Skip to content

Commit e2435f6

Browse files
pdabelf5pdabelf5
authored
Merge branch 'main' into main
2 parents 9cc0a34 + 15403da commit e2435f6

File tree

6 files changed

+201
-42
lines changed

6 files changed

+201
-42
lines changed

‎build/Dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,12 @@ ARG PACKAGE_REPO=pkgs.nginx.com
1111

1212

1313
############################################# Base images containing libs for Opentracing and FIPS #############################################
14-
FROM ghcr.io/nginxinc/dependencies/nginx-ot:nginx-1.27.3@sha256:a68d1354dbfd4abde28178673bee466866585a971568fe50f76bafe200ed0a87 AS opentracing-lib
15-
FROM ghcr.io/nginxinc/dependencies/nginx-ot:nginx-1.27.3-alpine@sha256:5e10fbff8255e7a0262ac0d4d68448c5d93957f7a26c380a2673887ec4ac36ea AS alpine-opentracing-lib
14+
FROM ghcr.io/nginxinc/dependencies/nginx-ot:nginx-1.27.3@sha256:82aff3929e4020d186b49eb23d295cef3cf8a7bcde7886170395054313ac13c1 AS opentracing-lib
15+
FROM ghcr.io/nginxinc/dependencies/nginx-ot:nginx-1.27.3-alpine@sha256:ea31a90f556bc00f4fa243e2182e5a036c8126f9e63fc5ba0b4bccbeae022f74 AS alpine-opentracing-lib
1616
FROM ghcr.io/nginxinc/dependencies/nginx-ubi-ppc64le:nginx-1.27.3@sha256:4cda07664f09f16d780d1e803b9748c31489ea21c463bbcca50d9dcf26081a6f AS ubi-ppc64le
1717
FROM ghcr.io/nginxinc/alpine-fips:0.2.3-alpine3.17@sha256:67b69b49aff96e185be841e2b2ff2d8236551ea5c18002bffa4344798d803fd8 AS alpine-fips-3.17
1818
FROM ghcr.io/nginxinc/alpine-fips:0.2.3-alpine3.20@sha256:4c29e5c50b122354d9d4ba6b97cdf64647468e788b965fc0240ead541653454a AS alpine-fips-3.20
19-
FROM redhat/ubi9-minimal:9.5@sha256:d85040b6e3ed3628a89683f51a38c709185efc3fb552db2ad1b9180f2a6c38be AS ubi-minimal
19+
FROM redhat/ubi9-minimal:9.5@sha256:dee813b83663d420eb108983a1c94c614ff5d3fcb5159a7bd0324f0edbe7fca1 AS ubi-minimal
2020
FROM golang:1.23-alpine@sha256:6c5c9590f169f77c8046e45c611d3b28fe477789acd8d3762d23d4744de69812 AS golang-builder
2121

2222

‎internal/k8s/controller.go‎

Lines changed: 53 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -883,6 +883,7 @@ func (lbc *LoadBalancerController) updateAllConfigs() {
883883
var isNGINXConfigValid bool
884884
var mgmtConfigHasWarnings bool
885885
var mgmtErr error
886+
var reloadNginx bool
886887

