Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Traefik, Now With Native Go Plugins

traefik.io

Post reply on HN
Print view View original

31–40 of 65 posts

Re: Traefik, Now With Native Go Plugins

#31

Post by TheDong »

codethief wrote: post #3

I've been wanting to use Traefik for a long time but there's this security issue[0] that's almost two(!) years old now that's been keeping me from deploying it in production. As far as I can tell, there's still no out-of-the-box solution that's not overly complicated and won't come back to haunt me a year or two from now. [0] https://github.com/traefik/traefik/issues/4174 [1] https://doc.traefik.io/traefik/providers/…

That so called "security issue" is silly.

You don't have to deploy traefik with docker. If you want traefik to monitor new docker containers to add routes for them, of course traefik needs to talk to the docker api to do so.

The docker api has no way to control access such that it's not equivalent to root access.

However, there's no real vulnerability. I'm happy to provide you a url hosted by traefik with the docker integration enabled, no docker socket proxy, etc, and if you can manage to actually escalate permissions, I'll give you 500 bucks. But, of course, you can't. That security issue is just a "defense in depth" issue, and it's an issue for docker, not traefik.

This would be like saying "traefik uses the linux kernel api to open files, but the linux kernel requires traefik validate what goes into that api or else it could allow file path traversal"... But traefik does validate filepaths and so no one makes that complaint.

Similarly, traefik does validate that only safe docker api calls are made and works hard to prevent any sort of remote code execution, so the issue is not a security issue, but a defense in depth proposal that is really a feature request for the docker project.

Re: Traefik, Now With Native Go Plugins

#32

Post by kalev »

d33 wrote: post #30

I wish I could like Traefik, but it really isn't easy. The use case in our Hackerspace was to dispatch different Docker containers through our wild-card subdomains. Traefik is supposed to also automatically create TLS certificates. I had numerous problems with the Let's Encrypt functionality. Debugging information is quite cryptic, the documentation seems all over to me, which is even more problematic given the numbe…

Ouch, we’re currently using nginx but recently switched one service to use traefik. I’m so afraid what you describe is what will bite us in the end. I wrote treafik instead of traefik in one of the labels and only noticed it after hours of debugging. When it works, it works great. But to get it in that state..

Re: Traefik, Now With Native Go Plugins

#33

Post by thegagne »

jerryoftheyear wrote: post #15
rcarmo wrote: post #12

I would _really_ like to see social auth middleware (something like authelia, but simpler to setup and deploy, especially as an ingress).

Sign me up for an easy to use 2FA layer I can put in front of services.

I’ve been toying with Azure OpenID Connect w/ Cloudflare Workers. Not local to the datacenter but you could probably do something similar elsewhere?

Re: Traefik, Now With Native Go Plugins

#34

Post by viraptor »

kalev wrote: post #32
d33 wrote: post #30

I wish I could like Traefik, but it really isn't easy. The use case in our Hackerspace was to dispatch different Docker containers through our wild-card subdomains. Traefik is supposed to also automatically create TLS certificates. I had numerous problems with the Let's Encrypt functionality. Debugging information is quite cryptic, the documentation seems all over to me, which is even more problematic given the numbe…

Ouch, we’re currently using nginx but recently switched one service to use traefik. I’m so afraid what you describe is what will bite us in the end. I wrote treafik instead of traefik in one of the labels and only noticed it after hours of debugging. When it works, it works great. But to get it in that state..

I see where the op is coming from, but I found the debugging quite easy in practice. If something doesn't work, go to the traefik panel and find the element you're looking for. If it's not there, it's normally fairly obvious.

Re: Traefik, Now With Native Go Plugins

#35

Post by throwaway894345 »

password4321 wrote: post #29

Does anyone have time to explain the downsides of the HashiCorp plugin approach (gRPC to another process) vs. creating an interpreter? https://github.com/hashicorp/go-plugin

Using an interpreter locks you into the interpreter's language (e.g., no NodeJS, Python, etc plugins), but you are able to pass around memory and call procedures from the host program directly instead of having to write an IPC shim layer.

