Is it possible to use a yaml list for whitelisting groups in config.yml?

Traefik Traefik v2
,
1

Is something like this even possible?

  middlewares:
    test-whitelist-group:
      - "1.1.1.1/32"
      - "2.2.2.2/32"

    first-whitelist:
      ipWhiteList:
        sourceRange: ${test-whitelist-group}

    second-whitelist:
      ipWhiteList:
        sourceRange: 
          - ${test-whitelist-group}
          - "1.2.3.4/32"
...
2

Middlewares are usually dynamic config, you can create those in a dynamic config file, which you can load via providers.file in static config.

There is ipwhitelist for http and TCP routers, check the doc.

3

Hey, and yes, that is exactly what I do.

I load the dynamic config.yml within the static traefik.yml file, but I couldn't get this to work, or anything similar.

4

Did you assign the middlewares globally to entrypoint or to the routers?

5

Assigned to a router.

{"entryPointName":"web-secure","level":"error","msg":"cannot parse CIDR whitelist [${test-whitelist-group}]: parsing CIDR trusted IPs \u003cnil\u003e: invalid CIDR address: ${test-whitelist-group}","routerName":"test-router@file","time":"2023-08-27T13:41:15+02:00"}
6

Seems your templating does not work and ${test-whitelist-group} was not replaced with the value.

Share your full Traefik static and dynamic config, and docker-compose.yml if used.

7

Dynamic:

tls:
  options:
    default:
      sniStrict: true
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  stores:
    default:
      defaultCertificate:
        certFile: /etc/traefik/certs/home.local.crt
        keyFile: /etc/traefik/certs/home.local.key
  certificates:
    - certFile: /etc/traefik/certs/home.local.crt
      keyFile: /etc/traefik/certs/home.local.key
      stores:
        - default

http:
  routers:
    example-router:
      rule: Host(`example.home.local`)
      entryPoints:
        - web-secure
      middlewares:
        - test-whitelist
      service: test-service
      tls:
        domains:
          - main: "*.home.local"

 middlewares:
    test-whitelist:
    ipWhiteList:
      sourceRange:
          - "10.0.0.0/8"
          - "172.16.0.0/12"
          - "192.168.0.0/16"

  services:
    test-service:
      loadBalancer:
        servers:
          - url: https://some-other-local-host:443

This works, although I have 20+ routers, and each have the same sub-group of allowed hosts, and some additional hosts.
So for example, all of them have:

- "1.1.1.1/32"
- "2.2.2.2/32"
- "3.3.3.3/32"

And only some have.

- "4.4.4.4"

What I want to do, is set a static group for all routers:

management-group-whitelist:
  ipWhiteList:
    sourceRange:
      - "1.1.1.1/32"
      - "2.2.2.2/32"
      - "3.3.3.3/32"

whatever-the-fuck-whitelist:
  ipWhiteList:
    sourceRange:
      - "4.4.4.4/32"

So I can add my custom one only where I need it, and make configuration easier.

 example-router:
      rule: Host(`example.home.local`)
      entryPoints:
        - web-secure
      middlewares:
        - management-group-whitelist
        - whatever-the-fuck-whitelist

Static:

log:
  filePath: /var/log/traefik/traefik.log
  format: json
  level: INFO

accessLog:
  format: json
  filePath: /var/log/traefik/access.log
  bufferingSize: 2000
  fields:
    names:
      StartLocal: keep
      StartUTC: drop
      ServiceAddr: keep
      ServiceURL: drop
    headers:
      names:
        Referrer: keep
        Authorization: drop
        User-Agent: keep

api:
  dashboard: true

serversTransport:
  rootCAs:
    - [REDACTED]
  insecureSkipVerify: false

providers:
  file:
    filename: /etc/traefik/config.yml
    watch: true

entryPoints:
  web:
    address: 0.0.0.0:80
    http:
      redirections:
        entryPoint:
          to: web-secure
          scheme: https
          permanent: true

  web-secure:
    address: 0.0.0.0:443
    forwardedHeaders:
      trustedIPs:
        - "127.0.0.1/32"
        - "10.0.0.0/8" 
        - "192.168.0.0/16"
        - "172.16.0.0/12" 

certificatesResolvers:
  le:
    acme:
      email: [REDACTED]
      storage: [REDACTED]
      dnsChallenge:
        provider: [REDACTED]
        delayBeforeCheck: "0"
        resolvers:
          - [REDACTED]
8

That should work.

As stated before, the last error you shared was about a template variable (${test-whitelist-group}), that should have been replaced, but was not, otherwise it would not have been shown in the error message.

9

My thoughts exactly, "should work", but it doesn't because the middlewares aren't chained. Only the last one is applied, while the management-group-whitelist is being completely ignored.

Also there isn't any way to template and use lists, which is what I'm aiming at.

10

If it should work but does not, then open an issue at Traefik Github.

YAML files can re-use blocks, see for example this article.

11

Unfortunately that didn't help, and neither did this:

An issue seems to be opened for quite some time and there doesn't seem to be any activity on it:

12

Ok, now I see the challenge. You really need an "OR" to match at least one of the middlewares, the first one can fail, but the second one could be okay and still let the request succeed.

There is a middleware to chain (doc), but nothing for "OR". Traefik is open source, you could (let someone else) implement it and do a pull request.

13

I have tried the chain middleware, but it did not work as expected, only the last whitelist in the chain was applied.

Of course...

Thank you for the help though.