Skip to content

Commit 6756a2f

Browse files
sarthypartysarthyparty
committed
update nginx template for TLS passthrough (#2166)
Update nginx template for TLS passthrough Problem: nginx configuration templates didn't support TLS passthrough Solution: I added a template setup fro stream servers
1 parent 2ed7d4a commit 6756a2f

35 files changed

+943
-57
lines changed

‎charts/nginx-gateway-fabric/templates/deployment.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,8 @@ spec:
129129
volumeMounts:
130130
- name: nginx-conf
131131
mountPath: /etc/nginx/conf.d
132+
- name: nginx-stream-conf
133+
mountPath: /etc/nginx/stream-conf.d
132134
- name: module-includes
133135
mountPath: /etc/nginx/module-includes
134136
- name: nginx-secrets
@@ -166,6 +168,8 @@ spec:
166168
volumeMounts:
167169
- name: nginx-conf
168170
mountPath: /etc/nginx/conf.d
171+
- name: nginx-stream-conf
172+
mountPath: /etc/nginx/stream-conf.d
169173
- name: module-includes
170174
mountPath: /etc/nginx/module-includes
171175
- name: nginx-secrets
@@ -200,6 +204,8 @@ spec:
200204
volumes:
201205
- name: nginx-conf
202206
emptyDir: {}
207+
- name: nginx-stream-conf
208+
emptyDir: {}
203209
- name: module-includes
204210
emptyDir: {}
205211
- name: nginx-secrets

‎config/tests/static-deployment.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,8 @@ spec:
7272
volumeMounts:
7373
- name: nginx-conf
7474
mountPath: /etc/nginx/conf.d
75+
- name: nginx-stream-conf
76+
mountPath: /etc/nginx/stream-conf.d
7577
- name: module-includes
7678
mountPath: /etc/nginx/module-includes
7779
- name: nginx-secrets
@@ -102,6 +104,8 @@ spec:
102104
volumeMounts:
103105
- name: nginx-conf
104106
mountPath: /etc/nginx/conf.d
107+
- name: nginx-stream-conf
108+
mountPath: /etc/nginx/stream-conf.d
105109
- name: module-includes
106110
mountPath: /etc/nginx/module-includes
107111
- name: nginx-secrets
@@ -121,6 +125,8 @@ spec:
121125
volumes:
122126
- name: nginx-conf
123127
emptyDir: {}
128+
- name: nginx-stream-conf
129+
emptyDir: {}
124130
- name: module-includes
125131
emptyDir: {}
126132
- name: nginx-secrets

‎deploy/aws-nlb/deploy.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,8 @@ spec:
246246
volumeMounts:
247247
- mountPath: /etc/nginx/conf.d
248248
name: nginx-conf
249+
- mountPath: /etc/nginx/stream-conf.d
250+
name: nginx-stream-conf
249251
- mountPath: /etc/nginx/module-includes
250252
name: module-includes
251253
- mountPath: /etc/nginx/secrets
@@ -276,6 +278,8 @@ spec:
276278
volumeMounts:
277279
- mountPath: /etc/nginx/conf.d
278280
name: nginx-conf
281+
- mountPath: /etc/nginx/stream-conf.d
282+
name: nginx-stream-conf
279283
- mountPath: /etc/nginx/module-includes
280284
name: module-includes
281285
- mountPath: /etc/nginx/secrets
@@ -295,6 +299,8 @@ spec:
295299
volumes:
296300
- emptyDir: {}
297301
name: nginx-conf
302+
- emptyDir: {}
303+
name: nginx-stream-conf
298304
- emptyDir: {}
299305
name: module-includes
300306
- emptyDir: {}

