github.com/nginxinc/kubernetes-ingress@v1.12.5/internal/configs/version1/nginx.ingress.tmpl (about) 1 # configuration for {{.Ingress.Namespace}}/{{.Ingress.Name}} 2 {{range $upstream := .Upstreams}} 3 upstream {{$upstream.Name}} { 4 {{if ne $upstream.UpstreamZoneSize "0"}}zone {{$upstream.Name}} {{$upstream.UpstreamZoneSize}};{{end}} 5 {{if $upstream.LBMethod }}{{$upstream.LBMethod}};{{end}} 6 {{range $server := $upstream.UpstreamServers}} 7 server {{$server.Address}}:{{$server.Port}} max_fails={{$server.MaxFails}} fail_timeout={{$server.FailTimeout}} max_conns={{$server.MaxConns}};{{end}} 8 {{if $.Keepalive}}keepalive {{$.Keepalive}};{{end}} 9 }{{end}} 10 11 {{range $server := .Servers}} 12 server { 13 {{if not $server.GRPCOnly}} 14 {{range $port := $server.Ports}} 15 listen {{$port}}{{if $server.ProxyProtocol}} proxy_protocol{{end}}; 16 {{- end}} 17 {{end}} 18 19 {{if $server.SSL}} 20 {{if $server.TLSPassthrough}} 21 listen unix:/var/lib/nginx/passthrough-https.sock ssl{{if $server.HTTP2}} http2{{end}} proxy_protocol; 22 set_real_ip_from unix:; 23 real_ip_header proxy_protocol; 24 {{else}} 25 {{- range $port := $server.SSLPorts}} 26 listen {{$port}} ssl{{if $server.HTTP2}} http2{{end}}{{if $server.ProxyProtocol}} proxy_protocol{{end}}; 27 {{- end}} 28 {{end}} 29 {{if $server.SSLRejectHandshake}} 30 ssl_reject_handshake on; 31 {{else}} 32 ssl_certificate {{$server.SSLCertificate}}; 33 ssl_certificate_key {{$server.SSLCertificateKey}}; 34 {{end}} 35 {{end}} 36 37 {{range $setRealIPFrom := $server.SetRealIPFrom}} 38 set_real_ip_from {{$setRealIPFrom}};{{end}} 39 {{if $server.RealIPHeader}}real_ip_header {{$server.RealIPHeader}};{{end}} 40 {{if $server.RealIPRecursive}}real_ip_recursive on;{{end}} 41 42 server_tokens {{$server.ServerTokens}}; 43 44 server_name {{$server.Name}}; 45 46 set $resource_type "ingress"; 47 set $resource_name "{{$.Ingress.Name}}"; 48 set $resource_namespace "{{$.Ingress.Namespace}}"; 49 50 {{range $proxyHideHeader := $server.ProxyHideHeaders}} 51 proxy_hide_header {{$proxyHideHeader}};{{end}} 52 {{range $proxyPassHeader := $server.ProxyPassHeaders}} 53 proxy_pass_header {{$proxyPassHeader}};{{end}} 54 55 {{- if and $server.HSTS (or $server.SSL $server.HSTSBehindProxy)}} 56 set $hsts_header_val ""; 57 proxy_hide_header Strict-Transport-Security; 58 {{- if $server.HSTSBehindProxy}} 59 if ($http_x_forwarded_proto = 'https') { 60 {{else}} 61 if ($https = on) { 62 {{- end}} 63 set $hsts_header_val "max-age={{$server.HSTSMaxAge}}; {{if $server.HSTSIncludeSubdomains}}includeSubDomains; {{end}}preload"; 64 } 65 66 add_header Strict-Transport-Security "$hsts_header_val" always; 67 {{end}} 68 69 {{if $server.SSL}} 70 {{if not $server.GRPCOnly}} 71 {{- if $server.SSLRedirect}} 72 if ($scheme = http) { 73 return 301 https://$host:{{index $server.SSLPorts 0}}$request_uri; 74 } 75 {{- end}} 76 {{end}} 77 {{- end}} 78 79 {{- if $server.RedirectToHTTPS}} 80 if ($http_x_forwarded_proto = 'http') { 81 return 301 https://$host$request_uri; 82 } 83 {{- end}} 84 85 {{- if $server.ServerSnippets}} 86 {{range $value := $server.ServerSnippets}} 87 {{$value}}{{end}} 88 {{- end}} 89 90 {{range $location := $server.Locations}} 91 location {{$location.Path}} { 92 set $service "{{$location.ServiceName}}"; 93 {{with $location.MinionIngress}} 94 # location for minion {{$location.MinionIngress.Namespace}}/{{$location.MinionIngress.Name}} 95 set $resource_name "{{$location.MinionIngress.Name}}"; 96 set $resource_namespace "{{$location.MinionIngress.Namespace}}"; 97 {{end}} 98 {{if $location.GRPC}} 99 {{if not $server.GRPCOnly}} 100 error_page 400 @grpcerror400; 101 error_page 401 @grpcerror401; 102 error_page 403 @grpcerror403; 103 error_page 404 @grpcerror404; 104 error_page 405 @grpcerror405; 105 error_page 408 @grpcerror408; 106 error_page 414 @grpcerror414; 107 error_page 426 @grpcerror426; 108 error_page 500 @grpcerror500; 109 error_page 501 @grpcerror501; 110 error_page 502 @grpcerror502; 111 error_page 503 @grpcerror503; 112 error_page 504 @grpcerror504; 113 {{end}} 114 115 {{- if $location.LocationSnippets}} 116 {{range $value := $location.LocationSnippets}} 117 {{$value}}{{end}} 118 {{- end}} 119 120 grpc_connect_timeout {{$location.ProxyConnectTimeout}}; 121 grpc_read_timeout {{$location.ProxyReadTimeout}}; 122 grpc_send_timeout {{$location.ProxySendTimeout}}; 123 grpc_set_header Host $host; 124 grpc_set_header X-Real-IP $remote_addr; 125 grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 126 grpc_set_header X-Forwarded-Host $host; 127 grpc_set_header X-Forwarded-Port $server_port; 128 grpc_set_header X-Forwarded-Proto {{if $server.RedirectToHTTPS}}https{{else}}$scheme{{end}}; 129 130 {{- if $location.ProxyBufferSize}} 131 grpc_buffer_size {{$location.ProxyBufferSize}}; 132 {{- end}} 133 {{if $location.SSL}} 134 grpc_pass grpcs://{{$location.Upstream.Name}}{{$location.Rewrite}}; 135 {{else}} 136 grpc_pass grpc://{{$location.Upstream.Name}}{{$location.Rewrite}}; 137 {{end}} 138 {{else}} 139 proxy_http_version 1.1; 140 {{if $location.Websocket}} 141 proxy_set_header Upgrade $http_upgrade; 142 proxy_set_header Connection $connection_upgrade; 143 {{- else}} 144 {{- if $.Keepalive}}proxy_set_header Connection "";{{end}} 145 {{- end}} 146 147 {{- if $location.LocationSnippets}} 148 {{range $value := $location.LocationSnippets}} 149 {{$value}}{{end}} 150 {{- end}} 151 152 proxy_connect_timeout {{$location.ProxyConnectTimeout}}; 153 proxy_read_timeout {{$location.ProxyReadTimeout}}; 154 proxy_send_timeout {{$location.ProxySendTimeout}}; 155 client_max_body_size {{$location.ClientMaxBodySize}}; 156 proxy_set_header Host $host; 157 proxy_set_header X-Real-IP $remote_addr; 158 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 159 proxy_set_header X-Forwarded-Host $host; 160 proxy_set_header X-Forwarded-Port $server_port; 161 proxy_set_header X-Forwarded-Proto {{if $server.RedirectToHTTPS}}https{{else}}$scheme{{end}}; 162 proxy_buffering {{if $location.ProxyBuffering}}on{{else}}off{{end}}; 163 164 {{- if $location.ProxyBuffers}} 165 proxy_buffers {{$location.ProxyBuffers}}; 166 {{- end}} 167 {{- if $location.ProxyBufferSize}} 168 proxy_buffer_size {{$location.ProxyBufferSize}}; 169 {{- end}} 170 {{- if $location.ProxyMaxTempFileSize}} 171 proxy_max_temp_file_size {{$location.ProxyMaxTempFileSize}}; 172 {{- end}} 173 {{if $location.SSL}} 174 proxy_pass https://{{$location.Upstream.Name}}{{$location.Rewrite}}; 175 {{else}} 176 proxy_pass http://{{$location.Upstream.Name}}{{$location.Rewrite}}; 177 {{end}} 178 {{end}} 179 }{{end}} 180 {{if $server.GRPCOnly}} 181 error_page 400 @grpcerror400; 182 error_page 401 @grpcerror401; 183 error_page 403 @grpcerror403; 184 error_page 404 @grpcerror404; 185 error_page 405 @grpcerror405; 186 error_page 408 @grpcerror408; 187 error_page 414 @grpcerror414; 188 error_page 426 @grpcerror426; 189 error_page 500 @grpcerror500; 190 error_page 501 @grpcerror501; 191 error_page 502 @grpcerror502; 192 error_page 503 @grpcerror503; 193 error_page 504 @grpcerror504; 194 {{end}} 195 {{if $server.HTTP2}} 196 location @grpcerror400 { default_type application/grpc; return 400 "\n"; } 197 location @grpcerror401 { default_type application/grpc; return 401 "\n"; } 198 location @grpcerror403 { default_type application/grpc; return 403 "\n"; } 199 location @grpcerror404 { default_type application/grpc; return 404 "\n"; } 200 location @grpcerror405 { default_type application/grpc; return 405 "\n"; } 201 location @grpcerror408 { default_type application/grpc; return 408 "\n"; } 202 location @grpcerror414 { default_type application/grpc; return 414 "\n"; } 203 location @grpcerror426 { default_type application/grpc; return 426 "\n"; } 204 location @grpcerror500 { default_type application/grpc; return 500 "\n"; } 205 location @grpcerror501 { default_type application/grpc; return 501 "\n"; } 206 location @grpcerror502 { default_type application/grpc; return 502 "\n"; } 207 location @grpcerror503 { default_type application/grpc; return 503 "\n"; } 208 location @grpcerror504 { default_type application/grpc; return 504 "\n"; } 209 {{end}} 210 }{{end}}