Skip to content

Commit 581050c

Browse files
sarthypartysarthyparty
committed
update nginx template for TLS passthrough (#2166)
Update nginx template for TLS passthrough Problem: nginx configuration templates didn't support TLS passthrough Solution: I added a template setup fro stream servers
1 parent c96fa3f commit 581050c

31 files changed

+921
-76
lines changed

‎charts/nginx-gateway-fabric/templates/deployment.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,8 @@ spec:
127127
volumeMounts:
128128
- name: nginx-conf
129129
mountPath: /etc/nginx/conf.d
130+
- name: nginx-stream-conf
131+
mountPath: /etc/nginx/stream-conf.d
130132
- name: module-includes
131133
mountPath: /etc/nginx/module-includes
132134
- name: nginx-secrets
@@ -162,6 +164,8 @@ spec:
162164
volumeMounts:
163165
- name: nginx-conf
164166
mountPath: /etc/nginx/conf.d
167+
- name: nginx-stream-conf
168+
mountPath: /etc/nginx/stream-conf.d
165169
- name: module-includes
166170
mountPath: /etc/nginx/module-includes
167171
- name: nginx-secrets
@@ -196,6 +200,8 @@ spec:
196200
volumes:
197201
- name: nginx-conf
198202
emptyDir: {}
203+
- name: nginx-stream-conf
204+
emptyDir: {}
199205
- name: module-includes
200206
emptyDir: {}
201207
- name: nginx-secrets

‎config/tests/static-deployment.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,8 @@ spec:
7070
volumeMounts:
7171
- name: nginx-conf
7272
mountPath: /etc/nginx/conf.d
73+
- name: nginx-stream-conf
74+
mountPath: /etc/nginx/stream-conf.d
7375
- name: module-includes
7476
mountPath: /etc/nginx/module-includes
7577
- name: nginx-secrets
@@ -98,6 +100,8 @@ spec:
98100
volumeMounts:
99101
- name: nginx-conf
100102
mountPath: /etc/nginx/conf.d
103+
- name: nginx-stream-conf
104+
mountPath: /etc/nginx/stream-conf.d
101105
- name: module-includes
102106
mountPath: /etc/nginx/module-includes
103107
- name: nginx-secrets
@@ -117,6 +121,8 @@ spec:
117121
volumes:
118122
- name: nginx-conf
119123
emptyDir: {}
124+
- name: nginx-stream-conf
125+
emptyDir: {}
120126
- name: module-includes
121127
emptyDir: {}
122128
- name: nginx-secrets

‎deploy/manifests/nginx-gateway-experimental.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -226,6 +226,8 @@ spec:
226226
volumeMounts:
227227
- name: nginx-conf
228228
mountPath: /etc/nginx/conf.d
229+
- name: nginx-stream-conf
230+
mountPath: /etc/nginx/stream-conf.d
229231
- name: module-includes
230232
mountPath: /etc/nginx/module-includes
231233
- name: nginx-secrets
@@ -254,6 +256,8 @@ spec:
254256
volumeMounts:
255257
- name: nginx-conf
256258
mountPath: /etc/nginx/conf.d
259+
- name: nginx-stream-conf
260+
mountPath: /etc/nginx/stream-conf.d
257261
- name: module-includes
258262
mountPath: /etc/nginx/module-includes
259263
- name: nginx-secrets
@@ -273,6 +277,8 @@ spec:
273277
volumes:
274278
- name: nginx-conf
275279
emptyDir: {}
280+
- name: nginx-stream-conf
281+
emptyDir: {}
276282
- name: module-includes
277283
emptyDir: {}
278284
- name: nginx-secrets

‎deploy/manifests/nginx-gateway.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,8 @@ spec:
222222
volumeMounts:
223223
- name: nginx-conf
224224
mountPath: /etc/nginx/conf.d
225+
- name: nginx-stream-conf
226+
mountPath: /etc/nginx/stream-conf.d
225227
- name: module-includes
226228
mountPath: /etc/nginx/module-includes
227229
- name: nginx-secrets
@@ -250,6 +252,8 @@ spec:
250252
volumeMounts:
251253
- name: nginx-conf
252254
mountPath: /etc/nginx/conf.d
255+
- name: nginx-stream-conf
256+
mountPath: /etc/nginx/stream-conf.d
253257
- name: module-includes
254258
mountPath: /etc/nginx/module-includes
255259
- name: nginx-secrets
@@ -269,6 +273,8 @@ spec:
269273
volumes:
270274
- name: nginx-conf
271275
emptyDir: {}
276+
- name: nginx-stream-conf
277+
emptyDir: {}
272278
- name: module-includes
273279
emptyDir: {}
274280
- name: nginx-secrets

