Skip to content

Commit 2c207f9

Browse files
johngmyersjohngmyers
committed
Add SSLPolicy field to IngressClassParams
1 parent e1fb94a commit 2c207f9

File tree

8 files changed

+302
-14
lines changed

8 files changed

+302
-14
lines changed

‎apis/elbv2/v1beta1/ingressclassparams_types.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,10 @@ type IngressClassParamsSpec struct {
9999
// +optional
100100
Scheme *LoadBalancerScheme `json:"scheme,omitempty"`
101101

102+
// SSLPolicy specifies the SSL Policy for all Ingresses that belong to IngressClass with this IngressClassParams.
103+
// +optional
104+
SSLPolicy string `json:"sslPolicy,omitEmpty"`
105+
102106
// Subnets defines the subnets for all Ingresses that belong to IngressClass with this IngressClassParams.
103107
// +optional
104108
Subnets *SubnetSelector `json:"subnets,omitempty"`

‎config/crd/bases/elbv2.k8s.aws_ingressclassparams.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,10 @@ spec:
140140
- internal
141141
- internet-facing
142142
type: string
143+
sslPolicy:
144+
description: SSLPolicy specifies the SSL Policy for all Ingresses
145+
that belong to IngressClass with this IngressClassParams.
146+
type: string
143147
subnets:
144148
description: Subnets defines the subnets for all Ingresses that belong
145149
to IngressClass with this IngressClassParams.

‎docs/guide/ingress/ingress_class.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,11 @@ Cluster administrators can use the `scheme` field to restrict the scheme for all
135135
1. If `scheme` specified, all Ingresses with this IngressClass will have the specified scheme.
136136
2. If `scheme` un-specified, Ingresses with this IngressClass can continue to use `alb.ingress.kubernetes.io/scheme annotation` to specify scheme.
137137

138+
#### spec.sslPolicy
139+
140+
Cluster administrators can use the optional `sslPolicy` field to specify the SSL policy for the load balancers that belong to this IngressClass.
141+
If the field is specified, LBC will ignore the `alb.ingress.kubernetes.io/ssl-policy annotation` annotation.
142+
138143
#### spec.subnets
139144

140145
Cluster administrators can use the optional `subnets` field to specify the subnets for the load balancers that belong to this IngressClass.

‎helm/aws-load-balancer-controller/crds/crds.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,10 @@ spec:
139139
- internal
140140
- internet-facing
141141
type: string
142+
sslPolicy:
143+
description: SSLPolicy specifies the SSL Policy for all Ingresses
144+
that belong to IngressClass with this IngressClassParams.
145+
type: string
142146
subnets:
143147
description: Subnets defines the subnets for all Ingresses that belong
144148
to IngressClass with this IngressClassParams.

‎pkg/ingress/model_build_listener.go

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -104,15 +104,15 @@ type listenPortConfig struct {
104104
tlsCerts []string
105105
}
106106

107-
func (t *defaultModelBuildTask) computeIngressListenPortConfigByPort(ctx context.Context, ing *networking.Ingress) (map[int64]listenPortConfig, error) {
108-
explicitTLSCertARNs := t.computeIngressExplicitTLSCertARNs(ctx, ing)
107+
func (t *defaultModelBuildTask) computeIngressListenPortConfigByPort(ctx context.Context, ing *ClassifiedIngress) (map[int64]listenPortConfig, error) {
108+
explicitTLSCertARNs := t.computeIngressExplicitTLSCertARNs(ctx, ing.Ing)
109109
explicitSSLPolicy := t.computeIngressExplicitSSLPolicy(ctx, ing)
110-
inboundCIDRv4s, inboundCIDRV6s, err := t.computeIngressExplicitInboundCIDRs(ctx, ing)
110+
inboundCIDRv4s, inboundCIDRV6s, err := t.computeIngressExplicitInboundCIDRs(ctx, ing.Ing)
111111
if err != nil {
112112
return nil, err
113113
}
114114
preferTLS := len(explicitTLSCertARNs) != 0
115-
listenPorts, err := t.computeIngressListenPorts(ctx, ing, preferTLS)
115+
listenPorts, err := t.computeIngressListenPorts(ctx, ing.Ing, preferTLS)
116116
if err != nil {
117117
return nil, err
118118
}
@@ -126,7 +126,7 @@ func (t *defaultModelBuildTask) computeIngressListenPortConfigByPort(ctx context
126126
}
127127
var inferredTLSCertARNs []string
128128
if containsHTTPSPort && len(explicitTLSCertARNs) == 0 {
129-
inferredTLSCertARNs, err = t.computeIngressInferredTLSCertARNs(ctx, ing)
129+
inferredTLSCertARNs, err = t.computeIngressInferredTLSCertARNs(ctx, ing.Ing)
130130
if err != nil {
131131
return nil, err
132132
}
@@ -228,9 +228,12 @@ func (t *defaultModelBuildTask) computeIngressExplicitInboundCIDRs(_ context.Con
228228
return inboundCIDRv4s, inboundCIDRv6s, nil
229229
}
230230

