config.go

package version1

import (
	"github.com/nginx/kubernetes-ingress/internal/configs/version2"
	"github.com/nginx/kubernetes-ingress/internal/nginx"
)

// UpstreamLabels describes the Prometheus labels for an NGINX upstream.
type UpstreamLabels struct {
	Service           string
	ResourceType      string
	ResourceName      string
	ResourceNamespace string
}

// IngressNginxConfig describes an NGINX configuration.
type IngressNginxConfig struct {
	Upstreams               []Upstream
	Servers                 []Server
	Keepalive               string
	Maps                    []version2.Map
	CORSHeaders             []version2.AddHeader
	Ingress                 Ingress
	DynamicSSLReloadEnabled bool
	StaticSSLPath           string
	LimitReqZones           []LimitReqZone
	// AppProtectLoadModule mirrors the controller's -enable-app-protect flag so
	// templates can safely emit app_protect_enable off; in internal sub-request
	// locations only when the WAF module is actually loaded.
	AppProtectLoadModule bool
}

// Ingress holds information about an Ingress resource.
type Ingress struct {
	Name        string
	Namespace   string
	Annotations map[string]string
}

// Upstream describes an NGINX upstream.
type Upstream struct {
	Name             string
	UpstreamServers  []UpstreamServer
	StickyCookie     string
	LBMethod         string
	Queue            int64
	QueueTimeout     int64
	UpstreamZoneSize string
	UpstreamLabels   UpstreamLabels
}

// UpstreamServer describes a server in an NGINX upstream.
type UpstreamServer struct {
	Address     string
	MaxFails    int
	MaxConns    int
	FailTimeout string
	SlowStart   string
	Resolve     bool
}

// HealthCheck describes an active HTTP health check.
type HealthCheck struct {
	UpstreamName   string
	URI            string
	Interval       int32
	Fails          int32
	Passes         int32
	Scheme         string
	Mandatory      bool
	Headers        map[string]string
	TimeoutSeconds int64
}

// LimitReqZone describes a zone used for request rate limiting
type LimitReqZone struct {
	Name string
	Key  string
	Size string
	Rate string
	Sync bool
}

// Server describes an NGINX server.
type Server struct {
	AddHeaderInherit       string
	ServerSnippets         []string
	Name                   string
	IsDefaultServer        bool
	AccessLogOff           bool
	DefaultServerReturn    string
	HealthStatus           bool
	HealthStatusURI        string
	ServerTokens           string
	Locations              []Location
	EgressMTLS             *version2.EgressMTLS
	SSL                    bool
	SSLCertificate         string
	SSLCertificateKey      string
	SSLCiphers             string
	SSLPreferServerCiphers bool
	SSLRejectHandshake     bool
	TLSPassthrough         bool
	GRPCOnly               bool
	IngressMTLS            *version2.IngressMTLS
	HasGRPCLocations       bool
	StatusZone             string
	HTTP2                  bool
	RedirectToHTTPS        bool
	SSLRedirect            bool
	HTTPRedirectCode       int
	ProxyProtocol          bool
	HSTS                   bool
	HSTSMaxAge             int64
	HSTSIncludeSubdomains  bool
	HSTSBehindProxy        bool
	ProxyHideHeaders       []string
	ProxyPassHeaders       []string
	AddHeaders             []version2.AddHeader
	Allow                  []string
	Deny                   []string
	PoliciesErrorReturn    *version2.Return

	HealthChecks map[string]HealthCheck

	RealIPHeader    string
	SetRealIPFrom   []string
	RealIPRecursive bool

	JWTAuth              *JWTAuth
	ExternalAuth         *version2.ExternalAuth
	BasicAuth            *BasicAuth
	JWTRedirectLocations []JWTRedirectLocation

	Ports                        []int
	SSLPorts                     []int
	AppProtectEnable             string
	AppProtectPolicy             string
	AppProtectLogConfs           []string
	AppProtectLogEnable          string
	AppProtectDosEnable          string
	AppProtectDosPolicyFile      string
	AppProtectDosLogConfFile     string
	AppProtectDosLogEnable       bool
	AppProtectDosMonitorURI      string
	AppProtectDosMonitorProtocol string
	AppProtectDosMonitorTimeout  uint64
	AppProtectDosName            string
	AppProtectDosAllowListPath   string
	AppProtectDosAccessLogDst    string
	WAF                          *version2.WAF

	DisableIPV6 bool

	ProxyRedirectFrom string
	ProxyRedirectTo   string

	// CustomHTTPErrorCodes holds the upstream status codes to intercept at server
	// context (set from the nginx.org/custom-http-errors annotation on the Ingress
	// or on the master of a mergeable Ingress). All non-overriding locations on
	// the server inherit these directives via standard NGINX inheritance.
	CustomHTTPErrorCodes []int
	// CustomHTTPErrorBackend is the upstream name that @custom_default_backend
	// proxies to. Populated from the Ingress's spec.defaultBackend upstream.
	// Non-empty iff the server should render the shared @custom_default_backend
	// named location — that is, custom-http-errors are configured AND the Ingress
	// has a spec.defaultBackend. Doubles as the enable flag; no separate boolean.
	CustomHTTPErrorBackend string

	AppRoot string
}

// JWTRedirectLocation describes a location for redirecting client requests to a login URL for JWT Authentication.
type JWTRedirectLocation struct {
	Name     string
	LoginURL string
}

// BasicAuth holds HTTP Basic authentication parameters
type BasicAuth struct {
	Realm  string
	Secret string
}

// JWTAuth holds JWT authentication configuration.
type JWTAuth struct {
	Key                  string
	Realm                string
	Token                string
	RedirectLocationName string
}

// LimitReq configures a request rate limit
type LimitReq struct {
	Zone       string
	Burst      int
	Delay      int
	NoDelay    bool
	RejectCode int
	DryRun     bool
	LogLevel   string
}

// Location describes an NGINX location.
type Location struct {
	AddHeaderInherit        string
	LocationSnippets        []string
	Path                    string
	Upstream                Upstream
	ProxyPass               string
	ProxyPassRequestBody    string
	ProxyPassRequestHeaders string
	ProxyConnectTimeout     string
	ProxyReadTimeout        string
	ProxySendTimeout        string
	ProxySetHeaders         []version2.Header
	ClientMaxBodySize       string
	ClientBodyBufferSize    string
	Websocket               bool
	Rewrite                 string
	RewriteTarget           string
	SSL                     bool
	GRPC                    bool
	ProxyBuffering          bool
	ProxyBuffers            string
	ProxyBufferSize         string
	ProxyBusyBuffersSize    string
	ProxyMaxTempFileSize    string
	ProxySSLName            string
	AddHeaders              []version2.AddHeader
	JWTAuth                 *JWTAuth
	ExternalAuth            *version2.ExternalAuth
	BasicAuth               *BasicAuth
	ServiceName             string
	LimitReq                *LimitReq
	CORSEnabled             bool

	AuthRequestOff bool
	Internal       bool

	MinionIngress *Ingress

	ProxyNextUpstream        string
	ProxyNextUpstreamTimeout string
	ProxyNextUpstreamTries   *uint64
	ProxyRedirectFrom        string
	ProxyRedirectTo          string
	// CustomHTTPErrorCodes lists the upstream status codes to intercept at this
	// location. When non-empty, the location renders proxy_intercept_errors on;
	// and, when the parent Server has a non-empty CustomHTTPErrorBackend, an
	// error_page directive routing those codes to @custom_default_backend.
	// Overrides any server-level CustomHTTPErrorCodes for this location per
	// NGINX's error_page inheritance rule (nested block replaces parent).
	CustomHTTPErrorCodes []int
	// SkipCustomHTTPErrors is set on the synthesized default-backend location to
	// break the intercept loop when server-level custom-http-errors would
	// otherwise cause the default backend to intercept its own responses. When
	// true the template emits proxy_intercept_errors off; inside the location.
	SkipCustomHTTPErrors       bool
	ProxySSLVerify             bool
	ProxySSLVerifyDepth        int
	ProxySSLTrustedCertificate string
	Allow                      []string
	Deny                       []string
	WAF                        *version2.WAF
	EgressMTLS                 *version2.EgressMTLS
	PoliciesErrorReturn        *version2.Return
}

// ZoneSyncConfig is tbe configuration for the zone_sync directives for state sharing.
type ZoneSyncConfig struct {
	Enable            bool
	Port              int
	Domain            string
	ResolverAddresses []string
	// Time the resolver is valid. Go time string format: "5s", "10s".
	ResolverValid string
	ResolverIPV6  *bool
}

