Skip to content

Commit e308e86

Browse files
author
Timo Reimann
authored
Merge pull request #390 from dikshant/dadhikari/disable-le-dns-records-ccm
cloud-controller-manager/do/load-balancers: add new annotation for disabling automatic DNS record creation for let's encrypt cert
2 parents 1c51415 + 3576e27 commit e308e86

File tree

9 files changed

+281
-57
lines changed

9 files changed

+281
-57
lines changed

‎cloud-controller-manager/do/loadbalancers.go‎

Lines changed: 35 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,10 @@ const (
146146
// should be redirected to Https. Defaults to false
147147
annDORedirectHTTPToHTTPS = "service.beta.kubernetes.io/do-loadbalancer-redirect-http-to-https"
148148

149+
// annDODisableLetsEncryptDNSRecords is the annotation specifying whether automatic DNS record creation should
150+
// be disabled when a Let's Encrypt cert is added to a load balancer
151+
annDODisableLetsEncryptDNSRecords = "service.beta.kubernetes.io/do-loadbalancer-disable-lets-encrypt-dns-records"
152+
149153
// annDOEnableProxyProtocol is the annotation specifying whether PROXY protocol should
150154
// be enabled. Defaults to false.
151155
annDOEnableProxyProtocol = "service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol"
@@ -693,26 +697,32 @@ func (l *loadBalancers) buildLoadBalancerRequest(ctx context.Context, service *v
693697
return nil, err
694698
}
695699

700+
disableLetsEncryptDNSRecords, err := getDisableLetsEncryptDNSRecords(service)
701+
if err != nil {
702+
return nil, err
703+
}
704+
696705
var tags []string
697706
if l.resources.clusterID != "" {
698707
tags = []string{buildK8sTag(l.resources.clusterID)}
699708
}
700709

701710
return &godo.LoadBalancerRequest{
702-
Name: lbName,
703-
DropletIDs: dropletIDs,
704-
Region: l.region,
705-
SizeSlug: sizeSlug,
706-
SizeUnit: sizeUnit,
707-
ForwardingRules: forwardingRules,
708-
HealthCheck: healthCheck,
709-
StickySessions: stickySessions,
710-
Tags: tags,
711-
Algorithm: algorithm,
712-
RedirectHttpToHttps: redirectHTTPToHTTPS,
713-
EnableProxyProtocol: enableProxyProtocol,
714-
EnableBackendKeepalive: enableBackendKeepalive,
715-
VPCUUID: l.resources.clusterVPCID,
711+
Name: lbName,
712+
DropletIDs: dropletIDs,
713+
Region: l.region,
714+
SizeSlug: sizeSlug,
715+
SizeUnit: sizeUnit,
716+
ForwardingRules: forwardingRules,
717+
HealthCheck: healthCheck,
718+
StickySessions: stickySessions,
719+
Tags: tags,
720+
Algorithm: algorithm,
721+
RedirectHttpToHttps: redirectHTTPToHTTPS,
722+
EnableProxyProtocol: enableProxyProtocol,
723+
EnableBackendKeepalive: enableBackendKeepalive,
724+
VPCUUID: l.resources.clusterVPCID,
725+
DisableLetsEncryptDNSRecords: &disableLetsEncryptDNSRecords,
716726
}, nil
717727
}
718728

@@ -1199,6 +1209,17 @@ func getEnableProxyProtocol(service *v1.Service) (bool, error) {
11991209
return enableProxyProtocol, nil
12001210
}
12011211

1212+
// getDisableLetsEncryptDNSRecords returns whether DNS records should be automatically created
1213+
// for Let's Encrypt certs added to the LB
1214+
func getDisableLetsEncryptDNSRecords(service *v1.Service) (bool, error) {
1215+
disableLetsEncryptDNSRecords, _, err := getBool(service.Annotations, annDODisableLetsEncryptDNSRecords)
1216+
if err != nil {
1217+
return false, fmt.Errorf("failed to get disable lets encrypt dns records configuration setting: %s", err)
1218+
}
1219+
1220+
return disableLetsEncryptDNSRecords, nil
1221+
}
1222+
12021223
// getEnableBackendKeepalive returns whether HTTP keepalive to target droplets should be enabled.
12031224
// False is returned if not specified.
12041225
func getEnableBackendKeepalive(service *v1.Service) (bool, error) {

