Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use a more unique name for upstreams #4

Closed
wants to merge 2 commits into from

Conversation

munnerz
Copy link

@munnerz munnerz commented Mar 12, 2016

With the previous naming convention, I am unable to create an Ingress such as this:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: example-ingress
spec:
  rules:
  - host: foo.bar.com
    http:
      paths:
      - backend:
          serviceName: s1
          servicePort: 80
        path: /foo
  - host: bar.baz.com
    http:
      paths:
      - backend:
          serviceName: s1
          servicePort: 80
        path: /foo

(where two rules point to the same service)

I'm unsure what the best naming convention would be, but this provides a good level of uniqueness. Should the servicePort be included in the name too?

@scruplelesswizard
Copy link

Typically you would have a different ingress controller for each service, instead of adding them to a single ingress controller. As such, fairly common practice is to use the pattern <ServiceName>-Ingress on the name metadata for the Ingress spec.
This would would mean that the path name for the current behavior would end up being <ServiceName>-Ingress-<ServiceName> and the proposed behavior would result in <ServiceName>-Ingress-<HostName>-<ServiceName>. I really like the idea of including the hostname, but why not drop the tailing <ServiceName>, giving us <ServiceName>-Ingress-<HostName>?

@munnerz
Copy link
Author

munnerz commented Mar 12, 2016

Should we also be including the path to make it <ServiceName>-Ingress-<HostName>-<Path>? A user could definitely have different paths leading to the same service, on the same host.

@scruplelesswizard
Copy link

While my gut feeling is that this would be atypical behavior, it is a
possibility that should be accounted for. If we do have a collision do we
currently make that clear in the logging output (ideally to stdout)?

On Sat, Mar 12, 2016 at 9:53 PM James Munnelly [email protected]
wrote:

Should we also be including the path to make it
-Ingress--? A user could definitely have
different paths leading to the same service, on the same host.


Reply to this email directly or view it on GitHub
#4 (comment)
.

@munnerz
Copy link
Author

munnerz commented Mar 12, 2016

No, if I recall correctly nginx just crashes, causing the container to crash in a cycle until the ingress is removed. kubectl logs shows that nginx has only printed it's exit code and no error message.

@scruplelesswizard
Copy link

Yummy. I have been doing some work on the contrib project, but I might take
a look at handling that more gracefully in the next few days.

On Sat, Mar 12, 2016 at 10:48 PM James Munnelly [email protected]
wrote:

No, if I recall correctly nginx just crashes, causing the container to
crash in a cycle until the ingress is removed. kubectl logs shows that
nginx has only printed it's exit code and no error message.


Reply to this email directly or view it on GitHub
#4 (comment)
.

@LinuxJedi
Copy link

NGINX not so much crashes but would fatal error on startup because the generated configuration would have two upstream configuration blocks would have the same name.

Kubectl logs probably doesn't capture stderr which would show the cause.

@pleshakov
Copy link
Contributor

Thanks for submitting a pull request and pointing out the issue!

The issue exists because the generated NGINX config file contains 2 upstreams with the same name, which is not allowed in NGINX.

Adding a hostname as a part of the name of an usptream solves the problem.
However if we have something like this in our ingress definition:

  - host: s1.example.com
    http:
      paths:
      - backend:
          serviceName: s1
          servicePort: 80
        path: /foo
      - backend:
          serviceName: s1
          servicePort: 80
        path: /bar

We'll end up with two upstreams with the same name.

Adding a path as a part of the name of an upstream is not a good idea, because the path can be a regular expression. A regular expression is not allowed in an upstream name.