231-
func (t *defaultModelBuildTask) computeIngressExplicitSSLPolicy(_ context.Context, ing *networking.Ingress) *string {
231+
func (t *defaultModelBuildTask) computeIngressExplicitSSLPolicy(_ context.Context, ing *ClassifiedIngress) *string {
232232
var rawSSLPolicy string
233-
if exists := t.annotationParser.ParseStringAnnotation(annotations.IngressSuffixSSLPolicy, &rawSSLPolicy, ing.Annotations); !exists {
233+
if ing.IngClassConfig.IngClassParams != nil && ing.IngClassConfig.IngClassParams.Spec.SSLPolicy != "" {
234+
return &ing.IngClassConfig.IngClassParams.Spec.SSLPolicy
235+
}
236+
if exists := t.annotationParser.ParseStringAnnotation(annotations.IngressSuffixSSLPolicy, &rawSSLPolicy, ing.Ing.Annotations); !exists {
234237
return nil
235238
}
236239
return &rawSSLPolicy

‎pkg/ingress/model_builder.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ package ingress
22

33
import (
44
"context"
5+
"strconv"
6+
57
awssdk "github.com/aws/aws-sdk-go/aws"
68
elbv2sdk "github.com/aws/aws-sdk-go/service/elbv2"
79
"github.com/go-logr/logr"
@@ -21,7 +23,6 @@ import (
2123
elbv2model "sigs.k8s.io/aws-load-balancer-controller/pkg/model/elbv2"
2224
networkingpkg "sigs.k8s.io/aws-load-balancer-controller/pkg/networking"
2325
"sigs.k8s.io/controller-runtime/pkg/client"
24-
"strconv"
2526
)
2627

2728
const (
@@ -227,7 +228,7 @@ func (t *defaultModelBuildTask) run(ctx context.Context) error {
227228
listenPortConfigsByPort := make(map[int64][]listenPortConfigWithIngress)
228229
for _, member := range t.ingGroup.Members {
229230
ingKey := k8s.NamespacedName(member.Ing)
230-
listenPortConfigByPortForIngress, err := t.computeIngressListenPortConfigByPort(ctx, member.Ing)
231+
listenPortConfigByPortForIngress, err := t.computeIngressListenPortConfigByPort(ctx, &member)
231232
if err != nil {
232233
return errors.Wrapf(err, "ingress: %v", ingKey.String())
233234
}

