Skip to content

Commit c7d470b

Browse files
sbueringersbueringer
committed
Add tls options to manager.Options
1 parent 8ad090e commit c7d470b

File tree

6 files changed

+67
-18
lines changed

6 files changed

+67
-18
lines changed

‎pkg/config/v1alpha1/types.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,10 @@ type ControllerWebhook struct {
140140
// must be named tls.key and tls.crt, respectively.
141141
// +optional
142142
CertDir string `json:"certDir,omitempty"`
143+
144+
// TLSVersion is the minimum version of TLS supported. Accepts
145+
// "", "1.0", "1.1", "1.2" and "1.3" only ("" is equivalent to "1.0" for backwards compatibility)
146+
TLSMinVersion string
143147
}
144148

145149
// +kubebuilder:object:root=true

‎pkg/envtest/webhook_test.go

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package envtest
1818

1919
import (
2020
"context"
21+
"crypto/tls"
2122
"path/filepath"
2223
"time"
2324

@@ -27,6 +28,7 @@ import (
2728
corev1 "k8s.io/api/core/v1"
2829
apierrors "k8s.io/apimachinery/pkg/api/errors"
2930
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
31+
3032
"sigs.k8s.io/controller-runtime/pkg/client"
3133
"sigs.k8s.io/controller-runtime/pkg/manager"
3234
"sigs.k8s.io/controller-runtime/pkg/webhook"
@@ -38,9 +40,13 @@ var _ = Describe("Test", func() {
3840
Describe("Webhook", func() {
3941
It("should reject create request for webhook that rejects all requests", func() {
4042
m, err := manager.New(env.Config, manager.Options{
41-
Port: env.WebhookInstallOptions.LocalServingPort,
42-
Host: env.WebhookInstallOptions.LocalServingHost,
43-
CertDir: env.WebhookInstallOptions.LocalServingCertDir,
43+
Port: env.WebhookInstallOptions.LocalServingPort,
44+
Host: env.WebhookInstallOptions.LocalServingHost,
45+
CertDir: env.WebhookInstallOptions.LocalServingCertDir,
46+
TLSMinVersion: "1.2",
47+
TLSOpts: []func(*tls.Config){
48+
func(config *tls.Config) {},
49+
},
4450
}) // we need manager here just to leverage manager.SetFields
4551
Expect(err).NotTo(HaveOccurred())
4652
server := m.GetWebhookServer()

‎pkg/manager/internal.go

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package manager
1818

1919
import (
2020
"context"
21+
"crypto/tls"
2122
"errors"
2223
"fmt"
2324
"net"
@@ -135,6 +136,11 @@ type controllerManager struct {
135136
// if not set, webhook server would look up the server key and certificate in
136137
// {TempDir}/k8s-webhook-server/serving-certs
137138
certDir string
139+
// tlsMinVersion is the minimum version of TLS supported by the webhook server.
140+
// Accepts "", "1.0", "1.1", "1.2" and "1.3" only ("" is equivalent to "1.0" for backwards compatibility).
141+
tlsMinVersion string
142+
// tlsOpts is used to allow configuring the TLS config used for the webhook server.
143+
tlsOpts []func(*tls.Config)
138144

139145
webhookServer *webhook.Server
140146
// webhookServerOnce will be called in GetWebhookServer() to optionally initialize
@@ -302,9 +308,11 @@ func (cm *controllerManager) GetWebhookServer() *webhook.Server {
302308
cm.webhookServerOnce.Do(func() {
303309
if cm.webhookServer == nil {
304310
cm.webhookServer = &webhook.Server{
305-
Port: cm.port,
306-
Host: cm.host,
307-
CertDir: cm.certDir,
311+
Port: cm.port,
312+
Host: cm.host,
313+
CertDir: cm.certDir,
314+
TLSMinVersion: cm.tlsMinVersion,
315+
TLSOpts: cm.tlsOpts,
308316
}
309317
}
310318
if err := cm.Add(cm.webhookServer); err != nil {