// OIDCConfig allows to configure OIDC parameters.
type OIDCConfig struct {
	Enable          bool
	PKCETimeout     string
	PKCEZoneSize    string
	IDTokenTimeout  string
	IDTokenZoneSize string
	AccessTimeout   string
	AccessZoneSize  string
	RefreshTimeout  string
	RefreshZoneSize string
	SIDSTimeout     string
	SIDSZoneSize    string
}

// MGMTConfig is tbe configuration for the MGMT block.
type MGMTConfig struct {
	SSLVerify            *bool
	EnforceInitialReport *bool
	Endpoint             string
	Interval             string
	TrustedCert          bool
	TrustedCRL           bool
	ClientAuth           bool
	ResolverAddresses    []string
	ResolverIPV6         *bool
	ResolverValid        string
	ProxyHost            string
	ProxyUser            string
	ProxyPass            string
}

// MainConfig describe the main NGINX configuration file.
type MainConfig struct {
	AccessLog                          string
	AddHeaderInherit                   string
	DisableIPV6                        bool
	ErrorLogLevel                      string
	HTTP2                              bool
	HTTPSnippets                       []string
	AddHeaders                         []version2.AddHeader
	KeepaliveRequests                  int64
	KeepaliveTimeout                   string
	LogFormat                          []string
	LogFormatEscaping                  string
	MainSnippets                       []string
	MGMTConfig                         MGMTConfig
	NginxStatus                        bool
	NginxStatusAllowCIDRs              []string
	NginxStatusPort                    int
	MainOtelLoadModule                 bool
	MainOtelGlobalTraceEnabled         bool
	MainOtelExporterEndpoint           string
	MainOtelExporterHeaderName         string
	MainOtelExporterHeaderValue        string
	MainOtelServiceName                string
	ProxyProtocol                      bool
	ResolverAddresses                  []string
	ResolverIPV6                       bool
	ResolverTimeout                    string
	ResolverValid                      string
	SetRealIPFrom                      []string
	ServerNamesHashBucketSize          string
	ServerNamesHashMaxSize             string
	MapHashBucketSize                  string
	MapHashMaxSize                     string
	ClientBodyBufferSize               string
	SSLCiphers                         string
	SSLDHParam                         string
	SSLPreferServerCiphers             bool
	SSLProtocols                       string
	StreamLogFormat                    []string
	StreamLogFormatEscaping            string
	StreamSnippets                     []string
	StubStatusOverUnixSocketForOSS     bool
	TLSPassthrough                     bool
	TLSPassthroughPort                 int
	VariablesHashBucketSize            uint64
	VariablesHashMaxSize               uint64
	WorkerConnections                  string
	WorkerCPUAffinity                  string
	WorkerProcesses                    string
	WorkerRlimitNofile                 string
	WorkerShutdownTimeout              string
	AppProtectLoadModule               bool
	AppProtectV5LoadModule             bool
	AppProtectV5EnforcerAddr           string
	AppProtectFailureModeAction        string
	AppProtectCompressedRequestsAction string
	AppProtectCookieSeed               string
	AppProtectCPUThresholds            string
	AppProtectPhysicalMemoryThresholds string
	AppProtectReconnectPeriod          string
	AppProtectDosLoadModule            bool
	AppProtectDosLogFormat             []string
	AppProtectDosLogFormatEscaping     string
	AppProtectDosArbFqdn               string
	LatencyMetrics                     bool
	ZoneSyncConfig                     ZoneSyncConfig
	OIDC                               OIDCConfig
	DynamicSSLReloadEnabled            bool
	StaticSSLPath                      string
	NginxVersion                       nginx.Version
}

// NewUpstreamWithDefaultServer creates an upstream with the default server.
// proxy_pass to an upstream with the default server returns 502.
// We use it for services that have no endpoints.
func NewUpstreamWithDefaultServer(name string) Upstream {
	return Upstream{
		Name:             name,
		UpstreamZoneSize: "256k",
		UpstreamServers: []UpstreamServer{
			{
				Address:     "127.0.0.1:8181",
				MaxFails:    1,
				MaxConns:    0,
				FailTimeout: "10s",
			},
		},
	}
}