noonien/kube-http-proxy repository overview
kube-http-proxy
This is a HTTP reverse proxy for Kubernetes based on Nginx and confd.
To run this container, you need Kubernetes v0.15.0 or later and access to the etcd cluster on which Kubernetes operates.
Usage
docker run -e CONFD_ETCD_NODE=<etcd-address>:<etcd-port> -p 80:80 -p 443:443 noonien/kube-http-proxy
The reverse proxy is configured using Kubernetes annotations on services.
The configuration is stored as serialized JSON strings. Two annotations are supported:
- http-proxy-servers - To configure the servers and a root path for the service
- http-proxy-paths - To configure additional paths for specified servers
Examples
http-proxy-servers:
[
{
"host": "some.example.com",
"names": ["some.other.example.com"],
"port": "8080",
"targetPort": "3000",
"default": true,
"targetPath": "proxy",
"pathOptions": ["proxy_pass_request_headers on"],
},
{
"host": "another.example.com",
"port": "8000",
"ssl": true,
"sslPort": "8443",
"path": "/somewhere/",
"webSocket": true
},
]
Field:
- host - Server hostname. Required.
- names - Additional names for the server.
- port - Port on which to listen for connections. Defaults to 80.
- ssl - If enabled, ceritificate and key has to be available at /etc/nginx/ssl named .crt and <host.key>. If enabled all http requests are redirected to https. Defaults to false.
- sslPort - Port on which to listen to ssl connections. Defaults to 443.
- targetPort - Port on which the service listens for connections. Defaults to 80.
- path - Path on which this service is exposed. Defaults to "/".
- webSocket - Enable if the service requires upgrading the HTTP conenction to a WebSocket. Defaults to false.
- default - Enable if this is the default server. Defaults to false.
- targetPath - The path to proxy to.
- options - Additional Nginx options for the server;
- pathOptions - Additional Nginx options for the default path;
http-proxy-paths:
{
"some.example.com": [
{
"path": "/somewhere/",
"targetPort": "3000",
"webSocket": true
},
{
"path": "/somewhere/else/",
"targetPort": "3000",
"options": ["proxy_pass_request_headers on"],
}
],
"another.example.com": [
{
"path": "/api/",
"targetPort": "8080",
"targetPath": "proxy",
}
]
}
Fields:
- path - Path on which this service is exposed. Required.
- targetPort - Port on which the service listens for connections. Defaults to 80.
- webSocket - Enable if the service requires upgrading the HTTP conenction to a WebSocket. Defaults to false.
- targetPath - Path to proxy to.
- options - Additional Nginx options for the path.
Example service.yaml
apiVersion: v1beta3
kind: List
items:
- kind: Service
apiVersion: v1beta3
metadata:
name: test-proxy
annotations:
http-proxy-servers: '[{"host": "some.example.com"}]'
spec:
selector:
name: test-pod
ports:
- port: 80
targetPort: http
- kind: Service
apiVersion: v1beta3
metadata:
name: test-proxy-api
annotations:
http-proxy-paths: '{"some.example.com": [{"path": "/api/", "targetPort": 8080}]}'
spec:
selector:
name: test-pod-api
ports:
- port: 8080
targetPort: api
Fleet
This container should be ran outside of kubernetes because due to kube-proxy, client IPs are obscured. Here's a service file that can be used to launch this container:
[Unit]
Description=Kubernetes HTTP Reverse Proxy
Documentation=https://github.com/noonien/kube-http-proxy
Requires=docker.service
Requires=etcd2.service
After=docker.service
After=etcd2.service
[Service]
EnvironmentFile=/etc/network-environment
ExecStartPre=-/usr/bin/docker rm -f kube-http-proxy
ExecStart=/usr/bin/docker run -e CONFD_ETCD_NODE=${DEFAULT_IPV4}:4001 -p 443:443 -p 80:80 --name kube-http-proxy noonien/kube-http-proxy
Restart=always
RestartSec=10
This example uses setup-network-environment to get the correct IP address of the etcd server.
Tag summary
Content type
Image
Digest
sha256:eaba30a92…
Size
131.4 MB
Last updated
over 10 years ago
docker pull noonien/kube-http-proxy