887888
if lbc.configMap != nil {
888889
cfgParams, isNGINXConfigValid = configs.ParseConfigMap(ctx, lbc.configMap, lbc.isNginxPlus, lbc.appProtectEnabled, lbc.appProtectDosEnabled, lbc.configuration.isTLSPassthroughEnabled, lbc.recorder)
@@ -892,6 +893,15 @@ func (lbc *LoadBalancerController) updateAllConfigs() {
892893
if mgmtErr != nil {
893894
nl.Errorf(lbc.Logger, "configmap %s/%s: %v", lbc.mgmtConfigMap.GetNamespace(), lbc.mgmtConfigMap.GetName(), mgmtErr)
894895
}
896+
// update special license secret in mgmtConfigParams
897+
if mgmtCfgParams.Secrets.License != "" {
898+
secret, err := lbc.client.CoreV1().Secrets(lbc.mgmtConfigMap.GetNamespace()).Get(context.TODO(), mgmtCfgParams.Secrets.License, meta_v1.GetOptions{})
899+
if err != nil {
900+
nl.Errorf(lbc.Logger, "secret %s/%s: %v", lbc.mgmtConfigMap.GetNamespace(), mgmtCfgParams.Secrets.License, err)
901+
}
902+
lbc.specialSecrets.licenseSecret = fmt.Sprintf("%s/%s", secret.Namespace, secret.Name)
903+
lbc.handleSpecialSecretUpdate(secret, reloadNginx)
904+
}
895905
// update special CA secret in mgmtConfigParams
896906
if mgmtCfgParams.Secrets.TrustedCert != "" {
897907
secret, err := lbc.client.CoreV1().Secrets(lbc.mgmtConfigMap.GetNamespace()).Get(context.TODO(), mgmtCfgParams.Secrets.TrustedCert, meta_v1.GetOptions{})
@@ -901,6 +911,17 @@ func (lbc *LoadBalancerController) updateAllConfigs() {
901911
if _, hasCRL := secret.Data[configs.CACrlKey]; hasCRL {
902912
mgmtCfgParams.Secrets.TrustedCRL = secret.Name
903913
}
914+
lbc.specialSecrets.trustedCertSecret = fmt.Sprintf("%s/%s", secret.Namespace, secret.Name)
915+
lbc.handleSpecialSecretUpdate(secret, reloadNginx)
916+
}
917+
// update special ClientAuth secret in mgmtConfigParams
918+
if mgmtCfgParams.Secrets.ClientAuth != "" {
919+
secret, err := lbc.client.CoreV1().Secrets(lbc.mgmtConfigMap.GetNamespace()).Get(context.TODO(), mgmtCfgParams.Secrets.ClientAuth, meta_v1.GetOptions{})
920+
if err != nil {
921+
nl.Errorf(lbc.Logger, "secret %s/%s: %v", lbc.mgmtConfigMap.GetNamespace(), mgmtCfgParams.Secrets.ClientAuth, err)
922+
}
923+
lbc.specialSecrets.clientAuthSecret = fmt.Sprintf("%s/%s", secret.Namespace, secret.Name)
924+
lbc.handleSpecialSecretUpdate(secret, reloadNginx)
904925
}
905926
}
906927

@@ -1769,7 +1790,8 @@ func (lbc *LoadBalancerController) syncSecret(task task) {
17691790
lbc.secretStore.AddOrUpdateSecret(secret)
17701791

17711792
if lbc.isSpecialSecret(key) {
1772-
lbc.handleSpecialSecretUpdate(secret)
1793+
reloadNginx := true
1794+
lbc.handleSpecialSecretUpdate(secret, reloadNginx)
17731795
// we don't return here in case the special secret is also used in resources.
17741796
}
17751797

@@ -1828,25 +1850,22 @@ func (lbc *LoadBalancerController) handleSecretUpdate(secret *api_v1.Secret, res
18281850
warnings, addOrUpdateErr = lbc.configurator.AddOrUpdateResources(resourceExes, !lbc.configurator.DynamicSSLReloadEnabled())
18291851
if addOrUpdateErr != nil {
18301852
nl.Errorf(lbc.Logger, "Error when updating Secret %v: %v", secretNsName, addOrUpdateErr)
1831-
lbc.recorder.Eventf(secret, api_v1.EventTypeWarning, "UpdatedWithError", "%v was updated, but not applied: %v", secretNsName, addOrUpdateErr)
1853+
lbc.recorder.Eventf(lbc.metadata.pod, api_v1.EventTypeWarning, "UpdatedWithError", "%v was updated, but not applied: %v", secretNsName, addOrUpdateErr)
18321854
}
18331855

18341856
lbc.updateResourcesStatusAndEvents(resources, warnings, addOrUpdateErr)
18351857
}
18361858

1837-
func (lbc *LoadBalancerController) validationTLSSpecialSecret(secret *api_v1.Secret, secretName string, secretList *[]string) {
1838-
secretNsName := generateSecretNSName(secret)
1839-
1859+
func (lbc *LoadBalancerController) validationTLSSpecialSecret(secret *api_v1.Secret, secretName string, secretList *[]string) error {
18401860
err := secrets.ValidateTLSSecret(secret)
18411861
if err != nil {
1842-
nl.Errorf(lbc.Logger, "Couldn't validate the special Secret %v: %v", secretNsName, err)
1843-
lbc.recorder.Eventf(secret, api_v1.EventTypeWarning, "Rejected", "the special Secret %v was rejected, using the previous version: %v", secretNsName, err)
1844-
return
1862+
return err
18451863
}
18461864
*secretList = append(*secretList, secretName)
1865+
return nil
18471866
}
18481867

1849-
func (lbc *LoadBalancerController) handleSpecialSecretUpdate(secret *api_v1.Secret) {
1868+
func (lbc *LoadBalancerController) handleSpecialSecretUpdate(secret *api_v1.Secret, reload bool) {
18501869
var specialTLSSecretsToUpdate []string
18511870
secretNsName := generateSecretNSName(secret)
18521871

