adding support for secrets for backendtlspolicy

Author: porthorian

internal/mode/static/state/dataplane/configuration.go

@@ -766,11 +766,11 @@ func generateSSLKeyPairID(secret types.NamespacedName) SSLKeyPairID {
 	return SSLKeyPairID(fmt.Sprintf("ssl_keypair_%s_%s", secret.Namespace, secret.Name))
 }
 
-// generateCertBundleID generates an ID for the certificate bundle based on the ConfigMap namespaced name.
+// generateCertBundleID generates an ID for the certificate bundle based on the ConfigMap/Secret namespaced name.
 // It is guaranteed to be unique per unique namespaced name.
 // The ID is safe to use as a file name.
-func generateCertBundleID(configMap types.NamespacedName) CertBundleID {
-	return CertBundleID(fmt.Sprintf("cert_bundle_%s_%s", configMap.Namespace, configMap.Name))
+func generateCertBundleID(caCertRef types.NamespacedName) CertBundleID {
+	return CertBundleID(fmt.Sprintf("cert_bundle_%s_%s", caCertRef.Namespace, caCertRef.Name))
 }
 
 // buildTelemetry generates the Otel configuration.

internal/mode/static/state/graph/backend_tls_policy.go

@@ -2,9 +2,11 @@ package graph
 
 import (
 	"fmt"
+	"slices"
 
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/validation/field"
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
 	"sigs.k8s.io/gateway-api/apis/v1alpha3"
 
 	"github.com/nginxinc/nginx-gateway-fabric/internal/framework/conditions"
@@ -31,6 +33,7 @@ type BackendTLSPolicy struct {
 func processBackendTLSPolicies(
 	backendTLSPolicies map[types.NamespacedName]*v1alpha3.BackendTLSPolicy,
 	configMapResolver *configMapResolver,
+	secretResolver *secretResolver,
 	ctlrName string,
 	gateway *Gateway,
 ) map[types.NamespacedName]*BackendTLSPolicy {
@@ -42,7 +45,7 @@ func processBackendTLSPolicies(
 	for nsname, backendTLSPolicy := range backendTLSPolicies {
 		var caCertRef types.NamespacedName
 
-		valid, ignored, conds := validateBackendTLSPolicy(backendTLSPolicy, configMapResolver, ctlrName)
+		valid, ignored, conds := validateBackendTLSPolicy(backendTLSPolicy, configMapResolver, secretResolver, ctlrName)
 
 		if valid && !ignored && backendTLSPolicy.Spec.Validation.CACertificateRefs != nil {
 			caCertRef = types.NamespacedName{
@@ -68,6 +71,7 @@ func processBackendTLSPolicies(
 func validateBackendTLSPolicy(
 	backendTLSPolicy *v1alpha3.BackendTLSPolicy,
 	configMapResolver *configMapResolver,
+	secretResolver *secretResolver,
 	ctlrName string,
 ) (valid, ignored bool, conds []conditions.Condition) {
 	valid = true
@@ -93,7 +97,7 @@ func validateBackendTLSPolicy(
 		conds = append(conds, staticConds.NewPolicyInvalid(msg))
 
 	case len(caCertRefs) > 0:
-		if err := validateBackendTLSCACertRef(backendTLSPolicy, configMapResolver); err != nil {
+		if err := validateBackendTLSCACertRef(backendTLSPolicy, configMapResolver, secretResolver); err != nil {
 			valid = false
 			conds = append(conds, staticConds.NewPolicyInvalid(
 				fmt.Sprintf("invalid CACertificateRef: %s", err.Error())))
@@ -124,30 +128,42 @@ func validateBackendTLSHostname(btp *v1alpha3.BackendTLSPolicy) error {
 	return nil
 }
 