EDIT: Updated for accuracy

Re: Traefik, Now With Native Go Plugins

#36

Post by atombender »

d33 wrote: post #30

I wish I could like Traefik, but it really isn't easy. The use case in our Hackerspace was to dispatch different Docker containers through our wild-card subdomains. Traefik is supposed to also automatically create TLS certificates. I had numerous problems with the Let's Encrypt functionality. Debugging information is quite cryptic, the documentation seems all over to me, which is even more problematic given the numbe…

I worked on a project last year where we tried using Traefik on Kubernetes together with Let's Encrypt certs. It worked... sometimes.

We had significant issues with Traefik not allocating or renewing certs, resulting in some painful outages. The worst part was that there was no workaround; when adding a new domain to an ingress, it was completely incomprehensible why Traefik wasn't requesting a cert, or indeed why it wasn't renewing older ones that were close to expiration. We filed GitHub issues with concrete errors, but they were never addressed. At the time, I tried to debug Traefik to understand how it worked and maybe chase down some of those bugs. I don't like to speak ill of other people's code — let's just say that peeking under the covers made me realize perfectly why Traefik was so brittle and buggy.

We eventually ditched Traefik in favour of Google Load Balancer ingresses, combined with Cert-Manager for Let's Encrypt, and this combination worked flawlessly out of the box despite not being a 1.0 release at the time. The beauty of this setup is that the control plane (cert and ingress configuration) is kept separate from the data plane (web server), so the two can be maintained and upgraded/replaced separately.

Re: Traefik, Now With Native Go Plugins

#37

Post by thegeekpirate »

throwaway894345 wrote: post #35
password4321 wrote: post #29

Does anyone have time to explain the downsides of the HashiCorp plugin approach (gRPC to another process) vs. creating an interpreter? https://github.com/hashicorp/go-plugin

Using an interpreter locks you into the interpreter's language (e.g., no NodeJS, Python, etc plugins), but you are able to pass around memory and call procedures from the host program directly instead of having to write an IPC shim layer. EDIT: Updated for accuracy

They actually created their own interpreter https://github.com/traefik/yaegi

Here's their original announcement post https://traefik.io/blog/announcing-yaegi-263a1e2d070a

Re: Traefik, Now With Native Go Plugins

#38

Post by fuzzy2 »

d33 wrote: post #30

I wish I could like Traefik, but it really isn't easy. The use case in our Hackerspace was to dispatch different Docker containers through our wild-card subdomains. Traefik is supposed to also automatically create TLS certificates. I had numerous problems with the Let's Encrypt functionality. Debugging information is quite cryptic, the documentation seems all over to me, which is even more problematic given the numbe…

I actually have the same setup and it's working perfectly fine, even with my IPv4+6 specific address only config + lots of file-based configuration. I absolutely recommend using the TLS challenge with Let's Encrypt.

No problems with Docker (Compose) networks either, but I'm not using it with GitLab because I have enough IPs.

The biggest problem I see is the accumulation of certificates that will all be kept up-to-date, whether in use or not.

Re: Traefik, Now With Native Go Plugins

#39

Post by slx26 »

jdoliner wrote: post #24

I really wish Go plugins got some more love from the go team. It looks like this is using Yaegi a Go interpreter, which is probably the only reasonable choice. Go's plugin package requires that the plugin be compiled with exactly the same compiler version as the main binary. So you need to recompile every plugin for every new release, at least if you upgrade the compiler between releases which you often do. It also d…

There was a public doc talking about the golang linker that addressed this issue at the end. My comment at the time and the post can be found here [0]. I guess there's some hope, but I haven't looked into it again, so I don't know whether anything is moving forward or not.

[0] https://news.ycombinator.com/item?id=20957741

Re: Traefik, Now With Native Go Plugins

#40

Post by throwaway894345 »

thegeekpirate wrote: post #37
throwaway894345 wrote: post #35

Earlier quoted context omitted.

Using an interpreter locks you into the interpreter's language (e.g., no NodeJS, Python, etc plugins), but you are able to pass around memory and call procedures from the host program directly instead of having to write an IPC shim layer. EDIT: Updated for accuracy

They actually created their own interpreter https://github.com/traefik/yaegi Here's their original announcement post https://traefik.io/blog/announcing-yaegi-263a1e2d070a

oof, I noticed that they referenced a different interpreter; didn't realize they also created it. My bad.
Post reply on HN