Skip to content
This repository has been archived by the owner on Jul 11, 2023. It is now read-only.

Support Ingress controllers with mTLS on them #3582

Closed
KnicKnic opened this issue Jun 11, 2021 · 1 comment
Closed

Support Ingress controllers with mTLS on them #3582

KnicKnic opened this issue Jun 11, 2021 · 1 comment
Assignees
@shashankram
Labels
area/ingress Ingress functionality

Comments

@KnicKnic
Copy link

KnicKnic commented Jun 11, 2021 •
edited
Loading

Please describe the Improvement and/or Feature Request
Blindly allow traffic to flow into the ingress controller, however add mTLS to the http sessions from the controller to the servers that the ingress forwards to.

public -> (allow *) (nginx) -> (OSM mTLS) webservers

I want to inject OSM into the ingress controller, and annotate it with please pass through data to ingress controller, however do mTLS on outgoing sessions.

Scope (please mark with X where applicable)

  • New Functionality [x ]

Possible use cases
In my usecase

  1. I have already authenticated traffic being proxied into the ingress controller (and is being secured with my own mTLS ).
    1. I need OSM to ignore this "inbound" traffic (ingress controller will decap the mTLS session)
  2. I then need outbound traffic from the ingress controller to use OSM mTLS sessions.

** Problems **

  1. I don't know how to communicate to envoy blindly ignore traffic on inbound port, yet pass it through to application that has been injected with sidecar
  2. I do not know how ingress rules will play with traffic policies.
    1. If I setup a TrafficTarget to allow ingress controller to talk to my backend webservers, and an ingress rule to proxy traffic from ingress controller to backend webservers, what happens to mTLS?
@shashankram shashankram added the area/ingress Ingress functionality label Jun 11, 2021
shashankram added a commit to shashankram/osm that referenced this issue Jun 14, 2021
@shashankram
injector: support inbound port exclusions
9def98c 
Similar to outbound port exclusions (global and pod
scoped), this change adds support to exclude specified
ports from inbound sidecar redirection.

This is required in certain scenarios when traffic
destined to certain ports should not be proxied
to the sidecar (ex. ports that terminate TLS
connections in the app).

Required for openservicemesh#3582

Signed-off-by: Shashank Ram <[email protected]>
shashankram added a commit to shashankram/osm that referenced this issue Jun 14, 2021
@shashankram
injector: support inbound port exclusions
6664c75 
Similar to outbound port exclusions (global and pod
scoped), this change adds support to exclude specified
ports from inbound sidecar redirection.

This is required in certain scenarios when traffic
destined to certain ports should not be proxied
to the sidecar (ex. ports that terminate TLS
connections in the app).

Required for openservicemesh#3582

Signed-off-by: Shashank Ram <[email protected]>
@shashankram shashankram mentioned this issue Jun 14, 2021
Merged
shashankram added a commit to shashankram/osm-docs that referenced this issue Jun 15, 2021
@shashankram
traffic/iptables: inbound port exclusions
cfeda91 
Documents inbound port exclusions for sidecar traffic
interception.

Required for openservicemesh/osm#3582

Signed-off-by: Shashank Ram <[email protected]>
@shashankram shashankram mentioned this issue Jun 15, 2021
Merged
whitneygriffith pushed a commit to whitneygriffith/osm that referenced this issue Jun 16, 2021
@shashankram @whitneygriffith
injector: support inbound port exclusions
f8686ae 
Similar to outbound port exclusions (global and pod
scoped), this change adds support to exclude specified
ports from inbound sidecar redirection.

This is required in certain scenarios when traffic
destined to certain ports should not be proxied
to the sidecar (ex. ports that terminate TLS
connections in the app).

Required for openservicemesh#3582

Signed-off-by: Shashank Ram <[email protected]>
whitneygriffith pushed a commit to whitneygriffith/osm that referenced this issue Jun 16, 2021
@shashankram @whitneygriffith
injector: support inbound port exclusions
e7f532e 
Similar to outbound port exclusions (global and pod
scoped), this change adds support to exclude specified
ports from inbound sidecar redirection.

