Skip to content

Commit bde666a

Browse files
laurovenanciolaurovenancio
authored
Add a flag to set the default SSL Policy (#1881)
The default SSL Policy is used when the SSL policy is not set by annotations.
1 parent 0fac200 commit bde666a

File tree

8 files changed

+26
-7
lines changed

8 files changed

+26
-7
lines changed

‎controllers/ingress/group_controller.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@ func NewGroupReconciler(cloud aws.Cloud, k8sClient client.Client, eventRecorder
4646
cloud.EC2(), cloud.ACM(),
4747
annotationParser, subnetsResolver,
4848
authConfigBuilder, enhancedBackendBuilder,
49-
cloud.VpcID(), config.ClusterName, config.DefaultTags, logger)
49+
cloud.VpcID(), config.ClusterName, config.DefaultTags,
50+
config.DefaultSSLPolicy, logger)
5051
stackMarshaller := deploy.NewDefaultStackMarshaller()
5152
stackDeployer := deploy.NewDefaultStackDeployer(cloud, k8sClient, networkingSGManager, networkingSGReconciler,
5253
config, ingressTagPrefix, logger)

‎controllers/service/service_controller.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ func NewServiceReconciler(cloud aws.Cloud, k8sClient client.Client, eventRecorde
3737
config config.ControllerConfig, logger logr.Logger) *serviceReconciler {
3838

3939
annotationParser := annotations.NewSuffixAnnotationParser(serviceAnnotationPrefix)
40-
modelBuilder := service.NewDefaultModelBuilder(annotationParser, subnetsResolver, config.ClusterName, config.DefaultTags)
40+
modelBuilder := service.NewDefaultModelBuilder(annotationParser, subnetsResolver, config.ClusterName, config.DefaultTags, config.DefaultSSLPolicy)
4141
stackMarshaller := deploy.NewDefaultStackMarshaller()
4242
stackDeployer := deploy.NewDefaultStackDeployer(cloud, k8sClient, networkingSGManager, networkingSGReconciler, config, serviceTagPrefix, logger)
4343
return &serviceReconciler{

‎docs/deploy/configurations.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ Currently, you can set only 1 namespace to watch in this flag. See [this Kuberne
6767
|aws-vpc-id | string | [instance metadata](#instance-metadata) | AWS VPC ID for the Kubernetes cluster |
6868
|cluster-name | string | | Kubernetes cluster name|
6969
|default-tags | stringMap | | Default AWS Tags that will be applied to all AWS resources managed by this controller |
70+
|default-ssl-policy | string | ELBSecurityPolicy-2016-08 | Default SSL Policy that will be applied to all ingresses or services that do not have the SSL Policy annotation. |
7071
|enable-leader-election | boolean | true | Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. |
7172
|enable-pod-readiness-gate-inject | boolean | true | If enabled, targetHealth readiness gate will get injected to the pod spec for the matching endpoint pods. |
7273
|enable-shield | boolean | true | Enable Shield addon for ALB |

‎pkg/config/controller_config.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,10 @@ const (
1313
flagDefaultTags = "default-tags"
1414
flagServiceMaxConcurrentReconciles = "service-max-concurrent-reconciles"
1515
flagTargetGroupBindingMaxConcurrentReconciles = "targetgroupbinding-max-concurrent-reconciles"
16+
flagDefaultSSLPolicy = "default-ssl-policy"
1617
defaultLogLevel = "info"
1718
defaultMaxConcurrentReconciles = 3
19+
defaultSSLPolicy = "ELBSecurityPolicy-2016-08"
1820
)
1921

2022
// ControllerConfig contains the controller configuration
@@ -37,6 +39,10 @@ type ControllerConfig struct {
3739
// Default AWS Tags that will be applied to all AWS resources managed by this controller.
3840
DefaultTags map[string]string
3941

42+
// Default SSL Policy that will be applied to all ingresses or services that do not have
43+
// the SSL Policy annotation.
44+
DefaultSSLPolicy string
45+
4046
// Max concurrent reconcile loops for Service objects
4147
ServiceMaxConcurrentReconciles int
4248
// Max concurrent reconcile loops for TargetGroupBinding objects
@@ -54,6 +60,8 @@ func (cfg *ControllerConfig) BindFlags(fs *pflag.FlagSet) {
5460
"Maximum number of concurrently running reconcile loops for service")
5561
fs.IntVar(&cfg.TargetGroupBindingMaxConcurrentReconciles, flagTargetGroupBindingMaxConcurrentReconciles, defaultMaxConcurrentReconciles,
5662
"Maximum number of concurrently running reconcile loops for targetGroupBinding")
63+
fs.StringVar(&cfg.DefaultSSLPolicy, flagDefaultSSLPolicy, defaultSSLPolicy,
64+
"Default SSL policy for load balancers listeners")
5765

5866
cfg.AWSConfig.BindFlags(fs)
5967
cfg.RuntimeConfig.BindFlags(fs)