‎pkg/manager/manager.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package manager
1818

1919
import (
2020
"context"
21+
"crypto/tls"
2122
"fmt"
2223
"net"
2324
"net/http"
@@ -32,6 +33,7 @@ import (
3233
"k8s.io/client-go/tools/leaderelection/resourcelock"
3334
"k8s.io/client-go/tools/record"
3435
"k8s.io/utils/pointer"
36+
3537
"sigs.k8s.io/controller-runtime/pkg/cache"
3638
"sigs.k8s.io/controller-runtime/pkg/client"
3739
"sigs.k8s.io/controller-runtime/pkg/cluster"
@@ -242,6 +244,13 @@ type Options struct {
242244
// It is used to set webhook.Server.CertDir if WebhookServer is not set.
243245
CertDir string
244246

247+
// TLSMinVersion is the minimum version of TLS supported by the webhook server.
248+
// Accepts "", "1.0", "1.1", "1.2" and "1.3" only ("" is equivalent to "1.0" for backwards compatibility).
249+
TLSMinVersion string
250+
251+
// TLSOpts is used to allow configuring the TLS config used for the webhook server.
252+
TLSOpts []func(*tls.Config)
253+
245254
// WebhookServer is an externally configured webhook.Server. By default,
246255
// a Manager will create a default server using Port, Host, and CertDir;
247256
// if this is set, the Manager will use this server instead.
@@ -422,6 +431,8 @@ func New(config *rest.Config, options Options) (Manager, error) {
422431
port: options.Port,
423432
host: options.Host,
424433
certDir: options.CertDir,
434+
tlsMinVersion: options.TLSMinVersion,
435+
tlsOpts: options.TLSOpts,
425436
webhookServer: options.WebhookServer,
426437
leaseDuration: *options.LeaseDuration,
427438
renewDeadline: *options.RenewDeadline,
@@ -490,6 +501,10 @@ func (o Options) AndFrom(loader config.ControllerManagerConfiguration) (Options,
490501
o.CertDir = newObj.Webhook.CertDir
491502
}
492503

504+
if o.TLSMinVersion == "" && newObj.Webhook.TLSMinVersion != "" {
505+
o.TLSMinVersion = newObj.Webhook.TLSMinVersion
506+
}
507+
493508
if newObj.Controller != nil {
494509
if o.Controller.CacheSyncTimeout == nil && newObj.Controller.CacheSyncTimeout != nil {
495510
o.Controller.CacheSyncTimeout = newObj.Controller.CacheSyncTimeout

‎pkg/manager/manager_test.go

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package manager
1818

1919
import (
2020
"context"
21+
"crypto/tls"
2122
"errors"
2223
"fmt"
2324
"io"
@@ -148,9 +149,10 @@ var _ = Describe("manger.Manager", func() {
148149
LivenessEndpointName: "/livez",
149150
},
150151
Webhook: v1alpha1.ControllerWebhook{
151-
Port: &port,
152-
Host: "localhost",
153-
CertDir: "/certs",
152+
Port: &port,
153+
Host: "localhost",
154+
CertDir: "/certs",
155+
TLSMinVersion: "1.2",
154156
},
155157
},
156158
}
@@ -174,6 +176,7 @@ var _ = Describe("manger.Manager", func() {
174176
Expect(m.Port).To(Equal(port))
175177
Expect(m.Host).To(Equal("localhost"))
176178
Expect(m.CertDir).To(Equal("/certs"))
179+
Expect(m.TLSMinVersion).To(Equal("1.2"))
177180
})
178181

179182
It("should be able to keep Options when cfg.ControllerManagerConfiguration set", func() {
@@ -204,13 +207,17 @@ var _ = Describe("manger.Manager", func() {
204207
LivenessEndpointName: "/livez",
205208
},
206209
Webhook: v1alpha1.ControllerWebhook{
207-
Port: &port,
208-
Host: "localhost",
209-
CertDir: "/certs",
210+
Port: &port,
211+
Host: "localhost",
212+
CertDir: "/certs",
213+
TLSMinVersion: "1.1",
210214
},
211215
},
212216
}
213217

