DOCSEARCHbyAlgolia
Submit Docs

YARP (Yet Another Reverse Proxy)

repository·main·Indexed 27 days ago

https://github.com/dotnet/yarp

A high-performance, highly customizable reverse proxy toolkit for .NET and ASP.NET infrastructure. Designed as a library and project template, YARP allows developers to build custom proxy servers with programmatic configuration via a configuration API, supporting complex deployment scenarios and Kubernetes Ingress controllers.

Tokens
19K
Snippets
47
Records
107
Agent score
91%

What's inside YARP

  1. Overview of YARP Telemetry Consumption

    main
    The Yarp.TelemetryConsumption package extends the base Yarp.ReverseProxy implementation to allow developers to consume telemetry from AspNetCore, HttpClient, and YARP in-process. This enables live performance monitoring and the ability to export telemetry data as needed for diagnostics and observability.

  2. Overview of YARP (Yet Another Reverse Proxy)

    main
    YARP is a reverse proxy toolkit designed for building fast, highly customizable proxy servers using .NET and ASP.NET infrastructure. Unlike static reverse proxies, YARP is built as a library and project template, allowing developers to manage configuration programmatically via a configuration API rather than relying solely on configuration files. This makes it suitable for complex deployment scenarios where backend configuration is managed by external systems.

  3. Architecture and Extensibility Note

    main

    The YARP Container Application is a pre-built, opinionated application, not an extensible framework. It is designed for users who want a ready-to-use proxy with minimal configuration.

    If you require custom behavior, middleware, or complex logic, you should use the YARP library directly within your own ASP.NET Core application instead of using this containerized application.

  4. Deploy the Kubernetes Ingress Sample backend

    main

    Follow these steps to deploy the backend service and the ingress controller manifests to your Kubernetes cluster:

    1. Open the backend.yaml file located in ./samples/KubernetesIngress.Sample/backend/.
    2. Update the container image field to match your built image name (e.g., change <REGISTRY_NAME>/backend:<TAG> to backend:latest).
    3. Apply the backend configuration: kubectl apply -f ./samples/KubernetesIngress.Sample/backend/backend.yaml
    4. Apply the ingress configuration: kubectl apply -f ./samples/KubernetesIngress.Sample/backend/ingress-sample.yaml
    kubectl apply -f ./samples/KubernetesIngress.Sample/backend/backend.yaml
kubectl apply -f ./samples/KubernetesIngress.Sample/backend/ingress-sample.yaml

  7. Integrate Let's Encrypt for TLS termination in YARP

    main

    You can automate TLS certificate management in YARP by integrating with the LettuceEncrypt library. This allows YARP to handle TLS termination between clients and the proxy with minimal configuration.

    To implement this, you must:

    1. Call IServiceCollection.AddLettuceEncrypt during service configuration in your Program.cs.
    2. Configure the required LettuceEncrypt options in your appsettings.json.

  8. Understand YARP support policies

    main

    YARP support is provided by the ASP.NET and .NET library teams. Support availability depends on the release type:

    Release TypeIssue TypeSupport Period
    Major or minor versionSecurity Bugs, Major behavior defectsUntil next GA + 6 Months
    Patch versionMinor behavior defectsUntil next GA
    PreviewSecurity Bugs, Major behavior defectsUntil next preview
    PreviewAll other issuesNone (may be addressed by next preview)

    Reporting Issues:

  10. Secure YARP Tunneling connections

    main

    When implementing YARP Tunneling, follow these security best practices:

    • Use HTTPS: Tunnel connections should only be established over HTTPS.
    • Route Validation: Tunnel traffic is restricted by the back-end configuration. Traffic will only be routed if there is a corresponding route and cluster configuration in the back-end. Tunnel traffic cannot specify arbitrary URLs that are not included in the back-end route table.
    • Authentication: Because authentication requirements vary, YARP Tunneling uses a callback mechanism. This allows the proxy author to implement custom authentication logic (e.g., using client certificates) to meet specific organizational requirements.

  11. Deploy YARP Kubernetes Ingress Controller

    main

    The YARP Kubernetes Ingress Controller monitors Kubernetes Ingress resources and routes traffic to services. You can deploy it using the Yarp.Kubernetes.Controller project in one of two ways:

    1. Combined Deployment: A single deployable containing both the monitor and the ingress handler.
    2. Separate Deployment: Two separate deployables where a "monitor" watches Ingress resources and an "ingress" handler retrieves configuration from the monitor to handle routing.

    Supported Ingress features include:

    • Host name and path-based routing rules.
    • Ingress class for multiple independent controller instances (cluster scope).
    • Default ingress class configuration.

  12. Scale YARP Tunneling deployments

    main

    In large-scale deployments, YARP Tunneling supports multiple front-end and back-end proxies:

    • Front-end Scalability: If a front-end proxy receives multiple tunnel connections, it treats them as multiple destinations within a cluster. You can use standard load balancing policies to decide how traffic is routed to the back-end proxies.
    • Back-end Scalability: A back-end proxy can create tunnels to multiple front-ends. This allows back-ends to connect to related front-ends sharing the same load or to front-ends in different cloud deployments.

    Note: The front-end proxy is not aware of the actual destination servers. Each back-end proxy must have its own cluster definition for the actual destinations, which can include multiple servers for any route/cluster combination.