@@ -1860,6 +1879,12 @@ func (lbc *LoadBalancerController) handleSpecialSecretUpdate(secret *api_v1.Secr
18601879
return
18611880
}
18621881

1882+
// When the MGMT Configmap updates, we don't need to reload here, we are reloading in updateAllConfigs().
1883+
if !reload {
1884+
lbc.recorder.Eventf(lbc.metadata.pod, api_v1.EventTypeNormal, "SecretUpdated", "the special Secret %v was updated", secretNsName)
1885+
return
1886+
}
1887+
18631888
// reload nginx when the TLS special secrets are updated
18641889
switch secretNsName {
18651890
case lbc.specialSecrets.licenseSecret:
@@ -1881,7 +1906,7 @@ func (lbc *LoadBalancerController) handleSpecialSecretUpdate(secret *api_v1.Secr
18811906
}
18821907
}
18831908

1884-
lbc.recorder.Eventf(secret, api_v1.EventTypeNormal, "Updated", "the special Secret %v was updated", secretNsName)
1909+
lbc.recorder.Eventf(lbc.metadata.pod, api_v1.EventTypeNormal, "SecretUpdated", "the special Secret %v was updated", secretNsName)
18851910
}
18861911

18871912
// writeSpecialSecrets generates content and writes the secret to disk
@@ -1904,10 +1929,20 @@ func (lbc *LoadBalancerController) writeSpecialSecrets(secret *api_v1.Secret, se
19041929

19051930
func (lbc *LoadBalancerController) specialSecretValidation(secretNsName string, secret *api_v1.Secret, specialTLSSecretsToUpdate *[]string) bool {
19061931
if secretNsName == lbc.specialSecrets.defaultServerSecret {
1907-
lbc.validationTLSSpecialSecret(secret, configs.DefaultServerSecretFileName, specialTLSSecretsToUpdate)
1932+
err := lbc.validationTLSSpecialSecret(secret, configs.DefaultServerSecretFileName, specialTLSSecretsToUpdate)
1933+
if err != nil {
1934+
nl.Errorf(lbc.Logger, "Couldn't validate the special Secret %v: %v", secretNsName, err)
1935+
lbc.recorder.Eventf(lbc.metadata.pod, api_v1.EventTypeWarning, "Rejected", "the special Secret %v was rejected, using the previous version: %v", secretNsName, err)
1936+
return false
1937+
}
19081938
}
19091939
if secretNsName == lbc.specialSecrets.wildcardTLSSecret {
1910-
lbc.validationTLSSpecialSecret(secret, configs.WildcardSecretFileName, specialTLSSecretsToUpdate)
1940+
err := lbc.validationTLSSpecialSecret(secret, configs.WildcardSecretFileName, specialTLSSecretsToUpdate)
1941+
if err != nil {
1942+
nl.Errorf(lbc.Logger, "Couldn't validate the special Secret %v: %v", secretNsName, err)
1943+
lbc.recorder.Eventf(lbc.metadata.pod, api_v1.EventTypeWarning, "Rejected", "the special Secret %v was rejected, using the previous version: %v", secretNsName, err)
1944+
return false
1945+
}
19111946
}
19121947
if secretNsName == lbc.specialSecrets.licenseSecret {
19131948
err := secrets.ValidateLicenseSecret(secret)
@@ -1926,7 +1961,12 @@ func (lbc *LoadBalancerController) specialSecretValidation(secretNsName string,
19261961
}
19271962
}
19281963
if secretNsName == lbc.specialSecrets.clientAuthSecret {
1929-
lbc.validationTLSSpecialSecret(secret, configs.ClientAuthCertSecretFileName, specialTLSSecretsToUpdate)
1964+
err := lbc.validationTLSSpecialSecret(secret, configs.ClientAuthCertSecretFileName, specialTLSSecretsToUpdate)
1965+
if err != nil {
1966+
nl.Errorf(lbc.Logger, "Couldn't validate the special Secret %v: %v", secretNsName, err)
1967+
lbc.recorder.Eventf(lbc.metadata.pod, api_v1.EventTypeWarning, "Rejected", "the special Secret %v was rejected, using the previous version: %v", secretNsName, err)
1968+
return false
1969+
}
19301970
}
19311971
return true
19321972
}

‎tests/data/mgmt-configmap-keys/plus-token-name-keys.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: nginx-config-mgmt
5+
namespace: nginx-ingress
6+
data:
7+
license-token-secret-name: "license-token-changed"

