Skip to content

Commit 0fe7e43

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #3974 from zac-nixon/advertise
feat: add advertise ca for mtls listener
2 parents ed8bd00 + b0e9edd commit 0fe7e43

File tree

8 files changed

+241
-26
lines changed

8 files changed

+241
-26
lines changed

‎docs/guide/ingress/annotations.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -805,6 +805,7 @@ TLS support can be controlled with the following annotations:
805805
- Both ARN and Name of trustStore are supported values.
806806
- `trustStore` is required when mode is `verify`.
807807
- `ignoreClientCertificateExpiry : true | false (default)`
808+
- `advertiseTrustStoreCaNames : "on" | "off" (default)`
808809
- Once the Mutual Authentication is set, to turn it off, you will have to explicitly pass in this annotation with `mode : "off"`.
809810

810811
!!!example

‎go.mod

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@ go 1.22.8
44

55
require (
66
github.com/aws/aws-sdk-go v1.55.5
7-
github.com/aws/aws-sdk-go-v2 v1.32.5
7+
github.com/aws/aws-sdk-go-v2 v1.32.6
88
github.com/aws/aws-sdk-go-v2/config v1.27.27
99
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11
1010
github.com/aws/aws-sdk-go-v2/service/acm v1.28.4
1111
github.com/aws/aws-sdk-go-v2/service/appmesh v1.27.7
1212
github.com/aws/aws-sdk-go-v2/service/ec2 v1.173.0
13-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.42.0
13+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.43.1
1414
github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.23.3
1515
github.com/aws/aws-sdk-go-v2/service/servicediscovery v1.31.7
1616
github.com/aws/aws-sdk-go-v2/service/shield v1.27.3
@@ -57,8 +57,8 @@ require (
5757
github.com/andybalholm/brotli v1.0.4 // indirect
5858
github.com/asaskevich/govalidator v0.0.0-20200428143746-21a406dcc535 // indirect
5959
github.com/aws/aws-sdk-go-v2/credentials v1.17.27 // indirect
60-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24 // indirect
61-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24 // indirect
60+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.25 // indirect
61+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.25 // indirect
6262
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
6363
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 // indirect
6464
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 // indirect

