Skip to content

Commit e8cd29a

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4259 from shraddhabang/gwmutualauth
[feat: gw api] Add secure HTTPRoute and mutual auth support for L7 Ga…
2 parents be5ec5b + 0169f63 commit e8cd29a

24 files changed

+2932
-122
lines changed

‎Makefile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ AWS_SDK_MODEL_OVERRIDE ?= "n"
2121
# Move Gateway API CRDs from bases directory to gateway directory
2222
MOVE_GATEWAY_CRDS = mv config/crd/bases/gateway.k8s.aws_* config/crd/gateway/
2323

24+
# Copy combined Gateway API CRDs from bases directory to helm directory
25+
COPY_GATEWAY_CRDS_TO_HELM = cp config/crd/gateway/gateway-crds.yaml helm/aws-load-balancer-controller/crds/gateway-crds.yaml
26+
2427
# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
2528
ifeq (,$(shell go env GOBIN))
2629
GOBIN=$(shell go env GOPATH)/bin
@@ -67,6 +70,7 @@ crds: manifests
6770
$(MOVE_GATEWAY_CRDS)
6871
$(KUSTOMIZE) build config/crd > helm/aws-load-balancer-controller/crds/crds.yaml
6972
$(KUSTOMIZE) build config/crd/gateway > config/crd/gateway/gateway-crds.yaml
73+
$(COPY_GATEWAY_CRDS_TO_HELM)
7074

7175
# Run go fmt against code
7276
fmt:

‎apis/gateway/v1beta1/loadbalancerconfig_types.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,10 @@ const (
118118
)
119119

120120
// Information about the mutual authentication attributes of a listener.
121+
// +kubebuilder:validation:XValidation:rule="!(self.mode == 'verify' && !has(self.trustStore))",message="trustStore is required when mutualAuthentication mode is 'verify'"
122+
// +kubebuilder:validation:XValidation:rule="!(self.mode != 'verify' && has(self.trustStore))",message="Mutual Authentication mode 'off' or 'passthrough' does not support 'trustStore'"
123+
// +kubebuilder:validation:XValidation:rule="!(self.mode != 'verify' && has(self.ignoreClientCertificateExpiry))",message="Mutual Authentication mode 'off' or 'passthrough' does not support 'ignoreClientCertificateExpiry'"
124+
// +kubebuilder:validation:XValidation:rule="!(self.mode != 'verify' && has(self.advertiseTrustStoreCaNames))",message="Mutual Authentication mode 'off' or 'passthrough' does not support 'advertiseTrustStoreCaNames'"
121125
type MutualAuthenticationAttributes struct {
122126

123127
// Indicates whether trust store CA certificate names are advertised.
@@ -142,7 +146,6 @@ type ListenerConfiguration struct {
142146
// protocolPort is identifier for the listener on load balancer. It should be of the form PROTOCOL:PORT
143147
ProtocolPort ProtocolPort `json:"protocolPort"`
144148

145-
// TODO: Add validation in admission webhook to make it required for secure protocols
146149
// defaultCertificate the cert arn to be used by default.
147150
DefaultCertificate *string `json:"defaultCertificate,omitempty"`
148151

@@ -155,10 +158,12 @@ type ListenerConfiguration struct {
155158

156159
// alpnPolicy an optional string that allows you to configure ALPN policies on your Load Balancer
157160
// +optional
161+
// +kubebuilder:default="None"
158162
ALPNPolicy *ALPNPolicy `json:"alpnPolicy,omitempty"`
159163

160164
// mutualAuthentication defines the mutual authentication configuration information.
161165
// +optional
166+
// +kubebuilder:default={"mode": "off"}
162167
MutualAuthentication *MutualAuthenticationAttributes `json:"mutualAuthentication,omitempty"`
163168

164169
// listenerAttributes defines the attributes for the listener

‎config/crd/gateway/gateway-crds.yaml‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ spec:
7979
items:
8080
properties:
8181
alpnPolicy:
82+
default: None
8283
description: alpnPolicy an optional string that allows you to
8384
configure ALPN policies on your Load Balancer
8485
enum:
@@ -95,9 +96,7 @@ spec:
9596
type: string
9697
type: array
9798
defaultCertificate:
98-
description: |-
99-
TODO: Add validation in admission webhook to make it required for secure protocols
100-
defaultCertificate the cert arn to be used by default.
99+
description: defaultCertificate the cert arn to be used by default.
101100
type: string
102101
listenerAttributes:
103102
description: listenerAttributes defines the attributes for the
@@ -117,6 +116,8 @@ spec:
117116
type: object
118117
type: array
119118
mutualAuthentication:
119+
default:
120+
mode: "off"
120121
description: mutualAuthentication defines the mutual authentication
121122
configuration information.
122123
properties:
@@ -145,6 +146,19 @@ spec:
145146
required:
146147
- mode
147148
type: object
149+
x-kubernetes-validations:
150+
- message: trustStore is required when mutualAuthentication
151+
mode is 'verify'
152+
rule: '!(self.mode == ''verify'' && !has(self.trustStore))'
153+
- message: Mutual Authentication mode 'off' or 'passthrough'
154+
does not support 'trustStore'
155+
rule: '!(self.mode != ''verify'' && has(self.trustStore))'
156+
- message: Mutual Authentication mode 'off' or 'passthrough'
157+
does not support 'ignoreClientCertificateExpiry'
158+
rule: '!(self.mode != ''verify'' && has(self.ignoreClientCertificateExpiry))'
159+
- message: Mutual Authentication mode 'off' or 'passthrough'
160+
does not support 'advertiseTrustStoreCaNames'
161+
rule: '!(self.mode != ''verify'' && has(self.advertiseTrustStoreCaNames))'
148162
protocolPort:
149163
description: protocolPort is identifier for the listener on
150164
load balancer. It should be of the form PROTOCOL:PORT

