feat: add advertise ca for mtls listener #3974
Conversation
k8s-ci-robot
added
cncf-cla: yes
|
/ok-to-test |
k8s-ci-robot
added
the
ok-to-test
| if modelMutualAuthenticationCfg.Mode == string(elbv2model.MutualAuthenticationVerifyMode) { | ||
| attributes.AdvertiseTrustStoreCaNames = translateAdvertiseCAToEnum(modelMutualAuthenticationCfg.AdvertiseTrustStoreCaNames) | ||
| } |
There was a problem hiding this comment.
Should IgnoreClientCertificateExpiry be handled the same way? Or should this be handled the same way as IgnoreClientCertificateExpiry?
They are both verify-specific features, this code section is more difficult to understand if similar features are implemented in different ways
There was a problem hiding this comment.
Unfortunately, the features might be implemented the same way but the API validation is different for the two. When the default value is set for IgnoreClientCertificateExpiry the API accepts the input no matter what mode we're using. However, the same is not true for AdvertiseTrustStoreCaNames, if the a value is set for this field and the mode is not verify, then the API will fail.
There was a problem hiding this comment.
Thanks for the clarification! If this is consistent with the API behavior, that's okay with me :)
k8s-ci-robot
added
the
approved
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: andreybutenko, shraddhabang, zac-nixon The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Issue
ALB recently added a new flag to mtls listeners:
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/mutual-authentication.html#advertise-ca-subject
This CR adds the ability to set the advertise ca flag on an mtls listener from an ingress / service annotation.
Description
Adds parsing logic to
alb.ingress.kubernetes.io/mutual-authenticationthat parses theadvertiseTrustStoreCaNamesfield and passes it onto the ELB API to set the new flag on an mtls listener.Tested locally in a cluster with the following setups:
1/ No mTLS
2/ mTLS off
3/ mTLS pass through mode
4/ mTLS verify with advertise ca off
5/ mTLS verify with advertise ca on
Checklist
README.md, or thedocsdirectory)BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