‎cloud-controller-manager/do/loadbalancers_test.go‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3067,6 +3067,7 @@ func Test_buildLoadBalancerRequest(t *testing.T) {
30673067
StickySessions: &godo.StickySessions{
30683068
Type: "none",
30693069
},
3070+
DisableLetsEncryptDNSRecords: godo.Bool(false),
30703071
},
30713072
nil,
30723073
},
@@ -3143,6 +3144,7 @@ func Test_buildLoadBalancerRequest(t *testing.T) {
31433144
StickySessions: &godo.StickySessions{
31443145
Type: "none",
31453146
},
3147+
DisableLetsEncryptDNSRecords: godo.Bool(false),
31463148
},
31473149
nil,
31483150
},
@@ -3219,6 +3221,7 @@ func Test_buildLoadBalancerRequest(t *testing.T) {
32193221
StickySessions: &godo.StickySessions{
32203222
Type: "none",
32213223
},
3224+
DisableLetsEncryptDNSRecords: godo.Bool(false),
32223225
},
32233226
nil,
32243227
},
@@ -3294,6 +3297,7 @@ func Test_buildLoadBalancerRequest(t *testing.T) {
32943297
StickySessions: &godo.StickySessions{
32953298
Type: "none",
32963299
},
3300+
DisableLetsEncryptDNSRecords: godo.Bool(false),
32973301
},
32983302
nil,
32993303
},
@@ -3370,6 +3374,7 @@ func Test_buildLoadBalancerRequest(t *testing.T) {
33703374
StickySessions: &godo.StickySessions{
33713375
Type: "none",
33723376
},
3377+
DisableLetsEncryptDNSRecords: godo.Bool(false),
33733378
},
33743379
nil,
33753380
},
@@ -3446,6 +3451,7 @@ func Test_buildLoadBalancerRequest(t *testing.T) {
34463451
StickySessions: &godo.StickySessions{
34473452
Type: "none",
34483453
},
3454+
DisableLetsEncryptDNSRecords: godo.Bool(false),
34493455
},
34503456
nil,
34513457
},
@@ -3582,6 +3588,7 @@ func Test_buildLoadBalancerRequest(t *testing.T) {
35823588
CookieName: "DO-CCM",
35833589
CookieTtlSeconds: 300,
35843590
},
3591+
DisableLetsEncryptDNSRecords: godo.Bool(false),
35853592
},
35863593
nil,
35873594
},
@@ -3663,6 +3670,7 @@ func Test_buildLoadBalancerRequest(t *testing.T) {
36633670
CookieName: "DO-CCM",
36643671
CookieTtlSeconds: 300,
36653672
},
3673+
DisableLetsEncryptDNSRecords: godo.Bool(false),
36663674
},
36673675
nil,
36683676
},
@@ -3753,6 +3761,99 @@ func Test_buildLoadBalancerRequest(t *testing.T) {
37533761
StickySessions: &godo.StickySessions{
37543762
Type: "none",
37553763
},
3764+
DisableLetsEncryptDNSRecords: godo.Bool(false),
3765+
},
3766+
nil,
3767+
},
3768+
{
3769+
"successful load balancer request with disable_lets_encrypt_dns_records",
3770+
[]godo.Droplet{
3771+
{
3772+
ID: 100,
3773+
Name: "node-1",
3774+
},
3775+
{
3776+
ID: 101,
3777+
Name: "node-2",
3778+
},
3779+
{
3780+
ID: 102,
3781+
Name: "node-3",
3782+
},
3783+
},
3784+
&v1.Service{
3785+
ObjectMeta: metav1.ObjectMeta{
3786+
Name: "test",
3787+
UID: "foobar123",
3788+
Annotations: map[string]string{
3789+
annDOProtocol: "http",
3790+
annDOAlgorithm: "round_robin",
3791+
annDORedirectHTTPToHTTPS: "true",
3792+
annDOTLSPorts: "443",
3793+
annDOCertificateID: "test-certificate",
3794+
annDODisableLetsEncryptDNSRecords: "true",
3795+
},
3796+
},
3797+
Spec: v1.ServiceSpec{
3798+
Ports: []v1.ServicePort{
3799+
{
3800+
Name: "test",
3801+
Protocol: "TCP",
3802+
Port: int32(80),
3803+
NodePort: int32(30000),
3804+
},
3805+
{
3806+
Name: "test",
3807+
Protocol: "TCP",
3808+
Port: int32(443),
3809+
NodePort: int32(30000),
3810+
},
3811+
},
3812+
},
3813+
},
3814+
[]*v1.Node{
3815+
{
3816+
ObjectMeta: metav1.ObjectMeta{
3817+
Name: "node-1",
3818+
},
3819+
},
3820+
{
3821+
ObjectMeta: metav1.ObjectMeta{
3822+
Name: "node-2",
3823+
},
3824+
},
3825+
{
3826+
ObjectMeta: metav1.ObjectMeta{
3827+
Name: "node-3",
3828+
},
3829+
},
3830+
},
3831+
&godo.LoadBalancerRequest{
3832+
Name: "afoobar123",
3833+
DropletIDs: []int{100, 101, 102},
3834+
Region: "nyc3",
3835+
ForwardingRules: []godo.ForwardingRule{
3836+
{
3837+
EntryProtocol: "http",
3838+
EntryPort: 80,
3839+
TargetProtocol: "http",
3840+
TargetPort: 30000,
3841+
},
3842+
{
3843+
EntryProtocol: "https",
3844+
EntryPort: 443,
3845+
TargetProtocol: "http",
3846+
TargetPort: 30000,
3847+
CertificateID: "test-certificate",
3848+
},
3849+
},
3850+
HealthCheck: defaultHealthCheck("tcp", 30000, ""),
3851+
Algorithm: "round_robin",
3852+
RedirectHttpToHttps: true,
3853+
StickySessions: &godo.StickySessions{
3854+
Type: "none",
3855+
},
3856+
DisableLetsEncryptDNSRecords: godo.Bool(true),
37563857
},
37573858
nil,
37583859
},
@@ -5064,3 +5165,81 @@ func TestEnsureLoadBalancerIDAnnotation(t *testing.T) {
50645165
})
50655166
}
50665167
}
5168+
5169+
func Test_getDisableLetsEncryptDNSRecords(t *testing.T) {
5170+
5171+
testcases := []struct {
5172+
name string
5173+
service *v1.Service
5174+
wantErr bool
5175+
wantDisableLetsEncryptRecords bool
5176+
}{
5177+
{
5178+
name: "enabled",
5179+
service: &v1.Service{
5180+
ObjectMeta: metav1.ObjectMeta{
5181+
Name: "test",
5182+
UID: "abc123",
5183+
Annotations: map[string]string{
5184+
annDODisableLetsEncryptDNSRecords: "true",
5185+
},
5186+
},
5187+
},
5188+
wantErr: false,
5189+
wantDisableLetsEncryptRecords: true,
5190+
},
5191+
{
5192+
name: "disabled",
5193+
service: &v1.Service{
5194+
ObjectMeta: metav1.ObjectMeta{
5195+
Name: "test",
5196+
UID: "abc123",
5197+
Annotations: map[string]string{
5198+
annDODisableLetsEncryptDNSRecords: "false",
5199+
},
5200+
},
5201+
},
5202+
wantErr: false,
5203+
wantDisableLetsEncryptRecords: false,
5204+
},
5205+
{
5206+
name: "annotation missing",
5207+
service: &v1.Service{
5208+
ObjectMeta: metav1.ObjectMeta{
5209+
Name: "test",
5210+
UID: "abc123",
5211+
},
5212+
},
5213+
wantErr: false,
5214+
wantDisableLetsEncryptRecords: false,
5215+
},
5216+
{
5217+
name: "illegal value",
5218+
service: &v1.Service{
5219+
ObjectMeta: metav1.ObjectMeta{
5220+
Name: "test",
5221+
UID: "abc123",
5222+
Annotations: map[string]string{
5223+
annDODisableLetsEncryptDNSRecords: "42",
5224+
},
5225+
},
5226+
},
5227+
wantErr: true,
5228+
wantDisableLetsEncryptRecords: false,
5229+
},
5230+
}
5231+
5232+
for _, test := range testcases {
5233+
t.Run(test.name, func(t *testing.T) {
5234+
gotDisableLetsEncryptDNSRecords, err := getDisableLetsEncryptDNSRecords(test.service)
5235+
if test.wantErr != (err != nil) {
5236+
t.Errorf("got error %q, want error: %t", err, test.wantErr)
5237+
}
5238+
5239+
// check for enable, disable
5240+
if gotDisableLetsEncryptDNSRecords != test.wantDisableLetsEncryptRecords {
5241+
t.Fatalf("got disable let's encrypt DNS records %t, want %t", gotDisableLetsEncryptDNSRecords, test.wantDisableLetsEncryptRecords)
5242+
}
5243+
})
5244+
}
5245+
}

