Repository: traefik/traefik
File: pkg/provider/kubernetes/ingress-nginx/kubernetes.go (Go)

Code before:
	conf.HTTP.Middlewares[corsMiddlewareName] = &dynamic.Middleware{
		Headers: &dynamic.Headers{
			AccessControlAllowCredentials: ptr.Deref(ingressConfig.EnableCORSAllowCredentials, true),
			AccessControlExposeHeaders:    ptr.Deref(ingressConfig.CORSExposeHeaders, []string{}),
			AccessControlAllowHeaders:     ptr.Deref(ingressConfig.CORSAllowHeaders, []string{"DNT", "Keep-Alive", "User-Agent", "X-Requested-With", "If-Modified-Since", "Cache-Control", "Content-Type", "Range,Authorization"}),
			AccessControlAllowMethods:     ptr.Deref(ingressConfig.CORSAllowMethods, []string{"GET", "PUT", "POST", "DELETE", "PATCH", "OPTIONS"}),
			AccessControlAllowOriginList:  ptr.Deref(ingressConfig.CORSAllowOrigin, []string{"*"}),
			AccessControlMaxAge:           int64(ptr.Deref(ingressConfig.CORSMaxAge, 1728000)),
		},
	}

	rt.Middlewares = append(rt.Middlewares, corsMiddlewareName)
}

func applyWhitelistSourceRangeConfiguration(routerName string, ingressConfig ingressConfig, rt *dynamic.Router, conf *dynamic.Configuration) error {
	whitelistSourceRange := ptr.Deref(ingressConfig.WhitelistSourceRange, "")
	if whitelistSourceRange == "" {
		return nil
	}

	sourceRanges := strings.Split(whitelistSourceRange, ",")
	for _, r := range sourceRanges {
		if _, _, err := net.ParseCIDR(r); err != nil {
			return fmt.Errorf("CIDR %s is invalid", r)
		}
	}

	whitelistSourceRangeMiddlewareName := routerName + "-whitelist-source-range"
	conf.HTTP.Middlewares[whitelistSourceRangeMiddlewareName] = &dynamic.Middleware{
		IPAllowList: &dynamic.IPAllowList{
			SourceRange: sourceRanges,
		},
	}
	rt.Middlewares = append(rt.Middlewares, whitelistSourceRangeMiddlewareName)

	return nil
}

func applySSLRedirectConfiguration(routerName string, ingressConfig ingressConfig, hasTLS bool, rt *dynamic.Router, conf *dynamic.Configuration) {
	var forceSSLRedirect bool
	if ingressConfig.ForceSSLRedirect != nil {
		forceSSLRedirect = *ingressConfig.ForceSSLRedirect
	}

	sslRedirect := ptr.Deref(ingressConfig.SSLRedirect, hasTLS)

	if !forceSSLRedirect && !sslRedirect {
		if hasTLS {
			httpRouter := &dynamic.Router{
				Rule: rt.Rule,
				// "default" stands for the default rule syntax in Traefik v3, i.e. the v3 syntax.

Review comment (bug):
If a user specifies "192.168.1.0/24, 10.0.0.0/8" (with space after comma), the parsing will fail because " 10.0.0.0/8" has a leading space.

Can you handle this use case please?

Code after:
	conf.HTTP.Middlewares[corsMiddlewareName] = &dynamic.Middleware{
		Headers: &dynamic.Headers{
			AccessControlAllowCredentials: ptr.Deref(ingressConfig.EnableCORSAllowCredentials, true),
			AccessControlExposeHeaders:    ptr.Deref(ingressConfig.CORSExposeHeaders, []string{}),
			AccessControlAllowHeaders:     ptr.Deref(ingressConfig.CORSAllowHeaders, []string{"DNT", "Keep-Alive", "User-Agent", "X-Requested-With", "If-Modified-Since", "Cache-Control", "Content-Type", "Range,Authorization"}),
			AccessControlAllowMethods:     ptr.Deref(ingressConfig.CORSAllowMethods, []string{"GET", "PUT", "POST", "DELETE", "PATCH", "OPTIONS"}),
			AccessControlAllowOriginList:  ptr.Deref(ingressConfig.CORSAllowOrigin, []string{"*"}),
			AccessControlMaxAge:           int64(ptr.Deref(ingressConfig.CORSMaxAge, 1728000)),
		},
	}

	rt.Middlewares = append(rt.Middlewares, corsMiddlewareName)
}

func applyUpstreamVhost(routerName string, ingressConfig ingressConfig, rt *dynamic.Router, conf *dynamic.Configuration) {
	if ingressConfig.UpstreamVhost == nil {
		return
	}

	vHostMiddlewareName := routerName + "-vhost"
	conf.HTTP.Middlewares[vHostMiddlewareName] = &dynamic.Middleware{
		Headers: &dynamic.Headers{
			CustomRequestHeaders: map[string]string{"Host": *ingressConfig.UpstreamVhost},
		},
	}

	rt.Middlewares = append(rt.Middlewares, vHostMiddlewareName)
}

func applyWhitelistSourceRangeConfiguration(routerName string, ingressConfig ingressConfig, rt *dynamic.Router, conf *dynamic.Configuration) {
	whitelistSourceRange := ptr.Deref(ingressConfig.WhitelistSourceRange, "")
	if whitelistSourceRange == "" {
		return
	}

	sourceRanges := strings.Split(whitelistSourceRange, ",")
	for i := range sourceRanges {
		sourceRanges[i] = strings.TrimSpace(sourceRanges[i])
	}

	whitelistSourceRangeMiddlewareName := routerName + "-whitelist-source-range"
	conf.HTTP.Middlewares[whitelistSourceRangeMiddlewareName] = &dynamic.Middleware{
		IPAllowList: &dynamic.IPAllowList{
			SourceRange: sourceRanges,
		},
	}
	rt.Middlewares = append(rt.Middlewares, whitelistSourceRangeMiddlewareName)
}

func applySSLRedirectConfiguration(routerName string, ingressConfig ingressConfig, hasTLS bool, rt *dynamic.Router, conf *dynamic.Configuration) {
	var forceSSLRedirect bool