‎pkg/ingress/model_builder.go

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,8 @@ func NewDefaultModelBuilder(k8sClient client.Client, eventRecorder record.EventR
3535
ec2Client services.EC2, acmClient services.ACM,
3636
annotationParser annotations.Parser, subnetsResolver networkingpkg.SubnetsResolver,
3737
authConfigBuilder AuthConfigBuilder, enhancedBackendBuilder EnhancedBackendBuilder,
38-
vpcID string, clusterName string, defaultTags map[string]string, logger logr.Logger) *defaultModelBuilder {
38+
vpcID string, clusterName string, defaultTags map[string]string, defaultSSLPolicy string,
39+
logger logr.Logger) *defaultModelBuilder {
3940
certDiscovery := NewACMCertDiscovery(acmClient, logger)
4041
ruleOptimizer := NewDefaultRuleOptimizer(logger)
4142
return &defaultModelBuilder{
@@ -51,6 +52,7 @@ func NewDefaultModelBuilder(k8sClient client.Client, eventRecorder record.EventR
5152
enhancedBackendBuilder: enhancedBackendBuilder,
5253
ruleOptimizer: ruleOptimizer,
5354
defaultTags: defaultTags,
55+
defaultSSLPolicy: defaultSSLPolicy,
5456
logger: logger,
5557
}
5658
}
@@ -73,6 +75,7 @@ type defaultModelBuilder struct {
7375
enhancedBackendBuilder EnhancedBackendBuilder
7476
ruleOptimizer RuleOptimizer
7577
defaultTags map[string]string
78+
defaultSSLPolicy string
7679

7780
logger logr.Logger
7881
}
@@ -100,7 +103,7 @@ func (b *defaultModelBuilder) Build(ctx context.Context, ingGroup Group) (core.S
100103
defaultTags: b.defaultTags,
101104
defaultIPAddressType: elbv2model.IPAddressTypeIPV4,
102105
defaultScheme: elbv2model.LoadBalancerSchemeInternal,
103-
defaultSSLPolicy: "ELBSecurityPolicy-2016-08",
106+
defaultSSLPolicy: b.defaultSSLPolicy,
104107
defaultTargetType: elbv2model.TargetTypeInstance,
105108
defaultBackendProtocol: elbv2model.ProtocolHTTP,
106109
defaultBackendProtocolVersion: elbv2model.ProtocolVersionHTTP1,

‎pkg/service/model_build_listener.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ func (t *defaultModelBuildTask) buildSSLNegotiationPolicy(_ context.Context) *st
9393
if exists := t.annotationParser.ParseStringAnnotation(annotations.SvcLBSuffixSSLNegotiationPolicy, &rawSslPolicyStr, t.service.Annotations); exists {
9494
return &rawSslPolicyStr
9595
}
96-
return nil
96+
return &t.defaultSSLPolicy
9797
}
9898

9999
func (t *defaultModelBuildTask) buildListenerCertificates(_ context.Context) []elbv2model.Certificate {

‎pkg/service/model_builder.go

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,14 @@ type ModelBuilder interface {
2727
}
2828

2929
// NewDefaultModelBuilder construct a new defaultModelBuilder
30-
func NewDefaultModelBuilder(annotationParser annotations.Parser, subnetsResolver networking.SubnetsResolver, clusterName string, defaultTags map[string]string) *defaultModelBuilder {
30+
func NewDefaultModelBuilder(annotationParser annotations.Parser, subnetsResolver networking.SubnetsResolver, clusterName string,
31+
defaultTags map[string]string, defaultSSLPolicy string) *defaultModelBuilder {
3132
return &defaultModelBuilder{
3233
annotationParser: annotationParser,
3334
subnetsResolver: subnetsResolver,
3435
clusterName: clusterName,
3536
defaultTags: defaultTags,
37+
defaultSSLPolicy: defaultSSLPolicy,
3638
}
3739
}
3840

@@ -43,6 +45,7 @@ type defaultModelBuilder struct {
4345
subnetsResolver networking.SubnetsResolver
4446
clusterName string
4547
defaultTags map[string]string
48+
defaultSSLPolicy string
4649
}
4750

4851
func (b *defaultModelBuilder) Build(ctx context.Context, service *corev1.Service) (core.Stack, *elbv2model.LoadBalancer, error) {
@@ -57,6 +60,7 @@ func (b *defaultModelBuilder) Build(ctx context.Context, service *corev1.Service
5760
tgByResID: make(map[string]*elbv2model.TargetGroup),
5861

5962
defaultTags: b.defaultTags,
63+
defaultSSLPolicy: b.defaultSSLPolicy,
6064
defaultAccessLogS3Enabled: false,
6165
defaultAccessLogsS3Bucket: "",
6266
defaultAccessLogsS3Prefix: "",
@@ -99,6 +103,7 @@ type defaultModelBuildTask struct {
99103
ec2Subnets []*ec2.Subnet
100104

101105
defaultTags map[string]string
106+
defaultSSLPolicy string
102107
defaultAccessLogS3Enabled bool
103108
defaultAccessLogsS3Bucket string
104109
defaultAccessLogsS3Prefix string

‎pkg/service/model_builder_test.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -772,6 +772,7 @@ func Test_defaultModelBuilderTask_Build(t *testing.T) {
772772
},
773773
"port":83,
774774
"protocol":"TLS",
775+
"sslPolicy": "ELBSecurityPolicy-2016-08",
775776
"defaultActions":[
776777
{
777778
"type":"forward",
@@ -1682,7 +1683,7 @@ func Test_defaultModelBuilderTask_Build(t *testing.T) {
16821683
}
16831684

16841685
annotationParser := annotations.NewSuffixAnnotationParser("service.beta.kubernetes.io")
1685-
builder := NewDefaultModelBuilder(annotationParser, subnetsResolver, "my-cluster", nil)
1686+
builder := NewDefaultModelBuilder(annotationParser, subnetsResolver, "my-cluster", nil, "ELBSecurityPolicy-2016-08")
16861687
ctx := context.Background()
16871688
stack, _, err := builder.Build(ctx, tt.svc)
16881689
if tt.wantError {

0 commit comments

Comments
 (0)