Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[octavia-ingress-controller] Support TLS in Ingress #927

Merged
merged 1 commit into from Feb 14, 2020
Merged

[octavia-ingress-controller] Support TLS in Ingress #927

merged 1 commit into from Feb 14, 2020

Conversation

lingxiankong
Copy link
Contributor

@lingxiankong lingxiankong commented Feb 8, 2020 •
edited

The binaries affected:

  • openstack-cloud-controller-manager
  • cinder-csi-plugin
  • k8s-keystone-auth
  • client-keystone-auth
  • octavia-ingress-controller
  • manila-csi-plugin
  • manila-provisioner
  • magnum-auto-healer
  • barbican-kms-plugin

What this PR does / why we need it:
Support to create TLS Ingress.

This implementation for octavia-ingress-controller requires the TLS secret must exist when creating the Ingress. In the future, we could consider to create the secret on the fly with integration of e.g. cert-manager.

The TLS support requires OpenStack Barbican deployed in the cloud, TLS Ingress creation will fail if Barbican is not available.

Which issue this PR fixes:
fixes #287

Special notes for reviewers:
Steps to test:

  1. Preprae for the TLS secret, make sure to specify the server name in the CN field of the certificate, in this example, we use www.example.com as the server name.

    $ ll
total 32
-rw-rw-r-- 1 ubuntu ubuntu 1346 Feb  7 11:01 ca.crt
-rw-rw-r-- 1 ubuntu ubuntu 1038 Feb  4 21:39 www.example.com.crt
-rw-rw-r-- 1 ubuntu ubuntu  887 Feb  4 21:39 www.example.com.key
$ openssl x509 -noout -text -in www.example.com.crt
Certificate:
...
        Subject: C = NZ, ST = Wellington, L = Wellington, O = Catalyst, OU = Lingxian, CN = www.example.com
...
$ kubectl create secret tls tls-secret --cert www.example.com.crt --key www.example.com.key
$ kubectl describe secret tls-secret
Name:         tls-secret
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  kubernetes.io/tls

Data
====
tls.key:  887 bytes
tls.crt:  1038 bytes

  2. Create the Ingress

    cat <<EOF | kubectl apply -f -
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: test-octavia-ingress
  annotations:
    kubernetes.io/ingress.class: "openstack"
    octavia.ingress.kubernetes.io/internal: "false"
spec:
  backend:
    serviceName: default-http-backend
    servicePort: 80
  tls:
    - secretName: tls-secret
  rules:
  - host: www.example.com
    http:
      paths:
      - path: /hostname
        backend:
          serviceName: hostname
          servicePort: 8080
EOF

  3. Check a secret created in OpenStack Barbican.

    $ openstack secret list
+------------------------------------------------------------------------------------+------------------------------------------------------------------+---------------------------+--------+-----------------------------------------+-----------+------------+-------------+------+------------+
| Secret href                                                                        | Name                                                             | Created                   | Status | Content types                           | Algorithm | Bit length | Secret type | Mode | Expiration |
+------------------------------------------------------------------------------------+------------------------------------------------------------------+---------------------------+--------+-----------------------------------------+-----------+------------+-------------+------+------------+
| http://128.110.154.166/key-manager/v1/secrets/c1b1ac4c-eced-4dee-8d61-efaaf13c4639 | kube_ingress_lingxiank8s_default_test-octavia-ingress_tls-secret | 2020-02-09T10:11:12+00:00 | ACTIVE | {'default': 'application/octet-stream'} | aes       |        256 | opaque      | cbc  | None       |
+------------------------------------------------------------------------------------+------------------------------------------------------------------+---------------------------+--------+-----------------------------------------+-----------+------------+-------------+------+------------+

  4. Verify https connection

    $ kubectl get ing
NAME                   HOSTS             ADDRESS        PORTS     AGE
test-octavia-ingress   www.example.com   172.24.5.218   80, 443   102s
$ ip=172.24.5.218
$ curl --cacert ca.crt --resolve www.example.com:443:$ip https://www.example.com/hostname
hostname-544845f9c6-t9tnv

Here is a live demo.

Release note:

octavia-ingress-controller: Support to create TLS Ingress. The TLS support requires OpenStack Barbican deployed in the cloud, TLS Ingress creation will fail if Barbican is not available.

This change is Reviewable

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Feb 8, 2020
@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 8, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 8, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 8, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 8, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 8, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 8, 2020

Build failed.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 8, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 9, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 9, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 9, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 9, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 9, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 9, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 9, 2020

Build failed.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 9, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 9, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 9, 2020

Build succeeded.

@lingxiankong
Copy link
Contributor Author

/test cloud-provider-openstack-e2e-test-csi-cinder

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 10, 2020

Build failed.

@lingxiankong
Copy link
Contributor Author

/test cloud-provider-openstack-e2e-test-csi-cinder

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 11, 2020

Build succeeded.

@lingxiankong
Copy link
Contributor Author

cc @ramineni @chrigl

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 12, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 12, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 12, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 12, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 12, 2020

Build failed.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 12, 2020

Build failed.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 12, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 12, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 13, 2020

Build failed.

@lingxiankong
Copy link
Contributor Author

/test cloud-provider-openstack-acceptance-test-e2e-conformance

@lingxiankong
Copy link
Contributor Author

/test cloud-provider-openstack-acceptance-test-flexvolume-cinder

@lingxiankong
Copy link
Contributor Author

/test cloud-provider-openstack-acceptance-test-csi-manila

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 13, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 13, 2020

Build failed.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 13, 2020

Build failed.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 13, 2020

Build succeeded.

@lingxiankong
Copy link
Contributor Author

/test cloud-provider-openstack-acceptance-test-flexvolume-cinder

@lingxiankong
Copy link
Contributor Author

/test cloud-provider-openstack-acceptance-test-csi-manila

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 13, 2020

Build succeeded.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Feb 13, 2020

Build succeeded.

@chrigl
Copy link
Contributor

chrigl commented Feb 13, 2020

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 13, 2020
@lingxiankong
Copy link
Contributor Author

/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lingxiankong

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 14, 2020
@k8s-ci-robot k8s-ci-robot merged commit dce4e27 into kubernetes:master Feb 14, 2020
@lingxiankong lingxiankong deleted the support-ingress-tls branch February 14, 2020 20:32
@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels Mar 19, 2020
powellchristoph pushed a commit to powellchristoph/cloud-provider-openstack that referenced this pull request Jan 19, 2022
@lingxiankong
[octavia-ingress-controller] Support TLS in Ingress (kubernetes#927)
8e839ef
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@chrigl chrigl chrigl left review comments

@dims dims Awaiting requested review from dims

@ramineni ramineni Awaiting requested review from ramineni

Assignees

@chrigl chrigl

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

TLS support for Octavia ingress controller
3 participants
@lingxiankong @chrigl @k8s-ci-robot