‎deploy/azure/deploy.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,8 @@ spec:
243243
volumeMounts:
244244
- mountPath: /etc/nginx/conf.d
245245
name: nginx-conf
246+
- mountPath: /etc/nginx/stream-conf.d
247+
name: nginx-stream-conf
246248
- mountPath: /etc/nginx/module-includes
247249
name: module-includes
248250
- mountPath: /etc/nginx/secrets
@@ -273,6 +275,8 @@ spec:
273275
volumeMounts:
274276
- mountPath: /etc/nginx/conf.d
275277
name: nginx-conf
278+
- mountPath: /etc/nginx/stream-conf.d
279+
name: nginx-stream-conf
276280
- mountPath: /etc/nginx/module-includes
277281
name: module-includes
278282
- mountPath: /etc/nginx/secrets
@@ -294,6 +298,8 @@ spec:
294298
volumes:
295299
- emptyDir: {}
296300
name: nginx-conf
301+
- emptyDir: {}
302+
name: nginx-stream-conf
297303
- emptyDir: {}
298304
name: module-includes
299305
- emptyDir: {}

‎deploy/default/deploy.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,8 @@ spec:
243243
volumeMounts:
244244
- mountPath: /etc/nginx/conf.d
245245
name: nginx-conf
246+
- mountPath: /etc/nginx/stream-conf.d
247+
name: nginx-stream-conf
246248
- mountPath: /etc/nginx/module-includes
247249
name: module-includes
248250
- mountPath: /etc/nginx/secrets
@@ -273,6 +275,8 @@ spec:
273275
volumeMounts:
274276
- mountPath: /etc/nginx/conf.d
275277
name: nginx-conf
278+
- mountPath: /etc/nginx/stream-conf.d
279+
name: nginx-stream-conf
276280
- mountPath: /etc/nginx/module-includes
277281
name: module-includes
278282
- mountPath: /etc/nginx/secrets
@@ -292,6 +296,8 @@ spec:
292296
volumes:
293297
- emptyDir: {}
294298
name: nginx-conf
299+
- emptyDir: {}
300+
name: nginx-stream-conf
295301
- emptyDir: {}
296302
name: module-includes
297303
- emptyDir: {}

‎deploy/experimental-nginx-plus/deploy.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,8 @@ spec:
256256
volumeMounts:
257257
- mountPath: /etc/nginx/conf.d
258258
name: nginx-conf
259+
- mountPath: /etc/nginx/stream-conf.d
260+
name: nginx-stream-conf
259261
- mountPath: /etc/nginx/module-includes
260262
name: module-includes
261263
- mountPath: /etc/nginx/secrets
@@ -286,6 +288,8 @@ spec:
286288
volumeMounts:
287289
- mountPath: /etc/nginx/conf.d
288290
name: nginx-conf
291+
- mountPath: /etc/nginx/stream-conf.d
292+
name: nginx-stream-conf
289293
- mountPath: /etc/nginx/module-includes
290294
name: module-includes
291295
- mountPath: /etc/nginx/secrets
@@ -305,6 +309,8 @@ spec:
305309
volumes:
306310
- emptyDir: {}
307311
name: nginx-conf
312+
- emptyDir: {}
313+
name: nginx-stream-conf
308314
- emptyDir: {}
309315
name: module-includes
310316
- emptyDir: {}

‎deploy/experimental/deploy.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,8 @@ spec:
247247
volumeMounts:
248248
- mountPath: /etc/nginx/conf.d
249249
name: nginx-conf
250+
- mountPath: /etc/nginx/stream-conf.d
251+
name: nginx-stream-conf
250252
- mountPath: /etc/nginx/module-includes
251253
name: module-includes
252254
- mountPath: /etc/nginx/secrets
@@ -277,6 +279,8 @@ spec:
277279
volumeMounts:
278280
- mountPath: /etc/nginx/conf.d
279281
name: nginx-conf
282+
- mountPath: /etc/nginx/stream-conf.d
283+
name: nginx-stream-conf
280284
- mountPath: /etc/nginx/module-includes
281285
name: module-includes
282286
- mountPath: /etc/nginx/secrets
@@ -296,6 +300,8 @@ spec:
296300
volumes:
297301
- emptyDir: {}
298302
name: nginx-conf
303+
- emptyDir: {}
304+
name: nginx-stream-conf
299305
- emptyDir: {}
300306
name: module-includes
301307
- emptyDir: {}

