Skip to content

Commit f87edc9

Browse files
vepatelvepatel
authored
Merge branch 'main' into certs
2 parents 33b2e02 + 470c65b commit f87edc9

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+3103
-442
lines changed

‎.github/workflows/build-oss.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ jobs:
201201

202202
- name: Run Docker Scout vulnerability scanner
203203
id: docker-scout
204-
uses: docker/scout-action@cc6bf8dd03587425ef920278b3e2726ba8d791e8 # v1.14.0
204+
uses: docker/scout-action@e1c0d589b972d5605e035bbf74ed95cfc306d597 # v1.15.0
205205
with:
206206
command: cves,recommendations
207207
image: ${{ steps.meta.outputs.tags }}

‎.github/workflows/build-plus.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@ jobs:
222222

223223
- name: Run Docker Scout vulnerability scanner
224224
id: docker-scout
225-
uses: docker/scout-action@cc6bf8dd03587425ef920278b3e2726ba8d791e8 # v1.14.0
225+
uses: docker/scout-action@e1c0d589b972d5605e035bbf74ed95cfc306d597 # v1.15.0
226226
with:
227227
command: cves,recommendations
228228
image: ${{ steps.meta.outputs.tags }}

‎.github/workflows/docs-build-push.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ permissions:
3131

3232
jobs:
3333
call-docs-build-push:
34-
uses: nginxinc/docs-actions/.github/workflows/docs-build-push.yml@69843fb5d009e99750e50c23e90c23a899e4637e # v1.0.6
34+
uses: nginxinc/docs-actions/.github/workflows/docs-build-push.yml@9c59fab05a8131f4d691ba6ea2b6a119f3ef832a # v1.0.7
3535
permissions:
3636
pull-requests: write # needed to write preview url comment to PR
3737
contents: read

‎.github/workflows/image-promotion.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -449,7 +449,7 @@ jobs:
449449

450450
- name: Run Docker Scout vulnerability scanner
451451
id: docker-scout
452-
uses: docker/scout-action@cc6bf8dd03587425ef920278b3e2726ba8d791e8 # v1.14.0
452+
uses: docker/scout-action@e1c0d589b972d5605e035bbf74ed95cfc306d597 # v1.15.0
453453
with:
454454
command: cves,recommendations
455455
image: ${{ steps.meta.outputs.tags }}
@@ -539,7 +539,7 @@ jobs:
539539

540540
- name: Run Docker Scout vulnerability scanner
541541
id: docker-scout
542-
uses: docker/scout-action@cc6bf8dd03587425ef920278b3e2726ba8d791e8 # v1.14.0
542+
uses: docker/scout-action@e1c0d589b972d5605e035bbf74ed95cfc306d597 # v1.15.0
543543
with:
544544
command: cves,recommendations
545545
image: ${{ steps.meta.outputs.tags }}
@@ -636,7 +636,7 @@ jobs:
636636

637637
- name: Run Docker Scout vulnerability scanner
638638
id: docker-scout
639-
uses: docker/scout-action@cc6bf8dd03587425ef920278b3e2726ba8d791e8 # v1.14.0
639+
uses: docker/scout-action@e1c0d589b972d5605e035bbf74ed95cfc306d597 # v1.15.0
640640
with:
641641
command: cves,recommendations
642642
image: ${{ steps.meta.outputs.tags }}

‎build/Dockerfile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ ARG PACKAGE_REPO=pkgs.nginx.com
1111

