param({"extra_args": ["-disable-ipv6=true"]}),
128+
],
129+
indirect=True,
130+
)
131+
class TestDisableIPV6Ingress:
132+
def test_ipv6_listeners_not_in_config(
133+
self,
134+
kube_apis,
135+
ingress_setup,
136+
ingress_controller_prerequisites,
137+
):
138+
wait_before_test()
139+
nginx_config = get_nginx_template_conf(kube_apis.v1, ingress_controller_prerequisites.namespace)
140+
upstream_conf = get_ingress_nginx_template_conf(
141+
kube_apis.v1,
142+
ingress_setup.namespace,
143+
ingress_setup.ingress_name,
< 3E14 code>144+
ingress_setup.ingress_pod_name,
145+
ingress_controller_prerequisites.namespace,
146+
)
147+
assert "listen [::]:" not in nginx_config
148+
assert "listen [::]:" not in upstream_conf

0 commit comments

Comments
 (0)
0