Traefik, Now With Native Go Plugins
traefik.io
Traefik, Now With Native Go Plugins
1–10 of 65 posts
Re: Traefik, Now With Native Go Plugins
#2Awesome use of yaegi interpreter!
Re: Traefik, Now With Native Go Plugins
#3I've been wanting to use Traefik for a long time but there's this security issue[0] that's almost two(!) years old now that's been keeping me from deploying it in production. As far as I can tell, there's still no out-of-the-box solution that's not overly complicated and won't come back to haunt me a year or two from now.
[0] https://github.com/traefik/traefik/issues/4174
[1] https://doc.traefik.io/traefik/providers/docker/#docker-api-...
Re: Traefik, Now With Native Go Plugins
#4Awesome use of yaegi interpreter!
So the Go middleware is interpreted? Curious how that works with a request lazy/large body reader and a response lazy/large body writer? What kind of overhead is added to each invocation of read/write there?
Re: Traefik, Now With Native Go Plugins
#5Quick question: is this the beginning of monetization of some of traefik future features ?
Re: Traefik, Now With Native Go Plugins
#6Awesome use of yaegi interpreter!
So the Go middleware is interpreted? Curious how that works with a request lazy/large body reader and a response lazy/large body writer? What kind of overhead is added to each invocation of read/write there?
from what we measured on a gzip compression plugin, only a few percents of overhead. Because the gzip part is compiled. Only the plugin glue is interpreted.
Re: Traefik, Now With Native Go Plugins
#7I've been wanting to use Traefik for a long time but there's this security issue[0] that's almost two(!) years old now that's been keeping me from deploying it in production. As far as I can tell, there's still no out-of-the-box solution that's not overly complicated and won't come back to haunt me a year or two from now. [0] https://github.com/traefik/traefik/issues/4174 [1] https://doc.traefik.io/traefik/providers/…
This security issue is not that simple to manage as you probably know. It's mainly due to the fact that there is now way to have authorization on the the docker API. This is not the case on Kubernetes for example where you have RBAC to prevent this kind of issue. We have described this in detail in our documentation, and you have many solutions/workarounds to address this: https://doc.traefik.io/traefik/providers/docker/#docker-api-...
Re: Traefik, Now With Native Go Plugins
#8> Rather than being pre-compiled and linked, however, plugins are executed on the fly by Yaegi, an embedded Go interpreter.
Woof, no thank you.
Go is basically incompatible with any kind of plugin-like dynamic linking. There are basically two reasonable models for doing something like plugins: the HashiCorp model, where plugins are actually separate processes that do some kind of intra-process communication with the host; or the Caddy model, where you select which plugins you want when downloading the binary, and they're built-in at compile time.
Re: Traefik, Now With Native Go Plugins
#9I've been wanting to use Traefik for a long time but there's this security issue[0] that's almost two(!) years old now that's been keeping me from deploying it in production. As far as I can tell, there's still no out-of-the-box solution that's not overly complicated and won't come back to haunt me a year or two from now. [0] https://github.com/traefik/traefik/issues/4174 [1] https://doc.traefik.io/traefik/providers/…
You've probably discounted this for some reason already, but why not use something more built for service discovery - e.g. Consul Catalog / k8s / etcd?
Re: Traefik, Now With Native Go Plugins
#10> Rather than being pre-compiled and linked, however, plugins are executed on the fly by Yaegi, an embedded Go interpreter. Woof, no thank you. Go is basically incompatible with any kind of plugin-like dynamic linking. There are basically two reasonable models for doing something like plugins: the HashiCorp model, where plugins are actually separate processes that do some kind of intra-process communication with the…
I'm sure you're onto something. But I can't really decipher whats bad here and which of the two scenarios you mention apply to go interpreted plugins.