From caa60fa1ef5f95c258d534489eb732956a195471 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Janto=C5=A1ovi=C4=8D?= Date: Wed, 13 May 2026 13:25:51 +0200 Subject: [PATCH] fix: correctly redirect http traffic to https when using scheduler-k3s --- .../ingress_route_template_test.go | 188 ++++++++++++++++++ .../templates/chart/ingress-route.yaml | 16 +- 2 files changed, 197 insertions(+), 7 deletions(-) create mode 100644 plugins/scheduler-k3s/ingress_route_template_test.go diff --git a/plugins/scheduler-k3s/ingress_route_template_test.go b/plugins/scheduler-k3s/ingress_route_template_test.go new file mode 100644 index 000000000..e9d21be0e --- /dev/null +++ b/plugins/scheduler-k3s/ingress_route_template_test.go @@ -0,0 +1,188 @@ +package scheduler_k3s + +import ( + "errors" + "io" + "os" + "path/filepath" + "strings" + "testing" + + "gopkg.in/yaml.v3" + "helm.sh/helm/v3/pkg/chart/loader" + "helm.sh/helm/v3/pkg/chartutil" + "helm.sh/helm/v3/pkg/engine" +) + +func renderIngressRouteTemplate(t *testing.T, values map[string]interface{}) []map[string]interface{} { + t.Helper() + + chartDir := t.TempDir() + if err := os.MkdirAll(filepath.Join(chartDir, "templates"), 0o755); err != nil { + t.Fatalf("mkdir: %v", err) + } + + chartYAML := []byte("apiVersion: v2\nname: test\nversion: 0.0.1\n") + if err := os.WriteFile(filepath.Join(chartDir, "Chart.yaml"), chartYAML, 0o644); err != nil { + t.Fatalf("write Chart.yaml: %v", err) + } + + ingressRouteTpl, err := templates.ReadFile("templates/chart/ingress-route.yaml") + if err != nil { + t.Fatalf("read ingress-route template: %v", err) + } + if err := os.WriteFile(filepath.Join(chartDir, "templates", "ingress-route.yaml"), ingressRouteTpl, 0o644); err != nil { + t.Fatalf("write ingress-route template: %v", err) + } + + helpersTpl, err := templates.ReadFile("templates/chart/_helpers.tpl") + if err != nil { + t.Fatalf("read _helpers: %v", err) + } + if err := os.WriteFile(filepath.Join(chartDir, "templates", "_helpers.tpl"), helpersTpl, 0o644); err != nil { + t.Fatalf("write _helpers: %v", err) + } + + loaded, err := loader.Load(chartDir) + if err != nil { + t.Fatalf("load chart: %v", err) + } + + renderValues, err := chartutil.ToRenderValues(loaded, values, chartutil.ReleaseOptions{Name: "test", Namespace: "default"}, nil) + if err != nil { + t.Fatalf("ToRenderValues: %v", err) + } + + rendered, err := engine.Render(loaded, renderValues) + if err != nil { + t.Fatalf("render: %v", err) + } + + manifest, ok := rendered["test/templates/ingress-route.yaml"] + if !ok { + t.Fatalf("ingress-route.yaml not rendered; got: %v", rendered) + } + + var docs []map[string]interface{} + decoder := yaml.NewDecoder(strings.NewReader(manifest)) + for { + var doc map[string]interface{} + if err := decoder.Decode(&doc); err != nil { + if errors.Is(err, io.EOF) { + break + } + t.Fatalf("yaml decode failed: %v\nrendered:\n%s", err, manifest) + } + if doc != nil { + docs = append(docs, doc) + } + } + + return docs +} + +func testIngressRouteValues(tlsEnabled bool) map[string]interface{} { + web := map[string]interface{}{ + "domains": []interface{}{ + map[string]interface{}{"name": "app.example.com"}, + }, + "port_maps": []interface{}{ + map[string]interface{}{ + "name": "http-80-5000", + "scheme": "http", + "container_port": 5000, + }, + }, + "tls": map[string]interface{}{ + "enabled": tlsEnabled, + "use_imported_cert": false, + }, + } + + return map[string]interface{}{ + "global": map[string]interface{}{ + "app_name": "myapp", + "namespace": "myns", + "network": map[string]interface{}{ + "ingress_class": "traefik", + }, + }, + "processes": map[string]interface{}{ + "web": map[string]interface{}{ + "web": web, + }, + }, + } +} + +func findDocByName(t *testing.T, docs []map[string]interface{}, name string) map[string]interface{} { + t.Helper() + for _, doc := range docs { + metadata, _ := doc["metadata"].(map[string]interface{}) + if metadata["name"] == name { + return doc + } + } + t.Fatalf("document %q not found in %#v", name, docs) + return nil +} + +func TestIngressRouteTemplateTLSCreatesSeparateHTTPAndHTTPSRoutes(t *testing.T) { + docs := renderIngressRouteTemplate(t, testIngressRouteValues(true)) + if len(docs) != 2 { + t.Fatalf("expected 2 ingress routes when tls enabled, got %d", len(docs)) + } + + httpRoute := findDocByName(t, docs, "myapp-web-http-80-5000") + httpSpec := httpRoute["spec"].