httpproxy: Add support for ip-based filtering by ecordell · Pull Request #5008 · projectcontour/contour

ecordell · 2023-01-25T23:55:24Z

Configures Envoy's envoy.filters.http.rbac per route via HTTPProxy.

See #4990 for design

Fixes #3693

sunjayBhatia

this looks great so far, awesome to have an implementation to play with

github-actions · 2023-02-16T00:23:17Z

The Contour project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 14d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, the PR is closed

You can:

Mark this PR as fresh by commenting or pushing a commit
Close this PR
Offer to help out with triage

Please send feedback to the #contour channel in the Kubernetes Slack

ecordell · 2023-02-16T16:29:30Z

I'll rebase this when the design is finalized

github-actions · 2023-03-03T01:59:55Z

The Contour project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 14d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, the PR is closed

You can:

Mark this PR as fresh by commenting or pushing a commit
Close this PR
Offer to help out with triage

Please send feedback to the #contour channel in the Kubernetes Slack

skriss · 2023-03-24T19:38:54Z

@ecordell thanks for the PR! One thing to put on your radar is that we will want to add some user documentation as part of this PR -- should be a new page in site/content/docs/main/config, and added to the TOC via site/data/docs/main-toc.md.

codecov · 2023-03-24T19:44:21Z

Codecov Report

Merging #5008 (18a54cc) into main (7572a41) will increase coverage by 0.11%.
The diff coverage is 93.84%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5008      +/-   ##
==========================================
+ Coverage   77.78%   77.89%   +0.11%     
==========================================
  Files         138      138              
  Lines       18068    18198     +130     
==========================================
+ Hits        14054    14176     +122     
- Misses       3742     3748       +6     
- Partials      272      274       +2

Impacted Files	Coverage Δ
internal/dag/dag.go	`96.64% <ø> (ø)`
internal/dag/httpproxy_processor.go	`92.09% <87.30%> (-0.24%)`	⬇️
internal/envoy/v3/listener.go	`98.43% <100.00%> (+0.01%)`	⬆️
internal/envoy/v3/route.go	`80.15% <100.00%> (+1.71%)`	⬆️

apis/projectcontour/v1/httpproxy.go

test/e2e/httpproxy/ip_filtering_test.go

ecordell · 2023-03-31T21:25:15Z

@skriss thanks for the initial review! addressed everything that you noted.

test/e2e/httpproxy/ip_filtering_test.go

internal/dag/httpproxy_processor.go

skriss · 2023-04-10T15:48:31Z

@ecordell just a friendly ping that the end of this release cycle is rapidly approaching; if you could address the above comments and fix the small merge conflict then we can take another look here. Thanks!

apis/projectcontour/v1/httpproxy.go

ecordell · 2023-04-17T14:41:05Z

@skriss Addressed the comments and rebased, please let me know if you see anything else I need to do to get this into the next release

ecordell · 2023-04-18T12:42:25Z

@sunjayBhatia @skriss any final comments? I want to make sure I've covered everything so this can get into the next release, feel free to ping me in kube slack (same username) if there's anything else you'd like me to address.

site/content/docs/main/config/ip-filtering.md

sunjayBhatia · 2023-04-18T16:17:47Z

go.mod

 go 1.19

+// remove once https://github.com/cert-manager/cert-manager/issues/5953 is fixed
+replace github.com/Venafi/vcert/v4 => github.com/jetstack/vcert/v4 v4.9.6-0.20230127103832-3aa3dfd6613d


huh never end up running go list ... very often but confirmed this is an issue

skriss · 2023-04-20T08:03:36Z

@skriss Addressed the comments and rebased, please let me know if you see anything else I need to do to get this into the next release

Thanks @ecordell! Looks like @sunjayBhatia approved and I will take a final look as soon as I can (at KubeCon EU right now). We definitely want to get this into the upcoming release as well.

skriss

thanks for the updates @ecordell, LGTM. One last tiny merge conflict to resolve and this should be ready for merge

Configures Envoy's envoy.filters.http.rbac per route via HTTPProxy. See API docs in this commit for details. Fixes projectcontour#3693 Signed-off-by: Evan Cordell <cordell.evan@gmail.com>

