Skip to content

Commit 6379e34

Browse files
ivanmatmatiMo3m3n
ivanmatmati
authored and
Mo3m3n
committed
REORG/MINOR: Use an interface in haproxy.certs package
1 parent 4c2877b commit 6379e34

File tree

10 files changed

+45
-32
lines changed

10 files changed

+45
-32
lines changed

‎pkg/annotations/annotations.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ type Annotations interface {
2626
GlobalCfgSnipp() []Annotation
2727
Global(g *models.Global, l *models.LogTargets) []Annotation
2828
Defaults(d *models.Defaults) []Annotation
29-
Backend(b *models.Backend, s store.K8s, c *certs.Certificates) []Annotation
29+
Backend(b *models.Backend, s store.K8s, c certs.Certificates) []Annotation
3030
Frontend(i *store.Ingress, r *rules.List, m maps.MapFiles) []Annotation
3131
Secret(name, defaultNs string, k store.K8s, annotations ...map[string]string) (secret *store.Secret, err error)
3232
Timeout(name string, annotations ...map[string]string) (out *int64, err error)
@@ -129,7 +129,7 @@ func (a annImpl) Frontend(i *store.Ingress, r *rules.List, m maps.MapFiles) []An
129129
}
130130
}
131131

132-
func (a annImpl) Backend(b *models.Backend, s store.K8s, c *certs.Certificates) []Annotation {
132+
func (a annImpl) Backend(b *models.Backend, s store.K8s, c certs.Certificates) []Annotation {
133133
annotations := []Annotation{
134134
service.NewAbortOnClose("abortonclose", b),
135135
service.NewTimeoutCheck("timeout-check", b),

‎pkg/annotations/service/ca.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,11 @@ import (
1010

1111
type CA struct {
1212
name string
13-
haproxyCerts *certs.Certificates
13+
haproxyCerts certs.Certificates
1414
backend *models.Backend
1515
}
1616

17-
func NewCA(n string, c *certs.Certificates, b *models.Backend) *CA {
17+
func NewCA(n string, c certs.Certificates, b *models.Backend) *CA {
1818
return &CA{
1919
name: n,
2020
haproxyCerts: c,
@@ -41,7 +41,7 @@ func (a *CA) Process(k store.K8s, annotations ...map[string]string) error {
4141
}
4242
return nil
4343
}
44-
caFile, err = a.haproxyCerts.HandleTLSSecret(secret, certs.CA_CERT)
44+
caFile, err = a.haproxyCerts.AddSecret(secret, certs.CA_CERT)
4545
if err != nil {
4646
return err
4747
}

‎pkg/annotations/service/crt.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,11 @@ import (
1010

1111
type Crt struct {
1212
name string
13-
haproxyCerts *certs.Certificates
13+
haproxyCerts certs.Certificates
1414
backend *models.Backend
1515
}
1616

17-
func NewCrt(n string, c *certs.Certificates, b *models.Backend) *Crt {
17+
func NewCrt(n string, c certs.Certificates, b *models.Backend) *Crt {
1818
return &Crt{
1919
name: n,
2020
haproxyCerts: c,
@@ -41,7 +41,7 @@ func (a *Crt) Process(k store.K8s, annotations ...map[string]string) error {
4141
}
4242
return nil
4343
}
44-
crtFile, err = a.haproxyCerts.HandleTLSSecret(secret, certs.BD_CERT)
44+
crtFile, err = a.haproxyCerts.AddSecret(secret, certs.BD_CERT)
4545
if err != nil {
4646
return err
4747
}

‎pkg/controller/global.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,6 @@ func (c *HAProxyController) handleDefaultCert() {
174174
if secret == nil {
175175
return
176176
}
177-
_, err = c.haproxy.Certificates.HandleTLSSecret(secret, certs.FT_DEFAULT_CERT)
177+
_, err = c.haproxy.AddSecret(secret, certs.FT_DEFAULT_CERT)
178178
logger.Error(err)
179179
}