‎deploy/manifests/nginx-plus-gateway-experimental.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -233,6 +233,8 @@ spec:
233233
volumeMounts:
234234
- name: nginx-conf
235235
mountPath: /etc/nginx/conf.d
236+
- name: nginx-stream-conf
237+
mountPath: /etc/nginx/stream-conf.d
236238
- name: module-includes
237239
mountPath: /etc/nginx/module-includes
238240
- name: nginx-secrets
@@ -261,6 +263,8 @@ spec:
261263
volumeMounts:
262264
- name: nginx-conf
263265
mountPath: /etc/nginx/conf.d
266+
- name: nginx-stream-conf
267+
mountPath: /etc/nginx/stream-conf.d
264268
- name: module-includes
265269
mountPath: /etc/nginx/module-includes
266270
- name: nginx-secrets
@@ -280,6 +284,8 @@ spec:
280284
volumes:
281285
- name: nginx-conf
282286
emptyDir: {}
287+
- name: nginx-stream-conf
288+
emptyDir: {}
283289
- name: module-includes
284290
emptyDir: {}
285291
- name: nginx-secrets

‎deploy/manifests/nginx-plus-gateway.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,8 @@ spec:
229229
volumeMounts:
230230
- name: nginx-conf
231231
mountPath: /etc/nginx/conf.d
232+
- name: nginx-stream-conf
233+
mountPath: /etc/nginx/stream-conf.d
232234
- name: module-includes
233235
mountPath: /etc/nginx/module-includes
234236
- name: nginx-secrets
@@ -257,6 +259,8 @@ spec:
257259
volumeMounts:
258260
- name: nginx-conf
259261
mountPath: /etc/nginx/conf.d
262+
- name: nginx-stream-conf
263+
mountPath: /etc/nginx/stream-conf.d
260264
- name: module-includes
261265
mountPath: /etc/nginx/module-includes
262266
- name: nginx-secrets
@@ -276,6 +280,8 @@ spec:
276280
volumes:
277281
- name: nginx-conf
278282
emptyDir: {}
283+
- name: nginx-stream-conf
284+
emptyDir: {}
279285
- name: module-includes
280286
emptyDir: {}
281287
- name: nginx-secrets

‎internal/mode/static/nginx/conf/nginx-plus.conf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,21 @@ http {
5454
}
5555
}
5656

57+
stream {
58+
variables_hash_bucket_size 512;
59+
variables_hash_max_size 1024;
60+
61+
map_hash_max_size 2048;
62+
map_hash_bucket_size 256;
63+
64+
log_format stream-main '$remote_addr [$time_local] '
65+
'$protocol $status $bytes_sent $bytes_received '
66+
'$session_time "$ssl_preread_server_name"';
67+
access_log /dev/stdout stream-main;
68+
69+
include /etc/nginx/stream-conf.d/*.conf;
70+
}
71+
5772
mgmt {
5873
usage_report interval=0s;
5974
}

‎internal/mode/static/nginx/conf/nginx.conf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,18 @@ http {
3838
}
3939
}
4040
}
41+
42+
stream {
43+
variables_hash_bucket_size 512;
44+
variables_hash_max_size 1024;
45+
46+
map_hash_max_size 2048;
47+
map_hash_bucket_size 256;
48+
49+
log_format stream-main '$remote_addr [$time_local] '
50+
'$protocol $status $bytes_sent $bytes_received '
51+
'$session_time "$ssl_preread_server_name"';
52+
access_log /dev/stdout stream-main;
53+
54+
include /etc/nginx/stream-conf.d/*.conf;
55+
}

‎internal/mode/static/nginx/config/base_http_config_template.go

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,20 @@ package config
22

33
const baseHTTPTemplateText = `
44
{{- if .HTTP2 }}http2 on;{{ end }}
5+
6+
# Set $gw_api_compliant_host variable to the value of $http_host unless $http_host is empty, then set it to the value
7+
# of $host. We prefer $http_host because it contains the original value of the host header, which is required by the
8+
# Gateway API. However, in an HTTP/1.0 request, it's possible that $http_host can be empty. In this case, we will use
9+
# the value of $host. See http://nginx.org/en/docs/http/ngx_http_core_module.html#var_host.
10+
map $http_host $gw_api_compliant_host {
11+
'' $host;
12+
default $http_host;
13+
}
14+
15+
# Set $connection_header variable to upgrade when the $http_upgrade header is set, otherwise, set it to close. This
16+
# allows support for websocket connections. See https://nginx.org/en/docs/http/websocket.html.
17+
map $http_upgrade $connection_upgrade {
18+
default upgrade;
19+
'' close;
20+
}
521
`

‎internal/mode/static/nginx/config/base_http_config_test.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,5 +47,7 @@ func TestExecuteBaseHttp(t *testing.T) {
4747
res := executeBaseHTTPConfig(test.conf)
4848
g.Expect(res).To(HaveLen(1))
4949
g.Expect(test.expCount).To(Equal(strings.Count(string(res[0].data), expSubStr)))
50+
g.Expect(strings.Count(string(res[0].data), "map $http_host $gw_api_compliant_host {")).To(Equal(1))
51+
g.Expect(strings.Count(string(res[0].data), "map $http_upgrade $connection_upgrade {")).To(Equal(1))
5052
}
5153
}

0 commit comments

Comments
 (0)