Add support for fetching k8s Ingress TLS data from secrets

docs/user-guide/kubernetes.md

@@ -333,6 +333,51 @@ echo "$(minikube ip) traefik-ui.minikube" | sudo tee -a /etc/hosts
 
 We should now be able to visit [traefik-ui.minikube](http://traefik-ui.minikube) in the browser and view the Træfik Web UI.
 
+### Add a TLS Certificate to the Ingress
+
+!!! note
+    For this example to work you need a TLS entrypoint. You don't have to provide a TLS certificate at this point. For more details see [here](/configuration/entrypoints/).
+
+To setup an HTTPS-protected ingress, you can leverage the TLS feature of the ingress resource.
+
+```yaml
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: traefik-web-ui
+  namespace: kube-system
+  annotations:
+    kubernetes.io/ingress.class: traefik
+spec:
+  rules:
+  - host: traefik-ui.minikube
+    http:
+      paths:
+      - backend:
+          serviceName: traefik-web-ui
+          servicePort: 80
+  tls:
+    secretName: traefik-ui-tls-cert
+```
+
+In addition to the modified ingress you need to provide the TLS certificate via a kubernetes secret in the same namespace as the ingress. The following two commands will generate a new certificate and create a secret containing the key and cert files.
+
+```shell
+openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=traefik-ui.minikube"
+kubectl -n kube-system create secret tls traefik-ui-tls-cert --key=tls.key --cert=tls.crt
+```
+
+If there are any errors while loading the TLS section of an ingress, the whole ingress will be skipped.
+
+!!! note
+    The secret must have two entries named `tls.key`and `tls.crt`. See the [kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls) for more details.
+
+!!! note
+    The TLS certificates will be added to all entrypoints defined by the ingress annotation `traefik.frontend.entryPoints`. If no such annotation is provided, the TLS certificates will be added to all TLS-enabled `defaultEntryPoints`.
+
+!!! note
+    The field `hosts` in the TLS configuration is ignored. Instead, the domains provided by the certificate are used for this purpose. It is recommended to not use wildcard certificates as they will match globally.
+
 ## Basic Authentication
 
 It's possible to add additional authentication annotations in the Ingress rule.

provider/kubernetes/builder_configuration_test.go

@@ -3,6 +3,7 @@ package kubernetes
 import (
 	"testing"
 
+	"github.com/containous/traefik/tls"
 	"github.com/containous/traefik/types"
 	"github.com/stretchr/testify/assert"
 )
@@ -201,6 +202,39 @@ func route(name string, rule string) func(*types.Route) string {
 	}
 }
 
+func tlsConfigurations(opts ...func(*tls.Configuration)) func(*types.Configuration) {
+	return func(c *types.Configuration) {
+		for _, opt := range opts {
+			tlsConf := &tls.Configuration{}
+			opt(tlsConf)
+			c.TLSConfiguration = append(c.TLSConfiguration, tlsConf)
+		}
+	}
+}
+
+func tlsConfiguration(opts ...func(*tls.Configuration)) func(*tls.Configuration) {
+	return func(c *tls.Configuration) {
+		for _, opt := range opts {
+			opt(c)
+		}
+	}
+}
+
+func tlsEntryPoints(entryPoints ...string) func(*tls.Configuration) {
+	return func(c *tls.Configuration) {
+		c.EntryPoints = entryPoints
+	}
+}
+
+func certificate(cert string, key string) func(*tls.Configuration) {
+	return func(c *tls.Configuration) {
+		c.Certificate = &tls.Certificate{
+			CertFile: tls.FileOrContent(cert),
+			KeyFile:  tls.FileOrContent(key),
+		}
+	}
+}
+
 // Test
 
 func TestBuildConfiguration(t *testing.T) {
@@ -247,6 +281,12 @@ func TestBuildConfiguration(t *testing.T) {
 				),
 			),
 		),
+		tlsConfigurations(
+			tlsConfiguration(
+				tlsEntryPoints("https"),
+				certificate("certificate", "key"),
+			),
+		),
 	)
 
 	assert.EqualValues(t, sampleConfiguration(), actual)
@@ -335,5 +375,14 @@ func sampleConfiguration() *types.Configuration {
 				},
 			},
 		},
+		TLSConfiguration: []*tls.Configuration{
+			{
+				EntryPoints: []string{"https"},
+				Certificate: &tls.Certificate{
+					CertFile: tls.FileOrContent("certificate"),
+					KeyFile:  tls.FileOrContent("key"),
+				},
+			},
+		},
 	}
 }

provider/kubernetes/builder_ingress_test.go

@@ -92,6 +92,23 @@ func iBackend(name string, port intstr.IntOrString) func(*v1beta1.HTTPIngressPat
 	}
 }
 
