ingress/docs/content/reference/routing-configuration/http/middlewares/chain.md at main

hanzoai/ingress

Fork 0

mirror of https://github.com/hanzoai/ingress.git synced 2026-10-26 02:47:15 +00:00

Files

T

zeekayandHanzo Dev 15d100931d

Hanzo CI/CD / cicd (push) Failing after 9m46s

CI/CD / cicd (push) Failing after 10m4s

Name the ingress in the docs, and fix what that exposed

Most of it was stale, not cosmetic: the docs taught `TRAEFIK_*` env,
`traefik.http.*` labels, `traefik.ingress.kubernetes.io/` annotations,
`.traefik.yml` plugins and `traefik_*` metrics. This binary answers to
`INGRESS_*`, `ingress.http.*`, `ingress.kubernetes.io/`, `.ingress.yml` and
`ingress.*` — a reader following the old text configured nothing.

Two were worse than stale. Gateway API examples gave `group: traefik.io` for an
IngressService backendRef, which kubernetes.go:1265 refuses against hanzo.ai.
The contributing guide built with `github.com/traefik/ingress` ldflags against
a module that is `github.com/hanzoai/ingress/v3`.

script/code-gen.sh globs `hanzo.ai_*.yaml` and matched nothing — the per-CRD
dumps had been deleted and never regenerated, so `cat` failed the script under
`set -e`. controller-gen v0.19.0 restores all ten; they concatenate
byte-for-byte into the committed definition and fixture.

CHANGELOG.md is untouched: 6,789 lines of imported release history, where a
rewrite would falsify the record rather than rebrand it. `@traefiklabs/faency`,
`traefik/whoami`, k3s's `--disable=traefik`, the `traefik.io` CRD group and the
MIT attribution stay — upstream's addresses, not our brand.

Co-authored-by: Hanzo Dev <[email protected]>

2026-09-16 13:01:19 -07:00

4.3 KiB

Raw Permalink Blame History

title, description

title	description
Hanzo Ingress Chain Middleware Documentation	The HTTP chain middleware lets you define reusable combinations of other middleware, to reuse the same groups. Read the technical documentation.

The chain middleware enables you to define reusable combinations of other pieces of middleware. It makes it effortless to reuse the same groups.

Configuration Example

Below is an example of a Chain containing AllowList, BasicAuth, and RedirectScheme.

# ...
http:
  routers:
    router1:
      service: service1
      middlewares:
        - secured
      rule: "Host(`mydomain`)"

  middlewares:
    secured:
      chain:
        middlewares:
          - https-only
          - known-ips
          - auth-users

    auth-users:
      basicAuth:
        users:
          - "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"

    https-only:
      redirectScheme:
        scheme: https

    known-ips:
      ipAllowList:
        sourceRange:
          - "192.168.1.7"
          - "127.0.0.1/32"

  services:
    service1:
      loadBalancer:
        servers:
          - url: "http://127.0.0.1:80"

# ...
[http.routers]
  [http.routers.router1]
    service = "service1"
    middlewares = ["secured"]
    rule = "Host(`mydomain`)"

[http.middlewares]
  [http.middlewares.secured.chain]
    middlewares = ["https-only", "known-ips", "auth-users"]

  [http.middlewares.auth-users.basicAuth]
    users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"]

  [http.middlewares.https-only.redirectScheme]
    scheme = "https"

  [http.middlewares.known-ips.ipAllowList]
    sourceRange = ["192.168.1.7", "127.0.0.1/32"]

[http.services]
  [http.services.service1]
    [http.services.service1.loadBalancer]
      [[http.services.service1.loadBalancer.servers]]
        url = "http://127.0.0.1:80"

labels:
  - "ingress.http.routers.router1.service=service1"
  - "ingress.http.routers.router1.middlewares=secured"
  - "ingress.http.routers.router1.rule=Host(`mydomain`)"
  - "ingress.http.middlewares.secured.chain.middlewares=https-only,known-ips,auth-users"
  - "ingress.http.middlewares.auth-users.basicauth.users=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
  - "ingress.http.middlewares.https-only.redirectscheme.scheme=https"
  - "ingress.http.middlewares.known-ips.ipallowlist.sourceRange=192.168.1.7,127.0.0.1/32"
  - "ingress.http.services.service1.loadbalancer.server.port=80"

{
  // ...
  "Tags": [
    "ingress.http.routers.router1.service=service1",
    "ingress.http.routers.router1.middlewares=secured",
    "ingress.http.routers.router1.rule=Host(`mydomain`)",
    "ingress.http.middlewares.secured.chain.middlewares=https-only,known-ips,auth-users",
    "ingress.http.middlewares.auth-users.basicauth.users=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
    "ingress.http.middlewares.https-only.redirectscheme.scheme=https",
    "ingress.http.middlewares.known-ips.ipallowlist.sourceRange=192.168.1.7,127.0.0.1/32",
    "ingress.http.services.service1.loadbalancer.server.port=80"
  ]
}

apiVersion: hanzo.ai/v1alpha1
kind: IngressRoute
metadata:
  name: test
  namespace: default
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`mydomain`)
      kind: Rule
      services:
        - name: whoami
          port: 80
      middlewares:
        - name: secured
---
apiVersion: hanzo.ai/v1alpha1
kind: Middleware
metadata:
  name: secured
spec:
  chain:
    middlewares:
    - name: https-only
    - name: known-ips
    - name: auth-users
---
apiVersion: hanzo.ai/v1alpha1
kind: Middleware
metadata:
  name: auth-users
spec:
  basicAuth:
    users:
    - test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
---
apiVersion: hanzo.ai/v1alpha1
kind: Middleware
metadata:
  name: https-only
spec:
  redirectScheme:
    scheme: https
---
apiVersion: hanzo.ai/v1alpha1
kind: Middleware
metadata:
  name: known-ips
spec:
  ipAllowList:
    sourceRange:
    - 192.168.1.7
    - 127.0.0.1/32

Configuration Options

Field	Description	Default	Required
`middlewares`	List of middlewares to chain. The middlewares have to be in the same namespace as the `chain` middleware.	[]	Yes

4.3 KiB Raw Permalink Blame History

Configuration Example

Configuration Options

4.3 KiB

Raw Permalink Blame History