Skip to content

Commit a5f6377

Browse files
author
Jeff Bornemann
committed
Namespace can be specified within TLS secret annotations
1 parent f877383 commit a5f6377

File tree

3 files changed

+128
-49
lines changed

3 files changed

+128
-49
lines changed

‎pkg/cloudprovider/providers/oci/load_balancer.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -321,7 +321,7 @@ func (cp *CloudProvider) EnsureLoadBalancer(ctx context.Context, clusterName str
321321
}
322322
secretListenerString := service.Annotations[ServiceAnnotationLoadBalancerTLSSecret]
323323
secretBackendSetString := service.Annotations[ServiceAnnotationLoadBalancerTLSBackendSetSecret]
324-
sslConfig = NewSSLConfig(secretListenerString, secretBackendSetString, ports, cp)
324+
sslConfig = NewSSLConfig(secretListenerString, secretBackendSetString, service, ports, cp)
325325
}
326326
var subnets []string
327327
if cp.config.LoadBalancer.Subnet2 != "" {

‎pkg/cloudprovider/providers/oci/load_balancer_spec.go‎

Lines changed: 47 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,13 @@ func (ssr noopSSLSecretReader) readSSLSecret(ns, name string) (sslSecret *certif
4949

5050
// SSLConfig is a description of a SSL certificate.
5151
type SSLConfig struct {
52-
Ports sets.Int
53-
ListenerSSLSecretName string
54-
BackendSetSSLSecretName string
52+
Ports sets.Int
53+
54+
ListenerSSLSecretName string
55+
ListenerSSLSecretNamespace string
56+
57+
BackendSetSSLSecretName string
58+
BackendSetSSLSecretNamespace string
5559

5660
sslSecretReader
5761
}
@@ -62,15 +66,21 @@ func requiresCertificate(svc *v1.Service) bool {
6266
}
6367

6468
// NewSSLConfig constructs a new SSLConfig.
65-
func NewSSLConfig(listenerSecretName, backendSetSecretName string, ports []int, ssr sslSecretReader) *SSLConfig {
69+
func NewSSLConfig(secretListenerString string, secretBackendSetString string, service *v1.Service, ports []int, ssr sslSecretReader) *SSLConfig {
6670
if ssr == nil {
6771
ssr = noopSSLSecretReader{}
6872
}
73+
74+
listenerSecretName, listenerSecretNamespace := getSecretParts(secretListenerString, service)
75+
backendSecretName, backendSecretNamespace := getSecretParts(secretBackendSetString, service)
76+
6977
return &SSLConfig{
70-
Ports: sets.NewInt(ports...),
71-
ListenerSSLSecretName: listenerSecretName,
72-
BackendSetSSLSecretName: backendSetSecretName,
73-
sslSecretReader: ssr,
78+
Ports: sets.NewInt(ports...),
79+
ListenerSSLSecretName: listenerSecretName,
80+
ListenerSSLSecretNamespace: listenerSecretNamespace,
81+
BackendSetSSLSecretName: backendSecretName,
82+
BackendSetSSLSecretNamespace: backendSecretNamespace,
83+
sslSecretReader: ssr,
7484
}
7585
}
7686

@@ -172,25 +182,32 @@ func NewLBSpec(svc *v1.Service, nodes []*v1.Node, defaultSubnets []string, sslCo
172182
// Certificates builds a map of required SSL certificates.
173183
func (s *LBSpec) Certificates() (map[string]loadbalancer.CertificateDetails, error) {
174184
certs := make(map[string]loadbalancer.CertificateDetails)
185+
175186
if s.SSLConfig == nil {
176187
return certs, nil
177188
}
178-
secrets := make([]string, 0, 2)
189+
179190
if s.SSLConfig.ListenerSSLSecretName != "" {
180-
secrets = append(secrets, s.SSLConfig.ListenerSSLSecretName)
181-
}
182-
if s.SSLConfig.BackendSetSSLSecretName != "" {
183-
secrets = append(secrets, s.SSLConfig.BackendSetSSLSecretName)
191+
cert, err := s.SSLConfig.readSSLSecret(s.SSLConfig.ListenerSSLSecretNamespace, s.SSLConfig.ListenerSSLSecretName)
192+
if err != nil {
193+
return nil, errors.Wrap(err, "reading SSL Listener Secret")
194+
}
195+
certs[s.SSLConfig.ListenerSSLSecretName] = loadbalancer.CertificateDetails{
196+
CertificateName: &s.SSLConfig.ListenerSSLSecretName,
197+
CaCertificate: common.String(string(cert.CACert)),
198+
PublicCertificate: common.String(string(cert.PublicCert)),
199+
PrivateKey: common.String(string(cert.PrivateKey)),
200+
Passphrase: common.String(string(cert.Passphrase)),
201+
}
184202
}
185203