1212

1313
############################################# Base images containing libs for Opentracing and FIPS #############################################
14-
FROM ghcr.io/nginxinc/dependencies/nginx-ot:nginx-1.27.2@sha256:8604f87032b5fadfc4701a29cd78463df30f4a7e02bc6956f4d257b935931d32 AS opentracing-lib
15-
FROM ghcr.io/nginxinc/dependencies/nginx-ot:nginx-1.27.2-alpine@sha256:f5ada6e7e7b550cb6d8b20eb986f2c22e8ff32b846b4a8205e3ed11989bf27d4 AS alpine-opentracing-lib
14+
FROM ghcr.io/nginxinc/dependencies/nginx-ot:nginx-1.27.2@sha256:4962146a8305c718c8cc66b99063640b04676d13f893498e5eab9a2e63816e2c AS opentracing-lib
15+
FROM ghcr.io/nginxinc/dependencies/nginx-ot:nginx-1.27.2-alpine@sha256:28077c314babf7ebcbb8bc98d04067bad37eb0a2d03a3c1f74626a6f0caef775 AS alpine-opentracing-lib
1616
FROM ghcr.io/nginxinc/dependencies/nginx-ubi-ppc64le:nginx-1.27.1@sha256:0bab61e2bd639b269ec54343ea66b7acbdb0eb67bed44383e1be937c483c451d AS ubi-ppc64le
1717
FROM ghcr.io/nginxinc/alpine-fips:0.2.3-alpine3.17@sha256:67b69b49aff96e185be841e2b2ff2d8236551ea5c18002bffa4344798d803fd8 AS alpine-fips-3.17
1818
FROM ghcr.io/nginxinc/alpine-fips:0.2.3-alpine3.20@sha256:4c29e5c50b122354d9d4ba6b97cdf64647468e788b965fc0240ead541653454a AS alpine-fips-3.20
@@ -31,7 +31,7 @@ RUN --mount=type=bind,from=alpine-opentracing-lib,target=/tmp/ot/ \
3131

3232

3333
############################################# Base image for Debian #############################################
34-
FROM nginx:1.27.2@sha256:d2eb56950b84efe34f966a2b92efb1a1a2ea53e7e93b94cdf45a27cf3cd47fc0 AS debian
34+
FROM nginx:1.27.2@sha256:28402db69fec7c17e179ea87882667f1e054391138f77ffaf0c3eb388efc3ffb AS debian
3535

3636
RUN --mount=type=bind,from=opentracing-lib,target=/tmp/ot/ \
3737
apt-get update \
@@ -207,7 +207,7 @@ RUN --mount=type=bind,from=alpine-fips-3.17,target=/tmp/fips/ \
207207

208208

209209
############################################# Base image for Debian with NGINX Plus #############################################
210-
FROM debian:12-slim@sha256:ad86386827b083b3d71139050b47ffb32bbd9559ea9b1345a739b14fec2d9ecf AS debian-plus
210+
FROM debian:12-slim@sha256:36e591f228bb9b99348f584e83f16e012c33ba5cad44ef5981a1d7c0a93eca22 AS debian-plus
211211
ARG NGINX_PLUS_VERSION
212212

213213
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

‎examples/custom-resources/access-control/README.md‎

Lines changed: 2 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -1,96 +1,3 @@
1-
# Access Control
1+
# Deploy a Policy for access control
22

3-
In this example, we deploy a web application; configure load balancing for it via a VirtualServer; and apply access
4-
control policies to deny and allow traffic from a specific subnet.
5-
6-
## Prerequisites
7-
8-
1. Follow the [installation](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/)
9-
instructions to deploy the Ingress Controller.
10-
1. Save the public IP address of the Ingress Controller into a shell variable:
11-
12-
```console
13-
IC_IP=XXX.YYY.ZZZ.III
14-
```
15-
16-
1. Save the HTTP port of the Ingress Controller into a shell variable:
17-
18-
```console
19-
IC_HTTP_PORT=<port number>
20-
```
21-
22-
## Step 1 - Deploy a Web Application
23-
24-
Create the application deployment and service:
25-
26-
```console
27-
kubectl apply -f webapp.yaml
28-
```
29-
30-
## Step 2 - Deploy an Access Control Policy
31-
32-
In this step, we create a policy with the name `webapp-policy` that denies requests from clients with an IP that belongs
33-
to the subnet `10.0.0.0/8`. This is the subnet that our test client in Steps 4 and 6 will belong to. Make sure to change
34-
the `deny` field of the `access-control-policy-deny.yaml` according to your environment (use the subnet of your
35-
machine).
36-
37-
Create the policy:
38-
39-
```console
40-
kubectl apply -f access-control-policy-deny.yaml
41-
```
42-
43-
## Step 3 - Configure Load Balancing
44-
45-
Create a VirtualServer resource for the web application:
46-
47-
```console
48-
kubectl apply -f virtual-server.yaml
49-
```
50-
51-
Note that the VirtualServer references the policy `webapp-policy` created in Step 2.
52-
53-
## Step 4 - Test the Configuration
54-
55-
Let's access the application:
56-
57-
```console
58-
curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP http://webapp.example.com:$IC_HTTP_PORT
59-
```
60-
61-
```text
62-
<html>
63-
<head><title>403 Forbidden</title></head>
64-
<body>
65-
<center><h1>403 Forbidden</h1></center>
66-
</body>
67-
</html>
68-
```
69-
70-
We got a 403 response from NGINX, which means that our policy successfully blocked our request.
71-
72-
## Step 5 - Update the Policy
73-
74-
In this step, we update the policy to allow requests from clients from the subnet `10.0.0.0/8`. Make sure to change the
75-
`allow` field of the `access-control-policy-allow.yaml` according to your environment.
76-
77-
Update the policy:
78-
79-
```console
80-
kubectl apply -f access-control-policy-allow.yaml
81-
```
82-
83-
## Step 6 - Test the Configuration
84-
85-
Let's access the application again:
86-
87-
```console
88-
curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP http://webapp.example.com:$IC_HTTP_PORT
89-
```
90-
91-
```text
92-
Server address: 10.64.0.13:8080
93-
Server name: webapp-5cbbc7bd78-wf85w
94-
```
95-
96-
In contrast with Step 4, we got a 200 response, which means that our updated policy successfully allowed our request.
3+
This is the example code used in the [Deploy a Policy for access control](https://docs.nginx.com/nginx-ingress-controller/configuration/access-control/) documentation.

‎examples/custom-resources/tls-passthrough/README.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,9 @@ You can see how the Secure App is implemented in the `secure-app.yaml` file.
4646

4747
1. Save the HTTPS port of the Ingress Controller where TLS Passthrough is enabled into a shell variable:
4848