‎pkg/ingress/model_builder_test.go

Lines changed: 267 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"k8s.io/apimachinery/pkg/util/intstr"
2323
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
2424
"k8s.io/client-go/tools/record"
25+
"sigs.k8s.io/aws-load-balancer-controller/apis/elbv2/v1beta1"
2526
"sigs.k8s.io/aws-load-balancer-controller/pkg/annotations"
2627
"sigs.k8s.io/aws-load-balancer-controller/pkg/aws/services"
2728
"sigs.k8s.io/aws-load-balancer-controller/pkg/config"
@@ -1473,6 +1474,272 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
14731474
"ns-1/ing-1-svc-3:https": null
14741475
}
14751476
}
1477+
}`,
1478+
},
1479+
{
1480+
name: "Ingress - ssl-policy in IngressClassParams",
1481+
env: env{
1482+
svcs: []*corev1.Service{ns_1_svc_1, ns_1_svc_2, ns_1_svc_3},
1483+
},
1484+
fields: fields{
1485+
resolveViaDiscoveryCalls: []resolveViaDiscoveryCall{resolveViaDiscoveryCallForInternalLB},
1486+
listLoadBalancersCalls: []listLoadBalancersCall{listLoadBalancerCallForEmptyLB},
1487+
enableBackendSG: true,
1488+
},
1489+
args: args{
1490+
ingGroup: Group{
1491+
ID: GroupID{Namespace: "ns-1", Name: "ing-1"},
1492+
Members: []ClassifiedIngress{
1493+
{
1494+
IngClassConfig: ClassConfiguration{
1495+
IngClassParams: &v1beta1.IngressClassParams{
1496+
Spec: v1beta1.IngressClassParamsSpec{
1497+
SSLPolicy: "ingress-class-policy",
1498+
},
1499+
},
1500+
},
1501+
Ing: &networking.Ingress{ObjectMeta: metav1.ObjectMeta{
1502+
Namespace: "ns-1",
1503+
Name: "ing-1",
1504+
Annotations: map[string]string{
1505+
"alb.ingress.kubernetes.io/certificate-arn": "arn:aws:acm:us-east-1:9999999:certificate/11111111",
1506+
"alb.ingress.kubernetes.io/ssl-policy": "annotated-ssl-policy",
1507+
},
1508+
},
1509+
Spec: networking.IngressSpec{
1510+
Rules: []networking.IngressRule{
1511+
{
1512+
Host: "app-1.example.com",
1513+
IngressRuleValue: networking.IngressRuleValue{
1514+
HTTP: &networking.HTTPIngressRuleValue{
1515+
Paths: []networking.HTTPIngressPath{
1516+
{
1517+
Path: "/svc-1",
1518+
Backend: networking.IngressBackend{
1519+
Service: &networking.IngressServiceBackend{
1520+
Name: ns_1_svc_1.Name,
1521+
Port: networking.ServiceBackendPort{
1522+
Name: "http",
1523+
},
1524+
},
1525+
},
1526+
},
1527+
{
1528+
Path: "/svc-2",
1529+
Backend: networking.IngressBackend{
1530+
Service: &networking.IngressServiceBackend{
1531+
Name: ns_1_svc_2.Name,
1532+
Port: networking.ServiceBackendPort{
1533+
Name: "http",
1534+
},
1535+
},
1536+
},
1537+
},
1538+
},
1539+
},
1540+
},
1541+
},
1542+
{
1543+
Host: "app-2.example.com",
1544+
IngressRuleValue: networking.IngressRuleValue{
1545+
HTTP: &networking.HTTPIngressRuleValue{
1546+
Paths: []networking.HTTPIngressPath{
1547+
{
1548+
Path: "/svc-3",
1549+
Backend: networking.IngressBackend{
1550+
Service: &networking.IngressServiceBackend{
1551+
Name: ns_1_svc_3.Name,
1552+
Port: networking.ServiceBackendPort{
1553+
Name: "https",
1554+
},
1555+
},
1556+
},
1557+
},
1558+
},
1559+
},
1560+
},
1561+
},
1562+
},
1563+
},
1564+
},
1565+
},
1566+
},
1567+
},
1568+
},
1569+
wantStackPatch: `
1570+
{
1571+
"resources": {
1572+
"AWS::EC2::SecurityGroup": {
1573+
"ManagedLBSecurityGroup": {
1574+
"spec": {
1575+
"ingress": [
1576+
{
1577+
"fromPort": 443,
1578+
"ipProtocol": "tcp",
1579+
"ipRanges": [
1580+
{
1581+