‎config/crd/gateway/gateway.k8s.aws_loadbalancerconfigurations.yaml‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ spec:
8080
items:
8181
properties:
8282
alpnPolicy:
83+
default: None
8384
description: alpnPolicy an optional string that allows you to
8485
configure ALPN policies on your Load Balancer
8586
enum:
@@ -96,9 +97,7 @@ spec:
9697
type: string
9798
type: array
9899
defaultCertificate:
99-
description: |-
100-
TODO: Add validation in admission webhook to make it required for secure protocols
101-
defaultCertificate the cert arn to be used by default.
100+
description: defaultCertificate the cert arn to be used by default.
102101
type: string
103102
listenerAttributes:
104103
description: listenerAttributes defines the attributes for the
@@ -118,6 +117,8 @@ spec:
118117
type: object
119118
type: array
120119
mutualAuthentication:
120+
default:
121+
mode: "off"
121122
description: mutualAuthentication defines the mutual authentication
122123
configuration information.
123124
properties:
@@ -146,6 +147,19 @@ spec:
146147
required:
147148
- mode
148149
type: object
150+
x-kubernetes-validations:
151+
- message: trustStore is required when mutualAuthentication
152+
mode is 'verify'
153+
rule: '!(self.mode == ''verify'' && !has(self.trustStore))'
154+
- message: Mutual Authentication mode 'off' or 'passthrough'
155+
does not support 'trustStore'
156+
rule: '!(self.mode != ''verify'' && has(self.trustStore))'
157+
- message: Mutual Authentication mode 'off' or 'passthrough'
158+
does not support 'ignoreClientCertificateExpiry'
159+
rule: '!(self.mode != ''verify'' && has(self.ignoreClientCertificateExpiry))'
160+
- message: Mutual Authentication mode 'off' or 'passthrough'
161+
does not support 'advertiseTrustStoreCaNames'
162+
rule: '!(self.mode != ''verify'' && has(self.advertiseTrustStoreCaNames))'
149163
protocolPort:
150164
description: protocolPort is identifier for the listener on
151165
load balancer. It should be of the form PROTOCOL:PORT

‎controllers/gateway/gateway_controller.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ func newGatewayReconciler(controllerName string, lbType elbv2model.LoadBalancerT
6969
reconcileTracker func(namespaceName types.NamespacedName), routeReconciler routeutils.RouteReconciler) Reconciler {
7070

7171
trackingProvider := tracking.NewDefaultProvider(gatewayTagPrefix, controllerConfig.ClusterName)
72-
modelBuilder := gatewaymodel.NewModelBuilder(subnetResolver, vpcInfoProvider, cloud.VpcID(), lbType, trackingProvider, elbv2TaggingManager, controllerConfig, cloud.EC2(), cloud.ACM(), controllerConfig.FeatureGates, controllerConfig.ClusterName, controllerConfig.DefaultTags, sets.New(controllerConfig.ExternalManagedTags...), controllerConfig.DefaultSSLPolicy, controllerConfig.DefaultTargetType, controllerConfig.DefaultLoadBalancerScheme, backendSGProvider, sgResolver, controllerConfig.EnableBackendSecurityGroup, controllerConfig.DisableRestrictedSGRules, controllerConfig.IngressConfig.AllowedCertificateAuthorityARNs, logger)
72+
modelBuilder := gatewaymodel.NewModelBuilder(subnetResolver, vpcInfoProvider, cloud.VpcID(), lbType, trackingProvider, elbv2TaggingManager, controllerConfig, cloud.EC2(), cloud.ELBV2(), cloud.ACM(), controllerConfig.FeatureGates, controllerConfig.ClusterName, controllerConfig.DefaultTags, sets.New(controllerConfig.ExternalManagedTags...), controllerConfig.DefaultSSLPolicy, controllerConfig.DefaultTargetType, controllerConfig.DefaultLoadBalancerScheme, backendSGProvider, sgResolver, controllerConfig.EnableBackendSecurityGroup, controllerConfig.DisableRestrictedSGRules, controllerConfig.IngressConfig.AllowedCertificateAuthorityARNs, logger)
7373

7474
stackMarshaller := deploy.NewDefaultStackMarshaller()
7575
stackDeployer := deploy.NewDefaultStackDeployer(cloud, k8sClient, networkingManager, networkingSGManager, networkingSGReconciler, elbv2TaggingManager, controllerConfig, gatewayTagPrefix, logger, metricsCollector, controllerName)

0 commit comments

Comments
 (0)