bb7335f88e
Traefik matches hosts exactly, so an app serving a wildcard domain under the `traefik` ingress class had a valid certificate but silently 404d on every request. Wildcard domains now render as a `HostRegexp` rule that matches a single label, the same semantics as a Kubernetes wildcard host, so both ingress classes behave the same. Those routes carry an explicit low priority so an exact domain on any app still wins over another app's wildcard, mirroring ingress-nginx.
64 lines
2.0 KiB
Smarty
64 lines
2.0 KiB
Smarty
{{- define "print.annotations" }}
|
|
{{- if and .config.annotations (hasKey .config.annotations .key) }}
|
|
{{- $annotations := get .config.annotations .key }}
|
|
{{- range $k, $v := $annotations }}
|
|
{{ $k }}: {{ $v | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- define "print.labels" }}
|
|
{{- if and .config.labels (hasKey .config.labels .key) }}
|
|
{{- $labels := get .config.labels .key }}
|
|
{{- range $k, $v := $labels }}
|
|
{{ $k }}: {{ $v | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
traefik.host.match renders a domain as a Traefik router rule. Traefik v2 resolves HostRegexp
|
|
through gorilla/mux, where the pattern is a {name:regexp} template and every literal segment is
|
|
quoted, so a wildcard label is spelled out as a named group rather than a raw regexp. The group
|
|
matches a single label, mirroring both DNS and Kubernetes Ingress wildcard hosts.
|
|
*/}}
|
|
{{- define "traefik.host.match" -}}
|
|
{{- if hasPrefix "*." . -}}
|
|
HostRegexp(`{subdomain:[^.]+}.{{ trimPrefix "*." . }}`)
|
|
{{- else -}}
|
|
Host(`{{ . }}`)
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{- define "primary.port" -}}
|
|
{{- $found := dict -}}
|
|
{{- range $idx, $port_map := . -}}
|
|
{{- if hasPrefix "https-443-" $port_map.name -}}
|
|
{{- $found := set $found "https-443" $port_map.name -}}
|
|
{{- end -}}
|
|
{{- if hasPrefix "http-80-" $port_map.name -}}
|
|
{{- $found := set $found "http-80" $port_map.name -}}
|
|
{{- end -}}
|
|
{{- if and (eq "https" $port_map.scheme) (not (hasKey $found "https")) -}}
|
|
{{- $found := set $found "https" $port_map.name -}}
|
|
{{- end -}}
|
|
{{- if and (eq "http" $port_map.scheme) (not (hasKey $found "http")) -}}
|
|
{{- $found := set $found "http" $port_map.name -}}
|
|
{{- end -}}
|
|
{{- if not (hasKey $found "any") -}}
|
|
{{- $found := set $found "any" $port_map.name -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
{{- if hasKey $found "https-443" -}}
|
|
{{- get $found "https-443" -}}
|
|
{{- else if hasKey $found "http-80" -}}
|
|
{{- get $found "http-80" -}}
|
|
{{- else if hasKey $found "https" -}}
|
|
{{- get $found "https" -}}
|
|
{{- else if hasKey $found "http" -}}
|
|
{{- get $found "http" -}}
|
|
{{- else if hasKey $found "any" -}}
|
|
{{- get $found "any" -}}
|
|
{{- end -}}
|
|
{{- end -}}
|