dariopb / traefikservicefabricplugin

Traefik 2.x Service Fabric Provider Plugin

Traefik service-fabric-plugin

This provider plugin allows Traefik to query the Service Fabric management API to discover what services are currently running on a Service Fabric cluster. The provider then maps routing rules to these service instances. The provider will take into account the Health and Status of each of the services to ensure requests are only routed to healthy service instances.

This is a community/unofficial implementation in development

Installation

The plugin needs to be configured in the Traefik static configuration before it can be used.

Configuration

The plugin currently supports the following configuration settings:

• pollInterval: The interval for polling the management endpoint for changes, in seconds.
• clusterManagementURL: The URL for the Service Fabric Management API endpoint (e.g. http://dariotraefik1.southcentralus.cloudapp.azure.com:19080/)
• insecureSkipVerify: Skip verifying the Service Fabric cluster management certificate trust. Default true.
• apiVersion: Service Fabric API version to use. Default 3.0.
• certificate: The path to a certificate file or the PEM certificate content. If not provided, HTTP will be used.
• certificateKey: The path to a private key file or the key content. If not provided, HTTP will be used.

Example configuration

entryPoints:
  web:
    address: :9999
    
api:
  dashboard: true

log:
  level: DEBUG

pilot:
  token: xxxxx

experimental:
  traefikServiceFabricPlugin:
    moduleName: github.com/dariopb/traefikServiceFabricPlugin
    version: v0.2.2

providers:
  plugin:
    traefikServiceFabricPlugin:
    pollInterval: 4s
    clusterManagementURL: 'http://dariotraefik1.southcentralus.cloudapp.azure.com:19080/'
    insecureSkipVerify: true
    apiVersion: 6.0
    #certificate : ./cert.pem
    #certificateKey: ./cert.key

Sample deployments

For a complete way to deploy and use the proxy in a Service Fabric cluster, please look here: https://github.com/dariopb/sf-reverseproxies-templates (those are samples only and should be modified according to your needs)

ServiceManifest file

This is a sample SF enabled service showing the currently supported labels. If the sf name is fabric:/pinger/PingerService, the endpoint will be expose at that prefix: /pinger/PingerService/

<!-- ... -->
  <ServiceTypes>
    <StatelessServiceType ServiceTypeName="PingerServiceType" UseImplicitHost="true">
      <Extensions>
        <Extension Name="traefik">
        <Labels xmlns="http://schemas.microsoft.com/2015/03/fabact-no-schema">
          <Label Key="traefik.http.enable">true</Label>
          <Label Key="traefik.http.entrypoints">web</Label>
          <Label Key="traefik.http.loadbalancer.passhostheader">true</Label>
          <Label Key="traefik.http.loadbalancer.healthcheck.path">/</Label>
          <Label Key="traefik.http.loadbalancer.healthcheck.interval">10s</Label>
          <Label Key="traefik.http.loadbalancer.healthcheck.scheme">http</Label>
          <Label Key="traefik.http.loadbalancer.stickiness">true</Label>
          <Label Key="traefik.http.loadbalancer.stickiness.secure">true</Label>
          <Label Key="traefik.http.loadbalancer.stickiness.httpOnly">true</Label>
          <Label Key="traefik.http.loadbalancer.stickiness.sameSite">none</Label>
          <Label Key="traefik.http.loadbalancer.stickiness.cookieName">stickycookie</Label>
        </Labels>
        </Extension>
      </Extensions>
    </StatelessServiceType>
  </ServiceTypes>
<!-- ...-->

Supported Labels (since 0.2.x)

Entrypoints section

Label	Description
traefik.http.entrypoints	Comma separated list of entrypoints to be assigned to router, e.g., Web, WebSecure.

Rule section

Label	Description
traefik.http.rule	Traefik rule to apply PathPrefix(`/dario`). This rule is added on top of the default path generation. If this is set, you have to define a middleware to remove the prefix for the service to receive the stripped path.

