Skip to content

Commit 14c88b4

Browse files
marcel2012marcel2012
committed
HTTP/3 change use-http3 config to enable-quic flag to not make braking changes (for deployment where 443 UDP port is not available)
1 parent e3b229c commit 14c88b4

File tree

10 files changed

+61
-38
lines changed

10 files changed

+61
-38
lines changed

‎build/dev-env.sh

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,8 @@ controller:
8989
digest:
9090
config:
9191
worker-processes: "1"
92-
use-http3: "true"
92+
extraArgs:
93+
enable-quic: "true"
9394
podLabels:
9495
deploy-date: "$(date +%s)"
9596
updateStrategy:

‎docs/user-guide/cli-arguments.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ They are set in the container spec of the `ingress-nginx-controller` Deployment
2727
| `--enable-metrics` | Enables the collection of NGINX metrics. (Default: false) |
2828
| `--enable-ssl-chain-completion` | Autocomplete SSL certificate chains with missing intermediate CA certificates. Certificates uploaded to Kubernetes must have the "Authority Information Access" X.509 v3 extension for this to succeed. (default false)|
2929
| `--enable-ssl-passthrough` | Enable SSL Passthrough. (default false) |
30+
| `--enable-quic` | Enable QUIC. (default false) |
3031
| `--disable-leader-election` | Disable Leader Election on Nginx Controller. (default false) |
3132
| `--enable-topology-aware-routing` | Enable topology aware routing feature, needs service object annotation service.kubernetes.io/topology-mode sets to auto. (default false) |
3233
| `--exclude-socket-metrics` | Set of socket request metrics to exclude which won't be exported nor being calculated. The possible socket request metrics to exclude are documented in the monitoring guide e.g. 'nginx_ingress_controller_request_duration_seconds,nginx_ingress_controller_response_size'|

‎docs/user-guide/nginx-configuration/configmap.md

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,6 @@ The following table shows a configuration option's name, type, and the default v
108108
| [brotli-min-length](#brotli-min-length) | int | 20 | |
109109
| [brotli-types](#brotli-types) | string | "application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component" | |
110110
| [use-http2](#use-http2) | bool | "true" | |
111-
| [use-http3](#use-http3) | bool | "false" | |
112111
| [gzip-disable](#gzip-disable) | string | "" | |
113112
| [gzip-level](#gzip-level) | int | 1 | |
114113
| [gzip-min-length](#gzip-min-length) | int | 256 | |
@@ -770,10 +769,6 @@ _**default:**_ `application/xml+rss application/atom+xml application/javascript
770769

771770
Enables or disables [HTTP/2](https://nginx.org/en/docs/http/ngx_http_v2_module.html) support in secure connections.
772771

773-
## use-http3
774-
775-
Enables or disables [HTTP/3](https://nginx.org/en/docs/http/ngx_http_v3_module.html) support in secure connections.
776-
777772
## gzip-disable
778773

779774
Disables [gzipping](http://nginx.org/en/docs/http/ngx_http_gzip_module.html#gzip_disable) of responses for requests with "User-Agent" header fields matching any of the specified regular expressions.

‎internal/ingress/controller/config/config.go

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -458,11 +458,6 @@ type Configuration struct {
458458
// Default: true
459459
UseHTTP2 bool `json:"use-http2,omitempty"`
460460

461-
// Enables or disables the HTTP/3 support in secure connections
462-
// https://nginx.org/en/docs/http/ngx_http_v3_module.html
463-
// Default: false
464-
UseHTTP3 bool `json:"use-http3,omitempty"`
465-
466461
// Disables gzipping of responses for requests with "User-Agent" header fields matching any of
467462
// the specified regular expressions.
468463
// http://nginx.org/en/docs/http/ngx_http_gzip_module.html#gzip_disable
@@ -862,7 +857,6 @@ func NewDefault() Configuration {
862857
VariablesHashBucketSize: 256,
863858
VariablesHashMaxSize: 2048,
864859
UseHTTP2: true,
865-
UseHTTP3: false,
866860
DisableProxyInterceptErrors: false,
867861
RelativeRedirects: false,
868862
ProxyStreamTimeout: "600s",
@@ -952,6 +946,7 @@ type TemplateConfig struct {
952946
Cfg Configuration `json:"Cfg"`
953947
IsIPV6Enabled bool `json:"IsIPV6Enabled"`
954948
IsSSLPassthroughEnabled bool `json:"IsSSLPassthroughEnabled"`
949+
IsQUICEnabled bool `json:"IsQUICEnabled"`
955950
NginxStatusIpv4Whitelist []string `json:"NginxStatusIpv4Whitelist"`
956951
NginxStatusIpv6Whitelist []string `json:"NginxStatusIpv6Whitelist"`
957952
RedirectServers interface{} `json:"RedirectServers"`

