8000 Support warnings for TLS secrets in VS · nginx/kubernetes-ingress@28e9121 · GitHub
[go: up one dir, main page]
Skip to content

Commit 28e9121

Browse files
pleshakovpleshakov
committed
Support warnings for TLS secrets in VS
1 parent ff8384d commit 28e9121

File tree

3 files changed

+79
-43
lines changed

3 files changed

+79
-43
lines changed

‎internal/configs/virtualserver.go‎

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -196,16 +196,12 @@ type virtualServerConfigurator struct {
196196
}
197197

198198
func (vsc *virtualServerConfigurator) addWarningf(obj runtime.Object, msgFmt string, args ...interface{}) {
199-
vsc.addWarning(obj, fmt.Sprintf(msgFmt, args...))
200-
}
201-
202-
func (vsc *virtualServerConfigurator) addWarning(obj runtime.Object, msg string) {
203-
vsc.warnings[obj] = append(vsc.warnings[obj], msg)
199+
vsc.warnings.AddWarningf(obj, msgFmt, args...)
204200
}
205201

206202
func (vsc *virtualServerConfigurator) addWarnings(obj runtime.Object, msgs []string) {
207203
for _, msg := range msgs {
208-
vsc.addWarning(obj, msg)
204+
vsc.warnings.AddWarning(obj, msg)
209205
}
210206
}
211207

@@ -258,7 +254,7 @@ func (vsc *virtualServerConfigurator) generateEndpointsForUpstream(
258254
func (vsc *virtualServerConfigurator) GenerateVirtualServerConfig(vsEx *VirtualServerEx) (version2.VirtualServerConfig, Warnings) {
259255
vsc.clearWarnings()
260256

261-
sslConfig := generateSSLConfig(vsEx.VirtualServer.Spec.TLS, vsEx.VirtualServer.Namespace, vsEx.SecretRefs, vsc.cfgParams)
257+
sslConfig := vsc.generateSSLConfig(vsEx.VirtualServer, vsEx.VirtualServer.Spec.TLS, vsEx.VirtualServer.Namespace, vsEx.SecretRefs, vsc.cfgParams)
262258
tlsRedirectConfig := generateTLSRedirectConfig(vsEx.VirtualServer.Spec.TLS)
263259

264260
policyOpts := policyOptions{
@@ -1780,7 +1776,8 @@ func getNameForSourceForMatchesRouteMapFromCondition(condition conf_v1.Condition
17801776
return condition.Variable
17811777
}
17821778

1783-
func generateSSLConfig(tls *conf_v1.TLS, namespace string, secretRefs map[string]*secrets.SecretReference, cfgParams *ConfigParams) *version2.SSL {
1779+
func (vsc *virtualServerConfigurator) generateSSLConfig(owner runtime.Object, tls *conf_v1.TLS, namespace string,
1780+
secretRefs map[string]*secrets.SecretReference, cfgParams *ConfigParams) *version2.SSL {
17841781
if tls == nil {
17851782
return nil
17861783
}
@@ -1797,11 +1794,11 @@ func generateSSLConfig(tls *conf_v1.TLS, namespace string, secretRefs map[string
17971794
if secret.Error != nil {
17981795
name = pemFileNameForMissingTLSSecret
17991796
ciphers = "NULL"
1800-
// TO-DO: add a warning
1797+
vsc.addWarningf(owner, "TLS secret %s is invalid: %v", tls.Secret, secret.Error)
18011798
} else if secret.Type != api_v1.SecretTypeTLS {
18021799
name = pemFileNameForMissingTLSSecret
18031800
ciphers = "NULL"
1804-
// TO-DO: add a warning
1801+
vsc.addWarningf(owner, "TLS secret %s is of a wrong type '%s', must be '%s'", tls.Secret, secret.Type, api_v1.SecretTypeTLS)
18051802
} else {
18061803
name = secret.Path
18071804
}

