search

Azure / application-gateway-kubernetes-ingress

This is an ingress controller that can be run on Azure Kubernetes Service (AKS) to allow an Azure Application Gateway to act as the ingress for an AKS cluster.
https://azure.github.io/application-gateway-kubernetes-ingress
MIT License
667 stars 413 forks source link

Support regex in AzureIngressProhibitedTarget #1579

Closed birjj closed 7 months ago

birjj commented 7 months ago

Is your feature request related to a problem? Please describe. The current implementation of multi-cluster shared gateway has the (often blocking) problem that it requires each cluster to know every hostname it should ignore.
This often isn't practical to maintain, as evident by the number of different issues here (e.g. #1542, #1517, #1382).

Describe the solution you'd like A few different solutions exists for this (e.g. #1542), but one that is simple to implement would be to support regular expressions in the hostname field of AzureIngressProhibitedTarget resources. This would allow far more extendable logic - e.g. "not prod.*", "not specific.example.com" and similar - to be implemented without requiring new use-case-specific resource definitions.

Specifically, the CRD would need a way to indicate that the hostname is a regex (so test.example.com wouldn't match testxexample.com if that isn't the intention), and the following line would have to be augmented to use regexp.MatchString if that is the case:

https://github.com/Azure/application-gateway-kubernetes-ingress/blob/91fa7b29b7be7e8e437a75390358d5d905413364/pkg/brownfield/targets.go#L37

Implementation details I'm imagining that we could either use a flag embedded in the hostname (e.g. hostname: "r:prod\.*" indicates a regex),

kind: AzureIngressProhibitedTarget
metadata:
  name: disable-prod
spec:
  hostname: r:prod\..*

or an annotation on the resource similar to nginx.ingress.kubernetes.io/use-regex:

kind: AzureIngressProhibitedTarget
metadata:
  name: disable-prod
  annotations:
    appgw.ingress.kubernetes.io/use-regex: "true"
spec:
  hostname: prod\..*
birjj commented 7 months ago

Closing this as I discovered that the Golang regular expression engine doesn't support negative lookaheads. That means that the primary use case to motivate this (ignoring everything but a specific hostname) would be very verbose to implement.