49-
```console
50-
$ IC_HTTPS_PORT=<port number>
49+
```console
50+
IC_HTTPS_PORT=<port number>
51+
```
5152

5253
1. Save the HTTPS port of the Ingress Controller into a shell variable:
5354

‎examples/custom-resources/transport-server-sni/README.md‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# TransportServer SNI
2+
3+
In this example we create two different TransportServers that listen on the same interface, which are distinguished by their Host field.
4+
The applications (a TCP echo server, and MongoDB) will be accessed via `ncat` and `mongosh`.
5+
The `ncat` binary is available via `nmap`. On mac/linux this can be installed via homebrew/linuxbrew with `brew install nmap`
6+
`mongosh` installation instructions are [available here](https://www.mongodb.com/docs/mongodb-shell/install/).
7+
8+
## Create a GlobalConfiguration resource with the following listener
9+
10+
```yaml
11+
listeners:
12+
- name: tcp-listener
13+
port: 7000
14+
protocol: TCP
15+
```
16+
17+
## Add a custom port to the NGINX Ingress Controller pod with the Helm chart
18+
19+
```yaml
20+
controller.customPorts:
21+
- name: port
22+
containerPort: 7000
23+
protocol: TCP
24+
```
25+
26+
## Add a custom port to the NGINX Ingress Controller service
27+
28+
```yaml
29+
controller.service.customPorts:
30+
- name: tcp-port
31+
port: 7000
32+
protocol: TCP
33+
targetPort: 7000
34+
```
35+
36+
## Use `kubectl` to create the cafe-secret, and mongo-secret. These secrets are used for TLS in the TransportServers
37+
38+
`kubectl apply -f cafe-secret.yaml`
39+
`kubectl apply -f mongo-secret.yaml`
40+
41+
## Create the mongo and tcp echo example applications
42+
43+
`kubectl apply -f mongo.yaml`
44+
`kubectl apply -f tcp-echo-server.yaml`
45+
46+
## Wait until these are ready
47+
48+
`kubectl get deploy -w`
49+
50+
## Create the TransportServers for each application
51+
52+
`kubectl apply -f cafe-transport-server.yaml`
53+
`kubectl apply -f mongo-transport-server.yaml`
54+
55+
## Ensure they are in valid state
56+
57+
`kubectl get ts`
58+
59+
```shell
60+
NAME STATE REASON AGE
61+
cafe-ts Valid AddedOrUpdated 2m
62+
mongo-ts Valid AddedOrUpdated 2m
63+
```
64+
65+
## Set up /etc/hosts or DNS
66+
67+
This example uses a local NGINX Ingress Controller instance, so the /etc/hosts file
68+
