From 433eb26f3ccbf35542e8dce5a1b5762623d3b81f Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Sun, 11 Feb 2024 07:38:42 -0500 Subject: [PATCH] feat: always skip the https ingress/ingress-route/deployment port entry if there is a corresponding http entry Also inject the corresponding entries as necessary --- docs/deployment/schedulers/k3s.md | 2 +- .../templates/chart/deployment.yaml | 7 ++++++ .../templates/chart/ingress-route.yaml | 7 ++++++ .../templates/chart/ingress.yaml | 7 ++++++ plugins/scheduler-k3s/triggers.go | 24 +++++++++++++++++++ 5 files changed, 46 insertions(+), 1 deletion(-) diff --git a/docs/deployment/schedulers/k3s.md b/docs/deployment/schedulers/k3s.md index 540bd157d..e17a25fc7 100644 --- a/docs/deployment/schedulers/k3s.md +++ b/docs/deployment/schedulers/k3s.md @@ -243,7 +243,7 @@ dokku scheduler-k3s:set --global letsencrypt-email-prod automated@dokku.sh dokku scheduler-k3s:set --global letsencrypt-email-stag automated@dokku.sh ``` -After enabling and rebuilding, all apps with an `https` port mapping that utilize the related letsencrypt server will be automatically updated to enable ssl. All http requests will then be redirected to https. +After enabling and rebuilding, all apps with an `http:80` port mapping will have a corresponding `https:443` added and ssl will be automatically enabled. All http requests will then be redirected to https. ### Customizing the letsencrypt server diff --git a/plugins/scheduler-k3s/templates/chart/deployment.yaml b/plugins/scheduler-k3s/templates/chart/deployment.yaml index d064996fd..db957375e 100644 --- a/plugins/scheduler-k3s/templates/chart/deployment.yaml +++ b/plugins/scheduler-k3s/templates/chart/deployment.yaml @@ -1,5 +1,9 @@ {{- $processName := "PROCESS_NAME" }} {{- $config := index .Values.processes "PROCESS_NAME" }} +{{- $mappings := dict }} +{{- range $pdx, $port_map := $config.web.port_maps }} +{{- $mappings := set $mappings $port_map.name "true" }} +{{- end }} --- apiVersion: apps/v1 kind: Deployment @@ -76,6 +80,9 @@ spec: {{- if eq $processName "web" }} ports: {{- range $pdx, $port_map := $config.web.port_maps }} + {{- if and (eq $port_map.scheme "https") (hasKey $mappings (printf "http-80-%.0f" $port_map.container_port)) }} + {{- continue }} + {{- end }} - containerPort: {{ $port_map.container_port }} name: {{ $port_map.name }} protocol: {{ $port_map.protocol }} diff --git a/plugins/scheduler-k3s/templates/chart/ingress-route.yaml b/plugins/scheduler-k3s/templates/chart/ingress-route.yaml index f5fcbb96c..578fa7b3c 100644 --- a/plugins/scheduler-k3s/templates/chart/ingress-route.yaml +++ b/plugins/scheduler-k3s/templates/chart/ingress-route.yaml @@ -1,7 +1,14 @@ {{- $processName := "PROCESS_NAME" }} {{- $config := index .Values.processes "PROCESS_NAME" }} {{- if and $config.web.domains (eq $.Values.global.network.ingress_class "traefik") }} +{{- $mappings := dict }} {{- range $pdx, $port_map := $config.web.port_maps }} +{{- $mappings := set $mappings $port_map.name "true" }} +{{- end }} +{{- range $pdx, $port_map := $config.web.port_maps }} +{{- if and (eq $port_map.scheme "https") (hasKey $mappings (printf "http-80-%.0f" $port_map.container_port)) }} +{{- continue }} +{{- end }} --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute diff --git a/plugins/scheduler-k3s/templates/chart/ingress.yaml b/plugins/scheduler-k3s/templates/chart/ingress.yaml index 414022b07..4509cc5e2 100644 --- a/plugins/scheduler-k3s/templates/chart/ingress.yaml +++ b/plugins/scheduler-k3s/templates/chart/ingress.yaml @@ -1,7 +1,14 @@ {{- $processName := "PROCESS_NAME" }} {{- $config := index .Values.processes "PROCESS_NAME" }} {{- if and $config.web.domains (eq $.Values.global.network.ingress_class "nginx") }} +{{- $mappings := dict }} {{- range $pdx, $port_map := $config.web.port_maps }} +{{- $mappings := set $mappings $port_map.name "true" }} +{{- end }} +{{- range $pdx, $port_map := $config.web.port_maps }} +{{- if and (eq $port_map.scheme "https") (hasKey $mappings (printf "http-80-%.0f" $port_map.container_port)) }} +{{- continue }} +{{- end }} --- apiVersion: networking.k8s.io/v1 kind: Ingress diff --git a/plugins/scheduler-k3s/triggers.go b/plugins/scheduler-k3s/triggers.go index 51caafee4..b89be6147 100644 --- a/plugins/scheduler-k3s/triggers.go +++ b/plugins/scheduler-k3s/triggers.go @@ -426,6 +426,30 @@ func TriggerSchedulerDeploy(scheduler string, appName string, imageTag string) e }) } + for _, portMap := range processValues.Web.PortMaps { + _, httpOk := portMaps[fmt.Sprintf("http-80-%d", portMap.ContainerPort)] + _, httpsOk := portMaps[fmt.Sprintf("https-443-%d", portMap.ContainerPort)] + if portMap.Scheme == "http" && !httpsOk && tlsEnabled { + processValues.Web.PortMaps = append(processValues.Web.PortMaps, ProcessPortMap{ + ContainerPort: portMap.ContainerPort, + HostPort: 443, + Name: fmt.Sprintf("https-443-%d", portMap.ContainerPort), + Protocol: PortmapProtocol_TCP, + Scheme: "https", + }) + } + + if portMap.Scheme == "https" && !httpOk { + processValues.Web.PortMaps = append(processValues.Web.PortMaps, ProcessPortMap{ + ContainerPort: portMap.ContainerPort, + HostPort: 80, + Name: fmt.Sprintf("http-80-%d", portMap.ContainerPort), + Protocol: PortmapProtocol_TCP, + Scheme: "http", + }) + } + } + sort.Sort(NameSorter(processValues.Web.PortMaps)) sort.Strings(processValues.Web.Domains) }