Loadbalancer section

Label	Description	Values
traefik.http.loadbalancer.passhostheader	passhostheaders	true/false
traefik.http.loadbalancer.healthcheck.path	Healthcheck endpoint path	/healtz
traefik.http.loadbalancer.healthcheck.interval	Healthcheck interval	10s
traefik.http.loadbalancer.healthcheck.scheme	Healthcheck scheme	http
traefik.http.loadbalancer.stickiness	Enable sticky sessions	true/false
traefik.http.loadbalancer.stickiness.secure	Enable Secure flag for sticky session cookie	true/false
traefik.http.loadbalancer.stickiness.httpOnly	Enable HTTPOnly flag for sticky session cookie	true/false
traefik.http.loadbalancer.stickiness.sameSite	Enable SameSite flag for sticky session cookie	none/lax/strict
traefik.http.loadbalancer.stickiness.cookieName	Enable static name for sticky session cookie	stickycookie

Middleware section

Label	Description	Values
traefik.http.middleware.stripprefix	prefix to strip	/dario

License

This software is released under the MIT License

traefikservicefabricplugin's Issues

No label for customising entry point(s).

The current plugin, has hard coded the entry point as "web". We use different names for our entry point(s).

We also have a requirement to expose some services through multiple entry points, i.e., public services vs internal services.

I've changed it locally and I'll submit a PR over the coming days.

[Traefik Pilot] Traefik Plugin Analyzer has detected a problem.

The plugin was not imported into Traefik Pilot.

Cause:

failed to get readme: failed to get readme: GET https://api.github.com/repos/dariopb/traefikServiceFabricPlugin/readme?ref=v0.1.1: 502  []

Traefik Plugin Analyzer will restart when you will close this issue.

If you believe there is a problem with the Analyzer or this issue is the result of a false positive, please contact us.

All services get assigned the load balancer server(s) based on the the last SF service!

I spotted that when you have multiple services registered on the SF cluster; the plugin sets the services loadbalancer based for all services based on the last service to be configured. Refer to image below:

I believe this is a pointer issue within the code and I'll push a PR to resolve it.

SF Application not talking to Traefik?

I finally got Traefik v2.5.3 deployed to our test Service Fabric cluster however, I'm having trouble exposing a test application via the Traefik plugin. I don't see any indication in the logs that the application is talking to Traefik.

Current ServiceManifest labels: https://pastebin.pl/view/47b82ef6
Current Traefik.yml: https://pastebin.pl/view/86cda29e

I'm currently running Traefik v2.5.3 at home on Docker and trying to compare the two sets of labels, it seems like a router label is missing?

Traefik creates two routes from stateless services to same backend services

Good day,

I'm having an issue where I have deployed two different stateless services to fabric.

Both with similar extension config, with the only difference being the healthcheck.path
/routing/ping
customer/ping

When I look at the Traefik dash I can see two routes
http://myfabricservice.com:8880/Monitoring/Monitoring.Api/Routing/ping
http://myfabricservice.com:8880/CustomerService/CustomerService.Api/v1/customer/ping

But on inspecting the servers and ports for both of these routes I can see that both routes are pointing to the monitoring service and also that the healthcheck path for the customer service is /Routing/ping and not v1/customer/ping

Is anybody else sitting with this issue or I'm misconfiguring traefik and/or the plugin.