-func validateBackendTLSCACertRef(btp *v1alpha3.BackendTLSPolicy, configMapResolver *configMapResolver) error {
+func validateBackendTLSCACertRef(btp *v1alpha3.BackendTLSPolicy, configMapResolver *configMapResolver, secretResolver *secretResolver) error {
 	if len(btp.Spec.Validation.CACertificateRefs) != 1 {
 		path := field.NewPath("tls.cacertrefs")
 		valErr := field.TooMany(path, len(btp.Spec.Validation.CACertificateRefs), 1)
 		return valErr
 	}
-	if btp.Spec.Validation.CACertificateRefs[0].Kind != "ConfigMap" {
+
+	selectedCertRef := btp.Spec.Validation.CACertificateRefs[0]
+	allowedCaCertKinds := []v1.Kind{"ConfigMap", "Secret"}
+
+	if slices.Contains(allowedCaCertKinds, selectedCertRef.Kind) {
 		path := field.NewPath("tls.cacertrefs[0].kind")
-		valErr := field.NotSupported(path, btp.Spec.Validation.CACertificateRefs[0].Kind, []string{"ConfigMap"})
+		valErr := field.NotSupported(path, btp.Spec.Validation.CACertificateRefs[0].Kind, allowedCaCertKinds)
 		return valErr
 	}
-	if btp.Spec.Validation.CACertificateRefs[0].Group != "" &&
-		btp.Spec.Validation.CACertificateRefs[0].Group != "core" {
+	if selectedCertRef.Group != "" &&
+		selectedCertRef.Group != "core" {
 		path := field.NewPath("tls.cacertrefs[0].group")
-		valErr := field.NotSupported(path, btp.Spec.Validation.CACertificateRefs[0].Group, []string{"", "core"})
+		valErr := field.NotSupported(path, selectedCertRef.Group, []string{"", "core"})
 		return valErr
 	}
 	nsName := types.NamespacedName{
 		Namespace: btp.Namespace,
-		Name:      string(btp.Spec.Validation.CACertificateRefs[0].Name),
+		Name:      string(selectedCertRef.Name),
 	}
-	if err := configMapResolver.resolve(nsName); err != nil {
-		path := field.NewPath("tls.cacertrefs[0]")
-		return field.Invalid(path, btp.Spec.Validation.CACertificateRefs[0], err.Error())
+
+	if selectedCertRef.Kind == "ConfigMap" {
+		if err := configMapResolver.resolve(nsName); err != nil {
+			path := field.NewPath("tls.cacertrefs[0]")
+			return field.Invalid(path, selectedCertRef, err.Error())
+		}
+	} else if selectedCertRef.Kind == "Secret" {
+		if err := secretResolver.resolve(nsName); err != nil {
+			path := field.NewPath("tls.cacertrefs[0]")
+			return field.Invalid(path, selectedCertRef, err.Error())
+		}
 	}
 	return nil
 }

internal/mode/static/state/graph/backend_tls_policy_test.go

@@ -75,7 +75,7 @@ func TestProcessBackendTLSPoliciesEmpty(t *testing.T) {
 			t.Parallel()
 			g := NewWithT(t)
 
-			processed := processBackendTLSPolicies(test.backendTLSPolicies, nil, "test", test.gateway)
+			processed := processBackendTLSPolicies(test.backendTLSPolicies, nil, nil, "test", test.gateway)
 
 			g.Expect(processed).To(Equal(test.expected))
 		})
@@ -404,13 +404,31 @@ func TestValidateBackendTLSPolicy(t *testing.T) {
 		},
 	}
 
+	secretMaps := map[types.NamespacedName]*v1.Secret{
+		{Namespace: "test", Name: "test-secret"}: {
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "test-secret",
+				Namespace: "test",
+			},
+			// FILL IN
+		},
+		{Namespace: "test", Name: "invalid-secret"}: {
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "invalid-secret",
+				Namespace: "test",
+			},
+		},
+		// FILL IN
+	}
+
 	configMapResolver := newConfigMapResolver(configMaps)
+	secretMapResolver := newSecretResolver(secretMaps)
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			g := NewWithT(t)
 
-			valid, ignored, conds := validateBackendTLSPolicy(test.tlsPolicy, configMapResolver, "test")
+			valid, ignored, conds := validateBackendTLSPolicy(test.tlsPolicy, configMapResolver, secretMapResolver, "test")
 
 			g.Expect(valid).To(Equal(test.isValid))
 			g.Expect(ignored).To(Equal(test.ignored))

internal/mode/static/state/graph/graph.go

@@ -59,7 +59,7 @@ type Graph struct {
 	Routes map[RouteKey]*L7Route
 	// L4Routes hold L4Route resources.
 	L4Routes map[L4RouteKey]*L4Route
-	// ReferencedSecrets includes Secrets referenced by Gateway Listeners, including invalid ones.
+	// ReferencedSecrets includes Secrets referenced by Gateway Listeners or BackendTLSPolicies, including invalid ones.
 	// It is different from the other maps, because it includes entries for Secrets that do not exist
 	// in the cluster. We need such entries so that we can query the Graph to determine if a Secret is referenced
 	// by the Gateway, including the case when the Secret is newly created.
@@ -230,6 +230,7 @@ func BuildGraph(
 	processedBackendTLSPolicies := processBackendTLSPolicies(
 		state.BackendTLSPolicies,
 		configMapResolver,
+		secretResolver,
 		controllerName,
 		gw,
 	)