‎pkg/handler/https.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ func (handler HTTPS) handleClientTLSAuth(k store.K8s, h haproxy.HAProxy) (reload
8989
}
9090
}
9191
if secret != nil {
92-
caFile, err = h.Certificates.HandleTLSSecret(secret, certs.CA_CERT)
92+
caFile, err = h.Certificates.AddSecret(secret, certs.CA_CERT)
9393
if err != nil {
9494
err = fmt.Errorf("client TLS Auth: %w", err)
9595
return
@@ -153,7 +153,7 @@ func (handler HTTPS) Update(k store.K8s, h haproxy.HAProxy, a annotations.Annota
153153
logger.Error(err)
154154

155155
// ssl-offload
156-
if h.Certificates.FrontendCertsEnabled() {
156+
if h.FrontCertsInUse() {
157157
if !h.HTTPS {
158158
logger.Panic(h.FrontendEnableSSLOffload(h.FrontHTTPS, handler.CertDir, handler.alpn, handler.strictSNI))
159159
h.HTTPS = true
@@ -187,7 +187,7 @@ func (handler HTTPS) Update(k store.K8s, h haproxy.HAProxy, a annotations.Annota
187187
reload = true
188188
logger.Debug("SSLPassthrough disabled, reload required")
189189
}
190-
if h.Certificates.Updated() {
190+
if h.CertsUpdated() {
191191
reload = true
192192
}
193193

‎pkg/haproxy/certs/main.go

Lines changed: 27 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,26 @@ import (
1212
"github.com/haproxytech/kubernetes-ingress/pkg/utils"
1313
)
1414

15-
type Certificates struct {
15+
type certs struct {
1616
frontend map[string]*cert
1717
backend map[string]*cert
1818
ca map[string]*cert
1919
}
2020

21+
type Certificates interface {
22+
// Add takes a secret and its type and creats or updates the corresponding certificate
23+
AddSecret(secret *store.Secret, secretType SecretType) (certPath string, err error)
24+
// FrontCertsInuse returns true if a frontend certificate is configured.
25+
FrontCertsInUse() bool
26+
// Updated returns true if there is any updadted/created certificate
27+
CertsUpdated() bool
28+
// Refresh removes unused certs from HAProxyCertDir and returns false if
29+
// no certificates were removed, otherwise returns true
30+
RefreshCerts() bool
31+
// Clean cleans certificates state
32+
CleanCerts()
33+
}
34+
2135
type cert struct {
2236
name string
2337
path string
@@ -54,7 +68,7 @@ type SecretCtx struct {
5468
SecretType SecretType
5569
}
5670

57-
func New(envParam Env) (*Certificates, error) {
71+
func New(envParam Env) (Certificates, error) {
5872
env = envParam
5973
if env.FrontendDir == "" {
6074
return nil, fmt.Errorf("empty name for Frontend Cert Directory")
@@ -65,14 +79,14 @@ func New(envParam Env) (*Certificates, error) {
6579
if env.CaDir == "" {
6680
return nil, fmt.Errorf("empty name for CA Cert Directory")
6781
}
68-
return &Certificates{
82+
return &certs{
6983
frontend: make(map[string]*cert),
7084
backend: make(map[string]*cert),
7185
ca: make(map[string]*cert),
7286
}, nil
7387
}
7488

75-
func (c *Certificates) HandleTLSSecret(secret *store.Secret, secretType SecretType) (certPath string, err error) {
89+
func (c *certs) AddSecret(secret *store.Secret, secretType SecretType) (certPath string, err error) {
7690
if secret == nil {
7791
err = errors.New("nil secret")
7892
return
@@ -125,7 +139,7 @@ func (c *Certificates) HandleTLSSecret(secret *store.Secret, secretType SecretTy
125139
return crt.path, nil
126140
}
127141

128-
func (c *Certificates) Clean() {
142+
func (c *certs) CleanCerts() {
129143
for i := range c.frontend {
130144
c.frontend[i].inUse = false
131145
c.frontend[i].updated = false
@@ -140,7 +154,7 @@ func (c *Certificates) Clean() {
140154
}
141155
}
142156

143-
func (c *Certificates) FrontendCertsEnabled() bool {
157+
func (c *certs) FrontCertsInUse() bool {
144158
for _, cert := range c.frontend {
145159
if cert.inUse {
146160
return true
@@ -149,15 +163,14 @@ func (c *Certificates) FrontendCertsEnabled() bool {
149163
return false
150164
}
151165

