Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Traefik, Now With Native Go Plugins

traefik.io

Post reply on HN
Print view View original

51–60 of 65 posts

Re: Traefik, Now With Native Go Plugins

#51

Post by simplecto »

atombender wrote: post #36
d33 wrote: post #30

I wish I could like Traefik, but it really isn't easy. The use case in our Hackerspace was to dispatch different Docker containers through our wild-card subdomains. Traefik is supposed to also automatically create TLS certificates. I had numerous problems with the Let's Encrypt functionality. Debugging information is quite cryptic, the documentation seems all over to me, which is even more problematic given the numbe…

I worked on a project last year where we tried using Traefik on Kubernetes together with Let's Encrypt certs. It worked... sometimes. We had significant issues with Traefik not allocating or renewing certs, resulting in some painful outages. The worst part was that there was no workaround; when adding a new domain to an ingress, it was completely incomprehensible why Traefik wasn't requesting a cert, or indeed why it…

Seems that when any popular project has lacking documentation this creates an opportunity for users to swoop in and own part of that story.

I did this with traefik and consequently many of my blog posts about it are my top visited pages.

And to be fair it the Traefik team invests in developer success and advocacy. They even send you swag for making contributions like popular posts.

I agree to parent posts though the docs lack concrete examples to take the ambiguity out. And debugging logs is painful sometimes.

Re: Traefik, Now With Native Go Plugins

#52

Post by gnur »

rcarmo wrote: post #12

I would _really_ like to see social auth middleware (something like authelia, but simpler to setup and deploy, especially as an ingress).

I recently created https://github.com/gnur/tobab that looks similar to your needs.

It's an identity aware proxy that uses google as an identity provider (but more could be added).

I built it mainly out of frustration on how complicated the 2.x release of traefik has become.

Re: Traefik, Now With Native Go Plugins

#53

Post by fuzzy2 »

zwayhowder wrote: post #44
fuzzy2 wrote: post #38

Earlier quoted context omitted.

I actually have the same setup and it's working perfectly fine, even with my IPv4+6 specific address only config + lots of file-based configuration. I absolutely recommend using the TLS challenge with Let's Encrypt. No problems with Docker (Compose) networks either, but I'm not using it with GitLab because I have enough IPs. The biggest problem I see is the accumulation of certificates that will all be kept up-to-dat…

I also have a working system that I found very easy (for me) to setup. Recently it all came crashing down when an old domain I had expired and I was no longer able to update the DNS in Digital Ocean. The one - unused - domain failing stopped Traefik renewing all my certificates. But I'm also on 1.7 still and really should update to 2.x

This type of configuration is _much_ more verbose on 2.x, especially if you want automatic HTTP→HTTPS redirects.

Also, Traefik 2.x still does not clean up the certificate store automatically.

Re: Traefik, Now With Native Go Plugins

#54

Post by imtringued »

atombender wrote: post #49
pibefision wrote: post #45

Earlier quoted context omitted.

I second this. It's incredible complex to debug how Traefik understand it's configuration, and also documentation and examples over the internet are very confusing because the version 1.x vs 2.x changes.

Yep. I believe part of the wonkiness comes from the way the configuration is stored. They have this weird design where the config is mapped to key/value stores using an abstraction. You can use a TOML file, YAML file, Etcd, Redis, etc. If you use Let's Encrypt, it also uses this mechanism (e.g. Etcd) to store the state . It ends up being confusing and brittle, and exposes the underlying store as an API (you can modif…

Can't they just take the text based format and create a config tool that reads TOML/YAML and then writes that configuration to etcd, redis or whatever else they support?

Re: Traefik, Now With Native Go Plugins

#55

Post by imtringued »

sagichmal wrote: post #8

> Rather than being pre-compiled and linked, however, plugins are executed on the fly by Yaegi, an embedded Go interpreter. Woof, no thank you. Go is basically incompatible with any kind of plugin-like dynamic linking. There are basically two reasonable models for doing something like plugins: the HashiCorp model, where plugins are actually separate processes that do some kind of intra-process communication with the…

Any significant downside to the process based model? I haven't benchmarked the memory consumption of minimal a Go process but it should be well below what e.g. a minimal JVM application uses. With the right serialization format IPC can be reasonably efficient.

Re: Traefik, Now With Native Go Plugins

#56

Post by imtringued »

TheDong wrote: post #31
codethief wrote: post #3

I've been wanting to use Traefik for a long time but there's this security issue[0] that's almost two(!) years old now that's been keeping me from deploying it in production. As far as I can tell, there's still no out-of-the-box solution that's not overly complicated and won't come back to haunt me a year or two from now. [0] https://github.com/traefik/traefik/issues/4174 [1] https://doc.traefik.io/traefik/providers/…

That so called "security issue" is silly. You don't have to deploy traefik with docker. If you want traefik to monitor new docker containers to add routes for them, of course traefik needs to talk to the docker api to do so. The docker api has no way to control access such that it's not equivalent to root access. However, there's no real vulnerability. I'm happy to provide you a url hosted by traefik with the docker…

>The docker api has no way to control access such that it's not equivalent to root access.

