Skip to content

Commit

Permalink
Merge branch 'main' into add-events-to-special-secrets
Browse files Browse the repository at this point in the history 
Signed-off-by: Paul Abel <[email protected]>
  • Loading branch information
@pdabelf5
pdabelf5 authored Nov 28, 2024
2 parents c60d1ca + 5b5e052 commit 1c2b044
Show file tree
Hide file tree
Showing 4 changed files with 47 additions and 19 deletions.
25 changes: 16 additions & 9 deletions cmd/nginx-ingress/main.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,9 @@ func main() {
if err != nil {
logEventAndExit(ctx, eventRecorder, pod, secretErrorReason, err)
}

Check warning on line 162 in cmd/nginx-ingress/main.go

View check run for this annotation

Codecov / codecov/patch

cmd/nginx-ingress/main.go#L159-L162 

Added lines #L159 - L162 were not covered by tests

staticSSLPath := nginxManager.GetSecretsDir()

globalConfigurationValidator := createGlobalConfigurationValidator()

mustProcessGlobalConfiguration(ctx)
Expand Down Expand Up @@ -191,7 +194,7 @@ func main() {
EnableCertManager: *enableCertManager,
DynamicSSLReload: *enableDynamicSSLReload,
DynamicWeightChangesReload: *enableDynamicWeightChangesReload,
StaticSSLPath: nginxManager.GetSecretsDir(),
StaticSSLPath: staticSSLPath,
NginxVersion: nginxVersion,
AppProtectBundlePath: appProtectBundlePath,
}
Expand Down Expand Up @@ -577,7 +580,7 @@ func processDefaultServerSecret(kubeClient *kubernetes.Clientset, nginxManager n
var sslRejectHandshake bool

if *defaultServerSecret != "" {
secret, err := getAndValidateSecret(kubeClient, *defaultServerSecret)
secret, err := getAndValidateSecret(kubeClient, *defaultServerSecret, api_v1.SecretTypeTLS)
if err != nil {
return sslRejectHandshake, fmt.Errorf("error trying to get the default server TLS secret %v: %w", *defaultServerSecret, err)

Check warning on line 585 in cmd/nginx-ingress/main.go

View check run for this annotation

Codecov / codecov/patch

cmd/nginx-ingress/main.go#L585 

Added line #L585 was not covered by tests
}
Expand All @@ -601,7 +604,7 @@ func processDefaultServerSecret(kubeClient *kubernetes.Clientset, nginxManager n
func processWildcardSecret(kubeClient *kubernetes.Clientset, nginxManager nginx.Manager) (bool, error) {
isWildcardEnabled := *wildcardTLSSecret != ""
if isWildcardEnabled {

Check warning on line 606 in cmd/nginx-ingress/main.go

View check run for this annotation

Codecov / codecov/patch

cmd/nginx-ingress/main.go#L604-L606 

Added lines #L604 - L606 were not covered by tests
secret, err := getAndValidateSecret(kubeClient, *wildcardTLSSecret)
secret, err := getAndValidateSecret(kubeClient, *wildcardTLSSecret, api_v1.SecretTypeTLS)
if err != nil {
return false, fmt.Errorf("error trying to get the wildcard TLS secret %v: %w", *wildcardTLSSecret, err)

Check warning on line 609 in cmd/nginx-ingress/main.go

View check run for this annotation

Codecov / codecov/patch

cmd/nginx-ingress/main.go#L609 

Added line #L609 was not covered by tests
}
Expand Down Expand Up @@ -671,7 +674,8 @@ func getSocketClient(sockPath string) *http.Client {
}