152-
// Refresh removes unused certs from HAProxyCertDir
153-
func (c *Certificates) Refresh() (reload bool) {
154-
reload = refreshCerts(c.frontend, env.FrontendDir)
155-
reload = refreshCerts(c.backend, env.BackendDir) || reload
156-
reload = refreshCerts(c.ca, env.CaDir) || reload
166+
func (c *certs) RefreshCerts() (removed bool) {
167+
removed = refreshCerts(c.frontend, env.FrontendDir)
168+
removed = refreshCerts(c.backend, env.BackendDir) || removed
169+
removed = refreshCerts(c.ca, env.CaDir) || removed
157170
return
158171
}
159172

160-
func (c *Certificates) Updated() (reload bool) {
173+
func (c *certs) CertsUpdated() (reload bool) {
161174
for _, certs := range []map[string]*cert{c.frontend, c.backend, c.ca} {
162175
for _, crt := range certs {
163176
if crt.updated {
@@ -169,7 +182,7 @@ func (c *Certificates) Updated() (reload bool) {
169182
return reload
170183
}
171184

172-
func refreshCerts(certs map[string]*cert, certDir string) (reload bool) {
185+
func refreshCerts(certs map[string]*cert, certDir string) (removed bool) {
173186
files, err := ioutil.ReadDir(certDir)
174187
if err != nil {
175188
logger.Error(err)
@@ -186,7 +199,7 @@ func refreshCerts(certs map[string]*cert, certDir string) (reload bool) {
186199
if !crtOk || !crt.inUse {
187200
logger.Error(os.Remove(path.Join(certDir, filename)))
188201
delete(certs, certName)
189-
reload = true
202+
removed = true
190203
logger.Debugf("secret %s removed, reload required", crt.name)
191204
}
192205
}

‎pkg/haproxy/config/main.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ import (
1111
type Config struct {
1212
*maps.MapFiles
1313
rules.Rules
14-
*certs.Certificates
14+
certs.Certificates
1515
ActiveBackends map[string]struct{}
1616
RateLimitTables []string
1717
HTTPS bool
@@ -46,6 +46,6 @@ func (cfg *Config) Clean() {
4646
cfg.RateLimitTables = []string{}
4747
cfg.ActiveBackends = make(map[string]struct{})
4848
cfg.MapFiles.Clean()
49-
cfg.Certificates.Clean()
49+
cfg.CleanCerts()
5050
cfg.CleanRules()
5151
}

‎pkg/haproxy/main.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ func New(osArgs utils.OSArgs, env config.Env, cfgFile []byte, p process.Process,
6363
func (h *HAProxy) Refresh(cleanCrts bool) (reload bool, err error) {
6464
// Certs
6565
if cleanCrts {
66-
reload = h.Certificates.Refresh()
66+
reload = h.RefreshCerts()
6767
}
6868
// Rules
6969
reload = h.RefreshRules(h.HAProxyClient) || reload

‎pkg/ingress/ingress.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,7 @@ func (i *Ingress) Update(k store.K8s, h haproxy.HAProxy, a annotations.Annotatio
216216
logger.Warningf("Ingress '%s/%s': %s", i.resource.Namespace, i.resource.Name, secErr)
217217
continue
218218
}
219-
_, err := h.Certificates.HandleTLSSecret(secret, certs.FT_CERT)
219+
_, err := h.AddSecret(secret, certs.FT_CERT)
220220
logger.Error(err)
221221
}
222222
// Ingress annotations

‎pkg/service/service.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,15 +38,15 @@ type Service struct {
3838
path *store.IngressPath
3939
resource *store.Service
4040
backend *models.Backend
41-
certs *certs.Certificates
41+
certs certs.Certificates
4242
annotations []map[string]string
4343
modeTCP bool
4444
newBackend bool
4545
}
4646

4747
// New returns a Service instance to handle the k8s IngressPath resource given in params.
4848
// An error will be returned if there is no k8s Service resource corresponding to the service description in IngressPath.
49-
func New(k store.K8s, path *store.IngressPath, certs *certs.Certificates, tcpService bool, annList ...map[string]string) (*Service, error) {
49+
func New(k store.K8s, path *store.IngressPath, certs certs.Certificates, tcpService bool, annList ...map[string]string) (*Service, error) {
5050
service, err := k.GetService(path.SvcNamespace, path.SvcName)
5151
if err != nil {
5252
return nil, err

0 commit comments

Comments
 (0)