Signed-off-by: Evan Cordell <cordell.evan@gmail.com>

see: cert-manager/cert-manager#5953 Signed-off-by: Evan Cordell <cordell.evan@gmail.com>

ecordell requested a review from a team as a code owner January 25, 2023 23:55

ecordell requested review from skriss and sunjayBhatia and removed request for a team January 25, 2023 23:55

ecordell force-pushed the ipfilter branch from 721beaa to 22dc279 Compare January 25, 2023 23:56

ecordell mentioned this pull request Jan 25, 2023

Add ip filter design doc #4990

Merged

ecordell force-pushed the ipfilter branch 3 times, most recently from d860bd4 to 3d143ce Compare January 26, 2023 02:12

sunjayBhatia reviewed Feb 1, 2023

View reviewed changes

sunjayBhatia requested a review from tsaarni February 1, 2023 22:28

sunjayBhatia added the release-note/major A major change that needs more than a paragraph of explanation in the release notes. label Feb 1, 2023

github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 16, 2023

github-actions bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 17, 2023

github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 3, 2023

bison mentioned this pull request Mar 9, 2023

Add IP allowlist and blocklist functionality #3693

Closed

ecordell force-pushed the ipfilter branch 2 times, most recently from 13d0876 to d7a4308 Compare March 20, 2023 22:56

github-actions bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 21, 2023

skriss requested changes Mar 28, 2023

View reviewed changes

ecordell force-pushed the ipfilter branch from d7a4308 to eff912e Compare March 31, 2023 21:22

sunjayBhatia self-requested a review April 3, 2023 17:04

sunjayBhatia reviewed Apr 4, 2023

View reviewed changes

test/e2e/httpproxy/ip_filtering_test.go Show resolved Hide resolved

sunjayBhatia reviewed Apr 4, 2023

View reviewed changes

test/e2e/httpproxy/ip_filtering_test.go Show resolved Hide resolved

sunjayBhatia reviewed Apr 4, 2023

View reviewed changes

internal/dag/httpproxy_processor.go Show resolved Hide resolved

skriss reviewed Apr 10, 2023

View reviewed changes

apis/projectcontour/v1/httpproxy.go Outdated Show resolved Hide resolved

ecordell force-pushed the ipfilter branch from eff912e to 71a8085 Compare April 17, 2023 14:39

ecordell force-pushed the ipfilter branch 3 times, most recently from b791b1a to fff01bd Compare April 18, 2023 12:12

sunjayBhatia approved these changes Apr 18, 2023

View reviewed changes

ecordell force-pushed the ipfilter branch from fff01bd to df2eea8 Compare April 18, 2023 18:46

skriss approved these changes Apr 21, 2023

View reviewed changes

ecordell added 5 commits April 21, 2023 16:13

httpproxy: Add support for ip-based filtering

c927652

Configures Envoy's envoy.filters.http.rbac per route via HTTPProxy. See API docs in this commit for details. Fixes projectcontour#3693 Signed-off-by: Evan Cordell <cordell.evan@gmail.com>

support bare ips in ip filters

c4c8539

Signed-off-by: Evan Cordell <cordell.evan@gmail.com>

support specifying ip filters at the virtualhost level

a113dd9

Signed-off-by: Evan Cordell <cordell.evan@gmail.com>

add ip filtering docs

3c3aa02

Signed-off-by: Evan Cordell <cordell.evan@gmail.com>

pin jetstack/vcert to avoid go mod list errors

18a54cc

see: cert-manager/cert-manager#5953 Signed-off-by: Evan Cordell <cordell.evan@gmail.com>

ecordell force-pushed the ipfilter branch from df2eea8 to 18a54cc Compare April 21, 2023 20:13

skriss merged commit f3eb153 into projectcontour:main Apr 25, 2023

github-actions bot mentioned this pull request Feb 27, 2026

🌱 CNCF mission generation 2026-02-27 kubestellar/console-kb#6

Closed

Conversation

ecordell commented Jan 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sunjayBhatia left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Feb 16, 2023

Uh oh!

ecordell commented Feb 16, 2023

Uh oh!

github-actions bot commented Mar 3, 2023

Uh oh!

skriss commented Mar 24, 2023

Uh oh!

codecov bot commented Mar 24, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ecordell commented Mar 31, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

skriss commented Apr 10, 2023

Uh oh!

Uh oh!

ecordell commented Apr 17, 2023

Uh oh!

ecordell commented Apr 18, 2023

Uh oh!

Uh oh!

sunjayBhatia Apr 18, 2023

Choose a reason for hiding this comment

Uh oh!

skriss commented Apr 20, 2023

Uh oh!

skriss left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ecordell commented Jan 25, 2023 •

edited

Loading

codecov bot commented Mar 24, 2023 •

edited

Loading