‎internal/configs/virtualserver_test.go‎

Lines changed: 66 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -2157,7 +2157,7 @@ func TestGeneratePoliciesFails(t *testing.T) {
21572157
Code: 500,
21582158
},
21592159
},
2160-
expectedWarnings: map[runtime.Object][]string{
2160+
expectedWarnings: Warnings{
21612161
nil: {
21622162
"Policy default/allow-policy is missing or invalid",
21632163
},
@@ -2194,7 +2194,7 @@ func TestGeneratePoliciesFails(t *testing.T) {
21942194
Allow: []string{"127.0.0.1"},
21952195
Deny: []string{"127.0.0.2"},
21962196
},
2197-
expectedWarnings: map[runtime.Object][]string{
2197+
expectedWarnings: Warnings{
21982198
nil: {
21992199
"AccessControl policy (or policies) with deny rules is overridden by policy (or policies) with allow rules",
22002200
},
@@ -2264,7 +2264,7 @@ func TestGeneratePoliciesFails(t *testing.T) {
22642264
},
22652265
},
22662266
},
2267-
expectedWarnings: B5F2 map[runtime.Object][]string{
2267+
expectedWarnings: Warnings{
22682268
nil: {
22692269
`RateLimit policy "default/rateLimit-policy2" with limit request option dryRun=true is overridden to dryRun=false by the first policy reference in this context`,
22702270
`RateLimit policy "default/rateLimit-policy2" with limit request option logLevel=info is overridden to logLevel=error by the first policy reference in this context`,
@@ -2307,7 +2307,7 @@ func TestGeneratePoliciesFails(t *testing.T) {
23072307
Code: 500,
23082308
},
23092309
},
2310-
expectedWarnings: map[runtime.Object][]string{
2310+
expectedWarnings: Warnings{
23112311
nil: {
23122312
`JWT policy "default/jwt-policy" references an invalid Secret: secret is invalid`,
23132313
},
@@ -2369,7 +2369,7 @@ func TestGeneratePoliciesFails(t *testing.T) {
23692369
Realm: "test",
23702370
},
23712371
},
2372-
expectedWarnings: map[runtime.Object][]string{
2372+
expectedWarnings: Warnings{
23732373
nil: {
23742374
`Multiple jwt policies in the same context is not valid. JWT policy "default/jwt-policy2" will be ignored`,
23752375
},
@@ -2410,7 +2410,7 @@ func TestGeneratePoliciesFails(t *testing.T) {
24102410
Code: 500,
24112411
},
24122412
},
2413-
expectedWarnings: map[runtime.Object][]string{
2413+
expectedWarnings: Warnings{
24142414
nil: {
24152415
`IngressMTLS policy "default/ingress-mtls-policy" references an invalid Secret: secret is invalid`,
24162416
},
@@ -2465,7 +2465,7 @@ func TestGeneratePoliciesFails(t *testing.T) {
24652465
VerifyDepth: 1,
24662466
},
24672467
},
2468-
expectedWarnings: map[runtime.Object][]string{
2468+
expectedWarnings: Warnings{
24692469
nil: {
24702470
`Multiple ingressMTLS policies are not allowed. IngressMTLS policy "default/ingress-mtls-policy2" will be ignored`,
24712471
},
@@ -2507,7 +2507,7 @@ func TestGeneratePoliciesFails(t *testing.T) {
25072507
Code: 500,
25082508
},
25092509
},
2510-
expectedWarnings: map[runtime.Object][]string{
2510+
expectedWarnings: Warnings{
25112511
nil: {
25122512
`IngressMTLS policy is not allowed in the route context`,
25132513
},
@@ -2549,7 +2549,7 @@ func TestGeneratePoliciesFails(t *testing.T) {
25492549
Code: 500,
25502550
},
25512551
},
2552-
expectedWarnings: map[runtime.Object][]string{
2552+
expectedWarnings: Warnings{
25532553
nil: {
25542554
`TLS configuration needed for IngressMTLS policy`,
25552555
},
@@ -2612,7 +2612,7 @@ func TestGeneratePoliciesFails(t *testing.T) {
26122612
SSLName: "$proxy_host",
26132613
},
26142614
},
2615-
expectedWarnings: map[runtime.Object][]string{
2615+
expectedWarnings: Warnings{
26162616
nil: {
26172617
`Multiple egressMTLS policies in the same context is not valid. EgressMTLS policy "default/egress-mtls-policy2" will be ignored`,
26182618
},
@@ -2654,7 +2654,7 @@ func TestGeneratePoliciesFails(t *testing.T) {
26542654
Code: 500,
26552655
},
26562656
},
2657-
expectedWarnings: map[runtime.Object][]string{
2657+
expectedWarnings: Warnings{
26582658
nil: {
26592659
`EgressMTLS policy "default/egress-mtls-policy" references an invalid Secret: secret is invalid`,
26602660
},
@@ -2696,7 +2696,7 @@ func TestGeneratePoliciesFails(t *testing.T) {
26962696
Code: 500,
26972697
},
26982698
},
2699-
expectedWarnings: map[runtime.Object][]string{
2699+
expectedWarnings: Warnings{
27002700
nil: {
27012701
`EgressMTLS policy "default/egress-mtls-policy" references an invalid Secret: secret is invalid`,
27022702
},
@@ -3326,27 +3326,30 @@ func TestGenerateLocationForRedirect(t *testing.T) {
33263326