is being used to set cafe.example.com and mongo.example.com to localhost.
69+
In a production instance, the server names would be set at the DNS layer.
70+
`cat /etc/hosts`
71+
72+
```shell
73+
...
74+
127.0.0.1 cafe.example.com
75+
127.0.0.1 mongo.example.com
76+
```
77+
78+
## Expose port 7000 of the LoadBalancer service
79+
80+
`kubectl port-forward svc/my-release-nginx-ingress-controller 7000:7000`
81+
82+
## Use `ncat` to ping cafe.example.com on port 7000 with SSL
83+
84+
`ncat --ssl cafe.example.com 7000`
85+
When you write a message you should receive the following response:
86+
87+
```shell
88+
hi
89+
hi
90+
```
91+
92+
Close the connection (CTRL+ c), then view the NGINX Ingress Controller logs.
93+
94+
The request and response should both be 2 bytes.
95+
96+
```shell
97+
127.0.0.1 [24/Sep/2024:15:48:58 +0000] TCP 200 3 3 2.702 "-
98+
```
99+
100+
## Use mongosh to connect to the mongodb container through the TransportServer on port 7000
101+
102+
`mongosh --host mongo.example.com --port 7000 --tls --tlsAllowInvalidCertificates`
103+
104+
```shell
105+
test> show dbs
106+
admin 40.00 KiB
107+
config 60.00 KiB
108+
local 40.00 KiB
109+
test>
110+
```

‎examples/custom-resources/transport-server-sni/cafe-secret.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
data:
3+
tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY1ekNDQTgrZ0F3SUJBZ0lVR2dXT0JNTkR2TXNWOGY3OWc0MlpSZy9KaWc0d0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZSXhDekFKQmdOVkJBWVRBbGhZTVJJd0VBWURWUVFJREFsVGRHRjBaVTVoYldVeEVUQVBCZ05WQkFjTQpDRU5wZEhsT1lXMWxNUlF3RWdZRFZRUUtEQXREYjIxd1lXNTVUbUZ0WlRFYk1Ca0dBMVVFQ3d3U1EyOXRjR0Z1CmVWTmxZM1JwYjI1T1lXMWxNUmt3RndZRFZRUUREQkJqWVdabExtVjRZVzF3YkdVdVkyOXRNQjRYRFRJME1Ea3kKTXpFd01EUXdNVm9YRFRNME1Ea3lNVEV3TURRd01Wb3dnWUl4Q3pBSkJnTlZCQVlUQWxoWU1SSXdFQVlEVlFRSQpEQWxUZEdGMFpVNWhiV1V4RVRBUEJnTlZCQWNNQ0VOcGRIbE9ZVzFsTVJRd0VnWURWUVFLREF0RGIyMXdZVzU1ClRtRnRaVEViTUJrR0ExVUVDd3dTUTI5dGNHRnVlVk5sWTNScGIyNU9ZVzFsTVJrd0Z3WURWUVFEREJCallXWmwKTG1WNFlXMXdiR1V1WTI5dE1JSUNJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBZzhBTUlJQ0NnS0NBZ0VBbjkvZwpkMml5NEZyaGNtS3ZXQTVHZXFiS1c5WU1xeml6Vm4yRExkd215enkvS2FUdTdtUlkvUWRsTkxHaVhIM1NEa0FkCkhtZFJEK0Zob1ZHaWxoTjEzcTI0azdyRSt6dk1iMlRqdnBnMmVLYVd1dDBHaGQ3V3l3TnpIUU9WcWJCM2o2U2QKSE1sNlJKK25ERHo2Yi9adkRiNm9nQjBucUowZjBWN0tBMHFFalYxVld2dXI4YVZpVlVxK0tBOVMveEdJMHZSSwo2NE9BS2xIUUF4a2xGWWhheHVjcWRsS0owQlRXekE0Z0gzUTZlQi9CRjNOMTJDQjgrMVEzZG54bU5TVnpLbXp1CmJYdm1jK1RPUjg0V3ovemlaMTl1K3RuRHg2aklNajZZQXd2M0tzSVlYbmV1ZEgycUZKRG5FMmZwYjNnZzRxbm0KQnduY0ZlU1poY09nZWdnR1RmKzRTc3YwRUNuamNNdXhteTEwMTNwY0h1a2prTUNmVGJsUGZTU0NNS24rVnlGZQpUNzlSeUkxM3hmL0JXOSt0aTFad1IwYVpkWk5jV1R2Um53R1M1bWhnelJXclhRUmdJQlVVVjk2N3cxRVVONDJVCkE3ZjBVSzZlYks5bExBMnNZWmJJSWUrbllRY1d1OVRuNXo5YnVwK2w3aU5hUDYxWXdwWGdrUTFyNHlSamhMeUEKajVha1Z5VnROYzZmSWltaXlWV0Y1QzBaZnNIYzF3cUpLb2lXQzBtT1dyNEVRSVorRkY2WC9FRytSMmhodjZkQQpGcndpd3BHUE9kWkROQzNqNFBqVzVreWlYMlh2Vm1RWTUvbkxNdFpUaFF6VHpadG8zT3M4d1RsRjFyQlZkd05iCi9zNTh2dnlTQitsYk5Sd215TEErQVYvOGQ2L2VNcGZjS0ZyYU85OENBd0VBQWFOVE1GRXdIUVlEVlIwT0JCWUUKRktEejZlREZLaC93ZDVLTHpPMXpCMDR2UGVRSU1COEdBMVVkSXdRWU1CYUFGS0R6NmVERktoL3dkNUtMek8xegpCMDR2UGVRSU1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dJQkFKQnd5WVlyCllXa3RvRGJPYlpHRUFXT0lEcjFTb3NWRDVIRXdkazV6ZTJuT05oQXFHVWszOHpUT3V1VVZRNk5lT1c1UWtML3oKVTFUa3dwUlNFNjFpbVZHOUdjYWY5ampkSjd5VGhsOGpmZXUyWTF4RHo1OUpmbWJ1WUo2SGE4ZmR4STAxQXZ3RgoxaERYY1ZEcTZoalhhb0pKMVZta1NiTEJPc1JXaGVzWGl1K3FiN3NSOUhlZmJmaTUxandQb2NFblE4YzNiWXF5CmpIRkwxS1JJekIyR2VYVGk2WngwN2lqcDZIeGJSQUFEWnBuRGN0blM1UVQvTGFoYklIZVNNTExMK21vdnUrSUgKTVgwQmtaYmJjRk94L3d2ZlN1SXdveEVXR1RjVGJIYnJGanVUUDRkalpPdFhybElSK1RJTmRiaFhaMm1XZVdHbgpRa0tkcyt4a3puNzNZbG9xZCtPZGZ2d1dJYXVFYktuaXdQUk01NHZqK0dnbndiWmZNWXpnY292cE5BYzZjMmlmCkNNdHlHWDBUREptSjRVWC9FaFFSYTArSURMbFZTMWc2Y3IxWmVQM1N1MWpkSnhBSFVwUjZwSVYrWGdsTENDdGYKQXdDUW9BUWtUeXkyb0Y1Z0hWOGVuc28zVE15cmI5R1NBWDF0UEdJL080L3VCRDBqRzQ4anZsZEI3dzZKbjdmSwoyS21DWnIwYlRDdU9vWnVuZHA3OHA2R1ozb3lVOXBxcTFTUmU0MTdjSlVuNzR3S05TTkd0U0xTNm9OZ3FQQ2h6Cm9ZTy9zK0NHL295c0JUcTBma2VBYXdMZ2oxVG9ybGNsaEt6M05uWUtLZmhDVFBLTDVVUFZLNjVXQ3V2djlSVWgKVUZvM2F2TnhhSmpWUEY4V0FVUnRZem82bXBadFRITm53ZkJTCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
4+
tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUpRd0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQ1Mwd2dna3BBZ0VBQW9JQ0FRQ2YzK0IzYUxMZ1d1RnkKWXE5WURrWjZwc3BiMWd5ck9MTldmWU10M0NiTFBMOHBwTzd1WkZqOUIyVTBzYUpjZmRJT1FCMGVaMUVQNFdHaApVYUtXRTNYZXJiaVR1c1Q3Tzh4dlpPTyttRFo0cHBhNjNRYUYzdGJMQTNNZEE1V3BzSGVQcEowY3lYcEVuNmNNClBQcHY5bThOdnFpQUhTZW9uUi9SWHNvRFNvU05YVlZhKzZ2eHBXSlZTcjRvRDFML0VZalM5RXJyZzRBcVVkQUQKR1NVVmlGckc1eXAyVW9uUUZOYk1EaUFmZERwNEg4RVhjM1hZSUh6N1ZEZDJmR1kxSlhNcWJPNXRlK1p6NU01SAp6aGJQL09KblgyNzYyY1BIcU1neVBwZ0RDL2Nxd2hoZWQ2NTBmYW9Va09jVForbHZlQ0RpcWVZSENkd1Y1Sm1GCnc2QjZDQVpOLzdoS3kvUVFLZU53eTdHYkxYVFhlbHdlNlNPUXdKOU51VTk5SklJd3FmNVhJVjVQdjFISWpYZkYKLzhGYjM2MkxWbkJIUnBsMWsxeFpPOUdmQVpMbWFHRE5GYXRkQkdBZ0ZSUlgzcnZEVVJRM2paUUR0L1JRcnA1cwpyMlVzRGF4aGxzZ2g3NmRoQnhhNzFPZm5QMXU2bjZYdUkxby9yVmpDbGVDUkRXdmpKR09FdklDUGxxUlhKVzAxCnpwOGlLYUxKVllYa0xSbCt3ZHpYQ29rcWlKWUxTWTVhdmdSQWhuNFVYcGY4UWI1SGFHRy9wMEFXdkNMQ2tZODUKMWtNMExlUGcrTmJtVEtKZlplOVdaQmpuK2NzeTFsT0ZETlBObTJqYzZ6ekJPVVhXc0ZWM0Exdit6bnkrL0pJSAo2VnMxSENiSXNENEJYL3gzcjk0eWw5d29XdG83M3dJREFRQUJBb0lDQUNkQmRZQmNlTytWNFIyUkZiVHRiR2paClkzN0JSRU1XblJKenB5NHZqR2NDOTMxbVBqVFM5dmJLUmhOMk9vT3pjVXlHZVovcGhvSDd1VmsvRGtrRFprSFQKTGlzNEJQNGJaTXRGWHBhQ0VYMzJpYlJBYVVXZHZlZ0RaTlNPK01TOXk5MjljY2FMd2pYdmJia1hqL2JGNytiVQpGZE8vVk9tV0N5WUJ2R0NxZjNtbW5UckY2U1pna1pDWDFiRkljZnluZFkwMjV0NkZYNGNFcDZyYkZidi95eXBqCndJMWxIdW0wOURrT2p0eXFVV0VGaXdnVEZiQ0g2YWhjdVhHaWdnWXl0K0NHOXRSelE5YlpLNzE5NFNRWTJBN0IKNUNJOExsSnNJeHdUT29naysvL0h3T3dSUHdqamdrdWllTnJPL1FhZDNKVkxXbXdJQTc1c2J6WGxIeFpYdWhReApFZTlTTVNaRE5JMGMvcGdDVXloL2h5Y3ZYWVJKb1dIMnZYTDYzL1EyRWJVVVZVcXpzcEpjV0xMbkhSSFdBQjZQCmtPb0FMeEs2M3lpQTU5KzREQ0ZZMGM0dXd4WHM5YnZlVWk5UUdxaUtoZkFaNmE3Ymh4ajNvRWIvRDZ0dWZKb1QKMnIxUXFKTlJ4N0RzMmJUc3J6SEgyYmVKR0R4bFJ4djdaNmdSTzdHd2lrU25veDlMcnY3YzMwUHp0WjZENXhwQwpoVHdmM0VpRWlrZ2pOM1FGd2RaUXVqV3RxWXQ1UWVGYUxpL2Q3VXZteFdZNWcrWTYyQnFkNnBpWFFJSlFVbDZUCmZmU0U2OEYvZWF6QnhPQm9INUMvWWcrd1kyVEpTb1BzK3NFUUtnYlNJTmRQNHU4N3FiQ056YWZ4WjFySTN1dmgKR3NZTWpSbm50c3RKamJXVEJkakJBb0lCQVFEZXpsY3dVNFJYbnhKVENSTjFQZUx1UHI2aXFnc09uY1lRRXNuTgpZemdwOXF6eC9SSTJodGZCYnN6TkM2RUZ3eDBDZy8wRnpRbVhqWEQ3VmhQS0UrOHBXMmQzNTg4YTBwU0xSbFBOCkprUnFxR2ovbzhIaEtmTGdCYy9BSGU3dkJEZG1UTXh1d0o1SmFmMWZ3OGtxNEJyRXROTi83SVF3MkNYcFNIK2MKSEhSZnBTM1JidDArbW9xK2RTRW1pU2h3UGgxL2FJbng4ZnBKbTFmaU1QdXhvYStzOXNUVmQ3Ky9GSjdIaWNZSApSQThQRHdQT2RMQ2loQlZFT3liSkduTlpaSFhYQTA4MThhNnpjdjU2aUM2VGZzSkhWZUg4a2Nma1IzblI4eTUvCkx2MnI1QzVaZWJlbW9ZaVhBTC9sVnZ0QUNGMXE3UW1zdlRkQ2R3R1lvaXBMbksvNUFvSUJBUUMzc1YvcFFOVlEKSjNsZExFem9OVUdBZWFwL0NNU2tuY0lUUXNnMUI3SDJHclIyR201VGNuVGE0SE5Rbmt3a2h3YUxyTUlmVDFXZAorMFVvR3M5ZXdyYkZERWtKR0MxQVd2RmFIREk3Q3NOYUFUM2FWYTE5R1ZRWFg2NnkrWEF2QXFTOXpOU25id0J0CnM5UDFFVURwMko1SGtyNlVLUHZjSnY3Q0MyR3J5emZaTy85MFpTTlFQUXdKMXFqZ2NNOUJpMlBYSkE0OENldnMKK3RvaGFqUWFIMStVY0VqNkQ0SHhoQ1RtcTBxM2YvdFNudk9iaTNOYklEWjNEWmR4ejVPelJSVmpLNWlSOGZDNQpzSVVKckxCSXRZeWpUeHAzTzROUmRFaHhzamdBZTZrSTV2dm95RVAvRFZwTFlQU0s3cFpoVjJ4YUpXUkZUUVZzCjhrKzZDbGduWGZDWEFvSUJBUUM5QjY4dFR3NHZFTVNKTW1BUnprbWovQlBkQ2d1TGdRd3pRdDEzcGNCV3lmUDgKOHNycS9BZzlFbllyV0x4cW1Sa1pzMFdPRUdFYzlXRnZ1NTNhaW9NVVFYcE5YcHgxazBkM3lsajY2b2FOUHdpbQpLeGNvbzJCdDlFQklMSjAwcUEwZ2UvUE4yeG53Q3o1dWF6dFhadjhPK0tPZ0d0Z2tZSjM1aUFyTU5jLzkvYlFiCnhjVnJnYzVJdkRNOThJd2dmbktrVDlzSkxGVSs4YzdrRnM3VDYrdVNBV01LQVNqclF1RmJSV1ovYjV5ZkdBd1EKc3l2UkZlSzlHcnBUVUYrZzdmeVVTVGlBK2VWUVZqWFZXNGk0bG9qWjRPRjBXWEtRR0p3Z0pnUEMzK2xVVnFtRQpQQ0kxKzBKWmFzZGtHaUhjTjd5YUpUVmFHc2F4V3lvOWh3Zi9VcFp4QW9JQkFDQ0hDem5ObmpoTVZTUlhsT0xGCmsyekJucHhTSENnZU8yQ1h3Y1lLTDh3cG5HMFJieG5kdWEyTWN6OENXTzlhN2FETUhhL1hwNHlMRXdydi9HcUcKUmtFTVZONkVabmJ2NDY4V01ScmRaQXhMRGYzY2tCVUg2Q2tmYTFzTDZuNllsRDE3eU9oQk1xMDZXNzBZcWdyKwpyY0IwenNTRG9WMnhsZ2tjWk5ZNzdRN05uZ1dwWnlCdFB2VjdDbnA3MzJkMjNGNGJaMTNnVCtPdDQvUm96d01WCkxTS200M1ZNUzdGTnVnOFNvKzlzZlQ5N0lCNGFDbnBIY1AyUjdaQmN0b1hYSk50anUrZVVGUkY4bllKQ0R4RkEKL0w5cVlZQmRqSHBmQWZrSUd2eVM2VExIWERJelREOGN5VEZ4NEx1OVZlbTB4bDRNSXY1V2pqQmxsQktZaEZXcwpQODhDZ2dFQkFKUjR5UUIrREtoRE1ZOGlHOXpYWUJpWmZ5MFI2c21oeEJycTREZWd4cElkajBydHUyMFNuWDdsCnN3YlZsN2NmdWRxUi9tVEhnZ1lYeGJSS3UxUXhmN3NHTW4zWVpRY1AxZDVJelFMOWZFQitidGJsdWY5VTB4NDIKUzM0U0l6Z25pd0hPQnN3M2ZLYm1Gbnc1dmtNd2RoemlBT1R0elRwcmU3ckdhaEpwZlk0eFRWWjZpK3pjQ1pCWgo0ZHhSTjlQWnBiQm4vNmJDTFY3S0I3ZmY0Uk04b3c3K1l4aHFFTFhxcnVQS2paMnRRSWs2M2hzZklMd0tiRWIrCkhEM2VLZEhNc2hhbXFXZzI0NnlORW5nQUZCQzhoVU5kQ0pmeUthUlhkSlV5eDhqcWlKM3ErdnpnNFBieUhqeW0KZEQzM2pVT2UwdHdoSWJxKytUaXZCa1ptSDBsSStnVT0KLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo=
5+
kind: Secret
6+
metadata:
7+
creationTimestamp: null
8+
name: cafe-secret
9+
type: kubernetes.io/tls

‎examples/custom-resources/transport-server-sni/cafe-transport-server.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: k8s.nginx.org/v1
2+
kind: TransportServer
3+
metadata:
4+
name: cafe-ts
5+
spec:
6+
host: cafe.example.com
7+
listener:
8+
name: tcp-listener
9+
protocol: TCP
10+
tls:
11+
secret: cafe-secret
12+
upstreams:
13+
- name: tcp-echo
14+
service: tcp-echo-service
15+
port: 7000
16+
action:
17+
pass: tcp-echo

0 commit comments

Comments
 (0)