Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add SSLPolicy field to IngressClassParams #3025

Merged
merged 2 commits into from
Mar 3, 2023
Merged

Add SSLPolicy field to IngressClassParams #3025

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2c207f9
Add SSLPolicy field to IngressClassParams
johngmyers Feb 4, 2023
aeef13e
Fix typo
johngmyers Feb 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions apis/elbv2/v1beta1/ingressclassparams_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,10 @@ type IngressClassParamsSpec struct {
// +optional
Scheme *LoadBalancerScheme `json:"scheme,omitempty"`

// SSLPolicy specifies the SSL Policy for all Ingresses that belong to IngressClass with this IngressClassParams.
// +optional
SSLPolicy string `json:"sslPolicy,omitEmpty"`

// Subnets defines the subnets for all Ingresses that belong to IngressClass with this IngressClassParams.
// +optional
Subnets *SubnetSelector `json:"subnets,omitempty"`
Expand Down
4 changes: 4 additions & 0 deletions config/crd/bases/elbv2.k8s.aws_ingressclassparams.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,10 @@ spec:
- internal
- internet-facing
type: string
sslPolicy:
description: SSLPolicy specifies the SSL Policy for all Ingresses
that belong to IngressClass with this IngressClassParams.
type: string
subnets:
description: Subnets defines the subnets for all Ingresses that belong
to IngressClass with this IngressClassParams.
Expand Down
5 changes: 5 additions & 0 deletions docs/guide/ingress/ingress_class.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,11 @@ Cluster administrators can use the `scheme` field to restrict the scheme for all
1. If `scheme` specified, all Ingresses with this IngressClass will have the specified scheme.
2. If `scheme` un-specified, Ingresses with this IngressClass can continue to use `alb.ingress.kubernetes.io/scheme annotation` to specify scheme.

#### spec.sslPolicy

Cluster administrators can use the optional `sslPolicy` field to specify the SSL policy for the load balancers that belong to this IngressClass.
If the field is specified, LBC will ignore the `alb.ingress.kubernetes.io/ssl-policy` annotation.

#### spec.subnets

Cluster administrators can use the optional `subnets` field to specify the subnets for the load balancers that belong to this IngressClass.
Expand Down
4 changes: 4 additions & 0 deletions helm/aws-load-balancer-controller/crds/crds.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,10 @@ spec:
- internal
- internet-facing
type: string
sslPolicy:
description: SSLPolicy specifies the SSL Policy for all Ingresses
that belong to IngressClass with this IngressClassParams.
type: string
subnets:
description: Subnets defines the subnets for all Ingresses that belong
to IngressClass with this IngressClassParams.
Expand Down
17 changes: 10 additions & 7 deletions pkg/ingress/model_build_listener.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,15 +104,15 @@ type listenPortConfig struct {
tlsCerts []string
}

func (t *defaultModelBuildTask) computeIngressListenPortConfigByPort(ctx context.Context, ing *networking.Ingress) (map[int64]listenPortConfig, error) {
explicitTLSCertARNs := t.computeIngressExplicitTLSCertARNs(ctx, ing)
func (t *defaultModelBuildTask) computeIngressListenPortConfigByPort(ctx context.Context, ing *ClassifiedIngress) (map[int64]listenPortConfig, error) {
explicitTLSCertARNs := t.computeIngressExplicitTLSCertARNs(ctx, ing.Ing)
explicitSSLPolicy := t.computeIngressExplicitSSLPolicy(ctx, ing)
inboundCIDRv4s, inboundCIDRV6s, err := t.computeIngressExplicitInboundCIDRs(ctx, ing)
inboundCIDRv4s, inboundCIDRV6s, err := t.computeIngressExplicitInboundCIDRs(ctx, ing.Ing)
if err != nil {
return nil, err
}
preferTLS := len(explicitTLSCertARNs) != 0
listenPorts, err := t.computeIngressListenPorts(ctx, ing, preferTLS)
listenPorts, err := t.computeIngressListenPorts(ctx, ing.Ing, preferTLS)
if err != nil {
return nil, err
}
Expand All @@ -126,7 +126,7 @@ func (t *defaultModelBuildTask) computeIngressListenPortConfigByPort(ctx context
}
var inferredTLSCertARNs []string
if containsHTTPSPort && len(explicitTLSCertARNs) == 0 {
inferredTLSCertARNs, err = t.computeIngressInferredTLSCertARNs(ctx, ing)
inferredTLSCertARNs, err = t.computeIngressInferredTLSCertARNs(ctx, ing.Ing)
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -228,9 +228,12 @@ func (t *defaultModelBuildTask) computeIngressExplicitInboundCIDRs(_ context.Con
return inboundCIDRv4s, inboundCIDRv6s, nil
}