‎internal/ingress/controller/controller.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,8 @@ type Configuration struct {
101101

102102
EnableSSLPassthrough bool
103103

104+
EnableQUIC bool
105+
104106
DisableLeaderElection bool
105107

106108
EnableProfiling bool

‎internal/ingress/controller/nginx.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -620,6 +620,7 @@ func (n *NGINXController) generateTemplate(cfg ngx_config.Configuration, ingress
620620
NginxStatusIpv6Whitelist: cfg.NginxStatusIpv6Whitelist,
621621
RedirectServers: utilingress.BuildRedirects(ingressCfg.Servers),
622622
IsSSLPassthroughEnabled: n.cfg.EnableSSLPassthrough,
623+
IsQUICEnabled: n.cfg.EnableQUIC,
623624
ListenPorts: n.cfg.ListenPorts,
624625
EnableMetrics: n.cfg.EnableMetrics,
625626
MaxmindEditionFiles: n.cfg.MaxmindEditionFiles,

‎internal/ingress/controller/template/template.go

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1509,17 +1509,13 @@ func httpsListener(addresses []string, co string, tc *config.TemplateConfig) []s
15091509

15101510
out = append(out, strings.Join(lo, " "))
15111511
}
1512-
if !tc.Cfg.UseHTTP3 {
1512+
if !tc.IsQUICEnabled {
15131513
return out
15141514
}
15151515
if strings.Contains(co, "backlog=") {
15161516
klog.V(3).InfoS("Skipping HTTP/3 because of incompatible backlog parameter")
15171517
return out
15181518
}
1519-
if tc.IsSSLPassthroughEnabled {
1520-
klog.V(3).InfoS("Skipping HTTP/3 in SSL Passthrough mode")
1521-
return out
1522-
}
15231519
for _, address := range addresses {
15241520
lo := []string{"listen"}
15251521

‎pkg/flags/flags.go

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,9 @@ Requires the update-status parameter.`)
150150
enableSSLPassthrough = flags.Bool("enable-ssl-passthrough", false,
151151
`Enable SSL Passthrough.`)
152152

153+
enableQUIC = flags.Bool("enable-quic", false,
154+
`Enable QUIC.`)
155+
153156
disableLeaderElection = flags.Bool("disable-leader-election", false,
154157
`Disable Leader Election on NGINX Controller.`)
155158

@@ -275,10 +278,6 @@ https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geol
275278
return false, nil, fmt.Errorf("port %v is already in use. Please check the flag --https-port", *httpsPort)
276279
}
277280

278-
if !ing_net.IsUDPPortAvailable(*quicPort) {
279-
return false, nil, fmt.Errorf("port %v is already in use. Please check the flag --quic-port", *quicPort)
280-
}
281-
282281
if !ing_net.IsPortAvailable(*defServerPort) {
283282
return false, nil, fmt.Errorf("port %v is already in use. Please check the flag --default-server-port", *defServerPort)
284283
}
@@ -304,10 +303,18 @@ https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geol
304303
return false, nil, fmt.Errorf("port %v is already in use. Please check the flag --ssl-passthrough-proxy-port", *sslProxyPort)
305304
}
306305

306+
if *enableQUIC && !ing_net.IsUDPPortAvailable(*quicPort) {
307+
return false, nil, fmt.Errorf("port %v is already in use. Please check the flag --quic-port", *quicPort)
308+
}
309+
307310
if *publishSvc != "" && *publishStatusAddress != "" {
308311
return false, nil, fmt.Errorf("flags --publish-service and --publish-status-address are mutually exclusive")
309312
}
310313

314+
if *enableSSLPassthrough && *enableQUIC {
315+
return false, nil, fmt.Errorf("flags --enable-ssl-passthrough and --enable-quic are mutually exclusive")
316+
}
317+
311318
nginx.HealthPath = *defHealthzURL
312319

313320
if *defHealthCheckTimeout > 0 {
@@ -361,6 +368,7 @@ https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geol
361368
MonitorMaxBatchSize: *monitorMaxBatchSize,
362369
DisableServiceExternalName: *disableServiceExternalName,
363370
EnableSSLPassthrough: *enableSSLPassthrough,
371+
EnableQUIC: *enableQUIC,
364372
DisableLeaderElection: *disableLeaderElection,
365373
ResyncPeriod: *resyncPeriod,
366374
DefaultService: *defaultSvc,