186-
for idx, name := range secrets {
187-
cert, err := s.SSLConfig.readSSLSecret(s.service.Namespace, name)
204+
if s.SSLConfig.BackendSetSSLSecretName != "" {
205+
cert, err := s.SSLConfig.readSSLSecret(s.SSLConfig.BackendSetSSLSecretNamespace, s.SSLConfig.BackendSetSSLSecretName)
188206
if err != nil {
189-
return nil, errors.Wrap(err, "reading SSL BackendSet Secret")
207+
return nil, errors.Wrap(err, "reading SSL Backend Secret")
190208
}
191-
192-
certs[name] = loadbalancer.CertificateDetails{
193-
CertificateName: &secrets[idx],
209+
certs[s.SSLConfig.BackendSetSSLSecretName] = loadbalancer.CertificateDetails{
210+
CertificateName: &s.SSLConfig.BackendSetSSLSecretName,
194211
CaCertificate: common.String(string(cert.CACert)),
195212
PublicCertificate: common.String(string(cert.PublicCert)),
196213
PrivateKey: common.String(string(cert.PrivateKey)),
@@ -374,3 +391,14 @@ func getListeners(svc *v1.Service, sslCfg *SSLConfig) (map[string]loadbalancer.L
374391

375392
return listeners, nil
376393
}
394+
395+
func getSecretParts(secretString string, service *v1.Service) (name string, namespace string) {
396+
if secretString == "" {
397+
return "", ""
398+
}
399+
if !strings.Contains(secretString, "/") {
400+
return secretString, service.Namespace
401+
}
402+
parts := strings.Split(secretString, "/")
403+
return parts[1], parts[0]
404+
}

‎pkg/cloudprovider/providers/oci/load_balancer_spec_test.go‎

Lines changed: 80 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -790,44 +790,92 @@ func TestNewLBSpecFailure(t *testing.T) {
790790

791791
func TestNewSSLConfig(t *testing.T) {
792792
testCases := map[string]struct {
793-
listenerSecretName string
794-
backendSetSecretName string
795-
ports []int
796-
ssr sslSecretReader
793+
secretListenerString string
794+
secretBackendSetString string
795+
service *v1.Service
796+
ports []int
797+
ssr sslSecretReader
797798

798799
expectedResult *SSLConfig
799800
}{
800-
"noopSSLSecretReader if ssr is nil": {
801-
listenerSecretName: "listenerSecretName",
802-
backendSetSecretName: "backendSetSecretName",
803-
ports: []int{8080},
804-
ssr: nil,
801+
"noopSSLSecretReader if ssr is nil and uses the default service namespace": {
802+
secretListenerString: "listenerSecretName",
803+
secretBackendSetString: "backendSetSecretName",
804+
service: &v1.Service{
805+
ObjectMeta: metav1.ObjectMeta{
806+
Namespace: "default",
807+
},
808+
},
809+
ports: []int{8080},
810+
ssr: nil,
805811

806812
expectedResult: &SSLConfig{
807-
Ports: sets.NewInt(8080),
808-
ListenerSSLSecretName: "listenerSecretName",
809-
BackendSetSSLSecretName: "backendSetSecretName",
810-
sslSecretReader: noopSSLSecretReader{},
813+
Ports: sets.NewInt(8080),
814+
ListenerSSLSecretName: "listenerSecretName",
815+
ListenerSSLSecretNamespace: "default",
816+
BackendSetSSLSecretName: "backendSetSecretName",
817+
BackendSetSSLSecretNamespace: "default",
818+
sslSecretReader: noopSSLSecretReader{},
811819
},
812820
},
813-
"ssr is assigned if provided": {
814-
listenerSecretName: "listenerSecretName",
815-
backendSetSecretName: "backendSetSecretName",
816-
ports: []int{8080},
817-
ssr: &mockSSLSecretReader{},
821+
"ssr is assigned if provided and uses the default service namespace": {
822+
secretListenerString: "listenerSecretName",
823+
secretBackendSetString: "backendSetSecretName",
824+
service: &v1.Service{
825+
ObjectMeta: metav1.ObjectMeta{
826+
Namespace: "default",
827+
},
828+
},
829+
ports: []int{8080},
830+
ssr: &mockSSLSecretReader{},
818831

