Repository: traefik/traefik
File: pkg/provider/kubernetes/ingress-nginx/kubernetes.go (Go)

Code before:
		},
	}

	rt.Middlewares = append(rt.Middlewares, corsMiddlewareName)
}

func applyWhitelistSourceRangeConfiguration(routerName string, ingressConfig ingressConfig, rt *dynamic.Router, conf *dynamic.Configuration) {
	var whitelistSourceRange = ptr.Deref(ingressConfig.WhitelistSourceRange, "")
	if whitelistSourceRange == "" {
		return
	}

	WhitelistSourceRangeMiddlewareName := routerName + "-whitelist-source-range"
	conf.HTTP.Middlewares[WhitelistSourceRangeMiddlewareName] = &dynamic.Middleware{
		IPAllowList: &dynamic.IPAllowList{
			SourceRange: strings.Split(whitelistSourceRange, ","),
		},
	}

	rt.Middlewares = append(rt.Middlewares, WhitelistSourceRangeMiddlewareName)
}

func applySSLRedirectConfiguration(routerName string, ingressConfig ingressConfig, hasTLS bool, rt *dynamic.Router, conf *dynamic.Configuration) {
	var forceSSLRedirect bool
	if ingressConfig.ForceSSLRedirect != nil {
		forceSSLRedirect = *ingressConfig.ForceSSLRedirect
	}

	sslRedirect := ptr.Deref(ingressConfig.SSLRedirect, hasTLS)

	if !forceSSLRedirect && !sslRedirect {
		if hasTLS {
			httpRouter := &dynamic.Router{
				Rule: rt.Rule,
				// "default" stands for the default rule syntax in Traefik v3, i.e. the v3 syntax.
				RuleSyntax:  "default",
				Middlewares: rt.Middlewares,
				Service:     rt.Service,
			}

			conf.HTTP.Routers[routerName+"-http"] = httpRouter
		}

		return
	}

	redirectRouter := &dynamic.Router{
		Rule: rt.Rule,
		// "default" stands for the default rule syntax in Traefik v3, i.e. the v3 syntax.
		RuleSyntax: "default",
		Service:    "noop@internal",

Review comment (bug):
I'm wondering what does Nginx do, when the whitelist is an empty string? Does it reject every request then, or the annotation is ignored? This looks like an edge case, but it can be useful to easily 'turn off' without deleting it or affecting other ingresses. Does nginx happen to validate that the comma separated list of items are indeed parsable CIDR ranges?

Code after:
			AccessControlAllowOriginList:  ptr.Deref(ingressConfig.CORSAllowOrigin, []string{"*"}),
			AccessControlMaxAge:           int64(ptr.Deref(ingressConfig.CORSMaxAge, 1728000)),
		},
	}

	rt.Middlewares = append(rt.Middlewares, corsMiddlewareName)
}

func applyUpstreamVhost(routerName string, ingressConfig ingressConfig, rt *dynamic.Router, conf *dynamic.Configuration) {
	if ingressConfig.UpstreamVhost == nil {
		return
	}

	vHostMiddlewareName := routerName + "-vhost"
	conf.HTTP.Middlewares[vHostMiddlewareName] = &dynamic.Middleware{
		Headers: &dynamic.Headers{
			CustomRequestHeaders: map[string]string{"Host": *ingressConfig.UpstreamVhost},
		},
	}

	rt.Middlewares = append(rt.Middlewares, vHostMiddlewareName)
}

func applyWhitelistSourceRangeConfiguration(routerName string, ingressConfig ingressConfig, rt *dynamic.Router, conf *dynamic.Configuration) {
	whitelistSourceRange := ptr.Deref(ingressConfig.WhitelistSourceRange, "")
	if whitelistSourceRange == "" {
		return
	}

	sourceRanges := strings.Split(whitelistSourceRange, ",")
	for i := range sourceRanges {
		sourceRanges[i] = strings.TrimSpace(sourceRanges[i])
	}

	whitelistSourceRangeMiddlewareName := routerName + "-whitelist-source-range"
	conf.HTTP.Middlewares[whitelistSourceRangeMiddlewareName] = &dynamic.Middleware{
		IPAllowList: &dynamic.IPAllowList{
			SourceRange: sourceRanges,
		},
	}
	rt.Middlewares = append(rt.Middlewares, whitelistSourceRangeMiddlewareName)
}

func applySSLRedirectConfiguration(routerName string, ingressConfig ingressConfig, hasTLS bool, rt *dynamic.Router, conf *dynamic.Configuration) {
	var forceSSLRedirect bool
	if ingressConfig.ForceSSLRedirect != nil {
		forceSSLRedirect = *ingressConfig.ForceSSLRedirect
	}

	sslRedirect := ptr.Deref(ingressConfig.SSLRedirect, hasTLS)