I have a 5 node cluster and my extension xml looks like this:

<Extensions>
	<Extension Name="traefik">
		<Labels xmlns="http://schemas.microsoft.com/2015/03/fabact-no-schema">
			<Label Key="traefik.http.enable">true</Label>
			<Label Key="traefik.http.entrypoints">web</Label>
			<Label Key="traefik.http.loadbalancer.passhostheader">true</Label>
			<Label Key="traefik.http.loadbalancer.healthcheck.path">/Routing/ping</Label>
			<Label Key="traefik.http.loadbalancer.healthcheck.interval">10s</Label>
			<Label Key="traefik.http.loadbalancer.healthcheck.scheme">http</Label>
			<Label Key="traefik.http.loadbalancer.stickiness">true</Label>
			<Label Key="traefik.http.loadbalancer.stickiness.secure">true</Label>
			<Label Key="traefik.http.loadbalancer.stickiness.httpOnly">true</Label>
			<Label Key="traefik.http.loadbalancer.stickiness.sameSite">none</Label>
			<Label Key="traefik.http.loadbalancer.stickiness.cookieName">stickycookie</Label>
		</Labels>
	</Extension>
</Extensions>

[Traefik Pilot] Traefik Plugin Analyzer has detected a problem.

The plugin was not imported into Traefik Pilot.

Cause:

failed to get the latest tag: failed to get versions: GET https://api.github.com/repos/dariopb/traefikServiceFabricPlugin/tags: 502  []

Traefik Plugin Analyzer will restart when you will close this issue.

If you believe there is a problem with the Analyzer or this issue is the result of a false positive, please contact us.

v0.2.1 failed to check archive integrity

error:
traefik.go:81: command traefik.exe error: failed to check archive integrity of the plugin github.com/dariopb/traefikServiceFabricPlugin: plugin integrity check failed

pilot:
    token: "*"
experimental:
  plugins:
    traefikServiceFabricPlugin:
      moduleName: github.com/dariopb/traefikServiceFabricPlugin
      version: v0.2.1

providers:
  file:
    filename: "dyn.yml"

  plugin:
    traefikServiceFabricPlugin:
      pollInterval: 4s
      clusterMangementURL: "https://localhost:19080"

I'm using the latest version of Traefik.exe: v2.5.3
If I change the version to v0.1.1 it gets past this error.

Can't connect to my private servicefabric cluster using this plugin

I am trying to upgrade traefik from v1.17 to 2.10. With version v1.17, it is working and connecting servicefabric cluster successfully. we are using this traefik proxy from last 4 year. But with new version v2.10 it is failing to connect.

any help would be appreciate to successfully upgrade the traefik proxy.

{"level":"error","module":"github.com/dariopb/traefikServiceFabricPlugin","msg":"2024/01/13 02:46:47 Initializing: https://XXX, version: 3.0","plugin":"plugin-traefikServiceFabricPlugin","time":"2024-01-13T02:46:47Z"}

Sticky label is not working as expected.

Hi @dariopb , setting the sticky label within the SF application has no impact on the load balancer configuration. I got it working locally by initiating the internal Cookie struct within the Sticky struct. I will raise a PR to fix this issue along with implementing the additional Sticky labels, i.e., Name, HttpOnly, Secure, and SameSite.

Hi @ldez, one thing I noticed when configuring the Sticky session is that it's not displaying the fact that a service is configured with Sticky session within the dashboard. Is this expected behaviour? Note that I have validated that the cookie is being set within Postman, I've also confirmed that NTLM Auth is working which requires sticky sessions so I know it's turned on under the hood.

Error:field not found, node: plugin?

[experimental.plugins]
[experimental.plugins.traefikServiceFabricPlugin]
moduleName = "github.com/dariopb/traefikServiceFabricPlugin"
version = "v0.1.1"

[providers]
[providers.plugin]
[providers.plugin.traefikServiceFabricPlugin]
clusterManagementURL = "http://localhost:19080/"
pollInterval = "5s"

Auto generation of routers based on Partitions for Stateless services

I'd like to make the auto-generation of services based on partitions optional (or potenially disable it altogether) for Stateless services.

@dariopb

According to the Microsoft documentation:

"partitioning a stateless service is a very rare scenario--scalability and availability are normally achieved by adding more instances."

At the moment, I'm creating services with custom routers and the auto-generated routers are noisy in my configuration and something I will never use.

I'm happy to create a PR, however, @dariopb, as you're the owner, I'd like to discuss it with you first.