// getAndValidateSecret gets and validates a secret.
func getAndValidateSecret(kubeClient *kubernetes.Clientset, secretNsName string) (secret *api_v1.Secret, err error) {
// nolint:unparam
func getAndValidateSecret(kubeClient *kubernetes.Clientset, secretNsName string, secretType api_v1.SecretType) (secret *api_v1.Secret, err error) {
ns, name, err := k8s.ParseNamespaceName(secretNsName)
if err != nil {
return nil, fmt.Errorf("could not parse the %v argument: %w", secretNsName, err)
Expand All @@ -680,9 +684,12 @@ func getAndValidateSecret(kubeClient *kubernetes.Clientset, secretNsName string)
if err != nil {
return nil, fmt.Errorf("could not get %v: %w", secretNsName, err)
}
err = secrets.ValidateTLSSecret(secret)
if err != nil {
return nil, fmt.Errorf("%v is invalid: %w", secretNsName, err)
switch secretType {
case api_v1.SecretTypeTLS:
err = secrets.ValidateTLSSecret(secret)
if err != nil {
return nil, fmt.Errorf("%v is invalid: %w", secretNsName, err)
}
}
return secret, nil
}
Expand Down Expand Up @@ -789,7 +796,7 @@ func createPlusAndLatencyCollectors(
syslogListener = metrics.NewSyslogFakeServer()

if *prometheusTLSSecretName != "" {
prometheusSecret, err = getAndValidateSecret(kubeClient, *prometheusTLSSecretName)
prometheusSecret, err = getAndValidateSecret(kubeClient, *prometheusTLSSecretName, api_v1.SecretTypeTLS)
if err != nil {
nl.Fatalf(l, "Error trying to get the prometheus TLS secret %v: %v", *prometheusTLSSecretName, err)
}
Expand Down Expand Up @@ -841,7 +848,7 @@ func createHealthProbeEndpoint(kubeClient *kubernetes.Clientset, plusClient *cli
var err error

if *serviceInsightTLSSecretName != "" {
serviceInsightSecret, err = getAndValidateSecret(kubeClient, *serviceInsightTLSSecretName)
serviceInsightSecret, err = getAndValidateSecret(kubeClient, *serviceInsightTLSSecretName, api_v1.SecretTypeTLS)
if err != nil {
nl.Fatalf(l, "Error trying to get the service insight TLS secret %v: %v", *serviceInsightTLSSecretName, err)
}
Expand Down
11 changes: 11 additions & 0 deletions internal/configs/version1/template_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@ import (
"github.com/nginxinc/kubernetes-ingress/internal/nginx"
)

var fakeManager = nginx.NewFakeManager("/etc/nginx")

func TestMain(m *testing.M) {
v := m.Run()

Expand Down Expand Up @@ -2017,6 +2019,7 @@ var (
}

mainCfg = MainConfig{
StaticSSLPath: fakeManager.GetSecretsDir(),
DefaultHTTPListenerPort: 80,
DefaultHTTPSListenerPort: 443,
ServerNamesHashMaxSize: "512",
Expand Down Expand Up @@ -2061,6 +2064,7 @@ var (
}

mainCfgR31 = MainConfig{
StaticSSLPath: fakeManager.GetSecretsDir(),
DefaultHTTPListenerPort: 80,
DefaultHTTPSListenerPort: 443,
ServerNamesHashMaxSize: "512",
Expand Down Expand Up @@ -2090,6 +2094,7 @@ var (
}

mainCfgHTTP2On = MainConfig{
StaticSSLPath: fakeManager.GetSecretsDir(),
DefaultHTTPListenerPort: 80,
DefaultHTTPSListenerPort: 443,
HTTP2: true,
Expand Down Expand Up @@ -2130,6 +2135,7 @@ var (
}

mainCfgCustomTLSPassthroughPort = MainConfig{
StaticSSLPath: fakeManager.GetSecretsDir(),
ServerNamesHashMaxSize: "512",
ServerTokens: "off",
WorkerProcesses: "auto",
Expand Down Expand Up @@ -2157,6 +2163,7 @@ var (
}

mainCfgWithoutTLSPassthrough = MainConfig{
StaticSSLPath: fakeManager.GetSecretsDir(),
ServerNamesHashMaxSize: "512",
ServerTokens: "off",
WorkerProcesses: "auto",
Expand Down Expand Up @@ -2184,6 +2191,7 @@ var (
}

mainCfgDefaultTLSPassthroughPort = MainConfig{
StaticSSLPath: fakeManager.GetSecretsDir(),
ServerNamesHashMaxSize: "512",
ServerTokens: "off",
WorkerProcesses: "auto",
Expand Down Expand Up @@ -2211,6 +2219,7 @@ var (
}