I've thought this was a mistake many years ago. The fact that the docker daemon is running with root privileges is also something they should have solved a long time ago. Docker is pretty pathetic when it comes to security.

Re: Traefik, Now With Native Go Plugins

#57

Post by imtringued »

kayson wrote: post #13
codethief wrote: post #3

I've been wanting to use Traefik for a long time but there's this security issue[0] that's almost two(!) years old now that's been keeping me from deploying it in production. As far as I can tell, there's still no out-of-the-box solution that's not overly complicated and won't come back to haunt me a year or two from now. [0] https://github.com/traefik/traefik/issues/4174 [1] https://doc.traefik.io/traefik/providers/…

This is very easily solved by using a proxy for the docker socket: https://github.com/Tecnativa/docker-socket-proxy https://github.com/traefik/traefik/issues/4174#issuecomment- Create a private network that only connects Traefik and the proxy, and limit Traefik's access to only the GET requests it needs to operate. Now the socket is only exposed to a local container.

This is such an obvious solution. I am seriously wondering why this isn't integrated into docker directly.

Re: Traefik, Now With Native Go Plugins

#58

Post by BrandoElFollito »

I tried, really tried to use traefik for a year. It worked sometimes, the setup was complicated and the community support is very poor.

I eventually moved to caddy (https://caddyserver.com/) and it is fantastic. Works seamlessly and I got all my obvious and not so obvious questions answered.

The automated pulling of container data is not automatic, but there is a port for that (https://github.com/lucaslorentz/caddy-docker-proxy) with a great meta-language.

There are a few improvements to be done with the logging part, overall it is really worth checking.

Re: Traefik, Now With Native Go Plugins

#59

Post by codethief »

TheDong wrote: post #31
codethief wrote: post #3

I've been wanting to use Traefik for a long time but there's this security issue[0] that's almost two(!) years old now that's been keeping me from deploying it in production. As far as I can tell, there's still no out-of-the-box solution that's not overly complicated and won't come back to haunt me a year or two from now. [0] https://github.com/traefik/traefik/issues/4174 [1] https://doc.traefik.io/traefik/providers/…

That so called "security issue" is silly. You don't have to deploy traefik with docker. If you want traefik to monitor new docker containers to add routes for them, of course traefik needs to talk to the docker api to do so. The docker api has no way to control access such that it's not equivalent to root access. However, there's no real vulnerability. I'm happy to provide you a url hosted by traefik with the docker…

> You don't have to deploy traefik with docker.

Sure but in my case that was the whole idea.

> If you want traefik to monitor new docker containers to add routes for them, of course traefik needs to talk to the docker api to do so.

Yes, but it wouldn't be necessary for the network-facing part of Traefik to talk to the Docker API. There could be a second container (w/o network access) whose only task it is to talk to the Docker socket and generate a config and write that config to a shared volume.

> However, there's no real vulnerability.

In the present situation Traefik (with Docker integration) is effectively running as root. I don't think it's up for debate that this is much worse than just running Traefik as a normal user (outside Docker). Besides, most users expect applications running in Docker containers to be more secure – not less secure – than running them on the bare system.

> This would be like saying "traefik uses the linux kernel api to open files, but the linux kernel requires traefik validate what goes into that api or else it could allow file path traversal"... But traefik does validate filepaths and so no one makes that complaint.

No. This would be like saying "Traefik has full access to the kernel and the entire OS and the only thing preventing a hacker from exploiting this is Traefik validating incoming network requests."

Do you also run your other web servers as root?

> Similarly, traefik does validate that only safe docker api calls are made

This is completely irrelevant. Once a hacker is inside the Traefik process (i.e. can execute code under Traefik's PID), he can access the Docker socket and therefore the entire system as she/he pleases.

Re: Traefik, Now With Native Go Plugins

#60

Post by codethief »

kayson wrote: post #13
codethief wrote: post #3

I've been wanting to use Traefik for a long time but there's this security issue[0] that's almost two(!) years old now that's been keeping me from deploying it in production. As far as I can tell, there's still no out-of-the-box solution that's not overly complicated and won't come back to haunt me a year or two from now. [0] https://github.com/traefik/traefik/issues/4174 [1] https://doc.traefik.io/traefik/providers/…

This is very easily solved by using a proxy for the docker socket: https://github.com/Tecnativa/docker-socket-proxy https://github.com/traefik/traefik/issues/4174#issuecomment- Create a private network that only connects Traefik and the proxy, and limit Traefik's access to only the GET requests it needs to operate. Now the socket is only exposed to a local container.

This just adds another layer of indirection. While it improves security, it is not the same as fixing the issue in the first place and making sure that no network-facing part of the system runs as root.
Post reply on HN