Skip to content

Commit 7b76760

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4308 from 1ms-ms/feature/add-ssl-redirect-param
feature: add ssl redirect port to IngressClassParams
2 parents 4b5844e + 576c96b commit 7b76760

File tree

6 files changed

+294
-2
lines changed

6 files changed

+294
-2
lines changed

‎apis/elbv2/v1beta1/ingressclassparams_types.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,11 @@ type IngressClassParamsSpec struct {
144144

145145
// SSLPolicy specifies the SSL Policy for all Ingresses that belong to IngressClass with this IngressClassParams.
146146
// +optional
147-
SSLPolicy string `json:"sslPolicy,omitEmpty"`
147+
SSLPolicy string `json:"sslPolicy,omitempty"`
148+
149+
// SSLRedirectPort specifies the SSL Redirect Port for all Ingresses that belong to IngressClass with this IngressClassParams.
150+
// +optional
151+
SSLRedirectPort string `json:"sslRedirectPort,omitempty"`
148152

149153
// Subnets defines the subnets for all Ingresses that belong to IngressClass with this IngressClassParams.
150154
// +optional

‎config/crd/bases/elbv2.k8s.aws_ingressclassparams.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -230,6 +230,10 @@ spec:
230230
description: SSLPolicy specifies the SSL Policy for all Ingresses
231231
that belong to IngressClass with this IngressClassParams.
232232
type: string
233+
sslRedirectPort:
234+
description: SSLRedirectPort specifies the SSL Redirect Port for all
235+
Ingresses that belong to IngressClass with this IngressClassParams.
236+
type: string
233237
subnets:
234238
description: Subnets defines the subnets for all Ingresses that belong
235239
to IngressClass with this IngressClassParams.

‎docs/guide/ingress/ingress_class.md‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,15 @@ You can use IngressClassParams to enforce settings for a set of Ingresses.
174174
spec:
175175
targetType: ip
176176
```
177+
- with sslRedirectPort
178+
```
179+
apiVersion: elbv2.k8s.aws/v1beta1
180+
kind: IngressClassParams
181+
metadata:
182+
name: class2048-config
183+
spec:
184+
sslRedirectPort: '443'
185+
```
177186
- with IPv4IPAMPoolId
178187
```
179188
apiVersion: elbv2.k8s.aws/v1beta1
@@ -281,9 +290,15 @@ If the field is specified, LBC will ignore the `alb.ingress.kubernetes.io/certif
281290
282291
#### spec.sslPolicy
283292
284-
Cluster administrators can use the optional `sslPolicy` field to specify the SSL policy for the load balancers that belong to this IngressClass.
293+
Cluster administrators can use the optional `sslPolicy` field to specify the SSL policy for the load balancers that belongs to this IngressClass.
285294
If the field is specified, LBC will ignore the `alb.ingress.kubernetes.io/ssl-policy` annotation.
286295
296+
#### spec.sslRedirectPort
297+
298+
Cluster administrators can use the optional `sslRedirectPort` field to specify the SSL redirect port for the load balancers that belongs to this IngressClass.
299+
If the field is specified, LBC will ignore the `alb.ingress.kubernetes.io/ssl-redirect` annotation.
300+
301+
287302
#### spec.subnets
288303
289304
Cluster administrators can use the optional `subnets` field to specify the subnets for the load balancers that belong to this IngressClass.

‎helm/aws-load-balancer-controller/crds/crds.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,10 @@ spec:
229229
description: SSLPolicy specifies the SSL Policy for all Ingresses
230230
that belong to IngressClass with this IngressClassParams.
231231
type: string
232+
sslRedirectPort:
233+
description: SSLRedirectPort specifies the SSL Redirect Port for all
234+
Ingresses that belong to IngressClass with this IngressClassParams.
235+
type: string
232236
subnets:
233237
description: Subnets defines the subnets for all Ingresses that belong
234238
to IngressClass with this IngressClassParams.

‎pkg/ingress/model_builder.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -458,6 +458,15 @@ func (t *defaultModelBuildTask) mergeListenPortConfigs(_ context.Context, listen
458458
func (t *defaultModelBuildTask) buildSSLRedirectConfig(ctx context.Context, listenPortConfigByPort map[int32]listenPortConfig) (*SSLRedirectConfig, error) {
459459
explicitSSLRedirectPorts := sets.Int32{}
460460
for _, member := range t.ingGroup.Members {
461+
if member.IngClassConfig.IngClassParams != nil && member.IngClassConfig.IngClassParams.Spec.SSLRedirectPort != "" {
462+
sslRedirectPort, err := strconv.ParseInt(member.IngClassConfig.IngClassParams.Spec.SSLRedirectPort, 10, 32)
463+
if err != nil {
464+
return nil, nil
465+
}
466+
explicitSSLRedirectPorts.Insert(int32(sslRedirectPort))
467+
continue
468+
}
469+
461470
var rawSSLRedirectPort int32
462471
exists, err := t.annotationParser.ParseInt32Annotation(annotations.IngressSuffixSSLRedirect, &rawSSLRedirectPort, member.Ing.Annotations)
463472
if err != nil {

