Skip to content

Commit 0173b0e

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #3616 from Nezz7/main
Add CertficateArn field to IngressClassParam
2 parents b44633a + 7809766 commit 0173b0e

File tree

7 files changed

+301
-3
lines changed

7 files changed

+301
-3
lines changed

‎apis/elbv2/v1beta1/ingressclassparams_types.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,10 @@ type Attribute struct {
8686

8787
// IngressClassParamsSpec defines the desired state of IngressClassParams
8888
type IngressClassParamsSpec struct {
89+
// CertificateARN specifies the ARN of the certificates for all Ingresses that belong to IngressClass with this IngressClassParams.
90+
// +optional
91+
CertficateArn []string `json:"certficateArn,omitempty"`
92+
8993
// NamespaceSelector restrict the namespaces of Ingresses that are allowed to specify the IngressClass with this IngressClassParams.
9094
// * if absent or present but empty, it selects all namespaces.
9195
// +optional

‎apis/elbv2/v1beta1/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/elbv2.k8s.aws_ingressclassparams.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,12 @@ spec:
5555
spec:
5656
description: IngressClassParamsSpec defines the desired state of IngressClassParams
5757
properties:
58+
certficateArn:
59+
description: CertificateARN specifies the ARN of the certificates
60+
for all Ingresses that belong to IngressClass with this IngressClassParams.
61+
items:
62+
type: string
63+
type: array
5864
group:
5965
description: Group defines the IngressGroup for all Ingresses that
6066
belong to IngressClass with this IngressClassParams.

‎docs/guide/ingress/ingress_class.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,11 @@ Cluster administrators can use the `scheme` field to restrict the scheme for all
167167
Cluster administrators can use the optional `inboundCIDRs` field to specify the CIDRs that are allowed to access the load balancers that belong to this IngressClass.
168168
If the field is specified, LBC will ignore the `alb.ingress.kubernetes.io/inbound-cidrs` annotation.
169169

170+
### spec.certificateArn
171+
Cluster administrators can use the optional `certificateARN` field to specify the ARN of the certificates for all Ingresses that belong to IngressClass with this IngressClassParams.
172+
173+
If the field is specified, LBC will ignore the `alb.ingress.kubernetes.io/certificate-arn` annotation.
174+
170175
#### spec.sslPolicy
171176

172177
Cluster administrators can use the optional `sslPolicy` field to specify the SSL policy for the load balancers that belong to this IngressClass.

‎helm/aws-load-balancer-controller/crds/crds.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,13 @@ spec:
5454
spec:
5555
description: IngressClassParamsSpec defines the desired state of IngressClassParams
5656
properties:
57+
certficateArn:
58+
description:
59+
CertificateARN specifies the ARN of the certificates for
60+
all Ingresses that belong to IngressClass with this IngressClassParams.
61+
items:
62+
type: string
63+
type: array
5764
group:
5865
description: Group defines the IngressGroup for all Ingresses that
5966
belong to IngressClass with this IngressClassParams.

‎pkg/ingress/model_build_listener.go

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ type listenPortConfig struct {
110110
}
111111

112112
func (t *defaultModelBuildTask) computeIngressListenPortConfigByPort(ctx context.Context, ing *ClassifiedIngress) (map[int64]listenPortConfig, error) {
113-
explicitTLSCertARNs := t.computeIngressExplicitTLSCertARNs(ctx, ing.Ing)
113+
explicitTLSCertARNs := t.computeIngressExplicitTLSCertARNs(ctx, ing)
114114
explicitSSLPolicy := t.computeIngressExplicitSSLPolicy(ctx, ing)
115115
var prefixListIDs []string
116116
t.annotationParser.ParseStringSliceAnnotation(annotations.IngressSuffixSecurityGroupPrefixLists, &prefixListIDs, ing.Ing.Annotations)
@@ -166,9 +166,12 @@ func (t *defaultModelBuildTask) computeIngressListenPortConfigByPort(ctx context
166166
return listenPortConfigByPort, nil
167167
}
168168

169-
func (t *defaultModelBuildTask) computeIngressExplicitTLSCertARNs(_ context.Context, ing *networking.Ingress) []string {
169+
func (t *defaultModelBuildTask) computeIngressExplicitTLSCertARNs(_ context.Context, ing *ClassifiedIngress) []string {
170+
if ing.IngClassConfig.IngClassParams != nil && len(ing.IngClassConfig.IngClassParams.Spec.CertficateArn) != 0 {
171+
return ing.IngClassConfig.IngClassParams.Spec.CertficateArn
172+
}
170173
var rawTLSCertARNs []string
171-
_ = t.annotationParser.ParseStringSliceAnnotation(annotations.IngressSuffixCertificateARN, &rawTLSCertARNs, ing.Annotations)
174+
_ = t.annotationParser.ParseStringSliceAnnotation(annotations.IngressSuffixCertificateARN, &rawTLSCertARNs, ing.Ing.Annotations)
172175
return rawTLSCertARNs
173176
}
174177