mainCfgCustomDefaultHTTPAndHTTPSListenerPorts = MainConfig{
StaticSSLPath: fakeManager.GetSecretsDir(),
DefaultHTTPListenerPort: 8083,
DefaultHTTPSListenerPort: 8443,
ServerNamesHashMaxSize: "512",
Expand Down Expand Up @@ -2238,6 +2247,7 @@ var (
}

mainCfgCustomDefaultHTTPListenerPort = MainConfig{
StaticSSLPath: fakeManager.GetSecretsDir(),
DefaultHTTPListenerPort: 8083,
DefaultHTTPSListenerPort: 443,
ServerNamesHashMaxSize: "512",
Expand Down Expand Up @@ -2265,6 +2275,7 @@ var (
}

mainCfgCustomDefaultHTTPSListenerPort = MainConfig{
StaticSSLPath: fakeManager.GetSecretsDir(),
DefaultHTTPListenerPort: 80,
DefaultHTTPSListenerPort: 8443,
ServerNamesHashMaxSize: "512",
Expand Down
28 changes: 18 additions & 10 deletions internal/k8s/configmap.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -50,9 +50,8 @@ func createConfigMapHandlers(lbc *LoadBalancerController, name string) cache.Res
}
}

// addConfigMapHandler adds the handler for config maps to the controller
func (lbc *LoadBalancerController) addConfigMapHandler(handlers cache.ResourceEventHandlerFuncs, namespace string) {
options := cache.InformerOptions{
func (lbc *LoadBalancerController) getConfigMapHandlerOptions(handlers cache.ResourceEventHandlerFuncs, namespace string) cache.InformerOptions {
return cache.InformerOptions{
ListerWatcher: cache.NewListWatchFromClient(
lbc.client.CoreV1().RESTClient(),
"configmaps",
Expand All @@ -62,6 +61,12 @@ func (lbc *LoadBalancerController) addConfigMapHandler(handlers cache.ResourceEv
ResyncPeriod: lbc.resync,
Handler: handlers,
}
}

// addConfigMapHandler adds the handler for config maps to the controller
func (lbc *LoadBalancerController) addConfigMapHandler(handlers cache.ResourceEventHandlerFuncs, namespace string) {
options := lbc.getConfigMapHandlerOptions(handlers, namespace)

lbc.configMapLister.Store, lbc.configMapController = cache.NewInformerWithOptions(options)
lbc.cacheSyncs = append(lbc.cacheSyncs, lbc.configMapController.HasSynced)
}
Expand All @@ -75,14 +80,17 @@ func (lbc *LoadBalancerController) syncConfigMap(task task) {
lbc.syncQueue.Requeue(task, err)
return
}
if configExists {
lbc.configMap = obj.(*v1.ConfigMap)
externalStatusAddress, exists := lbc.configMap.Data["external-status-address"]
if exists {
lbc.statusUpdater.SaveStatusFromExternalStatus(externalStatusAddress)
switch key {
case lbc.nginxConfigMapName:
if configExists {
lbc.configMap = obj.(*v1.ConfigMap)
externalStatusAddress, exists := lbc.configMap.Data["external-status-address"]
if exists {
lbc.statusUpdater.SaveStatusFromExternalStatus(externalStatusAddress)
}
} else {
lbc.configMap = nil
}
} else {
lbc.configMap = nil
}

if !lbc.isNginxReady {
Expand Down
2 changes: 2 additions & 0 deletions internal/k8s/controller.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -171,6 +171,7 @@ type LoadBalancerController struct {
telemetryCollector *telemetry.Collector
telemetryChan chan struct{}
weightChangesDynamicReload bool
nginxConfigMapName string
}

var keyFunc = cache.DeletionHandlingMetaNamespaceKeyFunc
Expand Down Expand Up @@ -263,6 +264,7 @@ func NewLoadBalancerController(input NewLoadBalancerControllerInput) *LoadBalanc
isLatencyMetricsEnabled: input.IsLatencyMetricsEnabled,
isIPV6Disabled: input.IsIPV6Disabled,
weightChangesDynamicReload: input.DynamicWeightChangesReload,
nginxConfigMapName: input.ConfigMaps,
}

lbc.syncQueue = newTaskQueue(lbc.Logger, lbc.sync)
Expand Down

0 comments on commit 1c2b044

Please sign in to comment.