Skip to content

Commit

Permalink
Merge pull request #124 from alvaroaleman/route-termination-policy
Browse files Browse the repository at this point in the history 
Route ingress: Allow setting termination policy via annotation
  • Loading branch information
@openshift-merge-robot
openshift-merge-robot committed Jul 28, 2020
2 parents 0d9f936 + 87ed05a commit b6f2430
Show file tree
Hide file tree
Showing 2 changed files with 225 additions and 8 deletions.
26 changes: 18 additions & 8 deletions pkg/route/ingress/ingress.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -448,10 +448,7 @@ func (c *Controller) sync(key queueKey) error {
}
}

if len(errs) > 0 {
return utilerrors.NewAggregate(errs)
}
return nil
return utilerrors.NewAggregate(errs)
}

func hasIngressOwnerRef(owners []metav1.OwnerReference) (string, bool) {
Expand Down Expand Up @@ -489,7 +486,7 @@ func newRouteForIngress(
return nil
}
tlsConfig = &routev1.TLSConfig{
Termination: routev1.TLSTerminationEdge,
Termination: terminationPolicyForIngress(ingress),
Certificate: string(secret.Data[corev1.TLSCertKey]),
Key: string(secret.Data[corev1.TLSPrivateKeyKey]),
InsecureEdgeTerminationPolicy: routev1.InsecureEdgeTerminationPolicyRedirect,
Expand Down Expand Up @@ -577,7 +574,7 @@ func routeMatchesIngress(
return false
}
}
if !secretMatchesRoute(secret, route.Spec.TLS) {
if !secretMatchesRoute(secret, route.Spec.TLS, terminationPolicyForIngress(ingress)) {
return false
}
return true
Expand Down Expand Up @@ -625,7 +622,7 @@ func targetPortForService(namespace string, path *networkingv1beta1.HTTPIngressP
return nil, errors.New("no port found")
}

func secretMatchesRoute(secret *corev1.Secret, tlsConfig *routev1.TLSConfig) bool {
func secretMatchesRoute(secret *corev1.Secret, tlsConfig *routev1.TLSConfig, terminationPolicy routev1.TLSTerminationType) bool {
if secret == nil {
return tlsConfig == nil
}
Expand All @@ -641,7 +638,7 @@ func secretMatchesRoute(secret *corev1.Secret, tlsConfig *routev1.TLSConfig) boo
if tlsConfig == nil {
return false
}
return tlsConfig.Termination == routev1.TLSTerminationEdge &&
return tlsConfig.Termination == terminationPolicy &&
tlsConfig.Certificate == string(secret.Data[corev1.TLSCertKey]) &&
tlsConfig.Key == string(secret.Data[corev1.TLSPrivateKeyKey])
}
Expand Down Expand Up @@ -719,3 +716,16 @@ func generateRouteName(base string) string {
}
return fmt.Sprintf("%s%s", base, utilrand.String(randomLength))
}

var terminationPolicyAnnotationKey = routev1.GroupName + "/termination"

