Same-site cookie configuration for Kubernetes

Traefik Traefik v1
1

Hi guys!

with the v1.7.23 release we got the fix for the "same-site" cookie issue:

In this Pull-Request:

We are using Traefik in a larger enterprise-product and we have already updated our Docker Swarm based environments to this new version of Traefik (actually we updated to version v1.7.24). Together with the 1.7.23 release the documentation was updated, so that we can find information on how to set the 'same-site' setting:
https://docs.traefik.io/v1.7/configuration/backends/docker/#using-docker-compose

using the following "labels":
traefik.backend.loadbalancer.stickiness=true
traefik.backend.loadbalancer.stickiness.cookieName=NAME
traefik.backend.loadbalancer.stickiness.secure=true
traefik.backend.loadbalancer.stickiness.httpOnly=true
traefik.backend.loadbalancer.stickiness.sameSite=none

I am missing this information in the documentation for the Kubernetes-ingress provider. Some of our environments are Docker Swarm based, others are already Kubernetes based as we are migrating everything to Kubernetes finally.

Could you please tell me whether I am blind or whether the documentation for Kubernetes is actually missing? We tried to search the code in the Traefik repository and we even tried to set various annotations on our services + ingress objects - nothing really works.

Thanks!
Benni

2

Hello,

The annotations for ingress are:

traefik.ingress.kubernetes.io/session-secure
traefik.ingress.kubernetes.io/session-http-only
traefik.ngress.kubernetes.io/session-same-site

and must be placed on the Service.

3

Hello,
I am trying to implement this change but I am having some difficulties. I tried editing both the traefik service on the ingress and the actual application service, but for some reason the added annotations are not getting applied..this is what I am adding:

traefik.ingress.kubernetes.io/session-http-only: "true"
traefik.ingress.kubernetes.io/session-same-site: "Lax"
traefik.ingress.kubernetes.io/session-secure: "true"

I also tried removing the "traefik" and leaving just "ingress.kubernetes.io/session-http-only" ( I noticed that on the PR), but still the attributes are not present
Any suggestions on how to make this work?

Thank you!