Skip to content

Commit 1170634

Browse files
porthorianporthorian
committed
add support for secrets for backendtlspolicy
1 parent e553ce1 commit 1170634

File tree

12 files changed

+314
-103
lines changed

12 files changed

+314
-103
lines changed

‎.github/workflows/build.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -103,8 +103,8 @@ jobs:
103103
with:
104104
context: ${{ inputs.tag != '' && 'git' || 'workflow' }}
105105
images: |
106-
name=ghcr.io/nginxinc/nginx-gateway-fabric,enable=${{ inputs.image == 'ngf' && github.event_name != 'pull_request' }}
107-
name=ghcr.io/nginxinc/nginx-gateway-fabric/nginx,enable=${{ inputs.image == 'nginx' && github.event_name != 'pull_request' }}
106+
name=ghcr.io/${{ github.repository_owner }}/nginx-gateway-fabric,enable=${{ inputs.image == 'ngf' && github.event_name != 'pull_request' }}
107+
name=ghcr.io/${{ github.repository_owner }}/nginx-gateway-fabric/nginx,enable=${{ inputs.image == 'nginx' && github.event_name != 'pull_request' }}
108108
name=docker-mgmt.nginx.com/nginx-gateway-fabric/nginx-plus,enable=${{ inputs.image == 'plus' && github.event_name != 'pull_request' }}
109109
name=us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/nginx-gateway-fabric/nginx-plus,enable=${{ inputs.image == 'plus' && github.event_name != 'pull_request' }}
110110
name=localhost:5000/nginx-gateway-fabric/${{ inputs.image }}

‎internal/mode/static/state/change_processor_test.go‎

Lines changed: 85 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -422,6 +422,7 @@ var _ = Describe("ChangeProcessor", func() {
422422
var (
423423
gcUpdated *v1.GatewayClass
424424
diffNsTLSSecret, sameNsTLSSecret *apiv1.Secret
425+
diffNsTLSCert, sameNsTLSCert *graph.CertificateBundle
425426
hr1, hr1Updated, hr2 *v1.HTTPRoute
426427
gr1, gr1Updated, gr2 *v1.GRPCRoute
427428
tr1, tr1Updated, tr2 *v1alpha2.TLSRoute
@@ -592,8 +593,19 @@ var _ = Describe("ChangeProcessor", func() {
592593
apiv1.TLSPrivateKeyKey: key,
593594
},
594595
}
596+
sameNsTLSCert = graph.NewCertificateBundle(
597+
types.NamespacedName{Namespace: sameNsTLSSecret.Namespace, Name: sameNsTLSSecret.Name},
598+
"Secret",
599+
&graph.Certificate{
600+
TLSCert: cert,
601+
TLSPrivateKey: key,
602+
},
603+
)
595604

596605
diffNsTLSSecret = &apiv1.Secret{
606+
TypeMeta: metav1.TypeMeta{
607+
Kind: "Secret",
608+
},
597609
ObjectMeta: metav1.ObjectMeta{
598610
Name: "different-ns-tls-secret",
599611
Namespace: "cert-ns",
@@ -605,6 +617,15 @@ var _ = Describe("ChangeProcessor", func() {
605617
},
606618
}
607619

620+
diffNsTLSCert = graph.NewCertificateBundle(
621+
types.NamespacedName{Namespace: diffNsTLSSecret.Namespace, Name: diffNsTLSSecret.Name},
622+
"Secret",
623+
&graph.Certificate{
624+
TLSCert: cert,
625+
TLSPrivateKey: key,
626+
},
627+
)
628+
608629
gw1 = createGateway(
609630
"gateway-1",
610631
createHTTPListener(),
@@ -1155,6 +1176,14 @@ var _ = Describe("ChangeProcessor", func() {
11551176

11561177
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
11571178
Source: diffNsTLSSecret,
1179+
CertBundle: graph.NewCertificateBundle(
1180+
types.NamespacedName{Namespace: diffNsTLSSecret.Namespace, Name: diffNsTLSSecret.Name},
1181+
"Secret",
1182+
&graph.Certificate{
1183+
TLSCert: cert,
1184+
TLSPrivateKey: key,
1185+
},
1186+
),
11581187
}
11591188