‎test/data/config.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@
4848
"sslSessionTimeout": "10m",
4949
"useGzip": true,
5050
"useHttp2": true,
51-
"useHttp3": false,
5251
"proxyStreamTimeout": "600s",
5352
"workerProcesses": 1,
5453
"limitConnZoneVariable": "$remote_addr"

‎test/e2e/settings/http3.go

Lines changed: 41 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -17,41 +17,60 @@ limitations under the License.
1717
package settings
1818

1919
import (
20+
"context"
2021
"strings"
2122

2223
"github.com/onsi/ginkgo/v2"
24+
"github.com/stretchr/testify/assert"
25+
appsv1 "k8s.io/api/apps/v1"
26+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2327

2428
"k8s.io/ingress-nginx/test/e2e/framework"
2529
)
2630

2731
var _ = framework.DescribeSetting("http3", func() {
2832
f := framework.NewDefaultFramework("http3")
29-
30-
ginkgo.It("should disable HTTP/3", func() {
31-
host := "http3.com"
33+
host := "http3.com"
34+
35+
ginkgo.BeforeEach(func() {
36+
err := f.UpdateIngressControllerDeployment(func(deployment *appsv1.Deployment) error {
37+
args := deployment.Spec.Template.Spec.Containers[0].Args
38+
args = append(args, "--enable-quic")
39+
deployment.Spec.Template.Spec.Containers[0].Args = args
40+
_, err := f.KubeClientSet.AppsV1().Deployments(f.Namespace).Update(context.TODO(), deployment, metav1.UpdateOptions{})
41+
return err
42+
})
43+
assert.Nil(ginkgo.GinkgoT(), err, "updating ingress controller deployment flags")
3244
annotations := map[string]string{}
3345

3446
ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations)
3547
f.EnsureIngress(ing)
3648

37-
f.UpdateNginxConfigMapData("use-http3", "false")
38-
39-
f.WaitForNginxConfiguration(func(cfg string) bool {
40-
return !strings.Contains(cfg, "quic;")
41-
})
49+
f.WaitForNginxServer(host,
50+
func(server string) bool {
51+
return strings.Contains(server, "listen 443 quic;")
52+
})
4253
})
4354

44-
ginkgo.It("should enable HTTP/3", func() {
45-
host := "http3.com"
46-
annotations := map[string]string{}
47-
48-
ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations)
49-
f.EnsureIngress(ing)
55+
ginkgo.It("should enable HTTP/3 on a custom port", func() {
56+
err := f.UpdateIngressControllerDeployment(func(deployment *appsv1.Deployment) error {
57+
args := deployment.Spec.Template.Spec.Containers[0].Args
58+
args = append(args, "--quic-port=4321")
59+
deployment.Spec.Template.Spec.Containers[0].Args = args
60+
_, err := f.KubeClientSet.AppsV1().Deployments(f.Namespace).Update(context.TODO(), deployment, metav1.UpdateOptions{})
61+
return err
62+
})
63+
assert.Nil(ginkgo.GinkgoT(), err, "updating ingress controller deployment flags")
5064

51-
f.UpdateNginxConfigMapData("use-http3", "true")
65+
f.WaitForNginxServer(host,
66+
func(server string) bool {
67+
return strings.Contains(server, "listen 4321 quic;")
68+
})
69+
})
5270

71+
ginkgo.It("should have default http3_max_concurrent_streams value", func() {
5372
f.WaitForNginxConfiguration(func(cfg string) bool {
54-
return strings.Contains(cfg, "quic;")
73+
return strings.Contains(cfg, "http3_max_concurrent_streams 128;")
5574
})
5675
})
5776

@@ -63,6 +82,12 @@ var _ = framework.DescribeSetting("http3", func() {
6382
})
6483
})
6584

85+
ginkgo.It("should have default http3_stream_buffer_size value", func() {
86+
f.WaitForNginxConfiguration(func(cfg string) bool {
87+
return strings.Contains(cfg, "http3_stream_buffer_size 64k;")
88+
})
89+
})
90+
6691
ginkgo.It("should set http3_stream_buffer_size value", func() {
6792
f.UpdateNginxConfigMapData("http3-stream-buffer-size", "128k")
6893

0 commit comments

Comments
 (0)