‎pkg/ingress/model_builder_test.go

Lines changed: 268 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1876,6 +1876,274 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
18761876
"80:3": null
18771877
}
18781878
}
1879+
}`,
1880+
},
1881+
{
1882+
name: "Ingress - certificate-arn in IngressClassParams",
1883+
env: env{
1884+
svcs: []*corev1.Service{ns_1_svc_1, ns_1_svc_2, ns_1_svc_3},
1885+
},
1886+
fields: fields{
1887+
resolveViaDiscoveryCalls: []resolveViaDiscoveryCall{resolveViaDiscoveryCallForInternalLB},
1888+
listLoadBalancersCalls: []listLoadBalancersCall{listLoadBalancerCallForEmptyLB},
1889+
enableBackendSG: true,
1890+
},
1891+
args: args{
1892+
ingGroup: Group{
1893+
ID: GroupID{Namespace: "ns-1", Name: "ing-1"},
1894+
Members: []ClassifiedIngress{
1895+
{
1896+
IngClassConfig: ClassConfiguration{
1897+
IngClassParams: &v1beta1.IngressClassParams{
1898+
Spec: v1beta1.IngressClassParamsSpec{
1899+
CertficateArn: []string{"arn:aws:acm:us-east-1:9999999:certificate/ingress-class-certificate-arn"},
1900+
},
1901+
},
1902+
},
1903+
Ing: &networking.Ingress{ObjectMeta: metav1.ObjectMeta{
1904+
Namespace: "ns-1",
1905+
Name: "ing-1",
1906+
Annotations: map[string]string{
1907+
"alb.ingress.kubernetes.io/certificate-arn": "arn:aws:acm:us-east-1:9999999:certificate/annotated-certificate-arn",
1908+
},
1909+
},
1910+
Spec: networking.IngressSpec{
1911+
Rules: []networking.IngressRule{
1912+
{
1913+
Host: "app-1.example.com",
1914+
IngressRuleValue: networking.IngressRuleValue{
1915+
HTTP: &networking.HTTPIngressRuleValue{
1916+
Paths: []networking.HTTPIngressPath{
1917+
{
1918+
Path: "/svc-1",
1919+
Backend: networking.IngressBackend{
1920+
Service: &networking.IngressServiceBackend{
1921+
Name: ns_1_svc_1.Name,
1922+
Port: networking.ServiceBackendPort{
1923+
Name: "http",
1924+
},
1925+
},
1926+
},
1927+
},
1928+
{
1929+
Path: "/svc-2",
1930+
Backend: networking.IngressBackend{
1931+
Service: &networking.IngressServiceBackend{
1932+
Name: ns_1_svc_2.Name,
1933+
Port: networking.ServiceBackendPort{
1934+
Name: "http",
1935+
},
1936+
},
1937+
},
1938+
},
1939+
},
1940+
},
1941+
},
1942+
},
1943+
{
1944+
Host: "app-2.example.com",
1945+
IngressRuleValue: networking.IngressRuleValue{
1946+
HTTP: &networking.HTTPIngressRuleValue{
1947+
Paths: []networking.HTTPIngressPath{
1948+
{
1949+
Path: "/svc-3",
1950+
Backend: networking.IngressBackend{
1951+
Service: &networking.IngressServiceBackend{
1952+
Name: ns_1_svc_3.Name,
1953+
Port: networking.ServiceBackendPort{
1954+
Name: "https",
1955+
},
1956+
},
1957+
},
1958+
},
1959+
},
1960+
},
1961+
},
1962+
},
1963+
},
1964+
},
1965+
},
1966+
},
1967+
},
1968+
},
1969+
},
1970+
wantStackPatch: `
1971+
{
1972+
"resources": {
1973+
"AWS::EC2::SecurityGroup": {
1974+
"ManagedLBSecurityGroup": {
1975+
"spec": {
1976+
"ingress": [
1977+
{
1978+
"fromPort": 443,
1979+
"ipProtocol": "tcp",
1980+
"ipRanges": [
1981+
{
1982+
"cidrIP": "0.0.0.0/0"
1983+
}
1984+
],
1985+
"toPort": 443
1986+
}
1987+
]
1988+
}
1989+
}
1990+
},
1991+
"AWS::ElasticLoadBalancingV2::Listener": {
1992+
"443": {
1993+
"spec": {
1994+
"certificates": [
1995+
{
1996+
"certificateARN": "arn:aws:acm:us-east-1:9999999:certificate/ingress-class-certificate-arn"
1997+
}
1998+
],
1999+
"defaultActions": [
2000+
{
2001+
"fixedResponseConfig": {
2002+
"contentType": "text/plain",
2003+
"statusCode": "404"
2004+
},
2005+
"type": "fixed-response"
2006+
}
2007+
],
2008+
"loadBalancerARN": {
2009+
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::LoadBalancer/LoadBalancer/status/loadBalancerARN"
2010+
},
2011+
"port": 443,
2012+
"protocol": "HTTPS",
2013+
"sslPolicy": "ELBSecurityPolicy-2016-08",
2014+
"mutualAuthentication": {
2015+
"mode" : "off"
2016+
}
2017+
}
2018+
},
2019+
"80": null
2020+
},
2021+
"AWS::ElasticLoadBalancingV2::ListenerRule": {
2022+
"443:1": {
2023+
"spec": {
2024+
"actions": [
2025+
{
2026+
"forwardConfig": {
2027+
"targetGroups": [
2028+
{
2029+
"targetGroupARN": {
2030+
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::TargetGroup/ns-1/ing-1-svc-1:http/status/targetGroupARN"
2031+
}
2032+
}
2033+
]
2034+
},
2035+
"type": "forward"
2036+
}
2037+
],
2038+
"conditions": [
2039+
{
2040+
"field": "host-header",
2041+
"hostHeaderConfig": {
2042+
"values": [
2043+
"app-1.example.com"
2044+
]
2045+
}
2046+
},
2047+
{
2048+
"field": "path-pattern",
2049+
"pathPatternConfig": {
2050+
"values": [
2051+
"/svc-1"
2052+
]
2053+
}
2054+
}
2055+
],
2056+
"listenerARN": {
2057+
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::Listener/443/status/listenerARN"
2058+
},
2059+
"priority": 1
2060+
}
2061+
},
2062+
"443:2": {
2063+
"spec": {
2064+
"actions": [
2065+
{
2066+
"forwardConfig": {
2067+
"targetGroups": [
2068+
{
2069+
"targetGroupARN": {
2070+
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::TargetGroup/ns-1/ing-1-svc-2:http/status/targetGroupARN"
2071+
}
2072+
}
2073+
]
2074+
},
2075+
"type": "forward"
2076+
}
2077+
],
2078+
"conditions": [
2079+
{
2080+
"field": "host-header",
2081+
"hostHeaderConfig": {
2082+
"values": [
2083+
"app-1.example.com"
2084+
]
2085+
}
2086+
},
2087+
{
2088+
"field": "path-pattern",
2089+
"pathPatternConfig": {
2090+
"values": [
2091+
"/svc-2"
2092+
]
2093+
}
2094+
}
2095+
],
2096+
"listenerARN": {
2097+
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::Listener/443/status/listenerARN"
2098+
},
2099+
"priority": 2
2100+
}
2101+
},
2102+
"443:3": {
2103+
"spec": {
2104+
"actions": [
2105+
{
2106+
"forwardConfig": {
2107+
"targetGroups": [
2108+
{
2109+
"targetGroupARN": {
2110+
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::TargetGroup/ns-1/ing-1-svc-3:https/status/targetGroupARN"
2111+
}
2112+
}
2113+
]
2114+
},
2115+
"type": "forward"
2116+
}
2117+
],
2118+
"conditions": [
2119+
{
2120+
"field": "host-header",
2121+
"hostHeaderConfig": {
2122+
"values": [
2123+
"app-2.example.com"
2124+
]
2125+
}
2126+
},
2127+
{
2128+
"field": "path-pattern",
2129+
"pathPatternConfig": {
2130+
"values": [
2131+
"/svc-3"
2132+
]
2133+
}
2134+
}
2135+
],
2136+
"listenerARN": {
2137+
"$ref": "#/resources/AWS::ElasticLoadBalancingV2::Listener/443/status/listenerARN"
2138+
},
2139+
"priority": 3
2140+
}
2141+
},
2142+
"80:1": null,
2143+
"80:2": null,
2144+
"80:3": null
2145+
}
2146+
}
18792147
}`,
18802148
},
18812149
{

0 commit comments

Comments
 (0)