‎go.sum

Lines changed: 8 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -38,24 +38,18 @@ github.com/asaskevich/govalidator v0.0.0-20200428143746-21a406dcc535 h1:4daAzAu0
3838
github.com/asaskevich/govalidator v0.0.0-20200428143746-21a406dcc535/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
3939
github.com/aws/aws-sdk-go v1.55.5 h1:KKUZBfBoyqy5d3swXyiC7Q76ic40rYcbqH7qjh59kzU=
4040
github.com/aws/aws-sdk-go v1.55.5/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
41-
github.com/aws/aws-sdk-go-v2 v1.32.3 h1:T0dRlFBKcdaUPGNtkBSwHZxrtis8CQU17UpNBZYd0wk=
42-
github.com/aws/aws-sdk-go-v2 v1.32.3/go.mod h1:2SK5n0a2karNTv5tbP1SjsX0uhttou00v/HpXKM1ZUo=
43-
github.com/aws/aws-sdk-go-v2 v1.32.5 h1:U8vdWJuY7ruAkzaOdD7guwJjD06YSKmnKCJs7s3IkIo=
44-
github.com/aws/aws-sdk-go-v2 v1.32.5/go.mod h1:P5WJBrYqqbWVaOxgH0X/FYYD47/nooaPOZPlQdmiN2U=
41+
github.com/aws/aws-sdk-go-v2 v1.32.6 h1:7BokKRgRPuGmKkFMhEg/jSul+tB9VvXhcViILtfG8b4=
42+
github.com/aws/aws-sdk-go-v2 v1.32.6/go.mod h1:P5WJBrYqqbWVaOxgH0X/FYYD47/nooaPOZPlQdmiN2U=
4543
github.com/aws/aws-sdk-go-v2/config v1.27.27 h1:HdqgGt1OAP0HkEDDShEl0oSYa9ZZBSOmKpdpsDMdO90=
4644
github.com/aws/aws-sdk-go-v2/config v1.27.27/go.mod h1:MVYamCg76dFNINkZFu4n4RjDixhVr51HLj4ErWzrVwg=
4745
github.com/aws/aws-sdk-go-v2/credentials v1.17.27 h1:2raNba6gr2IfA0eqqiP2XiQ0UVOpGPgDSi0I9iAP+UI=
4846
github.com/aws/aws-sdk-go-v2/credentials v1.17.27/go.mod h1:gniiwbGahQByxan6YjQUMcW4Aov6bLC3m+evgcoN4r4=
4947
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 h1:KreluoV8FZDEtI6Co2xuNk/UqI9iwMrOx/87PBNIKqw=
5048
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11/go.mod h1:SeSUYBLsMYFoRvHE0Tjvn7kbxaUhl75CJi1sbfhMxkU=
51-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.22 h1:Jw50LwEkVjuVzE1NzkhNKkBf9cRN7MtE1F/b2cOKTUM=
52-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.22/go.mod h1:Y/SmAyPcOTmpeVaWSzSKiILfXTVJwrGmYZhcRbhWuEY=
53-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24 h1:4usbeaes3yJnCFC7kfeyhkdkPtoRYPa/hTmCqMpKpLI=
54-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24/go.mod h1:5CI1JemjVwde8m2WG3cz23qHKPOxbpkq0HaoreEgLIY=
55-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.22 h1:981MHwBaRZM7+9QSR6XamDzF/o7ouUGxFzr+nVSIhrs=
56-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.22/go.mod h1:1RA1+aBEfn+CAB/Mh0MB6LsdCYCnjZm7tKXtnk499ZQ=
57-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24 h1:N1zsICrQglfzaBnrfM0Ys00860C+QFwu6u/5+LomP+o=
58-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24/go.mod h1:dCn9HbJ8+K31i8IQ8EWmWj0EiIk0+vKiHNMxTTYveAg=
49+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.25 h1:s/fF4+yDQDoElYhfIVvSNyeCydfbuTKzhxSXDXCPasU=
50+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.25/go.mod h1:IgPfDv5jqFIzQSNbUEMoitNooSMXjRSDkhXv8jiROvU=
51+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.25 h1:ZntTCl5EsYnhN/IygQEUugpdwbhdkom9uHcbCftiGgA=
52+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.25/go.mod h1:DBdPrgeocww+CSl1C8cEV8PN1mHMBhuCDLpXezyvWkE=
5953
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU=
6054
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
6155
github.com/aws/aws-sdk-go-v2/service/acm v1.28.4 h1:wiW1Y6/1lysA0eJZRq0I53YYKuV9MNAzL15z2eZRlEE=
@@ -64,8 +58,8 @@ github.com/aws/aws-sdk-go-v2/service/appmesh v1.27.7 h1:q44a6kysAfej9zZwRnraOg9s
6458
github.com/aws/aws-sdk-go-v2/service/appmesh v1.27.7/go.mod h1:ZYSmrgAMp0rTCHH+SGsoxZo+PPbgsDqBzewTp3tSJ60=
6559
github.com/aws/aws-sdk-go-v2/service/ec2 v1.173.0 h1:ta62lid9JkIpKZtZZXSj6rP2AqY5x1qYGq53ffxqD9Q=
6660
github.com/aws/aws-sdk-go-v2/service/ec2 v1.173.0/go.mod h1:o6QDjdVKpP5EF0dp/VlvqckzuSDATr1rLdHt3A5m0YY=
67-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.42.0 h1:C4/D90/j3EF/SokpC4HO1aPMkZV1dgqUbmejdpxQiAE=
68-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.42.0/go.mod h1:pZP3I+Ts+XuhJJtZE49+ABVjfxm7u9/hxcNUYSpY3OE=
61+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.43.1 h1:L9Wt9zgtoYKIlaeFTy+EztGjL4oaXBBGtVXA+jaeYko=
62+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.43.1/go.mod h1:yxzLdxt7bVGvIOPYIKFtiaJCJnx2ChlIIvlhW4QgI6M=
6963
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 h1:dT3MqvGhSoaIhRseqw2I0yH81l7wiR2vjs57O51EAm8=
7064
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3/go.mod h1:GlAeCkHwugxdHaueRr4nhPuY+WW+gR8UjlcqzPr1SPI=
7165
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 h1:HGErhhrxZlQ044RiM+WdoZxp0p+EGM62y3L6pwA4olE=
@@ -86,8 +80,6 @@ github.com/aws/aws-sdk-go-v2/service/wafregional v1.23.3 h1:7dr6En0/6KRFoz8VmnYk
8680
github.com/aws/aws-sdk-go-v2/service/wafregional v1.23.3/go.mod h1:24TtlRsv4LKAE3VnRJQhpatr8cpX0yj8NSzg8/lxOCw=
8781
github.com/aws/aws-sdk-go-v2/service/wafv2 v1.51.4 h1:1khBA5uryBRJoCb4G2iR5RT06BkfPEjjDCHAiRb8P3Q=
8882
github.com/aws/aws-sdk-go-v2/service/wafv2 v1.51.4/go.mod h1:QpFImaPGKNwa+MiZ+oo6LbV1PVQBapc0CnrAMRScoxM=
89-
github.com/aws/smithy-go v1.22.0 h1:uunKnWlcoL3zO7q+gG2Pk53joueEOsnNB28QdMsmiMM=
90-
github.com/aws/smithy-go v1.22.0/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
9183
github.com/aws/smithy-go v1.22.1 h1:/HPHZQ0g7f4eUeK6HKglFz8uwVfZKgoI25rb/J+dnro=
9284
github.com/aws/smithy-go v1.22.1/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
9385
github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=

‎pkg/deploy/elbv2/listener_manager.go

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -365,11 +365,17 @@ func buildSDKMutualAuthenticationConfig(modelMutualAuthenticationCfg *elbv2model
365365
if modelMutualAuthenticationCfg == nil {
366366
return nil
367367
}
368-
return &elbv2types.MutualAuthenticationAttributes{
368+
attributes := &elbv2types.MutualAuthenticationAttributes{
369369
IgnoreClientCertificateExpiry: modelMutualAuthenticationCfg.IgnoreClientCertificateExpiry,
370370
Mode: awssdk.String(modelMutualAuthenticationCfg.Mode),
371371
TrustStoreArn: modelMutualAuthenticationCfg.TrustStoreArn,
372372
}
373+
374+
if modelMutualAuthenticationCfg.Mode == string(elbv2model.MutualAuthenticationVerifyMode) {
375+
attributes.AdvertiseTrustStoreCaNames = translateAdvertiseCAToEnum(modelMutualAuthenticationCfg.AdvertiseTrustStoreCaNames)
376+
}
377+
378+
return attributes
373379
}
374380

375381
func buildResListenerStatus(sdkLS ListenerWithTags) elbv2model.ListenerStatus {
@@ -396,3 +402,10 @@ func getRegionFromARN(arn string) string {
396402
func isIsolatedRegion(region string) bool {
397403
return strings.Contains(strings.ToLower(region), "-iso-")
398404
}
405+
406+
func translateAdvertiseCAToEnum(s *string) elbv2types.AdvertiseTrustStoreCaNamesEnum {
407+
if s == nil {
408+
return elbv2types.AdvertiseTrustStoreCaNamesEnumOff
409+
}
410+
return elbv2types.AdvertiseTrustStoreCaNamesEnum(*s)
411+
}

‎pkg/deploy/elbv2/listener_manager_test.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -235,6 +235,7 @@ func Test_isSDKListenerSettingsDrifted(t *testing.T) {
235235
Mode: awssdk.String("verify"),
236236
TrustStoreArn: awssdk.String("arn:aws:elasticloadbalancing:us-east-1:123456789123:truststore/ts-1/8786hghf"),
237237
IgnoreClientCertificateExpiry: awssdk.Bool(false),
238+
AdvertiseTrustStoreCaNames: elbv2types.AdvertiseTrustStoreCaNamesEnumOff,
238239
},
239240
},
240241
},
@@ -260,6 +261,7 @@ func Test_isSDKListenerSettingsDrifted(t *testing.T) {
260261
Mode: awssdk.String("verify"),
261262
TrustStoreArn: awssdk.String("arn:aws:elasticloadbalancing:us-east-1:123456789123:truststore/ts-1/8786hghf"),
262263
IgnoreClientCertificateExpiry: awssdk.Bool(false),
264+
AdvertiseTrustStoreCaNames: elbv2types.AdvertiseTrustStoreCaNamesEnumOff,
263265
},
264266
},
265267
},

‎pkg/ingress/model_build_listener.go

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"context"
55
"encoding/json"
66
"fmt"
7+
elbv2types "github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2/types"
78
"net"
89
"strings"
910