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ go 1.15
44

55
require (
66
github.com/davecgh/go-spew v1.1.1
7-
github.com/digitalocean/godo v1.67.0
7+
github.com/digitalocean/godo v1.69.0
88
github.com/fsnotify/fsnotify v1.4.9 // indirect
99
github.com/go-ini/ini v1.39.0 // indirect
1010
github.com/google/go-cmp v0.5.4

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,8 +92,8 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
9292
github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
9393
github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
9494
github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
95-
github.com/digitalocean/godo v1.67.0 h1:MksZlZl7i3nzrczgNXhzky8FODerHKL76JmpencjEyM=
96-
github.com/digitalocean/godo v1.67.0/go.mod h1:epPuOzTOOJujNo0nduDj2D5O1zu8cSpp9R+DdN0W9I0=
95+
github.com/digitalocean/godo v1.69.0 h1:d+CXI7s3g7zAbCYqscRrq46XPMrlv+A5doOdPYn7Pss=
96+
github.com/digitalocean/godo v1.69.0/go.mod h1:epPuOzTOOJujNo0nduDj2D5O1zu8cSpp9R+DdN0W9I0=
9797
github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
9898
github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
9999
github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=

‎vendor/github.com/digitalocean/godo/CHANGELOG.md‎

Lines changed: 8 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/digitalocean/godo/godo.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/digitalocean/godo/kubernetes.go‎

Lines changed: 9 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)