‎tests/requirements.txt‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -489,18 +489,18 @@ pluggy==1.5.0 \
489489
# via
490490
# -r requirements.txt
491491
# pytest
492-
protobuf==5.29.0 \
493-
--hash=sha256:0cd67a1e5c2d88930aa767f702773b2d054e29957432d7c6a18f8be02a07719a \
494-
--hash=sha256:0d10091d6d03537c3f902279fcf11e95372bdd36a79556311da0487455791b20 \
495-
--hash=sha256:17d128eebbd5d8aee80300aed7a43a48a25170af3337f6f1333d1fac2c6839ac \
496-
--hash=sha256:34a90cf30c908f47f40ebea7811f743d360e202b6f10d40c02529ebd84afc069 \
497-
--hash=sha256:445a0c02483869ed8513a585d80020d012c6dc60075f96fa0563a724987b1001 \
498-
--hash=sha256:6c3009e22717c6cc9e6594bb11ef9f15f669b19957ad4087214d69e08a213368 \
499-
--hash=sha256:85286a47caf63b34fa92fdc1fd98b649a8895db595cfa746c5286eeae890a0b1 \
500-
--hash=sha256:88c4af76a73183e21061881360240c0cdd3c39d263b4e8fb570aaf83348d608f \
501-
--hash=sha256:c931c61d0cc143a2e756b1e7f8197a508de5365efd40f83c907a9febf36e6b43 \
502-
--hash=sha256:e467f81fdd12ded9655cea3e9b83dc319d93b394ce810b556fb0f421d8613e86 \
503-
--hash=sha256:ea7fb379b257911c8c020688d455e8f74efd2f734b72dc1ea4b4d7e9fd1326f2
492+
protobuf==5.29.1 \
493+
--hash=sha256:012ce28d862ff417fd629285aca5d9772807f15ceb1a0dbd15b88f58c776c98c \
494+
--hash=sha256:027fbcc48cea65a6b17028510fdd054147057fa78f4772eb547b9274e5219331 \
495+
--hash=sha256:1fc55267f086dd4050d18ef839d7bd69300d0d08c2a53ca7df3920cc271a3c34 \
496+
--hash=sha256:22c1f539024241ee545cbcb00ee160ad1877975690b16656ff87dde107b5f110 \
497+
--hash=sha256:32600ddb9c2a53dedc25b8581ea0f1fd8ea04956373c0c07577ce58d312522e0 \
498+
--hash=sha256:50879eb0eb1246e3a5eabbbe566b44b10348939b7cc1b267567e8c3d07213853 \
499+
--hash=sha256:5a41deccfa5e745cef5c65a560c76ec0ed8e70908a67cc8f4da5fce588b50d57 \
500+
--hash=sha256:683be02ca21a6ffe80db6dd02c0b5b2892322c59ca57fd6c872d652cb80549cb \
501+
--hash=sha256:8ee1461b3af56145aca2800e6a3e2f928108c749ba8feccc6f5dd0062c410c0d \
502+
--hash=sha256:b5ba1d0e4c8a40ae0496d0e2ecfdbb82e1776928a205106d14ad6985a09ec155 \
503+
--hash=sha256:d473655e29c0c4bbf8b69e9a8fb54645bc289dead6d753b952e7aa660254ae18
504504
# via
505505
# -r requirements.txt
506506
# grpcio-tools
@@ -635,9 +635,9 @@ rsa==4.9 \
635635
# via
636636
# -r requirements.txt
637637
# google-auth
638-
six==1.16.0 \
639-
--hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \
640-
--hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
638+
six==1.17.0 \
639+
--hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
640+
--hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81
641641
# via
642642
# -r requirements.txt
643643
# kubernetes