The solution I suggest is #6

@pleshakov pleshakov closed this Mar 31, 2016
vepatel added a commit that referenced this pull request Apr 26, 2021
# This is the 1st commit message:

add ingress mtls test

# This is the commit message #2:

add std vs

# This is the commit message #3:

change vs host

# This is the commit message #4:

Update tls secret

# This is the commit message #5:

update certs with host

# This is the commit message #6:

modify get_cert

# This is the commit message #7:

Addind encoded cert

# This is the commit message #8:

Update secrets

# This is the commit message #9:

Add correct cert and SNI module

# This is the commit message #10:

Bump styfle/cancel-workflow-action from 0.8.0 to 0.9.0 (#1527)

Bumps [styfle/cancel-workflow-action](https://github.com/styfle/cancel-workflow-action) from 0.8.0 to 0.9.0.
- [Release notes](https://github.com/styfle/cancel-workflow-action/releases)
- [Commits](styfle/cancel-workflow-action@0.8.0...89f242e)

Signed-off-by: dependabot[bot] <[email protected]>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
# This is the commit message #11:

Remove patch version from Docker image for tests (#1534)


# This is the commit message #12:

Add tests for Ingress TLS termination

# This is the commit message #13:

Improve assertion of TLS errors in tests

When NGINX terminates a TLS connection for a server
with a missing/invalid TLS secret, we expect NGINX
to reject the connection with the error
TLSV1_UNRECOGNIZED_NAME

In this commit we:
* ensure the specific error
* rename the assertion function to be more specific

# This is the commit message #14:

Bump k8s.io/client-go from 0.20.5 to 0.21.0 (#1530)

Bumps [k8s.io/client-go](https://github.com/kubernetes/client-go) from 0.20.5 to 0.21.0.
- [Release notes](https://github.com/kubernetes/client-go/releases)
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.20.5...v0.21.0)

Signed-off-by: dependabot[bot] <[email protected]>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
# This is the commit message #15:

Improve tests Dockerfile

* Reorganize layers so that changes to the tests do not cause a full
image rebuilt
* Use .dockerignore to ignore cache folders
* Convert spaces to tabs for consistency with the other Dockerfiles

# This is the commit message #16:

Upgrade kubernetes-python client to 12.0.1 (#1522)

* Upgrade kubernetes-python client to 12.0.1

Co-authored-by: Venktesh Patel <[email protected]>
# This is the commit message #17:

Bump k8s.io/code-generator from 0.20.5 to 0.21.0 (#1531)

Bumps [k8s.io/code-generator](https://github.com/kubernetes/code-generator) from 0.20.5 to 0.21.0.
- [Release notes](https://github.com/kubernetes/code-generator/releases)
- [Commits](kubernetes/code-generator@v0.20.5...v0.21.0)

Signed-off-by: dependabot[bot] <[email protected]>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
# This is the commit message #18:

Test all images (#1533)

* Test on all images

* Update nightly to test all images

* Run all test markers on debian plus also

* Update .github/workflows/nightly.yml

# This is the commit message #19:

Add tests for default server

# This is the commit message #20:

Support running tests in kind

# This is the commit message #21:

Update badge for Fossa (#1546)


# This is the commit message #22:

Fix ensuring connection in tests

* Add timeout for establishing a connection to prevent potential
"hangs" of the test runs. The problem was noticeable when running
tests in kind.
* Increase the number of tries to make sure the Ingress Controller
pod has enough time to get ready. When running tests in kind
locally the number of tries sometimes was not enough.

# This is the commit message #23:

Ensure connection in Ingress TLS tests

Ensure connection to NGINX before running tests.
Without ensuring, sometimes the first connection to NGINX would
hang (timeout). The problem is noticable when running tests in
kind.

# This is the commit message #24:

Revert changes in nightly for now (#1547)


# This is the commit message #25:

Bump actions/cache from v2.1.4 to v2.1.5 (#1541)

Bumps [actions/cache](https://github.com/actions/cache) from v2.1.4 to v2.1.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Commits](actions/cache@v2.1.4...1a9e213)

Signed-off-by: dependabot[bot] <[email protected]>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
# This is the commit message #26:

Create release workflow
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants