Skip to content

Commit d0c13bf

Browse files
shraddhabangshraddhabang
authored
Implement mutual TLS authentication support for Ingress (#3532)
* Implement mutual TLS authentication support for Ingress * Addressing comments and adding policy updates * Adding dependency for maps * removing ingressClassParam support
1 parent 1a8bfc0 commit d0c13bf

File tree

16 files changed

+1264
-37
lines changed

16 files changed

+1264
-37
lines changed

‎.github/workflows/test.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
- name: Set up Go 1.x
1111
uses: actions/setup-go@v2
1212
with:
13-
go-version: ^1.19
13+
go-version: ^1.21
1414

1515
- name: Check out code into the Go module directory
1616
uses: actions/checkout@v2

‎controllers/ingress/group_controller.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ func NewGroupReconciler(cloud aws.Cloud, k8sClient client.Client, eventRecorder
5656
trackingProvider := tracking.NewDefaultProvider(ingressTagPrefix, controllerConfig.ClusterName)
5757
elbv2TaggingManager := elbv2deploy.NewDefaultTaggingManager(cloud.ELBV2(), cloud.VpcID(), controllerConfig.FeatureGates, cloud.RGT(), logger)
5858
modelBuilder := ingress.NewDefaultModelBuilder(k8sClient, eventRecorder,
59-
cloud.EC2(), cloud.ACM(),
59+
cloud.EC2(), cloud.ELBV2(), cloud.ACM(),
6060
annotationParser, subnetsResolver,
6161
authConfigBuilder, enhancedBackendBuilder, trackingProvider, elbv2TaggingManager, controllerConfig.FeatureGates,
6262
cloud.VpcID(), controllerConfig.ClusterName, controllerConfig.DefaultTags, controllerConfig.ExternalManagedTags,

‎docs/install/iam_policy.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,8 @@
3838
"elasticloadbalancing:DescribeTargetGroups",
3939
"elasticloadbalancing:DescribeTargetGroupAttributes",
4040
"elasticloadbalancing:DescribeTargetHealth",
41-
"elasticloadbalancing:DescribeTags"
41+
"elasticloadbalancing:DescribeTags",
42+
"elasticloadbalancing:DescribeTrustStores"
4243
],
4344
"Resource": "*"
4445
},

‎docs/install/iam_policy_us-gov.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,8 @@
3838
"elasticloadbalancing:DescribeTargetGroups",
3939
"elasticloadbalancing:DescribeTargetGroupAttributes",
4040
"elasticloadbalancing:DescribeTargetHealth",
41-
"elasticloadbalancing:DescribeTags"
41+
"elasticloadbalancing:DescribeTags",
42+
"elasticloadbalancing:DescribeTrustStores"
4243
],
4344
"Resource": "*"
4445
},

‎go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
module sigs.k8s.io/aws-load-balancer-controller
22

3-
go 1.20
3+
go 1.21
44

55
require (
6-
github.com/aws/aws-sdk-go v1.47.13
6+
github.com/aws/aws-sdk-go v1.48.10
77
github.com/evanphx/json-patch v5.6.0+incompatible
88
github.com/gavv/httpexpect/v2 v2.9.0
99
github.com/go-logr/logr v1.2.4
@@ -23,6 +23,7 @@ require (
2323
k8s.io/apimachinery v0.26.5
2424
k8s.io/cli-runtime v0.26.3
2525
k8s.io/client-go v0.26.5
26+
k8s.io/utils v0.0.0-20221128185143-99ec85e7a448
2627
sigs.k8s.io/controller-runtime v0.14.6
2728
sigs.k8s.io/yaml v1.3.0
2829
)
@@ -156,7 +157,6 @@ require (
156157
k8s.io/klog/v2 v2.80.1 // indirect
157158
k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect
158159
k8s.io/kubectl v0.26.0 // indirect
159-
k8s.io/utils v0.0.0-20221128185143-99ec85e7a448 // indirect
160160
moul.io/http2curl/v2 v2.3.0 // indirect
161161
oras.land/oras-go v1.2.2 // indirect
162162
sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect

‎go.sum‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,8 @@ github.com/asaskevich/govalidator v0.0.0-20200428143746-21a406dcc535 h1:4daAzAu0
7979
github.com/asaskevich/govalidator v0.0.0-20200428143746-21a406dcc535/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
8080
github.com/aws/aws-sdk-go v1.47.13 h1:pJgCtldg5azDAFoEcE0fz6n+FnCc1/FY4krtUa5uvZQ=
8181
github.com/aws/aws-sdk-go v1.47.13/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
82+
github.com/aws/aws-sdk-go v1.48.10 h1:0LIFG3wp2Dt6PsxKWCg1Y1xRrn2vZnW5/gWdgaBalKg=
83+
github.com/aws/aws-sdk-go v1.48.10/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
8284
github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
8385
github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
8486
github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=

‎pkg/annotations/constants.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ const (
4646
IngressSuffixAuthSessionTimeout = "auth-session-timeout"
4747
IngressSuffixTargetNodeLabels = "target-node-labels"
4848
IngressSuffixManageSecurityGroupRules = "manage-backend-security-group-rules"
49+
IngressSuffixMutualAuthentication = "mutual-authentication"
4950