+func iTLSes(opts ...func(*v1beta1.IngressTLS)) func(*v1beta1.Ingress) {
+	return func(i *v1beta1.Ingress) {
+		for _, opt := range opts {
+			iTLS := v1beta1.IngressTLS{}
+			opt(&iTLS)
+			i.Spec.TLS = append(i.Spec.TLS, iTLS)
+		}
+	}
+}
+
+func iTLS(secret string, hosts ...string) func(*v1beta1.IngressTLS) {
+	return func(i *v1beta1.IngressTLS) {
+		i.SecretName = secret
+		i.Hosts = hosts
+	}
+}
+
 // Test
 
 func TestBuildIngress(t *testing.T) {
@@ -107,7 +124,11 @@ func TestBuildIngress(t *testing.T) {
 				onePath(iBackend("service2", intstr.FromInt(802))),
 			),
 			),
-		))
+		),
+		iTLSes(
+			iTLS("tls-secret", "foo"),
+		),
+	)
 
 	assert.EqualValues(t, sampleIngress(), i)
 }
@@ -164,6 +185,12 @@ func sampleIngress() *v1beta1.Ingress {
 					},
 				},
 			},
+			TLS: []v1beta1.IngressTLS{
+				{
+					Hosts:      []string{"foo"},
+					SecretName: "tls-secret",
+				},
+			},
 		},
 	}
 }

provider/kubernetes/kubernetes.go

@@ -19,6 +19,7 @@ import (
 	"github.com/containous/traefik/provider"
 	"github.com/containous/traefik/provider/label"
 	"github.com/containous/traefik/safe"
+	"github.com/containous/traefik/tls"
 	"github.com/containous/traefik/types"
 	"k8s.io/client-go/pkg/api/v1"
 	"k8s.io/client-go/pkg/apis/extensions/v1beta1"
@@ -174,6 +175,13 @@ func (p *Provider) loadIngresses(k8sClient Client) (*types.Configuration, error)
 			continue
 		}
 
+		tlsConfigs, err := getTLSConfigurations(i, k8sClient)
+		if err != nil {
+			log.Errorf("Error configuring TLS for ingress %s/%s: %v", i.Namespace, i.Name, err)
+			continue
+		}
+		templateObjects.TLSConfiguration = append(templateObjects.TLSConfiguration, tlsConfigs...)
+
 		for _, r := range i.Spec.Rules {
 			if r.HTTP == nil {
 				log.Warn("Error in ingress: HTTP is nil")
@@ -441,6 +449,48 @@ func loadAuthCredentials(namespace, secretName string, k8sClient Client) ([]stri
 	return creds, nil
 }
 
+func getTLSConfigurations(ingress *v1beta1.Ingress, k8sClient Client) ([]*tls.Configuration, error) {
+	var tlsConfigs []*tls.Configuration
+
+	for _, t := range ingress.Spec.TLS {
+		tlsSecret, exists, err := k8sClient.GetSecret(ingress.Namespace, t.SecretName)
+		if err != nil {
+			return nil, fmt.Errorf("failed to fetch secret %s/%s: %v", ingress.Namespace, t.SecretName, err)
+		}
+		if !exists {
+			return nil, fmt.Errorf("secret %s/%s does not exist", ingress.Namespace, t.SecretName)
+		}
+
+		tlsCrtData, tlsCrtExists := tlsSecret.Data["tls.crt"]
+		tlsKeyData, tlsKeyExists := tlsSecret.Data["tls.key"]
+
+		var missingEntries []string
+		if !tlsCrtExists {
+			missingEntries = append(missingEntries, "tls.crt")
+		}
+		if !tlsKeyExists {
+			missingEntries = append(missingEntries, "tls.key")
+		}
+		if len(missingEntries) > 0 {
+			return nil, fmt.Errorf("secret %s/%s is missing the following TLS data entries: %s", ingress.Namespace, t.SecretName, strings.Join(missingEntries, ", "))
+		}
+
+		entryPoints := label.GetSliceStringValue(ingress.Annotations, label.TraefikFrontendEntryPoints)
+
+		tlsConfig := &tls.Configuration{
+			EntryPoints: entryPoints,
+			Certificate: &tls.Certificate{
+				CertFile: tls.FileOrContent(tlsCrtData),
+				KeyFile:  tls.FileOrContent(tlsKeyData),
+			},
+		}
+
+		tlsConfigs = append(tlsConfigs, tlsConfig)
+	}
+
+	return tlsConfigs, nil
+}
+
 func endpointPortNumber(servicePort v1.ServicePort, endpointPorts []v1.EndpointPort) int {
 	if len(endpointPorts) > 0 {
 		//name is optional if there is only one port