11601189
expGraph.ReferencedServices = nil
@@ -1189,6 +1218,14 @@ var _ = Describe("ChangeProcessor", func() {
11891218

11901219
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
11911220
Source: diffNsTLSSecret,
1221+
CertBundle: graph.NewCertificateBundle(
1222+
types.NamespacedName{Namespace: diffNsTLSSecret.Namespace, Name: diffNsTLSSecret.Name},
1223+
"Secret",
1224+
&graph.Certificate{
1225+
TLSCert: cert,
1226+
TLSPrivateKey: key,
1227+
},
1228+
),
11921229
}
11931230

11941231
processAndValidateGraph(expGraph)
@@ -1209,6 +1246,14 @@ var _ = Describe("ChangeProcessor", func() {
12091246

12101247
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
12111248
Source: diffNsTLSSecret,
1249+
CertBundle: graph.NewCertificateBundle(
1250+
types.NamespacedName{Namespace: diffNsTLSSecret.Namespace, Name: diffNsTLSSecret.Name},
1251+
"Secret",
1252+
&graph.Certificate{
1253+
TLSCert: cert,
1254+
TLSPrivateKey: key,
1255+
},
1256+
),
12121257
}
12131258

12141259
processAndValidateGraph(expGraph)
@@ -1219,7 +1264,8 @@ var _ = Describe("ChangeProcessor", func() {
12191264
processor.CaptureUpsertChange(trServiceRefGrant)
12201265

12211266
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1222-
Source: diffNsTLSSecret,
1267+
Source: diffNsTLSSecret,
1268+
CertBundle: diffNsTLSCert,
12231269
}
12241270

12251271
processAndValidateGraph(expGraph)
@@ -1230,7 +1276,8 @@ var _ = Describe("ChangeProcessor", func() {
12301276
processor.CaptureUpsertChange(gatewayAPICRDUpdated)
12311277

12321278
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1233-
Source: diffNsTLSSecret,
1279+
Source: diffNsTLSSecret,
1280+
CertBundle: diffNsTLSCert,
12341281
}
12351282

12361283
expGraph.GatewayClass.Conditions = conditions.NewGatewayClassSupportedVersionBestEffort(
@@ -1247,7 +1294,8 @@ var _ = Describe("ChangeProcessor", func() {
12471294
processor.CaptureUpsertChange(gatewayAPICRDSameVersion)
12481295

12491296
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1250-
Source: diffNsTLSSecret,
1297+
Source: diffNsTLSSecret,
1298+
CertBundle: diffNsTLSCert,
12511299
}
12521300

12531301
expGraph.GatewayClass.Conditions = conditions.NewGatewayClassSupportedVersionBestEffort(
@@ -1266,7 +1314,8 @@ var _ = Describe("ChangeProcessor", func() {
12661314
processor.CaptureUpsertChange(gatewayAPICRD)
12671315

12681316
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1269-
Source: diffNsTLSSecret,
1317+
Source: diffNsTLSSecret,
1318+
CertBundle: diffNsTLSCert,
12701319
}
12711320

12721321
processAndValidateGraph(expGraph)
@@ -1282,7 +1331,8 @@ var _ = Describe("ChangeProcessor", func() {
12821331
listener80 := getListenerByName(expGraph.Gateway, httpListenerName)
12831332
listener80.Routes[httpRouteKey1].Source.SetGeneration(hr1Updated.Generation)
12841333
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1285-
Source: diffNsTLSSecret,
1334+
Source: diffNsTLSSecret,
1335+
CertBundle: diffNsTLSCert,
12861336
}
12871337

12881338
processAndValidateGraph(expGraph)
@@ -1299,7 +1349,8 @@ var _ = Describe("ChangeProcessor", func() {
12991349
listener80 := getListenerByName(expGraph.Gateway, httpListenerName)
13001350
listener80.Routes[grpcRouteKey1].Source.SetGeneration(gr1Updated.Generation)
13011351
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1302-
Source: diffNsTLSSecret,
1352+
Source: diffNsTLSSecret,
1353+
CertBundle: diffNsTLSCert,
13031354
}
13041355