func (t *defaultModelBuildTask) computeIngressExplicitSSLPolicy(_ context.Context, ing *networking.Ingress) *string {
func (t *defaultModelBuildTask) computeIngressExplicitSSLPolicy(_ context.Context, ing *ClassifiedIngress) *string {
var rawSSLPolicy string
if exists := t.annotationParser.ParseStringAnnotation(annotations.IngressSuffixSSLPolicy, &rawSSLPolicy, ing.Annotations); !exists {
if ing.IngClassConfig.IngClassParams != nil && ing.IngClassConfig.IngClassParams.Spec.SSLPolicy != "" {
return &ing.IngClassConfig.IngClassParams.Spec.SSLPolicy
}
if exists := t.annotationParser.ParseStringAnnotation(annotations.IngressSuffixSSLPolicy, &rawSSLPolicy, ing.Ing.Annotations); !exists {
return nil
}
return &rawSSLPolicy
Expand Down
5 changes: 3 additions & 2 deletions pkg/ingress/model_builder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ package ingress

import (
"context"
"strconv"

awssdk "github.com/aws/aws-sdk-go/aws"
elbv2sdk "github.com/aws/aws-sdk-go/service/elbv2"
"github.com/go-logr/logr"
Expand All @@ -21,7 +23,6 @@ import (
elbv2model "sigs.k8s.io/aws-load-balancer-controller/pkg/model/elbv2"
networkingpkg "sigs.k8s.io/aws-load-balancer-controller/pkg/networking"
"sigs.k8s.io/controller-runtime/pkg/client"
"strconv"
)

