Repository navigation
refactor(BA-8675): add TraefikRoutingConfigFactory for ingresses - #16018
Merged
jopemachine merged 13 commits intoOct 26, 2026
Merged
Conversation
The Traefik ingress export needs the router, service and middleware configs of an ingress and the etcd keys Traefik reads them from. The factory builds them from the ingress types in one place so the client that writes them to etcd holds no Traefik naming or layout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
github-actions
Bot
added
size:L
2 tasks done
The factory keeps the `TraefikConfig` it is given and reads `client_ip_strategy` from it when building an ipAllowList middleware, instead of keeping only the `ClientIPStrategyConfig`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`TraefikWorker` is the value the Traefik worker client builds from service discovery and the routing config factory reads, so it lives in its own module next to both instead of in the factory. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
It holds the worker's frontend settings a Traefik router needs (hostname, wildcard domain, tls_listen), not a worker, so the type and the arguments carrying it say so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…listen separately `WorkerFrontendSettings` grouped two worker API settings with the Traefik wildcard domain under a made-up name. The factory now takes the three values as keyword arguments and hands each private builder only the ones it uses, and `clients/worker/types.py` is removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tingConfigFactory The factory receives the Traefik, secret and permit hash config sections as one `TraefikRoutingConfigFactoryArgs` and reads the auth plugin secrets from them, instead of taking the two secret strings separately. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…fig_etcd_keys It returns every routing config key an ingress can own, whether or not the ingress uses it now, for clearing the ones it no longer has. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jopemachine
marked this pull request as draft
October 23, 2026 08:37
The router, service and middleware configs the factory returns are `TypedDict`s (`TraefikHttpRouterConfig`, `TraefikTcpServiceConfig`, `TraefikIpAllowListMiddlewareConfig`, ...) instead of `dict[str, Any]`, with the keys Traefik reads. The written etcd keys and values are unchanged. The tests compare each config as a whole. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every TypedDict in traefik_routing_config describes a Traefik config, so the module name already carries the prefix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ackage Move the routing config module to clients/worker/traefik/routing_config.py and its TypedDicts to clients/worker/traefik/types.py. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jopemachine
marked this pull request as ready for review
October 26, 2026 00:47
jopemachine
added a commit
that referenced
this pull request
Oct 26, 2026
… into a traefik package Move clients/worker/traefik.py to clients/worker/traefik/client.py and the routing config module to clients/worker/traefik/routing_config.py with its TypedDicts in clients/worker/traefik/types.py, matching #16018. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
wngh4628
reviewed
Oct 26, 2026
wngh4628
reviewed
Oct 26, 2026
…ances Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
wngh4628
approved these changes
Oct 26, 2026
jopemachine
deleted the
refactor/BA-8675-traefik-routing-config-factory
branch
October 26, 2026 05:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
TraefikRoutingConfigFactory(appproxy/coordinator/clients/worker/traefik/routing_config.py), which builds the Traefik routing configs of an ingress from the ingress types and exposes only two methods:all_routing_config_etcd_keys(ingress_key): every router, service and middleware key an ingress can own, for clearing the ones it no longer hasrouting_configs_by_etcd_key(ingress, *, hostname, wildcard_domain, tls_listen): the router, service and middleware configs of the ingress by the etcd key Traefik reads (worker_{authority}/{http|tcp}/{routers|services|middlewares}/{name})ClientIPfor TCP, joined with||for several allowed client IPs as Traefik v3 matchers take one value each, andHostfor HTTP; the HTTP router middleware order isCORSHeaders, thenipAllowListwhen there are allowed client IPs, then theappproxy-traefik-pluginauth plugin.TypedDicts with the keys Traefik reads inappproxy/coordinator/clients/worker/traefik/types.py(HttpRouterConfig,TcpRouterConfig,HttpServiceConfig,TcpServiceConfig, and theCORSHeaders,ipAllowListand auth plugin middleware configs);routing_configs_by_etcd_keyreturnsdict[str, RoutingConfig].TraefikRoutingConfigFactoryArgs(the Traefik, secret and permit hash config sections) and reads the client IP strategy and the auth plugin secrets from them.TraefikWildcardDomainMissingError.TraefikWorkerClientand carries this module until this PR merges.Test plan
test_traefik_routing_config.py:ipAllowListwith no client IP strategy, a depth and excluded IPs; the TCPClientIPrule with and without allowed client IPsClientIPrule and rejects the comma formResolves #15989 (BA-8675)
🤖 Generated with Claude Code