DOCSEARCHbyAlgolia
Submit Docs

Project Contour Documentation

website·Indexed 37 days ago

https://projectcontour.io/docs/

Contour is a Layer 7 HTTP middleware reverse proxy and ingress controller that serves as an Envoy control plane for Kubernetes clusters. The documentation provides guides on integrating cert-manager for TLS, configuring gRPC, implementing external authorization, and deploying with Gateway API, Gatekeeper, and AWS NLB. It includes performance testing for Contour/Envoy, Prometheus metrics configuration, and support policies across versions 1.23 through 1.33.

Tokens
2.1M
Snippets
7.7K
Records
14.7K
Agent score
44%

What's inside Contour

  1. Overview of JWT Verification in Contour

    Contour uses Envoy's jwt_authn HTTP filter to verify JSON Web Tokens on incoming requests. It can validate the issuer, audiences, signature (via JWKS), and time restrictions (expiration, not before).

    Key Constraints:

    • Only supported on TLS-terminating virtual hosts.
    • Incompatible with the fallback certificate feature.
    • Successful verification proxies the request to the upstream; failure returns an HTTP 401 (Unauthorized).

  2. Introduction to Contour Ingress Controller

    v1.6.0
    Contour is a Kubernetes Ingress controller that utilizes the Envoy proxy as a reverse proxy and load balancer. It supports dynamic configuration updates and maintains a lightweight profile. To extend the functionality of the standard Kubernetes Ingress API and address its design shortcomings, Contour introduces the HTTPProxy Custom Resource Definition (CRD).

  3. Overview of projectcontour.io/v1 API Group

    v1.17.0

    The projectcontour.io/v1 API group contains the specifications for Contour's Custom Resource Definitions (CRDs). It defines three distinct types of 'Conditions' to avoid ambiguity:

    1. MatchConditions: Used by Routes and Includes to define rules for matching requests for routing or inclusion purposes.
    2. DetailedConditions: Found in the Status of objects to provide information about the object's state and its environment.
    3. SubConditions: Nested under DetailedConditions to provide granular details regarding errors or warnings.

    Key resource types in this group include HTTPProxy and TLSCertificateDelegation.

  4. Introduction to Contour Ingress Controller

    v1.13.1
    Contour is a Kubernetes Ingress controller that utilizes the Envoy proxy as a reverse proxy and load balancer. It supports dynamic configuration updates and maintains a lightweight profile. To provide a richer user experience and address limitations of the standard Kubernetes Ingress API, Contour introduces the HTTPProxy API, which is implemented as a Custom Resource Definition (CRD).

  5. Overview of Project Contour

    v1.9.0
    Contour is a Kubernetes Ingress controller that utilizes the Envoy proxy as a reverse proxy and load balancer. It supports dynamic configuration updates and provides a lightweight profile. To extend the functionality of the standard Kubernetes Ingress API and address its design shortcomings, Contour introduces the HTTPProxy API, implemented via a Custom Resource Definition (CRD).

  6. Overview of projectcontour.io/v1 API Resources

    v1.14.1
    The projectcontour.io/v1 package defines the Custom Resource Definitions (CRDs) used by Contour. It includes two primary resource types: HTTPProxy, which is the Ingress CRD specification, and TLSCertificateDelegation.

  7. Overview of HTTPProxy benefits

    v1.15.2

    The HTTPProxy Custom Resource Definition (CRD) is designed to overcome the limitations of the standard Kubernetes Ingress API, particularly in multi-tenant environments. Key benefits include:

    • Multi-tenancy: Ability to limit which Namespaces can configure virtual hosts and TLS credentials.
    • Delegation: Support for including routing configuration for a path or domain from another HTTPProxy, potentially in a different Namespace.
    • Advanced Load Balancing: Support for multiple services within a single route, native service weighting, and load balancing strategies without requiring annotations.
    • Validation: Built-in validation of objects at creation time and post-creation status reporting.

  8. Overview of Contour Tracing Support

    Contour leverages Envoy's distributed tracing capabilities to export data to third-party providers via OpenTelemetry. It allows users to customize the following tracing parameters:

    • Service name (default: contour)
    • Sampling rate (default: 100)
    • Maximum request path length (default: 256)
    • Span tags (via literals or request headers)
    • Inclusion of pod hostname and namespace

  9. Overview of Contour Tracing Support

    Contour leverages Envoy's distributed tracing capabilities to export data to third-party providers via OpenTelemetry. It allows customization of the following tracing parameters:

    • Service name (default: contour)
    • Sampling rate (default: 100)
    • Maximum request path length (default: 256)
    • Span tags (via literals or request headers)
    • Inclusion of pod hostname and namespace

  10. Overview of Contour Rate Limiting

    v1.19.0

    Contour provides two types of HTTP rate limiting to protect backend services from DoS attacks, client bugs, or to enforce usage quotas:

    1. Local Rate Limiting: Enforced by each Envoy instance independently. There is no communication between Envoy pods or external services.
    2. Global Rate Limiting: Each Envoy instance queries an external Rate Limit Service (RLS) via gRPC to make rate limit decisions.

  11. Overview of Global Rate Limiting in Project Contour

    Starting in version 1.13, Project Contour supports Envoy global rate limiting. In this architecture, Envoy communicates with an external Rate Limit Service (RLS) over gRPC to determine if a request should be limited. Envoy generates one or more descriptors (e.g., client IP, header values) and sends them to the RLS, which returns a decision based on its configured limits.

  12. Introduction to Contour Ingress Controller

    v1.17.1
    Contour is an Ingress controller for Kubernetes that utilizes the Envoy proxy as a reverse proxy and load balancer. It supports dynamic configuration updates and maintains a lightweight profile. In addition to the standard Kubernetes Ingress API, Contour provides a Custom Resource Definition (CRD) called HTTPProxy designed to provide a richer user experience and address shortcomings in the original Ingress API design.