This is required in certain scenarios when traffic
destined to certain ports should not be proxied
to the sidecar (ex. ports that terminate TLS
connections in the app).

Required for openservicemesh#3582

Signed-off-by: Shashank Ram <[email protected]>
whitneygriffith pushed a commit to whitneygriffith/osm that referenced this issue Jun 16, 2021
@shashankram @whitneygriffith
injector: support inbound port exclusions
0f7c274 
Similar to outbound port exclusions (global and pod
scoped), this change adds support to exclude specified
ports from inbound sidecar redirection.

This is required in certain scenarios when traffic
destined to certain ports should not be proxied
to the sidecar (ex. ports that terminate TLS
connections in the app).

Required for openservicemesh#3582

Signed-off-by: Shashank Ram <[email protected]>
@shashankram shashankram self-assigned this Jun 17, 2021
shashankram added a commit to shashankram/osm that referenced this issue Jun 17, 2021
@shashankram
ingress: support ignoring an ingress resource
b05c94a 
As a part of openservicemesh#3582, specific ingress resources
need to be ignored. This change adds support
for this using the existing `openservicemesh.io/ignore`
annotation.

Also addresses an unnecessary type export and unused
variable variable.

Signed-off-by: Shashank Ram <[email protected]>
shashankram added a commit to shashankram/osm that referenced this issue Jun 17, 2021
@shashankram
ingress: support ignoring an ingress resource
12bec8a 
As a part of openservicemesh#3582, specific ingress resources
need to be ignored. This change adds support
for this using the existing `openservicemesh.io/ignore`
label.

Also addresses an unnecessary type export and makes
unusued variable usage explicit.

Signed-off-by: Shashank Ram <[email protected]>
shashankram added a commit to shashankram/osm that referenced this issue Jun 17, 2021
@shashankram
ingress: support ignoring an ingress resource
1e9db72 
As a part of openservicemesh#3582, specific ingress resources
need to be ignored. This change adds support
for this using the existing `openservicemesh.io/ignore`
label.

Also addresses an unnecessary type export and makes
unusued variable usage explicit.

Signed-off-by: Shashank Ram <[email protected]>
shashankram added a commit to shashankram/osm that referenced this issue Jun 17, 2021
@shashankram
ingress: support ignoring an ingress resource
9c7a2d9 
As a part of openservicemesh#3582, specific ingress resources
need to be ignored. This change adds support
for this using the existing `openservicemesh.io/ignore`
label.

Also addresses an unnecessary type export and makes
unusued variable usage explicit.

Signed-off-by: Shashank Ram <[email protected]>
@shashankram shashankram mentioned this issue Jun 17, 2021
Merged
shashankram added a commit to shashankram/osm-docs that referenced this issue Jun 17, 2021
@shashankram
ingress: document ignore label
c27e355 
Documents how to ignore an ingress resource.

Part of openservicemesh/osm#3582

Signed-off-by: Shashank Ram <[email protected]>
shashankram added a commit to shashankram/osm-docs that referenced this issue Jun 17, 2021
@shashankram
ingress: document ignore label
2c2e3fa 
Documents how to ignore an ingress resource.

Part of openservicemesh/osm#3582

Signed-off-by: Shashank Ram <[email protected]>
@shashankram shashankram mentioned this issue Jun 17, 2021
Merged
shashankram added a commit to shashankram/osm that referenced this issue Jun 18, 2021
@shashankram
injector: support inbound port exclusions
018908a 
Similar to outbound port exclusions (global and pod
scoped), this change adds support to exclude specified
ports from inbound sidecar redirection.

This is required in certain scenarios when traffic
destined to certain ports should not be proxied
to the sidecar (ex. ports that terminate TLS
connections in the app).