5051
// NLB annotation suffixes
5152
// prefixes service.beta.kubernetes.io, service.kubernetes.io

‎pkg/aws/services/ec2_mocks.go‎

Lines changed: 300 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/aws/services/elbv2_mocks.go‎

Lines changed: 599 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/deploy/elbv2/listener_manager.go‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package elbv2
22

33
import (
44
"context"
5+
"reflect"
56
"time"
67

78
awssdk "github.com/aws/aws-sdk-go/aws"
@@ -134,7 +135,8 @@ func (m *defaultListenerManager) updateSDKListenerWithSettings(ctx context.Conte
134135
return err
135136
}
136137
desiredDefaultCerts, _ := buildSDKCertificates(resLS.Spec.Certificates)
137-
if !isSDKListenerSettingsDrifted(resLS.Spec, sdkLS, desiredDefaultActions, desiredDefaultCerts) {
138+
desiredDefaultMutualAuthentication := buildSDKMutualAuthenticationConfig(resLS.Spec.MutualAuthentication)
139+
if !isSDKListenerSettingsDrifted(resLS.Spec, sdkLS, desiredDefaultActions, desiredDefaultCerts, desiredDefaultMutualAuthentication) {
138140
return nil
139141
}
140142
req := buildSDKModifyListenerInput(resLS.Spec, desiredDefaultActions, desiredDefaultCerts)
@@ -246,7 +248,7 @@ func (m *defaultListenerManager) fetchSDKListenerExtraCertificateARNs(ctx contex
246248
}
247249

248250
func isSDKListenerSettingsDrifted(lsSpec elbv2model.ListenerSpec, sdkLS ListenerWithTags,
249-
desiredDefaultActions []*elbv2sdk.Action, desiredDefaultCerts []*elbv2sdk.Certificate) bool {
251+
desiredDefaultActions []*elbv2sdk.Action, desiredDefaultCerts []*elbv2sdk.Certificate, desiredDefaultMutualAuthentication *elbv2sdk.MutualAuthenticationAttributes) bool {
250252
if lsSpec.Port != awssdk.Int64Value(sdkLS.Listener.Port) {
251253
return true
252254
}
@@ -265,6 +267,9 @@ func isSDKListenerSettingsDrifted(lsSpec elbv2model.ListenerSpec, sdkLS Listener
265267
if len(lsSpec.ALPNPolicy) != 0 && !cmp.Equal(lsSpec.ALPNPolicy, awssdk.StringValueSlice(sdkLS.Listener.AlpnPolicy), cmpopts.EquateEmpty()) {
266268
return true
267269
}
270+
if !reflect.DeepEqual(desiredDefaultMutualAuthentication, sdkLS.Listener.MutualAuthentication) {
271+
return true
272+
}
268273

269274
return false
270275
}
@@ -289,6 +294,8 @@ func buildSDKCreateListenerInput(lsSpec elbv2model.ListenerSpec, featureGates co
289294
if len(lsSpec.ALPNPolicy) != 0 {
290295
sdkObj.AlpnPolicy = awssdk.StringSlice(lsSpec.ALPNPolicy)
291296
}
297+
sdkObj.MutualAuthentication = buildSDKMutualAuthenticationConfig(lsSpec.MutualAuthentication)
298+
292299
return sdkObj, nil
293300
}
294301

@@ -302,6 +309,8 @@ func buildSDKModifyListenerInput(lsSpec elbv2model.ListenerSpec, desiredDefaultA
302309
if len(lsSpec.ALPNPolicy) != 0 {
303310
sdkObj.AlpnPolicy = awssdk.StringSlice(lsSpec.ALPNPolicy)
304311
}
312+
sdkObj.MutualAuthentication = buildSDKMutualAuthenticationConfig(lsSpec.MutualAuthentication)
313+
305314
return sdkObj
306315
}
307316

@@ -327,6 +336,18 @@ func buildSDKCertificate(modelCert elbv2model.Certificate) *elbv2sdk.Certificate
327336
}
328337
}
329338

339+
// buildSDKMutualAuthenticationConfig builds the mutual TLS authentication config for listener
340+
func buildSDKMutualAuthenticationConfig(modelMutualAuthenticationCfg *elbv2model.MutualAuthenticationAttributes) *elbv2sdk.MutualAuthenticationAttributes {
341+
if modelMutualAuthenticationCfg == nil {
342+
return nil
343+
}
344+
return &elbv2sdk.MutualAuthenticationAttributes{
345+
IgnoreClientCertificateExpiry: modelMutualAuthenticationCfg.IgnoreClientCertificateExpiry,
346+
Mode: awssdk.String(modelMutualAuthenticationCfg.Mode),
347+
TrustStoreArn: modelMutualAuthenticationCfg.TrustStoreArn,
348+
}
349+
}
350+
330351
func buildResListenerStatus(sdkLS ListenerWithTags) elbv2model.ListenerStatus {
331352
return elbv2model.ListenerStatus{
332353
ListenerARN: awssdk.StringValue(sdkLS.Listener.ListenerArn),

0 commit comments

Comments
 (0)