Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Traefik, Now With Native Go Plugins

traefik.io

Post reply on HN
Print view View original

41–50 of 65 posts

Re: Traefik, Now With Native Go Plugins

#41

Post by 3np »

rileymichael wrote: post #21
djsumdog wrote: post #19

I replaced my haproxy setup with Traefik and it works pretty wonderfully. The LetsEncrypt integration works really well. I don't really have any interest in plugins personally, but this is still quite an amazing project.

The only thing keeping me from switching is the removal of "distributed LetsEncrypt" in 2.0. I get that it's a non-issue for k8s setups with cert-manager, but people aren't always using k8s and it's still a feature in the enterprise edition.

Could you elaborate what you mean? While it'd be ideal to store certs in vault, I'm having it run fine in orchestrated containerization with the cert storage on a distributed filesystem.

Re: Traefik, Now With Native Go Plugins

#42

Post by slx26 »

alufers wrote: post #11
sagichmal wrote: post #8

> Rather than being pre-compiled and linked, however, plugins are executed on the fly by Yaegi, an embedded Go interpreter. Woof, no thank you. Go is basically incompatible with any kind of plugin-like dynamic linking. There are basically two reasonable models for doing something like plugins: the HashiCorp model, where plugins are actually separate processes that do some kind of intra-process communication with the…

There is the "plugin" package which seems really cool and fits the simplistic style of Go (tbh I haven't tried this module myself, only glanced at the documentation), but it does not work on Windows, which I think is the reason it is not used. The ticket about adding Windows support to the plugin package is one of the highest rated ones on Go's GitHub, yet it is still open.

See jdoliner's comment and replies on this thread for more context and information.

Re: Traefik, Now With Native Go Plugins

#43

Post by thomseddon »

rad_gruchalski wrote: post #18
rcarmo wrote: post #12

I would _really_ like to see social auth middleware (something like authelia, but simpler to setup and deploy, especially as an ingress).

Like this but a plugin? https://github.com/thomseddon/traefik-forward-auth

I'm planning to release this as a plugin :)

Re: Traefik, Now With Native Go Plugins

#44

Post by zwayhowder »

fuzzy2 wrote: post #38
d33 wrote: post #30

I wish I could like Traefik, but it really isn't easy. The use case in our Hackerspace was to dispatch different Docker containers through our wild-card subdomains. Traefik is supposed to also automatically create TLS certificates. I had numerous problems with the Let's Encrypt functionality. Debugging information is quite cryptic, the documentation seems all over to me, which is even more problematic given the numbe…

I actually have the same setup and it's working perfectly fine, even with my IPv4+6 specific address only config + lots of file-based configuration. I absolutely recommend using the TLS challenge with Let's Encrypt. No problems with Docker (Compose) networks either, but I'm not using it with GitLab because I have enough IPs. The biggest problem I see is the accumulation of certificates that will all be kept up-to-dat…

I also have a working system that I found very easy (for me) to setup.

Recently it all came crashing down when an old domain I had expired and I was no longer able to update the DNS in Digital Ocean. The one - unused - domain failing stopped Traefik renewing all my certificates. But I'm also on 1.7 still and really should update to 2.x

Re: Traefik, Now With Native Go Plugins

#45

Post by pibefision »

atombender wrote: post #36
d33 wrote: post #30

I wish I could like Traefik, but it really isn't easy. The use case in our Hackerspace was to dispatch different Docker containers through our wild-card subdomains. Traefik is supposed to also automatically create TLS certificates. I had numerous problems with the Let's Encrypt functionality. Debugging information is quite cryptic, the documentation seems all over to me, which is even more problematic given the numbe…

I worked on a project last year where we tried using Traefik on Kubernetes together with Let's Encrypt certs. It worked... sometimes. We had significant issues with Traefik not allocating or renewing certs, resulting in some painful outages. The worst part was that there was no workaround; when adding a new domain to an ingress, it was completely incomprehensible why Traefik wasn't requesting a cert, or indeed why it…

I second this. It's incredible complex to debug how Traefik understand it's configuration, and also documentation and examples over the internet are very confusing because the version 1.x vs 2.x changes.

