Add Traefik deployment and IngressRoute configuration#93
Open
Add Traefik deployment and IngressRoute configuration#93
Conversation
Signed-off-by: Martin M Sheriff <smartin772@yahoo.com>
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
Reviewer's GuideAdds a Traefik v2.4 Deployment plus associated Middleware plugin configuration and an example IngressRoute for routing HTTP traffic through Traefik with a real IP plugin. Sequence diagram for HTTP request through Traefik IngressRoute with real IP middlewaresequenceDiagram
actor User
participant TraefikPod as Traefik_pod
participant MiddlewareRealIP as Middleware_traefik_real_ip
participant ExampleService as example_service
User->>TraefikPod: HTTP GET http://domain.ltd/
TraefikPod->>TraefikPod: Match IngressRoute ingress-example (entryPoint web)
TraefikPod->>MiddlewareRealIP: Apply real IP processing
MiddlewareRealIP-->>TraefikPod: Updated client IP headers
TraefikPod->>ExampleService: HTTP request with real client IP
ExampleService-->>TraefikPod: HTTP response
TraefikPod-->>User: HTTP response
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
1989shack.comProject ID: Sites (1)
Tip Custom domains work with both CNAME for subdomains and NS records for apex domains |
❌ Deploy Preview for 1989shack-e-c failed. Why did it fail? →
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 3 issues, and left some high level feedback:
- The Deployment currently enables
--api.insecureand hardcodes--pilot.token={YOUR_PILOT_TOKEN}; consider disabling the insecure API and sourcing the pilot token (if still needed) via a Secret or config mechanism rather than committing it in the manifest. - Host and network-specific values like
Host(domain.ltd)andexcludednets: ["1.1.1.1/24"]are hardcoded in the IngressRoute and Middleware; you may want to externalize these into environment-specific overlays or configuration to avoid editing the base manifest per environment. - The Traefik Deployment has no liveness/readiness probes configured; adding HTTP probes on the appropriate ports would make the controller’s health behavior more robust under failure or restart conditions.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The Deployment currently enables `--api.insecure` and hardcodes `--pilot.token={YOUR_PILOT_TOKEN}`; consider disabling the insecure API and sourcing the pilot token (if still needed) via a Secret or config mechanism rather than committing it in the manifest.
- Host and network-specific values like `Host(`domain.ltd`)` and `excludednets: ["1.1.1.1/24"]` are hardcoded in the IngressRoute and Middleware; you may want to externalize these into environment-specific overlays or configuration to avoid editing the base manifest per environment.
- The Traefik Deployment has no liveness/readiness probes configured; adding HTTP probes on the appropriate ports would make the controller’s health behavior more robust under failure or restart conditions.
## Individual Comments
### Comment 1
<location> `kubernetes.yml:24` </location>
<code_context>
+ - name: traefik
+ image: traefik:v2.4
+ args:
+ - --api.insecure
+ - --accesslog
+ - --entrypoints.web.Address=:80
</code_context>
<issue_to_address>
**🚨 issue (security):** Exposing the Traefik API/dashboard insecurely can be a security risk in most environments.
`--api.insecure` exposes the Traefik dashboard/API on the `admin` port without authentication. Outside of local/testing, consider disabling it or protecting it with auth and strict network controls (e.g., internal-only Service, IP allowlist, or an auth middleware).
</issue_to_address>
### Comment 2
<location> `kubernetes.yml:28` </location>
<code_context>
+ - --accesslog
+ - --entrypoints.web.Address=:80
+ - --providers.kubernetescrd
+ - --pilot.token={YOUR_PILOT_TOKEN}
+ - --experimental.plugins.traefik-real-ip.modulename=github.com/soulbalz/traefik-real-ip
+ - --experimental.plugins.traefik-real-ip.version=v1.0.3
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Pilot token should not be embedded directly in the manifest.
Putting `{YOUR_PILOT_TOKEN}` directly in args ties a sensitive value to the manifest and increases the risk of leaking it via version control. Prefer sourcing it from an environment variable backed by a Kubernetes Secret and referencing that in the args, or remove the Pilot integration if it’s no longer needed.
Suggested implementation:
```
- name: traefik
image: traefik:v2.4
env:
- name: TRAEFIK_PILOT_TOKEN
valueFrom:
secretKeyRef:
name: traefik-pilot-token
key: token
args:
```
```
- --providers.kubernetescrd
- --experimental.plugins.traefik-real-ip.modulename=github.com/soulbalz/traefik-real-ip
```
1. Create a `Secret` named `traefik-pilot-token` in the same namespace, with a key `token` containing the Pilot token, for example:
```yaml
apiVersion: v1
kind: Secret
metadata:
name: traefik-pilot-token
type: Opaque
data:
token: <base64-encoded-token>
```
2. Verify that the Traefik version you are using supports reading the Pilot token from the `TRAEFIK_PILOT_TOKEN`/`PILOT_TOKEN` environment variable (v2.x does).
</issue_to_address>
### Comment 3
<location> `kubernetes.yml:36-40` </location>
<code_context>
+ containerPort: 80
+ - name: admin
+ containerPort: 8080
+ resources:
+ requests:
+ cpu: 300m
+ limits:
+ cpu: 500m
+
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Resource spec only sets CPU requests/limits, omitting memory constraints.
Only CPU is configured under `resources`. Without memory requests/limits, the pod may be scheduled unpredictably and is more prone to OOM kills under load. Please add appropriate memory requests/limits based on expected Traefik usage.
```suggestion
resources:
requests:
cpu: 300m
memory: 256Mi
limits:
cpu: 500m
memory: 512Mi
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by Sourcery
Add Traefik deployment and routing configuration for exposing an example service via HTTP with real IP handling middleware.
New Features: