fabricgateway: configure default SSL policy

Signed-off-by: Alexander Yastrebov <alexander.yastrebov@zalando.de>
zalando-incubator · May 6, 2022 · 60a1a28 · 60a1a28
1 parent 1549dad
commit 60a1a28
Show file tree

Hide file tree

Showing 2 changed files with 48 additions and 0 deletions.
diff --git a/kubernetes/adapter.go b/kubernetes/adapter.go
@@ -44,6 +44,7 @@ const (
 	DefaultClusterLocalDomain = ".cluster.local"
 	loadBalancerTypeNLB       = "nlb"
 	loadBalancerTypeALB       = "alb"
+	defaultFabricSSLPolicy    = "ELBSecurityPolicy-FS-2018-06"
 )
 
 var (
@@ -199,9 +200,24 @@ func (a *Adapter) newIngressFromFabric(fg *fabric) (*Ingress, error) {
 		}
 	}
 
+	configureFabricSSLPolicy(fg)
+
 	return a.newIngress(TypeFabricGateway, fg.Metadata, host, hostnames)
 }
 
+// Configure pre-defined SSL policy for backward compatibility with
+// Fabric gateway operator, see
+// https://github.com/zalando-incubator/fabric-gateway/blob/cdef22c0fc7914ae6434be1f59f4c80f9f24a171/src/main/scala/ie/zalando/fabric/gateway/service/IngressDerivationChain.scala#L627-L629
+func configureFabricSSLPolicy(fg *fabric) {
+	if fg.Metadata.Annotations == nil {
+		fg.Metadata.Annotations = make(map[string]string)
+	}
+	// Allow override
+	if _, ok := fg.Metadata.Annotations[ingressSSLPolicyAnnotation]; !ok {
+		fg.Metadata.Annotations[ingressSSLPolicyAnnotation] = defaultFabricSSLPolicy
+	}
+}
+
 func (a *Adapter) newIngress(typ IngressType, metadata kubeItemMetadata, host string, hostnames []string) (*Ingress, error) {
 	annotations := metadata.Annotations
 

diff --git a/kubernetes/adapter_test.go b/kubernetes/adapter_test.go
@@ -11,6 +11,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"github.com/zalando-incubator/kube-ingress-aws-controller/aws"
 )
 
@@ -803,3 +804,34 @@ func TestWithTargetCNIPodSelector(t *testing.T) {
 		assert.Equal(t, "application=skipper-ingress", a.cniPodLabelSelector)
 	})
 }
+
+func TestConfigureFabricSSLPolicy(t *testing.T) {
+	require.Contains(t, aws.SSLPolicies, defaultFabricSSLPolicy)
+
+	for _, test := range []struct {
+		name     string
+		fg       *fabric
+		expected string
+	}{
+		{
+			name:     "no annotations",
+			fg:       &fabric{},
+			expected: defaultFabricSSLPolicy,
+		},
+		{
+			name:     "other annotations",
+			fg:       &fabric{Metadata: kubeItemMetadata{Annotations: map[string]string{"foo": "bar"}}},
+			expected: defaultFabricSSLPolicy,
+		},
+		{
+			name:     "allow override",
+			fg:       &fabric{Metadata: kubeItemMetadata{Annotations: map[string]string{ingressSSLPolicyAnnotation: "a-policy"}}},
+			expected: "a-policy",
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			configureFabricSSLPolicy(test.fg)
+			assert.Equal(t, test.expected, test.fg.Metadata.Annotations[ingressSSLPolicyAnnotation])
+		})
+	}
+}