Re: Traefik, Now With Native Go Plugins

#46

Post by sagichmal »

hinkley wrote: post #27
sagichmal wrote: post #8

> Rather than being pre-compiled and linked, however, plugins are executed on the fly by Yaegi, an embedded Go interpreter. Woof, no thank you. Go is basically incompatible with any kind of plugin-like dynamic linking. There are basically two reasonable models for doing something like plugins: the HashiCorp model, where plugins are actually separate processes that do some kind of intra-process communication with the…

Correct me if I'm wrong, but the Caddy model requires curation, doesn't it? Plugins and scripting languages flourish when they democratize the process of adding features to a piece of code. To have prebuilt binaries you need a build matrix, and the complexity of the build matrix is somewhere between exponential and factorial. This is a perverse incentive for the curators. The cost has to be justified, and as the fric…

> Plugins and scripting languages flourish when they democratize the process of adding features to a piece of code . . . In the best addon ecosystems, the core maintainers put some safety rails on the system so the addons can't do anything too crazy. Then they watch the cream of the crop and start trying to include them in the base functionality (limiting the number of optional features the majority of their users have to manually pick).

Well, it's a cost/benefit judgment call, not a single valuation. And I think for situations like this, if you have to pick a side, it's generally better to pick the exclusionary walled garden over the bazaar -- I think the value of democratization is usually overstated, and the drawbacks underemphasized.

Re: Traefik, Now With Native Go Plugins

#47

Post by sagichmal »

alufers wrote: post #11
sagichmal wrote: post #8

> Rather than being pre-compiled and linked, however, plugins are executed on the fly by Yaegi, an embedded Go interpreter. Woof, no thank you. Go is basically incompatible with any kind of plugin-like dynamic linking. There are basically two reasonable models for doing something like plugins: the HashiCorp model, where plugins are actually separate processes that do some kind of intra-process communication with the…

There is the "plugin" package which seems really cool and fits the simplistic style of Go (tbh I haven't tried this module myself, only glanced at the documentation), but it does not work on Windows, which I think is the reason it is not used. The ticket about adding Windows support to the plugin package is one of the highest rated ones on Go's GitHub, yet it is still open.

The plugin package was an experiment and is basically now abandoned, it's not meant for real use.

Re: Traefik, Now With Native Go Plugins

#48

Post by rileymichael »

3np wrote: post #41
rileymichael wrote: post #21

Earlier quoted context omitted.

The only thing keeping me from switching is the removal of "distributed LetsEncrypt" in 2.0. I get that it's a non-issue for k8s setups with cert-manager, but people aren't always using k8s and it's still a feature in the enterprise edition.

Could you elaborate what you mean? While it'd be ideal to store certs in vault, I'm having it run fine in orchestrated containerization with the cert storage on a distributed filesystem.

Traefik 1.x instances would coordinate cert negotiation and then store everything in some K/V store. Some more info: https://github.com/traefik/traefik/issues/5426#issuecomment-...

Caddy supports this: https://caddyserver.com/docs/json/storage/

Re: Traefik, Now With Native Go Plugins

#49

Post by atombender »

pibefision wrote: post #45
atombender wrote: post #36

Earlier quoted context omitted.

I worked on a project last year where we tried using Traefik on Kubernetes together with Let's Encrypt certs. It worked... sometimes. We had significant issues with Traefik not allocating or renewing certs, resulting in some painful outages. The worst part was that there was no workaround; when adding a new domain to an ingress, it was completely incomprehensible why Traefik wasn't requesting a cert, or indeed why it…

I second this. It's incredible complex to debug how Traefik understand it's configuration, and also documentation and examples over the internet are very confusing because the version 1.x vs 2.x changes.

Yep. I believe part of the wonkiness comes from the way the configuration is stored. They have this weird design where the config is mapped to key/value stores using an abstraction. You can use a TOML file, YAML file, Etcd, Redis, etc. If you use Let's Encrypt, it also uses this mechanism (e.g. Etcd) to store the state.

It ends up being confusing and brittle, and exposes the underlying store as an API (you can modify Etcd directly and the changes are picked up). There's no intermediate layer that validates or controls the lifecycle of the config or state. You can end up in a situation where you break Traefik by pushing an invalid configuration, for example.

Re: Traefik, Now With Native Go Plugins

#50

Post by fomine3 »

viraptor wrote: post #34
kalev wrote: post #32

Earlier quoted context omitted.

Ouch, we’re currently using nginx but recently switched one service to use traefik. I’m so afraid what you describe is what will bite us in the end. I wrote treafik instead of traefik in one of the labels and only noticed it after hours of debugging. When it works, it works great. But to get it in that state..

I see where the op is coming from, but I found the debugging quite easy in practice. If something doesn't work, go to the traefik panel and find the element you're looking for. If it's not there, it's normally fairly obvious.

I wish I can also see actual active configuration at the page. I feel it lacks some debug outputs.
Post reply on HN