218+
optionsTlSOptsFuncs := []func(*tls.Config){
219+
func(config *tls.Config) {},
220+
}
214221
m, err := Options{
215222
SyncPeriod: &optDuration,
216223
LeaderElection: true,
@@ -228,6 +235,8 @@ var _ = Describe("manger.Manager", func() {
228235
Port: 8080,
229236
Host: "example.com",
230237
CertDir: "/pki",
238+
TLSMinVersion: "1.2",
239+
TLSOpts: optionsTlSOptsFuncs,
231240
}.AndFrom(&fakeDeferredLoader{ccfg})
232241
Expect(err).To(BeNil())
233242

@@ -247,6 +256,8 @@ var _ = Describe("manger.Manager", func() {
247256
Expect(m.Port).To(Equal(8080))
248257
Expect(m.Host).To(Equal("example.com"))
249258
Expect(m.CertDir).To(Equal("/pki"))
259+
Expect(m.TLSMinVersion).To(Equal("1.2"))
260+
Expect(m.TLSOpts).To(Equal(optionsTlSOptsFuncs))
250261
})
251262

252263
It("should lazily initialize a webhook server if needed", func() {

‎pkg/webhook/webhook_integration_test.go

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ import (
3434
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
3535
"k8s.io/apimachinery/pkg/runtime/schema"
3636
"k8s.io/client-go/kubernetes/scheme"
37+
3738
"sigs.k8s.io/controller-runtime/pkg/certwatcher"
3839
"sigs.k8s.io/controller-runtime/pkg/client"
3940
"sigs.k8s.io/controller-runtime/pkg/internal/httpserver"
@@ -82,9 +83,11 @@ var _ = Describe("Webhook", func() {
8283
Context("when running a webhook server with a manager", func() {
8384
It("should reject create request for webhook that rejects all requests", func() {
8485
m, err := manager.New(cfg, manager.Options{
85-
Port: testenv.WebhookInstallOptions.LocalServingPort,
86-
Host: testenv.WebhookInstallOptions.LocalServingHost,
87-
CertDir: testenv.WebhookInstallOptions.LocalServingCertDir,
86+
Port: testenv.WebhookInstallOptions.LocalServingPort,
87+
Host: testenv.WebhookInstallOptions.LocalServingHost,
88+
CertDir: testenv.WebhookInstallOptions.LocalServingCertDir,
89+
TLSMinVersion: "1.2",
90+
TLSOpts: []func(*tls.Config){func(config *tls.Config) {}},
8891
}) // we need manager here just to leverage manager.SetFields
8992
Expect(err).NotTo(HaveOccurred())
9093
server := m.GetWebhookServer()
@@ -105,9 +108,11 @@ var _ = Describe("Webhook", func() {
105108
})
106109
It("should reject create request for multi-webhook that rejects all requests", func() {
107110
m, err := manager.New(cfg, manager.Options{
108-
Port: testenv.WebhookInstallOptions.LocalServingPort,
109-
Host: testenv.WebhookInstallOptions.LocalServingHost,
110-
CertDir: testenv.WebhookInstallOptions.LocalServingCertDir,
111+
Port: testenv.WebhookInstallOptions.LocalServingPort,
112+
Host: testenv.WebhookInstallOptions.LocalServingHost,
113+
CertDir: testenv.WebhookInstallOptions.LocalServingCertDir,
114+
TLSMinVersion: "1.2",
115+
TLSOpts: []func(*tls.Config){func(config *tls.Config) {}},
111116
}) // we need manager here just to leverage manager.SetFields
112117
Expect(err).NotTo(HaveOccurred())
113118
server := m.GetWebhookServer()

0 commit comments

Comments
 (0)