Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TLS verification of backend services #852

Closed
wants to merge 4 commits into from
Closed

TLS verification of backend services #852

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3219f57
Support TLS verification of backend services
robbiemcmichael Nov 19, 2018
97c5e5c
Update ingress route CRD for TLS verification
robbiemcmichael Nov 21, 2018
0438867
TLS certificate hostname verification
robbiemcmichael Jan 13, 2019
b7be449
Different TLS settings must generate new Envoy clusters
robbiemcmichael Jan 14, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions apis/contour/v1beta1/ingressroute.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,8 @@ type Service struct {
HealthCheck *HealthCheck `json:"healthCheck,omitempty"`
// LB Algorithm to apply (see https://github.com/heptio/contour/blob/master/design/ingressroute-design.md#load-balancing)
Strategy string `json:"strategy,omitempty"`
// Optional TLS verification of the service using a CA certificate
TLSVerification *TLSVerification `json:"tlsVerification,omitempty"`
}

// Delegate allows for delegating VHosts to other IngressRoutes
Expand Down Expand Up @@ -114,6 +116,21 @@ type HealthCheck struct {
HealthyThresholdCount uint32 `json:"healthyThresholdCount"`
}

// TLS verification for the upstream services
type TLSVerification struct {
// Required, the CA to use for TLS verification
CA CA `json:"ca"`
// If specified, the hostname must be included in the certificate's Subject
// Alternative Names field
Hostname string `json:"hostname"`
}

// TLS verification for the upstream services
type CA struct {
// Required, the name of a configmap in the current namespace
ConfigMapName string `json:"configMapName"`
}

// Status reports the current state of the IngressRoute
type Status struct {
CurrentStatus string `json:"currentStatus"`
Expand Down
1 change: 1 addition & 0 deletions cmd/contour/contour.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,6 +166,7 @@ func main() {
wl := log.WithField("context", "watch")
k8s.WatchServices(&g, client, wl, &reh)
k8s.WatchIngress(&g, client, wl, &reh)
k8s.WatchConfigMaps(&g, client, wl, &reh)
k8s.WatchSecrets(&g, client, wl, &reh)
k8s.WatchIngressRoutes(&g, contourClient, wl, &reh)

Expand Down
15 changes: 15 additions & 0 deletions deployment/common/common.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,4 +147,19 @@ spec:
type: integer
healthyThresholdCount:
type: integer
tlsVerification:
type: object
required:
- ca
properties:
ca:
type: object
required:
- configMapName
properties:
configMapName:
type: string
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ # DNS-1123 subdomain
hostnames:
type: string
---
2 changes: 1 addition & 1 deletion deployment/common/rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ rules:
- apiGroups:
- ""
resources:
- configmaps
- endpoints
- nodes
- pods
Expand All @@ -36,6 +35,7 @@ rules:
- apiGroups:
- ""
resources:
- configmaps
- services
verbs:
- get
Expand Down
17 changes: 16 additions & 1 deletion deployment/render/daemonset-rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,21 @@ spec:
type: integer
healthyThresholdCount:
type: integer
tlsVerification:
type: object
required:
- ca
properties:
ca:
type: object
required:
- configMapName
properties:
configMapName:
type: string
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ # DNS-1123 subdomain
hostnames:
type: string
---
apiVersion: extensions/v1beta1
kind: DaemonSet
Expand Down Expand Up @@ -244,7 +259,6 @@ rules:
- apiGroups:
- ""
resources:
- configmaps
- endpoints
- nodes
- pods
Expand All @@ -261,6 +275,7 @@ rules:
- apiGroups:
- ""
resources:
- configmaps
- services
verbs:
- get
Expand Down
17 changes: 16 additions & 1 deletion deployment/render/deployment-rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,21 @@ spec:
type: integer
healthyThresholdCount:
type: integer
tlsVerification:
type: object
required:
- ca
properties:
ca:
type: object
required:
- configMapName
properties:
configMapName:
type: string
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ # DNS-1123 subdomain
hostnames:
type: string
---
apiVersion: extensions/v1beta1
kind: Deployment
Expand Down Expand Up @@ -261,7 +276,6 @@ rules:
- apiGroups:
- ""
resources:
- configmaps
- endpoints
- nodes
- pods
Expand All @@ -278,6 +292,7 @@ rules:
- apiGroups:
- ""
resources:
- configmaps
- services
verbs:
- get
Expand Down
8 changes: 1 addition & 7 deletions internal/contour/cluster.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,13 +97,7 @@ func visitClusters(root dag.Vertex) map[string]*v2.Cluster {

func (v *clusterVisitor) visit(vertex dag.Vertex) {
switch service := vertex.(type) {
case *dag.HTTPService:
name := envoy.Clustername(&service.TCPService)
if _, ok := v.clusters[name]; !ok {
c := envoy.Cluster(service)
v.clusters[c.Name] = c
}
case *dag.TCPService:
case dag.Service:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is good cleanup, but unrelated to this change. Can you please send it as its own PR. Thank you.

Copy link
Contributor Author

@robbiemcmichael robbiemcmichael Jan 29, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It wasn't completely unrelated to this PR, I had to change Clustername to take a Service as a parameter since the hash needed to include fields that are only present in an HTTPService.

The cleanup here was made possible as a byproduct of changing that function, but I can still split those parts out into a separate PR if you'd like.

name := envoy.Clustername(service)
if _, ok := v.clusters[name]; !ok {
c := envoy.Cluster(service)
Expand Down
Loading