(map[string]interface{}) + if got := httpSpec["entryPoints"]; len(got.([]interface{})) != 1 || got.([]interface{})[0] != "web" { + t.Fatalf("expected HTTP route entryPoints [web], got %#v", got) + } + httpRoutes := httpSpec["routes"].([]interface{}) + httpRoute0 := httpRoutes[0].(map[string]interface{}) + if _, ok := httpRoute0["middlewares"]; !ok { + t.Fatalf("expected HTTP route to contain redirect middleware, got %#v", httpRoute0) + } + if _, ok := httpSpec["tls"]; ok { + t.Fatalf("expected HTTP route to omit tls block, got %#v", httpSpec["tls"]) + } + + httpsRoute := findDocByName(t, docs, "myapp-web-http-80-5000-websecure") + httpsSpec := httpsRoute["spec"].(map[string]interface{}) + if got := httpsSpec["entryPoints"]; len(got.([]interface{})) != 1 || got.([]interface{})[0] != "websecure" { + t.Fatalf("expected HTTPS route entryPoints [websecure], got %#v", got) + } + httpsRoutes := httpsSpec["routes"].([]interface{}) + httpsRoute0 := httpsRoutes[0].(map[string]interface{}) + if _, ok := httpsRoute0["middlewares"]; ok { + t.Fatalf("expected HTTPS route to omit redirect middleware, got %#v", httpsRoute0["middlewares"]) + } + tls, ok := httpsSpec["tls"].(map[string]interface{}) + if !ok { + t.Fatalf("expected HTTPS route to include tls block, got %#v", httpsSpec["tls"]) + } + if tls["secretName"] != "tls-myapp-web" { + t.Fatalf("expected HTTPS route secretName %q, got %#v", "tls-myapp-web", tls["secretName"]) + } +} + +func TestIngressRouteTemplateWithoutTLSKeepsSingleHTTPRoute(t *testing.T) { + docs := renderIngressRouteTemplate(t, testIngressRouteValues(false)) + if len(docs) != 1 { + t.Fatalf("expected 1 ingress route when tls disabled, got %d", len(docs)) + } + + httpRoute := findDocByName(t, docs, "myapp-web-http-80-5000") + httpSpec := httpRoute["spec"].(map[string]interface{}) + if got := httpSpec["entryPoints"]; len(got.([]interface{})) != 1 || got.([]interface{})[0] != "web" { + t.Fatalf("expected HTTP route entryPoints [web], got %#v", got) + } + httpRoutes := httpSpec["routes"].([]interface{}) + httpRoute0 := httpRoutes[0].(map[string]interface{}) + if _, ok := httpRoute0["middlewares"]; ok { + t.Fatalf("expected non-TLS route to omit redirect middleware, got %#v", httpRoute0["middlewares"]) + } + if _, ok := httpSpec["tls"]; ok { + t.Fatalf("expected non-TLS route to omit tls block, got %#v", httpSpec["tls"]) + } +} diff --git a/plugins/scheduler-k3s/templates/chart/ingress-route.yaml b/plugins/scheduler-k3s/templates/chart/ingress-route.yaml index 24dd8e2ef..0d9db860a 100644 --- a/plugins/scheduler-k3s/templates/chart/ingress-route.yaml +++ b/plugins/scheduler-k3s/templates/chart/ingress-route.yaml @@ -13,6 +13,10 @@ {{- if and (eq $port_map.scheme "https") (hasKey $mappings (printf "http-80-%.0f" $port_map.container_port)) }} {{- continue }} {{- end }} +{{- range $rdx, $entryPoint := list "web" "websecure" }} +{{- if and (eq $entryPoint "websecure") (not $config.web.tls.enabled) }} +{{- continue }} +{{- end }} --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -27,19 +31,16 @@ metadata: app.kubernetes.io/part-of: {{ $.Values.global.app_name }} {{ include "print.labels" (dict "config" $.Values.global "key" "traefik_ingressroute") | indent 4 }} {{ include "print.labels" (dict "config" $config "key" "traefik_ingressroute") | indent 4 }} - name: {{ $.Values.global.app_name }}-{{ $processName }}-{{ $port_map.name }} + name: {{ $.Values.global.app_name }}-{{ $processName }}-{{ $port_map.name }}{{- if eq $entryPoint "websecure" }}-{{ $entryPoint }}{{- end }} namespace: {{ $.Values.global.namespace }} spec: entryPoints: - {{- if $config.web.tls.enabled }} - - websecure - {{- end }} - - web + - {{ $entryPoint }} routes: {{- range $ddx, $domain := $config.web.domains }} - kind: Rule match: Host(`{{ $domain.name }}`) - {{- if $config.web.tls.enabled }} + {{- if and (eq $entryPoint "web") $config.web.tls.enabled }} middlewares: - name: {{ $.Values.global.app_name}}-{{ $processName }}-redirect-to-https namespace: {{ $.Values.global.namespace }} @@ -51,7 +52,7 @@ spec: port: {{ $port_map.name }} scheme: http {{- end }} - {{- if $config.web.tls.enabled }} + {{- if eq $entryPoint "websecure" }} tls: {{- if $config.web.tls.use_imported_cert }} secretName: tls-{{ $.Values.global.app_name }} @@ -62,3 +63,4 @@ spec: {{- end }} {{- end }} {{- end }} +{{- end }}