‎pkg/ingress/model_builder_test.go‎

Lines changed: 256 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4972,6 +4972,69 @@ func Test_defaultModelBuildTask_buildSSLRedirectConfig(t *testing.T) {
49724972
},
49734973
wantErr: nil,
49744974
},
4975+
{
4976+
name: "single Ingress with IngressClassParam for ssl-redirect",
4977+
fields: fields{
4978+
ingGroup: Group{
4979+
ID: GroupID{Namespace: "ns-1", Name: "ing-1"},
4980+
Members: []ClassifiedIngress{
4981+
{
4982+
IngClassConfig: ClassConfiguration{
4983+
IngClassParams: &v1beta1.IngressClassParams{
4984+
Spec: v1beta1.IngressClassParamsSpec{
4985+
SSLRedirectPort: "443",
4986+
},
4987+
},
4988+
},
4989+
Ing: &networking.Ingress{ObjectMeta: metav1.ObjectMeta{
4990+
Namespace: "ns-1",
4991+
Name: "ing-1",
4992+
},
4993+
Spec: networking.IngressSpec{
4994+
Rules: []networking.IngressRule{
4995+
{
4996+
Host: "app-1.example.com",
4997+
IngressRuleValue: networking.IngressRuleValue{
4998+
HTTP: &networking.HTTPIngressRuleValue{
4999+
Paths: []networking.HTTPIngressPath{
5000+
{
5001+
Path: "/svc-1",
5002+
Backend: networking.IngressBackend{
5003+
Service: &networking.IngressServiceBackend{
5004+
Name: "svc-1",
5005+
Port: networking.ServiceBackendPort{
5006+
Name: "http",
5007+
},
5008+
},
5009+
},
5010+
},
5011+
},
5012+
},
5013+
},
5014+
},
5015+
},
5016+
},
5017+
},
5018+
},
5019+
},
5020+
},
5021+
},
5022+
args: args{
5023+
listenPortConfigByPort: map[int32]listenPortConfig{
5024+
80: {
5025+
protocol: elbv2model.ProtocolHTTP,
5026+
},
5027+
443: {
5028+
protocol: elbv2model.ProtocolHTTPS,
5029+
},
5030+
},
5031+
},
5032+
want: &SSLRedirectConfig{
5033+
SSLPort: 443,
5034+
StatusCode: "HTTP_301",
5035+
},
5036+
wantErr: nil,
5037+
},
49755038
{
49765039
name: "single Ingress with ssl-redirect annotation but refer non-exists port",
49775040
fields: fields{
@@ -5258,6 +5321,199 @@ func Test_defaultModelBuildTask_buildSSLRedirectConfig(t *testing.T) {
52585321
},
52595322
wantErr: nil,
52605323
},
5324+
{
5325+
name: "multiple Ingress with one IngressClassParam for ssl-redirect",
5326+
fields: fields{
5327+
ingGroup: Group{
5328+
ID: GroupID{Namespace: "ns-1", Name: "ing-1"},
5329+
Members: []ClassifiedIngress{
5330+
{
5331+
IngClassConfig: ClassConfiguration{
5332+
IngClassParams: &v1beta1.IngressClassParams{
5333+
Spec: v1beta1.IngressClassParamsSpec{
5334+
SSLRedirectPort: "443",
5335+
},
5336+
},
5337+
},
5338+
Ing: &networking.Ingress{ObjectMeta: metav1.ObjectMeta{
5339+
Namespace: "ns-1",
5340+
Name: "ing-1",
5341+
Annotations: map[string]string{},
5342+
},
5343+
Spec: networking.IngressSpec{
5344+
Rules: []networking.IngressRule{
5345+
{
5346+
Host: "app-1.example.com",
5347+
IngressRuleValue: networking.IngressRuleValue{
5348+
HTTP: &networking.HTTPIngressRuleValue{
5349+
Paths: []networking.HTTPIngressPath{
5350+
{
5351+
Path: "/svc-1",
5352+
Backend: networking.IngressBackend{
5353+
Service: &networking.IngressServiceBackend{
5354+
Name: "svc-1",
5355+
Port: networking.ServiceBackendPort{
5356+
Name: "http",
5357+
},
5358+
},
5359+
},
5360+
},
5361+
},
5362+
},
5363+
},
5364+
},
5365+
},
5366+
},
5367+
},
5368+
},
5369+
{
5370+
Ing: &networking.Ingress{ObjectMeta: metav1.ObjectMeta{
5371+
Namespace: "ns-2",
5372+
Name: "ing-2",
5373+
},
5374+
Spec: networking.IngressSpec{
5375+
Rules: []networking.IngressRule{
5376+
{
5377+
Host: "app-2.example.com",
5378+
IngressRuleValue: networking.IngressRuleValue{
5379+
HTTP: &networking.HTTPIngressRuleValue{
5380+
Paths: []networking.HTTPIngressPath{
5381+
{
5382+
Path: "/svc-2",
5383+
Backend: networking.IngressBackend{
5384+
Service: &networking.IngressServiceBackend{
5385+
Name: "svc-2",
5386+
Port: networking.ServiceBackendPort{
5387+
Name: "http",
5388+
},
5389+
},
5390+
},
5391+
},
5392+
},
5393+
},
5394+
},
5395+
},
5396+
},
5397+
},
5398+
},
5399+
},
5400+
},
5401+
},
5402+
},
5403+
args: args{
5404+
listenPortConfigByPort: map[int32]listenPortConfig{
5405+
80: {
5406+
protocol: elbv2model.ProtocolHTTP,
5407+
},
5408+
443: {
5409+
protocol: elbv2model.ProtocolHTTPS,
5410+
},
5411+
},
5412+
},
5413+
want: &SSLRedirectConfig{
5414+
SSLPort: 443,
5415+
StatusCode: "HTTP_301",
5416+
},
5417+
wantErr: nil,
5418+
},
5419+
{
5420+
name: "multiple Ingress with SSLRedirectPort defined by both annotation and IngressClassParams",
5421+
fields: fields{
5422+
ingGroup: Group{
5423+
ID: GroupID{Namespace: "ns-1", Name: "ing-1"},
5424+
Members: []ClassifiedIngress{
5425+
{
5426+
IngClassConfig: ClassConfiguration{
5427+
IngClassParams: &v1beta1.IngressClassParams{
5428+
Spec: v1beta1.IngressClassParamsSpec{
5429+
SSLRedirectPort: "443",
5430+
},
5431+
},
5432+
},
5433+
Ing: &networking.Ingress{ObjectMeta: metav1.ObjectMeta{
5434+
Namespace: "ns-1",
5435+
Name: "ing-1",
5436+
Annotations: map[string]string{},
5437+
},
5438+
Spec: networking.IngressSpec{
5439+
Rules: []networking.IngressRule{
5440+
{
5441+
Host: "app-1.example.com",
5442+
IngressRuleValue: networking.IngressRuleValue{
5443+
HTTP: &networking.HTTPIngressRuleValue{
5444+
Paths: []networking.HTTPIngressPath{
5445+
{
5446+
Path: "/svc-1",
5447+
Backend: networking.IngressBackend{
5448+
Service: &networking.IngressServiceBackend{
5449+
Name: "svc-1",
5450+
Port: networking.ServiceBackendPort{
5451+
Name: "http",
5452+
},
5453+
},
5454+
},
5455+
},
5456+
},
5457+
},
5458+
},
5459+
},
5460+
},
5461+
},
5462+
},
5463+
},
5464+
{
5465+
Ing: &networking.Ingress{ObjectMeta: metav1.ObjectMeta{
5466+
Namespace: "ns-2",
5467+
Name: "ing-2",
5468+
Annotations: map[string]string{
5469+
"alb.ingress.kubernetes.io/ssl-redirect": "443",
5470+
},
5471+
},
5472+
Spec: networking.IngressSpec{
5473+
Rules: []networking.IngressRule{
5474+
{
5475+
Host: "app-2.example.com",
5476+
IngressRuleValue: networking.IngressRuleValue{
5477+
HTTP: &networking.HTTPIngressRuleValue{
5478+
Paths: []networking.HTTPIngressPath{
5479+
{
5480+
Path: "/svc-2",
5481+
Backend: networking.IngressBackend{
5482+
Service: &networking.IngressServiceBackend{
5483+
Name: "svc-2",
5484+
Port: networking.ServiceBackendPort{
5485+
Name: "http",
5486+
},
5487+
},
5488+
},
5489+
},
5490+
},
5491+
},
5492+
},
5493+
},
5494+
},
5495+
},
5496+
},
5497+
},
5498+
},
5499+
},
5500+
},
5501+
args: args{
5502+
listenPortConfigByPort: map[int32]listenPortConfig{
5503+
80: {
5504+
protocol: elbv2model.ProtocolHTTP,
5505+
},
5506+
443: {
5507+
protocol: elbv2model.ProtocolHTTPS,
5508+
},
5509+
},
5510+
},
5511+
want: &SSLRedirectConfig{
5512+
SSLPort: 443,
5513+
StatusCode: "HTTP_301",
5514+
},
5515+
wantErr: nil,
5516+
},
52615517
{
52625518
name: "multiple Ingress with same ssl-redirect annotation",
52635519
fields: fields{

0 commit comments

Comments
 (0)