const (
Expand Down Expand Up @@ -227,7 +228,7 @@ func (t *defaultModelBuildTask) run(ctx context.Context) error {
listenPortConfigsByPort := make(map[int64][]listenPortConfigWithIngress)
for _, member := range t.ingGroup.Members {
ingKey := k8s.NamespacedName(member.Ing)
listenPortConfigByPortForIngress, err := t.computeIngressListenPortConfigByPort(ctx, member.Ing)
listenPortConfigByPortForIngress, err := t.computeIngressListenPortConfigByPort(ctx, &member)
if err != nil {
return errors.Wrapf(err, "ingress: %v", ingKey.String())
}
Expand Down
267 changes: 267 additions & 0 deletions pkg/ingress/model_builder_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ import (
"k8s.io/apimachinery/pkg/util/intstr"
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
"k8s.io/client-go/tools/record"
"sigs.k8s.io/aws-load-balancer-controller/apis/elbv2/v1beta1"
"sigs.k8s.io/aws-load-balancer-controller/pkg/annotations"
"sigs.k8s.io/aws-load-balancer-controller/pkg/aws/services"
"sigs.k8s.io/aws-load-balancer-controller/pkg/config"
Expand Down Expand Up @@ -1473,6 +1474,272 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
"ns-1/ing-1-svc-3:https": null
}
}
}`,
},
{
name: "Ingress - ssl-policy in IngressClassParams",
env: env{
svcs: []*corev1.Service{ns_1_svc_1, ns_1_svc_2, ns_1_svc_3},
},
fields: fields{
resolveViaDiscoveryCalls: []resolveViaDiscoveryCall{resolveViaDiscoveryCallForInternalLB},
listLoadBalancersCalls: []listLoadBalancersCall{listLoadBalancerCallForEmptyLB},
enableBackendSG: true,
},
args: args{
ingGroup: Group{
ID: GroupID{Namespace: "ns-1", Name: "ing-1"},
Members: []ClassifiedIngress{
{
IngClassConfig: ClassConfiguration{
IngClassParams: &v1beta1.IngressClassParams{
Spec: v1beta1.IngressClassParamsSpec{
SSLPolicy: "ingress-class-policy",
},
},
},
Ing: &networking.Ingress{ObjectMeta: metav1.ObjectMeta{
Namespace: "ns-1",
Name: "ing-1",
Annotations: map[string]string{
"alb.ingress.kubernetes.io/certificate-arn": "arn:aws:acm:us-east-1:9999999:certificate/11111111",
"alb.ingress.kubernetes.io/ssl-policy": "annotated-ssl-policy",
},
},
Spec: networking.IngressSpec{
Rules: []networking.IngressRule{
{
Host: "app-1.example.com",
IngressRuleValue: networking.IngressRuleValue{
HTTP: &networking.HTTPIngressRuleValue{
Paths: []networking.HTTPIngressPath{
{
Path: "/svc-1",
Backend: networking.IngressBackend{
Service: &networking.IngressServiceBackend{
Name: ns_1_svc_1.Name,
Port: networking.ServiceBackendPort{
Name: "http",
},
},
},
},
{
Path: "/svc-2",
Backend: networking.IngressBackend{
Service: &networking.IngressServiceBackend{
Name: ns_1_svc_2.Name,
Port: networking.ServiceBackendPort{
Name: "http",
},
},
},
},
},
},
},
},
{
Host: "app-2.example.com",
IngressRuleValue: networking.IngressRuleValue{
HTTP: &networking.HTTPIngressRuleValue{
Paths: []networking.HTTPIngressPath{
{
Path: "/svc-3",
Backend: networking.IngressBackend{
Service: &networking.IngressServiceBackend{
Name: ns_1_svc_3.Name,
Port: networking.ServiceBackendPort{
Name: "https",
},
},
},
},
},
},
},
},
},
},
},
},
},
},
},
wantStackPatch: `
{
"resources": {
"AWS::EC2::SecurityGroup": {
"ManagedLBSecurityGroup": {
"spec": {
"ingress": [
{
"fromPort": 443,
"ipProtocol": "tcp",
"ipRanges": [
{
"cidrIP": "0.0.0.0/0"
}
],
"toPort": 443
}
]
}
}
},
"AWS::ElasticLoadBalancingV2::Listener": {
"443": {
"spec": {
"certificates": [
{
"certificateARN": "arn:aws:acm:us-east-1:9999999:certificate/11111111"
}
],
"defaultActions": [
{
"fixedResponseConfig": {
"contentType": "text/plain",
"statusCode": "404"
},
"type": "fixed-response"
}
],
"loadBalancerARN": {
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::LoadBalancer/LoadBalancer/status/loadBalancerARN"
},
"port": 443,
"protocol": "HTTPS",
"sslPolicy": "ingress-class-policy"
}
},
"80": null
},
"AWS::ElasticLoadBalancingV2::ListenerRule": {
"443:1": {
"spec": {
"actions": [
{
"forwardConfig": {
"targetGroups": [
{
"targetGroupARN": {
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::TargetGroup/ns-1/ing-1-svc-1:http/status/targetGroupARN"
}
}
]
},
"type": "forward"
}
],
"conditions": [
{
"field": "host-header",
"hostHeaderConfig": {
"values": [
"app-1.example.com"
]
}
},
{
"field": "path-pattern",
"pathPatternConfig": {
"values": [
"/svc-1"
]
}
}
],
"listenerARN": {
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::Listener/443/status/listenerARN"
},
"priority": 1
}
},
"443:2": {
"spec": {
"actions": [
{
"forwardConfig": {
"targetGroups": [
{
"targetGroupARN": {
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::TargetGroup/ns-1/ing-1-svc-2:http/status/targetGroupARN"
}
}
]
},
"type": "forward"
}
],
"conditions": [
{
"field": "host-header",
"hostHeaderConfig": {
"values": [
"app-1.example.com"
]
}
},
{
"field": "path-pattern",
"pathPatternConfig": {
"values": [
"/svc-2"
]
}
}
],
"listenerARN": {
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::Listener/443/status/listenerARN"
},
"priority": 2
}
},
"443:3": {
"spec": {
"actions": [
{
"forwardConfig": {
"targetGroups": [
{
"targetGroupARN": {
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::TargetGroup/ns-1/ing-1-svc-3:https/status/targetGroupARN"
}
}
]
},
"type": "forward"
}
],
"conditions": [
{
"field": "host-header",
"hostHeaderConfig": {
"values": [
"app-2.example.com"
]
}
},
{
"field": "path-pattern",
"pathPatternConfig": {
"values": [
"/svc-3"
]
}
}
],
"listenerARN": {
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::Listener/443/status/listenerARN"
},
"priority": 3
}
},
"80:1": null,
"80:2": null,
"80:3": null
}
}
}`,
},
{
Expand Down
Loading