DevFW-CICD/ingress-nginx-helm
16
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move certificate authentication from location to server

Browse source
This commit is contained in:
Manuel de Brito Fontes 2017-07-06 17:48:35 -04:00
parent 835aea4bab
commit 20ea364886
3 changed files with 12 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
controllers/nginx/rootfs/etc/nginx/template/nginx.tmpl
View file

@ -308,17 +308,17 @@ http {
{{ if $cfg.EnableVtsStatus }}vhost_traffic_status_filter_by_set_key $geoip_country_code country::$server_name;{{ end }} {{ if $cfg.EnableVtsStatus }}vhost_traffic_status_filter_by_set_key $geoip_country_code country::$server_name;{{ end }}
{{ if not (empty $server.CertificateAuth.AuthSSLCert.CAFileName) }}
# PEM sha: {{ $server.CertificateAuth.AuthSSLCert.PemSHA }}
ssl_client_certificate {{ $server.CertificateAuth.AuthSSLCert.CAFileName }};
ssl_verify_client on;
ssl_verify_depth {{ $server.CertificateAuth.ValidationDepth }};
{{ end }}
{{ range $location := $server.Locations }} {{ range $location := $server.Locations }}
{{ $path := buildLocation $location }} {{ $path := buildLocation $location }}
{{ $authPath := buildAuthLocation $location }} {{ $authPath := buildAuthLocation $location }}
{{ if not (empty $location.CertificateAuth.AuthSSLCert.CAFileName) }}
# PEM sha: {{ $location.CertificateAuth.AuthSSLCert.PemSHA }}
ssl_client_certificate {{ $location.CertificateAuth.AuthSSLCert.CAFileName }};
ssl_verify_client on;
ssl_verify_depth {{ $location.CertificateAuth.ValidationDepth }};
{{ end }}
{{ if not (empty $location.Redirect.AppRoot)}} {{ if not (empty $location.Redirect.AppRoot)}}
if ($uri = /) { if ($uri = /) {
return 302 {{ $location.Redirect.AppRoot }}; return 302 {{ $location.Redirect.AppRoot }};
@ -407,7 +407,7 @@ http {
proxy_set_header Host $best_http_host; proxy_set_header Host $best_http_host;
# Pass the extracted client certificate to the backend # Pass the extracted client certificate to the backend
{{ if not (empty $location.CertificateAuth.AuthSSLCert.CAFileName) }} {{ if not (empty $server.CertificateAuth.AuthSSLCert.CAFileName) }}
proxy_set_header ssl-client-cert $ssl_client_cert; proxy_set_header ssl-client-cert $ssl_client_cert;
{{ end }} {{ end }}

2
core/pkg/ingress/controller/util_test.go
View file

@ -23,7 +23,6 @@ import (
"k8s.io/ingress/core/pkg/ingress" "k8s.io/ingress/core/pkg/ingress"
"k8s.io/ingress/core/pkg/ingress/annotations/auth" "k8s.io/ingress/core/pkg/ingress/annotations/auth"
"k8s.io/ingress/core/pkg/ingress/annotations/authreq" "k8s.io/ingress/core/pkg/ingress/annotations/authreq"
"k8s.io/ingress/core/pkg/ingress/annotations/authtls"
"k8s.io/ingress/core/pkg/ingress/annotations/ipwhitelist" "k8s.io/ingress/core/pkg/ingress/annotations/ipwhitelist"
"k8s.io/ingress/core/pkg/ingress/annotations/proxy" "k8s.io/ingress/core/pkg/ingress/annotations/proxy"
"k8s.io/ingress/core/pkg/ingress/annotations/ratelimit" "k8s.io/ingress/core/pkg/ingress/annotations/ratelimit"
@ -102,7 +101,6 @@ func TestMergeLocationAnnotations(t *testing.T) {
"Redirect": rewrite.Redirect{}, "Redirect": rewrite.Redirect{},
"Whitelist": ipwhitelist.SourceRange{}, "Whitelist": ipwhitelist.SourceRange{},
"Proxy": proxy.Configuration{}, "Proxy": proxy.Configuration{},
"CertificateAuth": authtls.AuthSSLConfig{},
"UsePortInRedirects": true, "UsePortInRedirects": true,
} }

9
core/pkg/ingress/types.go
View file

@ -213,6 +213,10 @@ type Server struct {
SSLPemChecksum string `json:"sslPemChecksum"` SSLPemChecksum string `json:"sslPemChecksum"`
// Locations list of URIs configured in the server. // Locations list of URIs configured in the server.
Locations []*Location `json:"locations,omitempty"` Locations []*Location `json:"locations,omitempty"`
// CertificateAuth indicates the access to this location requires
// external authentication
// +optional
CertificateAuth authtls.AuthSSLConfig `json:"certificateAuth,omitempty"`
} }
// Location describes an URI inside a server. // Location describes an URI inside a server.
@ -224,7 +228,6 @@ type Server struct {
// In some cases when more than one annotations is defined a particular order in the execution // In some cases when more than one annotations is defined a particular order in the execution
// is required. // is required.
// The chain in the execution order of annotations should be: // The chain in the execution order of annotations should be:
// - CertificateAuth
// - Whitelist // - Whitelist
// - RateLimit // - RateLimit
// - BasicDigestAuth // - BasicDigestAuth
@ -278,10 +281,6 @@ type Location struct {
// to be used in connections against endpoints // to be used in connections against endpoints
// +optional // +optional
Proxy proxy.Configuration `json:"proxy,omitempty"` Proxy proxy.Configuration `json:"proxy,omitempty"`
// CertificateAuth indicates the access to this location requires
// external authentication
// +optional
CertificateAuth authtls.AuthSSLConfig `json:"certificateAuth,omitempty"`
// UsePortInRedirects indicates if redirects must specify the port // UsePortInRedirects indicates if redirects must specify the port
// +optional // +optional
UsePortInRedirects bool `json:"use-port-in-redirects"` UsePortInRedirects bool `json:"use-port-in-redirects"`