Repository: traefik/traefik
File: pkg/provider/kubernetes/ingress-nginx/kubernetes.go (Go)

Code before:
			AccessControlAllowOriginList:  ptr.Deref(ingressConfig.CORSAllowOrigin, []string{"*"}),
			AccessControlMaxAge:           int64(ptr.Deref(ingressConfig.CORSMaxAge, 1728000)),
		},
	}

	rt.Middlewares = append(rt.Middlewares, corsMiddlewareName)
}

func applyWhitelistSourceRangeConfiguration(routerName string, ingressConfig ingressConfig, rt *dynamic.Router, conf *dynamic.Configuration) error {
	whitelistSourceRange := ptr.Deref(ingressConfig.WhitelistSourceRange, "")
	if whitelistSourceRange == "" {
		return nil
	}

	sourceRanges := strings.Split(whitelistSourceRange, ",")
	for i := range sourceRanges {
		sourceRanges[i] = strings.TrimSpace(sourceRanges[i])
	}

	for _, r := range sourceRanges {
		_, _, err := net.ParseCIDR(r)
		ip := net.ParseIP(r)
		if err != nil && ip == nil {
			return fmt.Errorf("IP/CIDR %s is invalid", r)
		}
	}

	whitelistSourceRangeMiddlewareName := routerName + "-whitelist-source-range"
	conf.HTTP.Middlewares[whitelistSourceRangeMiddlewareName] = &dynamic.Middleware{
		IPAllowList: &dynamic.IPAllowList{
			SourceRange: sourceRanges,
		},
	}
	rt.Middlewares = append(rt.Middlewares, whitelistSourceRangeMiddlewareName)

	return nil
}

func applySSLRedirectConfiguration(routerName string, ingressConfig ingressConfig, hasTLS bool, rt *dynamic.Router, conf *dynamic.Configuration) {
	var forceSSLRedirect bool
	if ingressConfig.ForceSSLRedirect != nil {
		forceSSLRedirect = *ingressConfig.ForceSSLRedirect
	}

	sslRedirect := ptr.Deref(ingressConfig.SSLRedirect, hasTLS)

	if !forceSSLRedirect && !sslRedirect {
		if hasTLS {
			httpRouter := &dynamic.Router{
				Rule: rt.Rule,
				// "default" stands for the default rule syntax in Traefik v3, i.e. the v3 syntax.

Review comment (suggestion):
```suggestion
```

Checking the validity of the CIDR/IP here is not necessary, as they will be checked when the corresponding IPAllowList middleware is created (see https://github.com/traefik/traefik/blob/master/pkg/middlewares/ipallowlist/ip_allowlist.go#L46). Thus, you can remove the corresponding test.


Code after:
			AccessControlAllowOriginList:  ptr.Deref(ingressConfig.CORSAllowOrigin, []string{"*"}),
			AccessControlMaxAge:           int64(ptr.Deref(ingressConfig.CORSMaxAge, 1728000)),
		},
	}

	rt.Middlewares = append(rt.Middlewares, corsMiddlewareName)
}

func applyUpstreamVhost(routerName string, ingressConfig ingressConfig, rt *dynamic.Router, conf *dynamic.Configuration) {
	if ingressConfig.UpstreamVhost == nil {
		return
	}

	vHostMiddlewareName := routerName + "-vhost"
	conf.HTTP.Middlewares[vHostMiddlewareName] = &dynamic.Middleware{
		Headers: &dynamic.Headers{
			CustomRequestHeaders: map[string]string{"Host": *ingressConfig.UpstreamVhost},
		},
	}

	rt.Middlewares = append(rt.Middlewares, vHostMiddlewareName)
}

func applyWhitelistSourceRangeConfiguration(routerName string, ingressConfig ingressConfig, rt *dynamic.Router, conf *dynamic.Configuration) {
	whitelistSourceRange := ptr.Deref(ingressConfig.WhitelistSourceRange, "")
	if whitelistSourceRange == "" {
		return
	}

	sourceRanges := strings.Split(whitelistSourceRange, ",")
	for i := range sourceRanges {
		sourceRanges[i] = strings.TrimSpace(sourceRanges[i])
	}

	whitelistSourceRangeMiddlewareName := routerName + "-whitelist-source-range"
	conf.HTTP.Middlewares[whitelistSourceRangeMiddlewareName] = &dynamic.Middleware{
		IPAllowList: &dynamic.IPAllowList{
			SourceRange: sourceRanges,
		},
	}
	rt.Middlewares = append(rt.Middlewares, whitelistSourceRangeMiddlewareName)
}

func applySSLRedirectConfiguration(routerName string, ingressConfig ingressConfig, hasTLS bool, rt *dynamic.Router, conf *dynamic.Configuration) {
	var forceSSLRedirect bool
	if ingressConfig.ForceSSLRedirect != nil {
		forceSSLRedirect = *ingressConfig.ForceSSLRedirect
	}

	sslRedirect := ptr.Deref(ingressConfig.SSLRedirect, hasTLS)