819832
expectedResult: &SSLConfig{
820-
Ports: sets.NewInt(8080),
821-
ListenerSSLSecretName: "listenerSecretName",
822-
BackendSetSSLSecretName: "backendSetSecretName",
823-
sslSecretReader: &mockSSLSecretReader{},
833+
Ports: sets.NewInt(8080),
834+
ListenerSSLSecretName: "listenerSecretName",
835+
ListenerSSLSecretNamespace: "default",
836+
BackendSetSSLSecretName: "backendSetSecretName",
837+
BackendSetSSLSecretNamespace: "default",
838+
sslSecretReader: &mockSSLSecretReader{},
839+
},
840+
},
841+
"If namespace is specified in secret string, use it": {
842+
secretListenerString: "namespaceone/listenerSecretName",
843+
secretBackendSetString: "namespacetwo/backendSetSecretName",
844+
service: &v1.Service{
845+
ObjectMeta: metav1.ObjectMeta{
846+
Namespace: "default",
847+
},
848+
},
849+
ports: []int{8080},
850+
ssr: &mockSSLSecretReader{},
851+
852+
expectedResult: &SSLConfig{
853+
Ports: sets.NewInt(8080),
854+
ListenerSSLSecretName: "listenerSecretName",
855+
ListenerSSLSecretNamespace: "namespaceone",
856+
BackendSetSSLSecretName: "backendSetSecretName",
857+
BackendSetSSLSecretNamespace: "namespacetwo",
858+
sslSecretReader: &mockSSLSecretReader{},
859+
},
860+
},
861+
"Empty secret string results in empty name and namespace": {
862+
ports: []int{8080},
863+
ssr: &mockSSLSecretReader{},
864+
865+
expectedResult: &SSLConfig{
866+
Ports: sets.NewInt(8080),
867+
ListenerSSLSecretName: "",
868+
ListenerSSLSecretNamespace: "",
869+
BackendSetSSLSecretName: "",
870+
BackendSetSSLSecretNamespace: "",
871+
sslSecretReader: &mockSSLSecretReader{},
824872
},
825873
},
826874
}
827875

828876
for name, tc := range testCases {
829877
t.Run(name, func(t *testing.T) {
830-
result := NewSSLConfig(tc.listenerSecretName, tc.backendSetSecretName, tc.ports, tc.ssr)
878+
result := NewSSLConfig(tc.secretListenerString, tc.secretBackendSetString, tc.service, tc.ports, tc.ssr)
831879
if !reflect.DeepEqual(result, tc.expectedResult) {
832880
t.Errorf("Expected SSlConfig \n%+v\nbut got\n%+v", tc.expectedResult, result)
833881
}
@@ -866,14 +914,15 @@ func TestCertificates(t *testing.T) {
866914
},
867915
},
868916
SSLConfig: &SSLConfig{
869-
BackendSetSSLSecretName: backendSecret,
917+
BackendSetSSLSecretName: backendSecret,
918+
BackendSetSSLSecretNamespace: "backendnamespace",
870919
sslSecretReader: &mockSSLSecretReader{
871920
returnError: false,
872921
returnMap: map[struct {
873922
namespaceArg string
874923
nameArg string
875924
}]*certificateData{
876-
{namespaceArg: "testnamespace", nameArg: backendSecret}: {
925+
{namespaceArg: "backendnamespace", nameArg: backendSecret}: {
877926
Name: "certificatename",
878927
CACert: []byte(backendSecretCaCert),
879928
PublicCert: []byte(backendSecretPublicCert),
@@ -903,22 +952,24 @@ func TestCertificates(t *testing.T) {
903952
},
904953
},
905954
SSLConfig: &SSLConfig{
906-
BackendSetSSLSecretName: backendSecret,
907-
ListenerSSLSecretName: listenerSecret,
955+
BackendSetSSLSecretName: backendSecret,
956+
BackendSetSSLSecretNamespace: "backendnamespace",
957+
ListenerSSLSecretName: listenerSecret,
958+
ListenerSSLSecretNamespace: "listenernamespace",
908959
sslSecretReader: &mockSSLSecretReader{
909960
returnError: false,
910961
returnMap: map[struct {
911962
namespaceArg string
912963
nameArg string
913964
}]*certificateData{
914-
{namespaceArg: "testnamespace", nameArg: backendSecret}: {
965+
{namespaceArg: "backendnamespace", nameArg: backendSecret}: {
915966
Name: "backendcertificatename",
916967
CACert: []byte(backendSecretCaCert),
917968
PublicCert: []byte(backendSecretPublicCert),
918969
PrivateKey: []byte(backendSecretPrivateKey),
919970
Passphrase: []byte(backendSecretPassphrase),
920971
},
921-
{namespaceArg: "testnamespace", nameArg: listenerSecret}: {
972+
{namespaceArg: "listenernamespace", nameArg: listenerSecret}: {
922973
Name: "listenercertificatename",
923974
CACert: []byte(listenerSecretCaCert),
924975
PublicCert: []byte(listenerSecretPublicCert),

0 commit comments

Comments
 (0)