AWS applies a default ssl policy if one is undefined.

Author: bigkraig

pkg/annotations/annotations.go

@@ -705,10 +705,17 @@ func (a *Annotations) setWafACLID(annotations map[string]string, validator Valid
 }
 
 func (a *Annotations) setSslPolicy(annotations map[string]string, validator Validator) error {
+	if a.CertificateArn != nil {
+		a.SslPolicy = aws.String("ELBSecurityPolicy-2016-08") // AWS default policy
+	}
+
 	if sslPolicy, ok := annotations[sslPolicyKey]; ok {
 		a.SslPolicy = aws.String(sslPolicy)
-		if err := validator.ValidateSslPolicy(a); err != nil {
-			return err
+		if c := cacheLookup(sslPolicy); c == nil || c.Expired() {
+			if err := validator.ValidateSslPolicy(a); err != nil {
+				return err
+			}
+			cache.Set(sslPolicy, "success", 30*time.Minute)
 		}
 	}
 	return nil

pkg/annotations/annotations_test.go

@@ -115,27 +115,29 @@ func TestSetIgnoreHostHeader(t *testing.T) {
 
 func TestSetSslPolicy(t *testing.T) {
 	var tests = []struct {
-		SslPolicy     string
-		expected      string
-		pass          bool
+		Annotations map[string]string
+		expected    string
+		pass        bool
 	}{
-		{"", "", true}, // ip-address-type has a sane default
-		{"ELBSecurityPolicy-TLS-1-2-2017-01", "", false},
-		{"ELBSecurityPolicy-TLS-1-2-2017-01", "ELBSecurityPolicy-TLS-1-2-2017-01", true},
+		{map[string]string{}, "", true}, // ssl policy has a sane default
+		{map[string]string{sslPolicyKey: "ELBSecurityPolicy-TLS-1-2-2017-01"}, "", false},
+		{map[string]string{certificateArnKey: "arn:aws:acm:"}, "ELBSecurityPolicy-2016-08", true}, // AWS's default policy when there is a cert assigned is 'ELBSecurityPolicy-2016-08'
+		{map[string]string{sslPolicyKey: "ELBSecurityPolicy-TLS-1-2-2017-01"}, "ELBSecurityPolicy-TLS-1-2-2017-01", true},
 	}
 
 	for _, tt := range tests {
 		a := &Annotations{}
+		a.setCertificateArn(tt.Annotations, fakeValidator())
 
-		err := a.setSslPolicy(map[string]string{sslPolicyKey: tt.SslPolicy}, fakeValidator())
+		err := a.setSslPolicy(tt.Annotations, fakeValidator())
 		if err != nil && tt.pass {
-			t.Errorf("setIpAddressType(%v): expected %v, actual %v", tt.SslPolicy, tt.pass, err)
+			t.Errorf("setSslPolicy(%v): expected %v, actual %v", tt.Annotations[sslPolicyKey], tt.pass, err)
 		}
-		if err == nil && tt.pass && tt.expected != *a.SslPolicy {
-			t.Errorf("setIpAddressType(%v): expected %v, actual %v", tt.SslPolicy, tt.expected, *a.SslPolicy)
+		if err == nil && tt.pass && a.SslPolicy != nil && tt.expected != *a.SslPolicy {
+			t.Errorf("setSslPolicy(%v): expected %v, actual %v", tt.Annotations[sslPolicyKey], tt.expected, *a.SslPolicy)
 		}
 		if err == nil && !tt.pass && tt.expected == *a.SslPolicy {
-			t.Errorf("setIpAddressType(%v): expected %v, actual %v", tt.SslPolicy, tt.expected, *a.SslPolicy)
+			t.Errorf("setSslPolicy(%v): expected %v, actual %v", tt.Annotations[sslPolicyKey], tt.expected, *a.SslPolicy)
 		}
 	}
 }