13051356
processAndValidateGraph(expGraph)
@@ -1313,7 +1364,8 @@ var _ = Describe("ChangeProcessor", func() {
13131364
tlsListener.L4Routes[trKey1].Source.SetGeneration(tr1Updated.Generation)
13141365

13151366
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1316-
Source: diffNsTLSSecret,
1367+
Source: diffNsTLSSecret,
1368+
CertBundle: diffNsTLSCert,
13171369
}
13181370

13191371
processAndValidateGraph(expGraph)
@@ -1325,7 +1377,8 @@ var _ = Describe("ChangeProcessor", func() {
13251377

13261378
expGraph.Gateway.Source.Generation = gw1Updated.Generation
13271379
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1328-
Source: diffNsTLSSecret,
1380+
Source: diffNsTLSSecret,
1381+
CertBundle: diffNsTLSCert,
13291382
}
13301383

13311384
processAndValidateGraph(expGraph)
@@ -1337,7 +1390,8 @@ var _ = Describe("ChangeProcessor", func() {
13371390

13381391
expGraph.GatewayClass.Source.Generation = gcUpdated.Generation
13391392
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1340-
Source: diffNsTLSSecret,
1393+
Source: diffNsTLSSecret,
1394+
CertBundle: diffNsTLSCert,
13411395
}
13421396

13431397
processAndValidateGraph(expGraph)
@@ -1348,7 +1402,8 @@ var _ = Describe("ChangeProcessor", func() {
13481402
processor.CaptureUpsertChange(diffNsTLSSecret)
13491403

13501404
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1351-
Source: diffNsTLSSecret,
1405+
Source: diffNsTLSSecret,
1406+
CertBundle: diffNsTLSCert,
13521407
}
13531408

13541409
processAndValidateGraph(expGraph)
@@ -1357,7 +1412,8 @@ var _ = Describe("ChangeProcessor", func() {
13571412
When("no changes are captured", func() {
13581413
It("returns nil graph", func() {
13591414
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1360-
Source: diffNsTLSSecret,
1415+
Source: diffNsTLSSecret,
1416+
CertBundle: diffNsTLSCert,
13611417
}
13621418

13631419
changed, graphCfg := processor.Process()
@@ -1371,7 +1427,8 @@ var _ = Describe("ChangeProcessor", func() {
13711427
processor.CaptureUpsertChange(sameNsTLSSecret)
13721428

13731429
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1374-
Source: diffNsTLSSecret,
1430+
Source: diffNsTLSSecret,
1431+
CertBundle: diffNsTLSCert,
13751432
}
13761433

13771434
changed, graphCfg := processor.Process()
@@ -1388,7 +1445,8 @@ var _ = Describe("ChangeProcessor", func() {
13881445
{Namespace: "test", Name: "gateway-2"}: gw2,
13891446
}
13901447
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1391-
Source: diffNsTLSSecret,
1448+
Source: diffNsTLSSecret,
1449+
CertBundle: diffNsTLSCert,
13921450
}
13931451

13941452
processAndValidateGraph(expGraph)
@@ -1411,7 +1469,8 @@ var _ = Describe("ChangeProcessor", func() {
14111469
FailedCondition: staticConds.NewRouteNotAcceptedGatewayIgnored(),
14121470
}
14131471
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1414-
Source: diffNsTLSSecret,
1472+
Source: diffNsTLSSecret,
1473+
CertBundle: diffNsTLSCert,
14151474
}
14161475

14171476
processAndValidateGraph(expGraph)
@@ -1445,7 +1504,8 @@ var _ = Describe("ChangeProcessor", func() {
14451504
}
14461505

14471506
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1448-
Source: diffNsTLSSecret,
1507+
Source: diffNsTLSSecret,
1508+
CertBundle: diffNsTLSCert,
14491509
}
14501510

