feat: add skip_mtls_uri_regex support for ApisixTls

pkg/kube/apisix/apis/config/v2/types.go

@@ -773,8 +773,9 @@ type ApisixSecret struct {
 
 // ApisixMutualTlsClientConfig describes the mutual TLS CA and verify depth
 type ApisixMutualTlsClientConfig struct {
-	CASecret ApisixSecret `json:"caSecret,omitempty" yaml:"caSecret,omitempty"`
-	Depth    int          `json:"depth,omitempty" yaml:"depth,omitempty"`
+	CASecret         ApisixSecret `json:"caSecret,omitempty" yaml:"caSecret,omitempty"`
+	Depth            int          `json:"depth,omitempty" yaml:"depth,omitempty"`
+	SkipMtlsUriRegex []string     `json:"skip_mtls_uri_regex,omitempty" yaml:"skip_mtls_uri_regex, omitempty"`
 }
 
 // +genclient

pkg/providers/apisix/translation/apisix_ssl.go

@@ -57,8 +57,9 @@ func (t *translator) TranslateSSLV2(tls *configv2.ApisixTls) (*apisixv1.Ssl, err
 			return nil, err
 		}
 		ssl.Client = &apisixv1.MutualTLSClientConfig{
-			CA:    string(ca),
-			Depth: tls.Spec.Client.Depth,
+			CA:               string(ca),
+			Depth:            tls.Spec.Client.Depth,
+			SkipMtlsUriRegex: tls.Spec.Client.SkipMtlsUriRegex,
 		}
 	}
 

pkg/types/apisix/v1/types.go

@@ -453,8 +453,9 @@ type Ssl struct {
 // MutualTLSClientConfig apisix SSL client field
 // +k8s:deepcopy-gen=true
 type MutualTLSClientConfig struct {
-	CA    string `json:"ca,omitempty" yaml:"ca,omitempty"`
-	Depth int    `json:"depth,omitempty" yaml:"depth,omitempty"`
+	CA               string   `json:"ca,omitempty" yaml:"ca,omitempty"`
+	Depth            int      `json:"depth,omitempty" yaml:"depth,omitempty"`
+	SkipMtlsUriRegex []string `json:"skip_mtls_uri_regex,omitempty" yaml:"skip_mtls_uri_regex, omitempty"`
 }
 
 // StreamRoute represents the stream_route object in APISIX.

samples/deploy/crd/v1/ApisixTls.yaml

@@ -254,6 +254,10 @@ spec:
                           minLength: 1
                     depth:
                       type: integer
+                    skip_mtls_uri_regex:
+                      type: array
+                      items:
+                        type: string
                 hosts:
                   type: array
                   minItems: 1

test/e2e/scaffold/ssl.go

@@ -88,6 +88,8 @@ spec:
       name: %s
       namespace: %s
     depth: 10
+    skip_mtls_uri_regex:
+    - %s
 `
 )
 
@@ -137,8 +139,8 @@ func (s *Scaffold) NewApisixTls(name, host, secretName string, ingressClassName
 }
 
 // NewApisixTlsWithClientCA new a ApisixTls CRD
-func (s *Scaffold) NewApisixTlsWithClientCA(name, host, secretName, clientCASecret string) error {
-	tls := fmt.Sprintf(_api6tlsWithClientCATemplate, s.opts.ApisixResourceVersion, name, host, secretName, s.kubectlOptions.Namespace, clientCASecret, s.kubectlOptions.Namespace)
+func (s *Scaffold) NewApisixTlsWithClientCA(name, host, secretName, clientCASecret, skipMtlsUriRegex string) error {
+	tls := fmt.Sprintf(_api6tlsWithClientCATemplate, s.opts.ApisixResourceVersion, name, host, secretName, s.kubectlOptions.Namespace, clientCASecret, s.kubectlOptions.Namespace, skipMtlsUriRegex)
 	if err := s.CreateResourceFromString(tls); err != nil {
 		return err
 	}

test/e2e/suite-ingress/suite-ingress-resource/ssl.go

@@ -263,7 +263,8 @@ var _ = ginkgo.Describe("suite-ingress-resource: ApisixTls mTLS Test", func() {
 
 			// create ApisixTls resource
 			tlsName := "tls-with-client-ca"
-			err = s.NewApisixTlsWithClientCA(tlsName, host, serverCertSecret, clientCASecret)
+			skipMtlsUriRegex := "/get"
+			err = s.NewApisixTlsWithClientCA(tlsName, host, serverCertSecret, clientCASecret, skipMtlsUriRegex)
 			assert.Nil(ginkgo.GinkgoT(), err, "create ApisixTls with client CA error")
 			// check ssl in APISIX
 			assert.Nil(ginkgo.GinkgoT(), s.EnsureNumApisixTlsCreated(1))
@@ -305,6 +306,8 @@ spec:
 
 			s.NewAPISIXHttpsClientWithCertificates(host, true, caCertPool, []tls.Certificate{cert}).
 				GET("/ip").WithHeader("Host", host).Expect().Status(http.StatusOK)
+
+			s.NewAPISIXHttpsClient(host).GET("/get").WithHeader("Host", host).Expect().Status(http.StatusOK)
 		})
 	}