‎deploy/nginx-plus/deploy.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,8 @@ spec:
254254
volumeMounts:
255255
- mountPath: /etc/nginx/conf.d
256256
name: nginx-conf
257+
- mountPath: /etc/nginx/stream-conf.d
258+
name: nginx-stream-conf
257259
- mountPath: /etc/nginx/module-includes
258260
name: module-includes
259261
- mountPath: /etc/nginx/secrets
@@ -284,6 +286,8 @@ spec:
284286
volumeMounts:
285287
- mountPath: /etc/nginx/conf.d
286288
name: nginx-conf
289+
- mountPath: /etc/nginx/stream-conf.d
290+
name: nginx-stream-conf
287291
- mountPath: /etc/nginx/module-includes
288292
name: module-includes
289293
- mountPath: /etc/nginx/secrets
@@ -303,6 +307,8 @@ spec:
303307
volumes:
304308
- emptyDir: {}
305309
name: nginx-conf
310+
- emptyDir: {}
311+
name: nginx-stream-conf
306312
- emptyDir: {}
307313
name: module-includes
308314
- emptyDir: {}

‎deploy/nodeport/deploy.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,8 @@ spec:
243243
volumeMounts:
244244
- mountPath: /etc/nginx/conf.d
245245
name: nginx-conf
246+
- mountPath: /etc/nginx/stream-conf.d
247+
name: nginx-stream-conf
246248
- mountPath: /etc/nginx/module-includes
247249
name: module-includes
248250
- mountPath: /etc/nginx/secrets
@@ -273,6 +275,8 @@ spec:
273275
volumeMounts:
274276
- mountPath: /etc/nginx/conf.d
275277
name: nginx-conf
278+
- mountPath: /etc/nginx/stream-conf.d
279+
name: nginx-stream-conf
276280
- mountPath: /etc/nginx/module-includes
277281
name: module-includes
278282
- mountPath: /etc/nginx/secrets
@@ -292,6 +296,8 @@ spec:
292296
volumes:
293297
- emptyDir: {}
294298
name: nginx-conf
299+
- emptyDir: {}
300+
name: nginx-stream-conf
295301
- emptyDir: {}
296302
name: module-includes
297303
- emptyDir: {}

‎deploy/openshift/deploy.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,8 @@ spec:
251251
volumeMounts:
252252
- mountPath: /etc/nginx/conf.d
253253
name: nginx-conf
254+
- mountPath: /etc/nginx/stream-conf.d
255+
name: nginx-stream-conf
254256
- mountPath: /etc/nginx/module-includes
255257
name: module-includes
256258
- mountPath: /etc/nginx/secrets
@@ -281,6 +283,8 @@ spec:
281283
volumeMounts:
282284
- mountPath: /etc/nginx/conf.d
283285
name: nginx-conf
286+
- mountPath: /etc/nginx/stream-conf.d
287+
name: nginx-stream-conf
284288
- mountPath: /etc/nginx/module-includes
285289
name: module-includes
286290
- mountPath: /etc/nginx/secrets
@@ -300,6 +304,8 @@ spec:
300304
volumes:
301305
- emptyDir: {}
302306
name: nginx-conf
307+
- emptyDir: {}
308+
name: nginx-stream-conf
303309
- emptyDir: {}
304310
name: module-includes
305311
- emptyDir: {}

‎internal/mode/static/nginx/conf/nginx-plus.conf

+15
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,21 @@ http {
5454
}
5555
}
5656

57+
stream {
58+
variables_hash_bucket_size 512;
59+
variables_hash_max_size 1024;
60+
61+
map_hash_max_size 2048;
62+
map_hash_bucket_size 256;
63+
64+
log_format stream-main '$remote_addr [$time_local] '
65+
'$protocol $status $bytes_sent $bytes_received '
66+
'$session_time "$ssl_preread_server_name"';
67+
access_log /dev/stdout stream-main;
68+
69+
include /etc/nginx/stream-conf.d/*.conf;
70+
}
71+
5772
mgmt {
5873
usage_report interval=0s;
5974
}