‎tests/suite/test_mgmt_configmap_keys.py‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
import pytest
2+
from settings import TEST_DATA
3+
from suite.utils.resources_utils import (
4+
create_license,
5+
ensure_connection_to_public_endpoint,
6+
get_events_for_object,
7+
get_first_pod_name,
8+
get_reload_count,
9+
is_secret_present,
10+
replace_configmap_from_yaml,
11+
wait_before_test,
12+
)
13+
14+
15+
def assert_event(event_list, event_type, reason, message_substring):
16+
"""
17+
Assert that an event with specific type, reason, and message substring exists.
18+
19+
:param event_list: List of events
20+
:param event_type: 'Normal' or 'Warning'
21+
:param reason: Event reason
22+
:param message_substring: Substring expected in the event message
23+
"""
24+
for event in event_list:
25+
if event.type == event_type and event.reason == reason and message_substring in event.message:
26+
return
27+
assert (
28+
False
29+
), f"Expected event with type '{event_type}', reason '{reason}', and message containing '{message_substring}' not found."
30+
31+
32+
@pytest.mark.skip_for_nginx_oss
33+
@pytest.mark.ingresses
34+
@pytest.mark.smoke
35+
class TestMGMTConfigMap:
36+
@pytest.mark.parametrize(
37+
"ingress_controller",
38+
[
39+
pytest.param(
40+
{"extra_args": ["-enable-prometheus-metrics"]},
41+
)
42+
],
43+
indirect=["ingress_controller"],
44+
)
45+
def test_mgmt_configmap_events(
46+
self,
47+
cli_arguments,
48+
kube_apis,
49+
ingress_controller_prerequisites,
50+
ingress_controller,
51+
ingress_controller_endpoint,
52+
):
53+
ensure_connection_to_public_endpoint(
54+
ingress_controller_endpoint.public_ip,
55+
ingress_controller_endpoint.port,
56+
ingress_controller_endpoint.port_ssl,
57+
)
58+
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
59+
metrics_url = (
60+
f"http://{ingress_controller_endpoint.public_ip}:{ingress_controller_endpoint.metrics_port}/metrics"
61+
)
62+
63+
print("Step 1: get reload count")
64+
reload_count = get_reload_count(metrics_url)
65+
66+
wait_before_test(1)
67+
print(f"Step 1a: initial reload count is {reload_count}")
68+
69+
print("Step 2: create duplicate existing secret with new name")
70+
license_name = create_license(
71+
kube_apis.v1,
72+
ingress_controller_prerequisites.namespace,
73+
cli_arguments["plus-jwt"],
74+
license_token_name="license-token-changed",
75+
)
76+
assert is_secret_present(kube_apis.v1, license_name, ingress_controller_prerequisites.namespace)
77+
78+
print("Step 3: update the ConfigMap/license-token-secret-name to the new secret")
79+
replace_configmap_from_yaml(
80+
kube_apis.v1,
81+
"nginx-config-mgmt",
82+
ingress_controller_prerequisites.namespace,
83+
f"{TEST_DATA}/mgmt-configmap-keys/plus-token-name-keys.yaml",
84+
)
85+
86+
wait_before_test()
87+
88+
print("Step 4: check reload count has incremented")
89+
new_reload_count = get_reload_count(metrics_url)
90+
print(f"Step 4a: new reload count is {new_reload_count}")
91+
assert new_reload_count > reload_count
92+
93+
print("Step 5: check pod for SecretUpdated event")
94+
events = get_events_for_object(
95+
kube_apis.v1,
96+
ingress_controller_prerequisites.namespace,
97+
ic_pod_name,
98+
)
99+
100+
# Assert that the 'SecretUpdated' event is present
101+
assert_event(
102+
events,
103+
"Normal",
104+
"SecretUpdated",
105+
f"the special Secret {ingress_controller_prerequisites.namespace}/{license_name} was updated",
106+
)

‎tests/suite/test_rl_ingress.py‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ def test_ingress_rate_limit(self, kube_apis, annotations_setup, ingress_controll
119119
@pytest.mark.annotations
120120
@pytest.mark.parametrize("annotations_setup", ["standard-scaled", "mergeable-scaled"], indirect=True)
121121
class TestRateLimitIngressScaled:
122-
def test_ingress_rate_limit_sscaled(
122+
def test_ingress_rate_limit_scaled(
123123
self, kube_apis, annotations_setup, ingress_controller_prerequisites, test_namespace
124124
):
125125
"""
@@ -133,14 +133,20 @@ def test_ingress_rate_limit_sscaled(
133133
wait_before_test()
134134

135135
ic_pods = get_pod_list(kube_apis.v1, ns)
136-
for i in range(len(ic_pods)):
137-
conf = get_ingress_nginx_template_conf(
138-
kube_apis.v1,
139-
annotations_setup.namespace,
140-
annotations_setup.ingress_name,
141-
ic_pods[i].metadata.name,
142-
ingress_controller_prerequisites.namespace,
143-
)
144-
flag = ("rate=10r/s" in conf) or ("rate=13r/s" in conf)
145-
assert flag
136+
flag = False
137+
retries = 0
138+
while flag is False and retries < 10:
139+
retries += 1
140+
wait_before_test()
141+
for i in range(len(ic_pods)):
142+
conf = get_ingress_nginx_template_conf(
143+
kube_apis.v1,
144+
annotations_setup.namespace,
145+
annotations_setup.ingress_name,
146+
ic_pods[i].metadata.name,
147+
ingress_controller_prerequisites.namespace,
148+
)
149+
flag = ("rate=10r/s" in conf) or ("rate=13r/s" in conf)
150+
151+
assert flag
146152
scale_deployment(kube_apis.v1, kube_apis.apps_v1_api, "nginx-ingress", ns, 1)

0 commit comments

Comments
 (0)