@@ -283,6 +284,7 @@ type MutualAuthenticationConfig struct {
283284
Mode string `json:"mode"`
284285
TrustStore *string `json:"trustStore,omitempty"`
285286
IgnoreClientCertificateExpiry *bool `json:"ignoreClientCertificateExpiry,omitempty"`
287+
AdvertiseTrustStoreCaNames *string `json:"advertiseTrustStoreCaNames,omitempty"`
286288
}
287289

288290
func (t *defaultModelBuildTask) computeIngressMutualAuthentication(ctx context.Context, ing *ClassifiedIngress) (map[int32]*elbv2model.MutualAuthenticationAttributes, error) {
@@ -319,21 +321,22 @@ func (t *defaultModelBuildTask) parseMtlsConfigEntries(_ context.Context, entrie
319321
mode := mutualAuthenticationConfig.Mode
320322
truststoreNameOrArn := awssdk.ToString(mutualAuthenticationConfig.TrustStore)
321323
ignoreClientCert := mutualAuthenticationConfig.IgnoreClientCertificateExpiry
324+
advertiseTrustStoreCaNames := mutualAuthenticationConfig.AdvertiseTrustStoreCaNames
322325

323-
err := t.validateMutualAuthenticationConfig(port, mode, truststoreNameOrArn, ignoreClientCert)
326+
err := t.validateMutualAuthenticationConfig(port, mode, truststoreNameOrArn, ignoreClientCert, advertiseTrustStoreCaNames)
324327
if err != nil {
325328
return nil, err
326329
}
327330

328331
if mode == string(elbv2model.MutualAuthenticationVerifyMode) && ignoreClientCert == nil {
329332
ignoreClientCert = awssdk.Bool(false)
330333
}
331-
portAndMtlsAttributes[port] = &elbv2model.MutualAuthenticationAttributes{Mode: mode, TrustStoreArn: awssdk.String(truststoreNameOrArn), IgnoreClientCertificateExpiry: ignoreClientCert}
334+
portAndMtlsAttributes[port] = &elbv2model.MutualAuthenticationAttributes{Mode: mode, TrustStoreArn: awssdk.String(truststoreNameOrArn), IgnoreClientCertificateExpiry: ignoreClientCert, AdvertiseTrustStoreCaNames: advertiseTrustStoreCaNames}
332335
}
333336
return portAndMtlsAttributes, nil
334337
}
335338

336-
func (t *defaultModelBuildTask) validateMutualAuthenticationConfig(port int32, mode string, truststoreNameOrArn string, ignoreClientCert *bool) error {
339+
func (t *defaultModelBuildTask) validateMutualAuthenticationConfig(port int32, mode string, truststoreNameOrArn string, ignoreClientCert *bool, advertiseTrustStoreCaNames *string) error {
337340
// Verify port value is valid for ALB: [1, 65535]
338341
if port < 1 || port > 65535 {
339342
return errors.Errorf("listen port must be within [1, 65535]: %v", port)
@@ -360,6 +363,19 @@ func (t *defaultModelBuildTask) validateMutualAuthenticationConfig(port int32, m
360363
return errors.Errorf("Mutual Authentication mode %s does not support ignoring client certificate expiry for port %v", mode, port)
361364
}
362365

366+
// Verify advertise trust ca names.
367+
// The value (if specified) must be "on" or "off"
368+
// The value can be only specified when using verify mode on the listener.
369+
if advertiseTrustStoreCaNames != nil {
370+
if mode != string(elbv2model.MutualAuthenticationVerifyMode) {
371+
return errors.Errorf("Mutual Authentication mode %s does not support advertiseTrustStoreCaNames for port %v", mode, port)
372+
}
373+
374+
if *advertiseTrustStoreCaNames != string(elbv2types.AdvertiseTrustStoreCaNamesEnumOff) && *advertiseTrustStoreCaNames != string(elbv2types.AdvertiseTrustStoreCaNamesEnumOn) {
375+
return errors.Errorf("advertiseTrustStoreCaNames only supports the values \"on\" and \"off\" got value %s for port %v", *advertiseTrustStoreCaNames, port)
376+
}
377+
}
378+
363379
return nil
364380
}
365381

0 commit comments

Comments
 (0)