33273327
func TestGenerateSSLConfig(t *testing.T) {
33283328
tests := []struct {
3329-
inputTLS *conf_v1.TLS
3330-
inputSecretRefs map[string]*secrets.SecretReference
3331-
inputCfgParams *ConfigParams
3332-
expected *version2.SSL
3333-
msg string
3329+
inputTLS *conf_v1.TLS
3330+
inputSecretRefs map[string]*secrets.SecretReference
3331+
inputCfgParams *ConfigParams
3332+
expectedSSL *version2.SSL
3333+
expectedWarnings Warnings
3334+
msg string
33343335
}{
33353336
{
3336-
inputTLS: nil,
3337-
inputSecretRefs: map[string]*secrets.SecretReference{},
3338-
inputCfgParams: &ConfigParams{},
3339-
expected: nil,
3340-
msg: "no TLS field",
3337+
inputTLS: nil,
3338+
inputSecretRefs: map[string]*secrets.SecretReference{},
3339+
inputCfgParams: &ConfigParams{},
3340+
expectedSSL: nil,
3341+
expectedWarnings: Warnings{},
3342+
msg: "no TLS field",
33413343
},
33423344
{
33433345
inputTLS: &conf_v1.TLS{
33443346
Secret: "",
33453347
},
3346-
inputSecretRefs: map[string]*secrets.SecretReference{},
3347-
inputCfgParams: &ConfigParams{},
3348-
expected: nil,
3349-
msg: "TLS field with empty secret",
3348+
inputSecretRefs: map[string]*secrets.SecretReference{},
3349+
inputCfgParams: &ConfigParams{},
3350+
expectedSSL: nil,
3351+
expectedWarnings: Warnings{},
3352+
msg: "TLS field with empty secret",
33503353
},
33513354
{
33523355
inputTLS: &conf_v1.TLS{
@@ -3358,14 +3361,38 @@ func TestGenerateSSLConfig(t *testing.T) {
33583361
Error: errors.New("secret doesn't exist"),
33593362
},
33603363
},
3361-
expected: &version2.SSL{
3364+
expectedSSL: &version2.SSL{
33623365
HTTP2: false,
33633366
Certificate: pemFileNameForMissingTLSSecret,
33643367
CertificateKey: pemFileNameForMissingTLSSecret,
33653368
Ciphers: "NULL",
33663369
},
3370+
expectedWarnings: Warnings{
3371+
nil: []string{"TLS secret secret is invalid: secret doesn't exist"},
3372+
},
33673373
msg: "secret doesn't exist in the cluster with HTTPS",
33683374
},
3375+
{
3376+
inputTLS: &conf_v1.TLS{
3377+
Secret: "secret",
3378+
},
3379+
inputCfgParams: &ConfigParams{},
3380+
inputSecretRefs: map[string]*secrets.SecretReference{
3381+
"default/secret": {
3382+
Type: secrets.SecretTypeCA,
3383+
},
3384+
},
3385+
expectedSSL: &version2.SSL{
3386+
HTTP2: false,
3387+
Certificate: pemFileNameForMissingTLSSecret,
3388+
CertificateKey: pemFileNameForMissingTLSSecret,
3389+
Ciphers: "NULL",
3390+
},
3391+
expectedWarnings: Warnings{
3392+
nil: []string{"TLS secret secret is of a wrong type 'nginx.org/ca', must be 'kubernetes.io/tls'"},
3393+
},
3394+
msg: "wrong secret type",
3395+
},
33693396
{
33703397
inputTLS: &conf_v1.TLS{
33713398
Secret: "secret",
@@ -3377,22 +3404,29 @@ func TestGenerateSSLConfig(t *testing.T) {
33773404
},
33783405
},
33793406
inputCfgParams: &ConfigParams{},
3380-
expected: &version2.SSL{
3407+
expectedSSL: &version2.SSL{
33813408
HTTP2: false,
33823409
Certificate: "secret.pem",
33833410
CertificateKey: "secret.pem",
33843411
Ciphers: "",
33853412
},
3386-
msg: "normal case with HTTPS",
3413+
expectedWarnings: Warnings{},
3414+
msg: "normal case with HTTPS",
33873415
},
33883416
}
33893417

33903418
namespace := "default"
33913419

33923420
for _, test := range tests {
3393-
result := generateSSLConfig(test.inputTLS, namespace, test.inputSecretRefs, test.inputCfgParams)
3394-
if !reflect.DeepEqual(result, test.expected) {
3395-
t.Errorf("generateSSLConfig() returned %v but expected %v for the case of %s", result, test.expected, test.msg)
3421+
vsc := newVirtualServerConfigurator(&ConfigParams{}, false, false, &StaticConfigParams{})
3422+
3423+
// it is ok to use nil as the owner
3424+
result := vsc.generateSSLConfig(nil, test.inputTLS, namespace, test.inputSecretRefs, test.inputCfgParams)
3425+
if !reflect.DeepEqual(result, test.expectedSSL) {
3426+
t.Errorf("generateSSLConfig() returned %v but expected %v for the case of %s", result, test.expectedSSL, test.msg)
3427+
}
3428+
if !reflect.DeepEqual(vsc.warnings, test.expectedWarnings) {
3429+
t.Errorf("generateSSLConfig() returned warnings of \n%v but expected \n%v for the case of %s", vsc.warnings, test.expectedWarnings, test.msg)
33963430
}
33973431
}
33983432
}

‎internal/configs/warnings.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,12 @@ func (w Warnings) Add(warnings Warnings) {
2020
}
2121
}
2222

23-
// Adds a warning for the specified object.
23+
// Adds a warning for the specified object using the provided format and arguments.
2424
func (w Warnings) AddWarningf(obj runtime.Object, msgFmt string, args ...interface{}) {
2525
w[obj] = append(w[obj], fmt.Sprintf(msgFmt, args...))
2626
}
27+
28+
// Adds a warning for the specified object.
29+
func (w Warnings) AddWarning(obj runtime.Object, msg string) {
30+
w[obj] = append(w[obj], msg)
31+
}

0 commit comments

Comments
 (0)
0