‎internal/mode/static/nginx/conf/nginx.conf

+15
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,18 @@ http {
3838
}
3939
}
4040
}
41+
42+
stream {
43+
variables_hash_bucket_size 512;
44+
variables_hash_max_size 1024;
45+
46+
map_hash_max_size 2048;
47+
map_hash_bucket_size 256;
48+
49+
log_format stream-main '$remote_addr [$time_local] '
50+
'$protocol $status $bytes_sent $bytes_received '
51+
'$session_time "$ssl_preread_server_name"';
52+
access_log /dev/stdout stream-main;
53+
54+
include /etc/nginx/stream-conf.d/*.conf;
55+
}

‎internal/mode/static/nginx/config/base_http_config_template.go

+16
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,20 @@ package config
22

33
const baseHTTPTemplateText = `
44
{{- if .HTTP2 }}http2 on;{{ end }}
5+
6+
# Set $gw_api_compliant_host variable to the value of $http_host unless $http_host is empty, then set it to the value
7+
# of $host. We prefer $http_host because it contains the original value of the host header, which is required by the
8+
# Gateway API. However, in an HTTP/1.0 request, it's possible that $http_host can be empty. In this case, we will use
9+
# the value of $host. See http://nginx.org/en/docs/http/ngx_http_core_module.html#var_host.
10+
map $http_host $gw_api_compliant_host {
11+
'' $host;
12+
default $http_host;
13+
}
14+
15+
# Set $connection_header variable to upgrade when the $http_upgrade header is set, otherwise, set it to close. This
16+
# allows support for websocket connections. See https://nginx.org/en/docs/http/websocket.html.
17+
map $http_upgrade $connection_upgrade {
18+
default upgrade;
19+
'' close;
20+
}
521
`

‎internal/mode/static/nginx/config/base_http_config_test.go

+2
Original file line numberDiff line numberDiff line change
@@ -47,5 +47,7 @@ func TestExecuteBaseHttp(t *testing.T) {
4747
res := executeBaseHTTPConfig(test.conf)
4848
g.Expect(res).To(HaveLen(1))
4949
g.Expect(test.expCount).To(Equal(strings.Count(string(res[0].data), expSubStr)))
50+
g.Expect(strings.Count(string(res[0].data), "map $http_host $gw_api_compliant_host {")).To(Equal(1))
51+
g.Expect(strings.Count(string(res[0].data), "map $http_upgrade $connection_upgrade {")).To(Equal(1))
5052
}
5153
}

‎internal/mode/static/nginx/config/generator.go

+10-1
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ const (
2020
// httpFolder is the folder where NGINX HTTP configuration files are stored.
2121
httpFolder = configFolder + "/conf.d"
2222

23+
// streamFolder is the folder where NGINX Stream configuration files are stored.
24+
streamFolder = configFolder + "/stream-conf.d"
25+
2326
// modulesIncludesFolder is the folder where the included "load_module" file is stored.
2427
modulesIncludesFolder = configFolder + "/module-includes"
2528

@@ -32,6 +35,9 @@ const (
3235
// httpConfigFile is the path to the configuration file with HTTP configuration.
3336
httpConfigFile = httpFolder + "/http.conf"
3437

38+
// streamConfigFile is the path to the configuration file with Stream configuration.
39+
streamConfigFile = streamFolder + "/stream.conf"
40+
3541
// configVersionFile is the path to the config version configuration file.
3642
configVersionFile = httpFolder + "/config-version.conf"
3743

@@ -43,7 +49,7 @@ const (
4349
)
4450

4551
// ConfigFolders is a list of folders where NGINX configuration files are stored.
46-
var ConfigFolders = []string{httpFolder, secretsFolder, includesFolder, modulesIncludesFolder}
52+
var ConfigFolders = []string{httpFolder, secretsFolder, includesFolder, modulesIncludesFolder, streamFolder}
4753

4854
// Generator generates NGINX configuration files.
4955
// This interface is used for testing purposes only.
@@ -168,6 +174,9 @@ func (g GeneratorImpl) getExecuteFuncs(generator policies.Generator) []executeFu
168174
executeSplitClients,
169175
executeMaps,
170176
executeTelemetry,
177+
executeStreamServers,
178+
g.executeStreamUpstreams,
179+
executeStreamMaps,
171180
}
172181
}
173182

0 commit comments

Comments
 (0)