ingress-controller

ingress-controller copied to clipboard

[P3] validate Ingress parameter combination

2

**Is your feature request related to a problem? Please describe.** Not all combinations of parameters are compatible, i.e. 1. TCP routes do not support certain annotations such as `secure_upstream` 2....

wasaga

**Is your feature request related to a problem? Please describe.** IDEs such as VSCode provide syntax and help for known file formats, including Kubernetes objects.  It would be useful...

wasaga

**Is your feature request related to a problem? Please describe.** Currently, Ingress controller accepts namespaces to watch for Ingress resources via `--namespaces` runtime option, which may be manually provided via...

wasaga

Support K8S Gateway API

1

As also described in https://gateway-api.sigs.k8s.io/ an Ingress API (resource) isn't tied to a specific role, but instead contains configuration for both infrastructure, policies, frontend and backend. The new Gateway API...

paul-bormans

It is assumed that configured cluster domain is always "cluster.local"

7

## What happened? Under [some circumstances](https://github.com/pomerium/ingress-controller/blob/553a780afdef05592c0fb5d48d6241ed58f98bfb/pomerium/ingress_to_route.go#L238), Pomerium could configure the destination endpoint with the format ``BACKEND.NAMESPACE.svc.cluster.local``. This is assuming the cluster domain is always ``cluster.local``, that could be not the...

adrianlzt

Do not assume the kubernetes cluster domain

2

## Summary Adding the suffix "cluster.local" in the service domain breaks compatibility with k8s clusters with custom domains. Just defining until ".svc" will use the "search" in /etc/resolv.conf to complete...

adrianlzt

Proposal: Provide a secure storage for policy headers

2

Currently `pomerium-operator` doesn't provide a secure way to store policy `set_request_headers` key. Maybe it makes sense to add a new annotation like: ```yaml ingress.pomerium.io/policy_from_secret: "secretName" ``` which will point at...

abuzhynsky

[low] check TLS cert secret actually matches the host

1

**Is your feature request related to a problem? Please describe.** apparently `cert-manager` would not complain if you specify an ingress and define `host` that does not match the contents of...

wasaga

This PR updates the Pomerium Core to the latest commit in main

apparitor

Bumps the k8s group with 3 updates in the / directory: [k8s.io/api](https://github.com/kubernetes/api), [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) and [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime). Updates `k8s.io/api` from 0.30.0 to 0.30.3 Commits 83bdab1 Update dependencies to v0.30.3 tag 0fd470c Merge...

dependabot[bot]