"cidrIP": "0.0.0.0/0"
1582+
}
1583+
],
1584+
"toPort": 443
1585+
}
1586+
]
1587+
}
1588+
}
1589+
},
1590+
"AWS::ElasticLoadBalancingV2::Listener": {
1591+
"443": {
1592+
"spec": {
1593+
"certificates": [
1594+
{
1595+
"certificateARN": "arn:aws:acm:us-east-1:9999999:certificate/11111111"
1596+
}
1597+
],
1598+
"defaultActions": [
1599+
{
1600+
"fixedResponseConfig": {
1601+
"contentType": "text/plain",
1602+
"statusCode": "404"
1603+
},
1604+
"type": "fixed-response"
1605+
}
1606+
],
1607+
"loadBalancerARN": {
1608+
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::LoadBalancer/LoadBalancer/status/loadBalancerARN"
1609+
},
1610+
"port": 443,
1611+
"protocol": "HTTPS",
1612+
"sslPolicy": "ingress-class-policy"
1613+
}
1614+
},
1615+
"80": null
1616+
},
1617+
"AWS::ElasticLoadBalancingV2::ListenerRule": {
1618+
"443:1": {
1619+
"spec": {
1620+
"actions": [
1621+
{
1622+
"forwardConfig": {
1623+
"targetGroups": [
1624+
{
1625+
"targetGroupARN": {
1626+
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::TargetGroup/ns-1/ing-1-svc-1:http/status/targetGroupARN"
1627+
}
1628+
}
1629+
]
1630+
},
1631+
"type": "forward"
1632+
}
1633+
],
1634+
"conditions": [
1635+
{
1636+
"field": "host-header",
1637+
"hostHeaderConfig": {
1638+
"values": [
1639+
"app-1.example.com"
1640+
]
1641+
}
1642+
},
1643+
{
1644+
"field": "path-pattern",
1645+
"pathPatternConfig": {
1646+
"values": [
1647+
"/svc-1"
1648+
]
1649+
}
1650+
}
1651+
],
1652+
"listenerARN": {
1653+
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::Listener/443/status/listenerARN"
1654+
},
1655+
"priority": 1
1656+
}
1657+
},
1658+
"443:2": {
1659+
"spec": {
1660+
"actions": [
1661+
{
1662+
"forwardConfig": {
1663+
"targetGroups": [
1664+
{
1665+
"targetGroupARN": {
1666+
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::TargetGroup/ns-1/ing-1-svc-2:http/status/targetGroupARN"
1667+
}
1668+
}
1669+
]
1670+
},
1671+
"type": "forward"
1672+
}
1673+
],
1674+
"conditions": [
1675+
{
1676+
"field": "host-header",
1677+
"hostHeaderConfig": {
1678+
"values": [
1679+
"app-1.example.com"
1680+
]
1681+
}
1682+
},
1683+
{
1684+
"field": "path-pattern",
1685+
"pathPatternConfig": {
1686+
"values": [
1687+
"/svc-2"
1688+
]
1689+
}
1690+
}
1691+
],
1692+
"listenerARN": {
1693+
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::Listener/443/status/listenerARN"
1694+
},
1695+
"priority": 2
1696+
}
1697+
},
1698+
"443:3": {
1699+
"spec": {
1700+
"actions": [
1701+
{
1702+
"forwardConfig": {
1703+
"targetGroups": [
1704+
{
1705+
"targetGroupARN": {
1706+
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::TargetGroup/ns-1/ing-1-svc-3:https/status/targetGroupARN"
1707+
}
1708+
}
1709+
]
1710+
},
1711+
"type": "forward"
1712+
}
1713+
],
1714+
"conditions": [
1715+
{
1716+
"field": "host-header",
1717+
"hostHeaderConfig": {
1718+
"values": [
1719+
"app-2.example.com"
1720+
]
1721+
}
1722+
},
1723+
{
1724+
"field": "path-pattern",
1725+
"pathPatternConfig": {
1726+
"values": [
1727+
"/svc-3"
1728+
]
1729+
}
1730+
}
1731+
],
1732+
"listenerARN": {
1733+
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::Listener/443/status/listenerARN"
1734+
},
1735+
"priority": 3
1736+
}
1737+
},
1738+
"80:1": null,
1739+
"80:2": null,
1740+
"80:3": null
1741+
}
1742+
}
14761743
}`,
14771744
},
14781745
{

0 commit comments

Comments
 (0)