14511511
processAndValidateGraph(expGraph)
@@ -1485,7 +1545,8 @@ var _ = Describe("ChangeProcessor", func() {
14851545
}
14861546

14871547
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(diffNsTLSSecret)] = &graph.Secret{
1488-
Source: diffNsTLSSecret,
1548+
Source: diffNsTLSSecret,
1549+
CertBundle: diffNsTLSCert,
14891550
}
14901551

14911552
processAndValidateGraph(expGraph)
@@ -1532,7 +1593,8 @@ var _ = Describe("ChangeProcessor", func() {
15321593
sameNsTLSSecretRef := helpers.GetPointer(client.ObjectKeyFromObject(sameNsTLSSecret))
15331594
listener443.ResolvedSecret = sameNsTLSSecretRef
15341595
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(sameNsTLSSecret)] = &graph.Secret{
1535-
Source: sameNsTLSSecret,
1596+
Source: sameNsTLSSecret,
1597+
CertBundle: sameNsTLSCert,
15361598
}
15371599

15381600
delete(expGraph.ReferencedServices, expRouteHR1.Spec.Rules[0].BackendRefs[0].SvcNsName)
@@ -1583,7 +1645,8 @@ var _ = Describe("ChangeProcessor", func() {
15831645
sameNsTLSSecretRef := helpers.GetPointer(client.ObjectKeyFromObject(sameNsTLSSecret))
15841646
listener443.ResolvedSecret = sameNsTLSSecretRef
15851647
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(sameNsTLSSecret)] = &graph.Secret{
1586-
Source: sameNsTLSSecret,
1648+
Source: sameNsTLSSecret,
1649+
CertBundle: sameNsTLSCert,
15871650
}
15881651

15891652
delete(expGraph.ReferencedServices, expRouteHR1.Spec.Rules[0].BackendRefs[0].SvcNsName)
@@ -1627,7 +1690,8 @@ var _ = Describe("ChangeProcessor", func() {
16271690
sameNsTLSSecretRef := helpers.GetPointer(client.ObjectKeyFromObject(sameNsTLSSecret))
16281691
listener443.ResolvedSecret = sameNsTLSSecretRef
16291692
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(sameNsTLSSecret)] = &graph.Secret{
1630-
Source: sameNsTLSSecret,
1693+
Source: sameNsTLSSecret,
1694+
CertBundle: sameNsTLSCert,
16311695
}
16321696

16331697
delete(expGraph.ReferencedServices, expRouteHR1.Spec.Rules[0].BackendRefs[0].SvcNsName)
@@ -1668,7 +1732,8 @@ var _ = Describe("ChangeProcessor", func() {
16681732
sameNsTLSSecretRef := helpers.GetPointer(client.ObjectKeyFromObject(sameNsTLSSecret))
16691733
listener443.ResolvedSecret = sameNsTLSSecretRef
16701734
expGraph.ReferencedSecrets[client.ObjectKeyFromObject(sameNsTLSSecret)] = &graph.Secret{
1671-
Source: sameNsTLSSecret,
1735+
Source: sameNsTLSSecret,
1736+
CertBundle: sameNsTLSCert,
16721737
}
16731738

16741739
expRouteHR1.Spec.Rules[0].BackendRefs[0].SvcNsName = types.NamespacedName{}

‎internal/mode/static/state/dataplane/configuration.go‎

Lines changed: 40 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -58,12 +58,14 @@ func BuildConfiguration(
5858
BackendGroups: backendGroups,
5959
SSLKeyPairs: buildSSLKeyPairs(g.ReferencedSecrets, g.Gateway.Listeners),
6060
Version: configVersion,
61-
CertBundles: buildCertBundles(g.ReferencedCaCertConfigMaps, backendGroups),
62-
Telemetry: buildTelemetry(g),
63-
BaseHTTPConfig: baseHTTPConfig,
64-
Logging: buildLogging(g),
65-
MainSnippets: buildSnippetsForContext(g.SnippetsFilters, ngfAPI.NginxContextMain),
66-
AuxiliarySecrets: buildAuxiliarySecrets(g.PlusSecrets),
61+
CertBundles: buildCertBundles(
62+
buildRefCertificateBundles(g.ReferencedSecrets, g.ReferencedCaCertConfigMaps),
63+
backendGroups),
64+
Telemetry: buildTelemetry(g),
65+
BaseHTTPConfig: baseHTTPConfig,
66+
Logging: buildLogging(g),
67+
MainSnippets: buildSnippetsForContext(g.SnippetsFilters, ngfAPI.NginxContextMain),
68+
AuxiliarySecrets: buildAuxiliarySecrets(g.PlusSecrets),
6769
}
6870

