pomerium / ingress-controller

Pomerium Kubernetes Ingress Controller
https://pomerium.com
Apache License 2.0
23 stars 11 forks source link

ingress-controller/config: add support for direct response #897

Open calebdoxsey opened 9 months ago

calebdoxsey commented 9 months ago

Direct responses are described in https://github.com/pomerium/pomerium/issues/4954. We should support them in the ingress controller as well.

calebdoxsey commented 8 months ago

@wasaga it appears that we don't currently support the redirect option, I'm guessing because its incompatible with an ingress rule. For the same reason, would the new direct response option also not be supported?

wasaga commented 8 months ago

I believe we may do that using i.e. ConfigMap or a Secret reference and Resource Backends

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: direct-response
  namespace: default
spec:
  ingressClassName: pomerium
  rules:
  - host: direct-response.localhost.pomerium.io
    http:
      paths:
      - backend:
          resource:
            kind: ConfigMap
            name: mydata
        path: /
        pathType: Exact
apiVersion: v1
kind: ConfigMap
metadata:
  name: mydata
  namespace: default
data:
  contentType: application/json
  code: "200"
  data: |
    {
      "key": "value"
    }
calebdoxsey commented 8 months ago

I think this needs more detailed requirements. I'm not sure how the backend resource is intended to be used with an ingress rule. For example, what would be the format of the data in the config map or secret? The direct response itself:

{"status":200, "body": "TEST"}

Or is it something more nested?

{
  "response": {
    "status": 200,
    "body": "TEST"
  }
}

Maybe we should put this on hold till we have clearer needs from users.