Required for openservicemesh#3582

Signed-off-by: Shashank Ram <[email protected]>
shashankram added a commit to shashankram/osm that referenced this issue Jun 18, 2021
@shashankram
ingress: support ignoring an ingress resource
ef10fe2 
As a part of openservicemesh#3582, specific ingress resources
need to be ignored. This change adds support
for this using the existing `openservicemesh.io/ignore`
label.

Also addresses an unnecessary type export and makes
unusued variable usage explicit.

Signed-off-by: Shashank Ram <[email protected]>
@shashankram shashankram mentioned this issue Jun 18, 2021
Merged
whitneygriffith pushed a commit to whitneygriffith/osm that referenced this issue Jun 18, 2021
@shashankram @whitneygriffith
injector: support inbound port exclusions
aa4df7c 
Similar to outbound port exclusions (global and pod
scoped), this change adds support to exclude specified
ports from inbound sidecar redirection.

This is required in certain scenarios when traffic
destined to certain ports should not be proxied
to the sidecar (ex. ports that terminate TLS
connections in the app).

Required for openservicemesh#3582

Signed-off-by: Shashank Ram <[email protected]>
shashankram added a commit to shashankram/osm-docs that referenced this issue Jun 18, 2021
@shashankram
traffic/iptables: inbound port exclusions
2943f4b 
Documents inbound port exclusions for sidecar traffic
interception.

Required for openservicemesh/osm#3582

Signed-off-by: Shashank Ram <[email protected]>
shashankram added a commit to shashankram/osm-docs that referenced this issue Jun 18, 2021
@shashankram
ingress: document ignore label
5eb0a7e 
Documents how to ignore an ingress resource.

Part of openservicemesh/osm#3582

Signed-off-by: Shashank Ram <[email protected]>
bridgetkromhout pushed a commit to openservicemesh/osm-docs that referenced this issue Jun 21, 2021
@shashankram
Backport docs for port exclusion and ingress (#139)
60b5fe6 
* traffic/iptables: inbound port exclusions

Documents inbound port exclusions for sidecar traffic
interception.

Required for openservicemesh/osm#3582

Signed-off-by: Shashank Ram <[email protected]>

* ingress: document ignore label

Documents how to ignore an ingress resource.

Part of openservicemesh/osm#3582

Signed-off-by: Shashank Ram <[email protected]>
@shashankram
Copy link
Member

This is done, and the changes have been backported to release-v0.9 to be available in the v0.9.1 release.

Relevant documentation:

  1. Inbound port exclusion: https://release-v0-9.docs.openservicemesh.io/docs/tasks/traffic_management/iptables_redirection/#inbound-port-exclusions
  2. Ignore an ingress resource: https://release-v0-9.docs.openservicemesh.io/docs/tasks/traffic_management/ingress/#ignoring-an-ingress-resource

@KnicKnic KnicKnic mentioned this issue Jun 25, 2021
Closed
shalier pushed a commit to shalier/osm that referenced this issue Jun 30, 2021
@shashankram @shalier
injector: support inbound port exclusions
237754f 
Similar to outbound port exclusions (global and pod
scoped), this change adds support to exclude specified
ports from inbound sidecar redirection.

This is required in certain scenarios when traffic
destined to certain ports should not be proxied
to the sidecar (ex. ports that terminate TLS
connections in the app).

Required for openservicemesh#3582

Signed-off-by: Shashank Ram <[email protected]>
shalier pushed a commit to shalier/osm that referenced this issue Jun 30, 2021
@shashankram @shalier
ingress: support ignoring an ingress resource
f14958f 
As a part of openservicemesh#3582, specific ingress resources
need to be ignored. This change adds support
for this using the existing `openservicemesh.io/ignore`
label.

Also addresses an unnecessary type export and makes
unusued variable usage explicit.

Signed-off-by: Shashank Ram <[email protected]>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@shashankram shashankram

Labels
area/ingress Ingress functionality
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@shashankram @KnicKnic @draychev