func terminationPolicyForIngress(ingress *networkingv1beta1.Ingress) routev1.TLSTerminationType {
switch {
case ingress.Annotations[terminationPolicyAnnotationKey] == string(routev1.TLSTerminationPassthrough):
return routev1.TLSTerminationPassthrough
case ingress.Annotations[terminationPolicyAnnotationKey] == string(routev1.TLSTerminationReencrypt):
return routev1.TLSTerminationReencrypt
default:
return routev1.TLSTerminationEdge
}
}
207 changes: 207 additions & 0 deletions pkg/route/ingress/ingress_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1193,6 +1193,213 @@ func TestController_sync(t *testing.T) {
},
},
},
{
name: "update route - termination policy changed to passthrough",
fields: fields{
i: &ingressLister{Items: []*networkingv1beta1.Ingress{
{
ObjectMeta: metav1.ObjectMeta{
Name: "1",
Namespace: "test",
Annotations: map[string]string{
"route.openshift.io/termination": "passthrough",
},
},
Spec: networkingv1beta1.IngressSpec{
TLS: []networkingv1beta1.IngressTLS{
{Hosts: []string{"test.com"}, SecretName: "secret-1"},
},
Rules: []networkingv1beta1.IngressRule{
{
Host: "test.com",
IngressRuleValue: networkingv1beta1.IngressRuleValue{
HTTP: &networkingv1beta1.HTTPIngressRuleValue{
Paths: []networkingv1beta1.HTTPIngressPath{
{
Path: "/", Backend: networkingv1beta1.IngressBackend{
ServiceName: "service-1",
ServicePort: intstr.FromString("http"),
},
},
},
},
},
},
},
},
},
}},
r: &routeLister{Items: []*routev1.Route{
{
ObjectMeta: metav1.ObjectMeta{
Name: "1-abcdef",
Namespace: "test",
OwnerReferences: []metav1.OwnerReference{{APIVersion: "networking.k8s.io/v1beta1", Kind: "Ingress", Name: "1", Controller: &boolTrue}},
},
Spec: routev1.RouteSpec{
Host: "test.com",
Path: "/",
TLS: &routev1.TLSConfig{
Termination: routev1.TLSTerminationEdge,
Certificate: "cert",
Key: "key",
InsecureEdgeTerminationPolicy: routev1.InsecureEdgeTerminationPolicyRedirect,
},
To: routev1.RouteTargetReference{
Name: "service-1",
},
Port: &routev1.RoutePort{
TargetPort: intstr.FromString("http"),
},
WildcardPolicy: routev1.WildcardPolicyNone,
},
},
}},
},
args: queueKey{namespace: "test", name: "1"},
wantPatches: []clientgotesting.PatchActionImpl{
{
Name: "1-abcdef",
Patch: []byte(`[{"op":"replace","path":"/spec","value":{"host":"test.com","path":"/","to":{"kind":"","name":"service-1","weight":null},"port":{"targetPort":"http"},"tls":{"termination":"passthrough","certificate":"cert","key":"key","insecureEdgeTerminationPolicy":"Redirect"}}}]`),
},
},
},
{
name: "update route - termination policy changed to reencrypt",
fields: fields{
i: &ingressLister{Items: []*networkingv1beta1.Ingress{
{
ObjectMeta: metav1.ObjectMeta{
Name: "1",
Namespace: "test",
Annotations: map[string]string{
"route.openshift.io/termination": "reencrypt",
},
},
Spec: networkingv1beta1.IngressSpec{
TLS: []networkingv1beta1.IngressTLS{
{Hosts: []string{"test.com"}, SecretName: "secret-1"},
},
Rules: []networkingv1beta1.IngressRule{
{
Host: "test.com",
IngressRuleValue: networkingv1beta1.IngressRuleValue{
HTTP: &networkingv1beta1.HTTPIngressRuleValue{
Paths: []networkingv1beta1.HTTPIngressPath{
{
Path: "/", Backend: networkingv1beta1.IngressBackend{
ServiceName: "service-1",
ServicePort: intstr.FromString("http"),
},
},
},
},
},
},
},
},
},
}},
r: &routeLister{Items: []*routev1.Route{
{
ObjectMeta: metav1.ObjectMeta{
Name: "1-abcdef",
Namespace: "test",
OwnerReferences: []metav1.OwnerReference{{APIVersion: "networking.k8s.io/v1beta1", Kind: "Ingress", Name: "1", Controller: &boolTrue}},
},
Spec: routev1.RouteSpec{
Host: "test.com",
Path: "/",
TLS: &routev1.TLSConfig{
Termination: routev1.TLSTerminationEdge,
Certificate: "cert",
Key: "key",
InsecureEdgeTerminationPolicy: routev1.InsecureEdgeTerminationPolicyRedirect,
},
To: routev1.RouteTargetReference{
Name: "service-1",
},
Port: &routev1.RoutePort{
TargetPort: intstr.FromString("http"),
},
WildcardPolicy: routev1.WildcardPolicyNone,
},
},
}},
},
args: queueKey{namespace: "test", name: "1"},
wantPatches: []clientgotesting.PatchActionImpl{
{
Name: "1-abcdef",
Patch: []byte(`[{"op":"replace","path":"/spec","value":{"host":"test.com","path":"/","to":{"kind":"","name":"service-1","weight":null},"port":{"targetPort":"http"},"tls":{"termination":"reencrypt","certificate":"cert","key":"key","insecureEdgeTerminationPolicy":"Redirect"}}}]`),
},
},
},
{
name: "termination policy on ingress invalid, nothing happens",
fields: fields{
i: &ingressLister{Items: []*networkingv1beta1.Ingress{
{
ObjectMeta: metav1.ObjectMeta{
Name: "1",
Namespace: "test",
Annotations: map[string]string{
"route.openshift.io/termination": "Passthrough",
},
},
Spec: networkingv1beta1.IngressSpec{
TLS: []networkingv1beta1.IngressTLS{
{Hosts: []string{"test.com"}, SecretName: "secret-1"},
},
Rules: []networkingv1beta1.IngressRule{
{
Host: "test.com",
IngressRuleValue: networkingv1beta1.IngressRuleValue{
HTTP: &networkingv1beta1.HTTPIngressRuleValue{
Paths: []networkingv1beta1.HTTPIngressPath{
{
Path: "/", Backend: networkingv1beta1.IngressBackend{
ServiceName: "service-1",
ServicePort: intstr.FromString("http"),
},
},
},
},
},
},
},
},
},
}},
r: &routeLister{Items: []*routev1.Route{
{
ObjectMeta: metav1.ObjectMeta{
Name: "1-abcdef",
Namespace: "test",
OwnerReferences: []metav1.OwnerReference{{APIVersion: "networking.k8s.io/v1beta1", Kind: "Ingress", Name: "1", Controller: &boolTrue}},
},
Spec: routev1.RouteSpec{
Host: "test.com",
Path: "/",
TLS: &routev1.TLSConfig{
Termination: routev1.TLSTerminationEdge,
Certificate: "cert",
Key: "key",
InsecureEdgeTerminationPolicy: routev1.InsecureEdgeTerminationPolicyRedirect,
},
To: routev1.RouteTargetReference{
Name: "service-1",
},
Port: &routev1.RoutePort{
TargetPort: intstr.FromString("http"),
},
WildcardPolicy: routev1.WildcardPolicyNone,
},
},
}},
},
args: queueKey{namespace: "test", name: "1"},
},
{
name: "update route - secret values changed",
fields: fields{
Expand Down

0 comments on commit b6f2430

Please sign in to comment.