6971
return config
@@ -224,8 +226,28 @@ func buildSSLKeyPairs(
224226
return keyPairs
225227
}
226228

229+
func buildRefCertificateBundles(
230+
secrets map[types.NamespacedName]*graph.Secret,
231+
configMaps map[types.NamespacedName]*graph.CaCertConfigMap) []graph.CertificateBundle {
232+
bundles := []graph.CertificateBundle{}
233+
234+
for _, secret := range secrets {
235+
if secret.CertBundle != nil {
236+
bundles = append(bundles, *secret.CertBundle)
237+
}
238+
}
239+
240+
for _, configMap := range configMaps {
241+
if configMap.CertBundle != nil {
242+
bundles = append(bundles, *configMap.CertBundle)
243+
}
244+
}
245+
246+
return bundles
247+
}
248+
227249
func buildCertBundles(
228-
caCertConfigMaps map[types.NamespacedName]*graph.CaCertConfigMap,
250+
refCertBundles []graph.CertificateBundle,
229251
backendGroups []BackendGroup,
230252
) map[CertBundleID]CertBundle {
231253
bundles := make(map[CertBundleID]CertBundle)
@@ -247,18 +269,16 @@ func buildCertBundles(
247269
}
248270
}
249271

250-
for cmName, cm := range caCertConfigMaps {
251-
id := generateCertBundleID(cmName)
272+
for _, bundle := range refCertBundles {
273+
id := generateCertBundleID(bundle.Name)
252274
if _, exists := refByBG[id]; exists {
253-
if cm.CACert != nil || len(cm.CACert) > 0 {
254-
// the cert could be base64 encoded or plaintext
255-
data := make([]byte, base64.StdEncoding.DecodedLen(len(cm.CACert)))
256-
_, err := base64.StdEncoding.Decode(data, cm.CACert)
257-
if err != nil {
258-
data = cm.CACert
259-
}
260-
bundles[id] = data
275+
// the cert could be base64 encoded or plaintext
276+
data := make([]byte, base64.StdEncoding.DecodedLen(len(bundle.Cert.CACert)))
277+
_, err := base64.StdEncoding.Decode(data, bundle.Cert.CACert)
278+
if err != nil {
279+
data = bundle.Cert.CACert
261280
}
281+
bundles[id] = data
262282
}
263283
}
264284

@@ -766,11 +786,11 @@ func generateSSLKeyPairID(secret types.NamespacedName) SSLKeyPairID {
766786
return SSLKeyPairID(fmt.Sprintf("ssl_keypair_%s_%s", secret.Namespace, secret.Name))
767787
}
768788

769-
// generateCertBundleID generates an ID for the certificate bundle based on the ConfigMap namespaced name.
789+
// generateCertBundleID generates an ID for the certificate bundle based on the ConfigMap/Secret namespaced name.
770790
// It is guaranteed to be unique per unique namespaced name.
771791
// The ID is safe to use as a file name.
772-
func generateCertBundleID(configMap types.NamespacedName) CertBundleID {
773-
return CertBundleID(fmt.Sprintf("cert_bundle_%s_%s", configMap.Namespace, configMap.Name))
792+
func generateCertBundleID(caCertRef types.NamespacedName) CertBundleID {
793+
return CertBundleID(fmt.Sprintf("cert_bundle_%s_%s", caCertRef.Namespace, caCertRef.Name))
774794
}
775795

776796
// buildTelemetry generates the Otel configuration.

0 commit comments

Comments
 (0)