Skip to content

Support backend set CA bundle SSL with verify-peer and custom LB name #548

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kpstack wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Support backend set CA bundle SSL with verify-peer and custom LB name #548

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docs/load-balancer-annotations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,9 @@ spec:
| `oci.oraclecloud.com/oci-backend-network-security-group` | Specifies backend Network Security Group(s)' OCID(s) for management of ingress / egress security rules for the LB/NLB by the CCM. Example NSG OCID: `ocid1.networksecuritygroup.oc1.iad.aaa` | `N/A` | `"ocid1...aaa, ocid1...bbb"` |
| `oci.oraclecloud.com/oci-load-balancer-listener-ssl-config` | Specifies the cipher suite on the listener of the LB managed by CCM. | `N/A` | `'{"CipherSuiteName":"oci-default-http2-ssl-cipher-suite-v1", "Protocols":["TLSv1.2"]}'` |
| `oci.oraclecloud.com/oci-load-balancer-backendset-ssl-config"` | Specifies the cipher suite on the backendsets of the LB managed by CCM. | `N/A` | `'{"CipherSuiteName":"oci-default-http2-ssl-cipher-suite-v1", "Protocols":["TLSv1.2"]}'` |
| `oci.oraclecloud.com/oci-load-balancer-backendset-ca-bundle` | Specifies an OCI Certificates Service CA Bundle OCID to populate the trusted certificate authorities on the backendset SSL configuration of the LB managed by CCM. Applies only to the backend-set (not the listener) and does not replace the `service.beta.kubernetes.io/oci-load-balancer-tls-backendset-secret` mechanism. | `N/A` | `"ocid1.cabundle.oc1..aaa"` |
| `oci.oraclecloud.com/oci-load-balancer-verify-peer-certificate` | Enables backend peer certificate verification against the trusted CA bundle on the backendset SSL configuration. Accepted truthy values: `true`, `yes`, `1`. | `false` | `"true"` |
| `oci.oraclecloud.com/oci-load-balancer-name` | Sets a custom display-name prefix for the OCI load balancer. The Service UID is appended to keep the name unique (`<name>-<uid>`), and the result is truncated to the 1024-character limit. | `N/A` | `"my-lb"` |
| `oci.oraclecloud.com/ingress-ip-mode` | Specifies ".status.loadBalancer.ingress.ipMode" for a Service with type set to LoadBalancer. Refer: [Specifying IPMode to adjust traffic routing][11] | `VIP` | `"proxy"` |
| `oci.oraclecloud.com/oci-load-balancer-rule-sets` | [Rule Sets][11] configuration. A JSON object mapping strings to RuleSetDetails objects as specified in [OCI API documentation][12]. All rule sets will be attached to all configured listeners. | `N/A` |

Expand Down
56 changes: 46 additions & 10 deletions pkg/cloudprovider/providers/oci/load_balancer_spec.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,6 +179,16 @@ const (
// ServiceAnnotationLoadbalancerBackendSetSSLConfig is a service annotation allows you to set the cipher suite on the backendSet
ServiceAnnotationLoadbalancerBackendSetSSLConfig = "oci.oraclecloud.com/oci-load-balancer-backendset-ssl-config"

// ServiceAnnotationLoadbalancerBackendSetCABundle is a service annotation that allows you to specify an OCI
// Certificates Service CA Bundle OCID to populate TrustedCertificateAuthorityIds on the backendSet SSL
// configuration. This is independent of, and can be supplied without, ServiceAnnotationLoadBalancerTLSBackendSetSecret.
ServiceAnnotationLoadbalancerBackendSetCABundle = "oci.oraclecloud.com/oci-load-balancer-backendset-ca-bundle"

// ServiceAnnotationLoadbalancerBackendSetVerifyPeerCertificate is a service annotation that allows you to enable
// peer certificate verification on the backendSet SSL configuration. When set to "true", the load balancer will
// verify backend server certificates against the trusted CA bundle. Defaults to "false".
ServiceAnnotationLoadbalancerBackendSetVerifyPeerCertificate = "oci.oraclecloud.com/oci-load-balancer-verify-peer-certificate"

// ServiceAnnotationIngressIpMode is a service annotation allows you to set the ".status.loadBalancer.ingress.ipMode" for a Service
// with type set to LoadBalancer.
// https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-ip-mode:~:text=Specifying%20IPMode%20of%20load%20balancer%20status
Expand All @@ -189,6 +199,9 @@ const (
// Expected format is a JSON blob containing a JSON object literal with keys being rule names and values being a JSON
// representation of a valid Rule object. https://docs.oracle.com/en-us/iaas/api/#/en/loadbalancer/20170115/datatypes/Rule
ServiceAnnotationRuleSets = "oci.oraclecloud.com/oci-load-balancer-rule-sets"

// ServiceAnnotationLoadBalancerName is a service annotation that allows specifying an optional custom display name prefix/name for the OCI Load Balancer.
ServiceAnnotationLoadBalancerName = "oci.oraclecloud.com/oci-load-balancer-name"
)

// NLB specific annotations
Expand Down Expand Up @@ -321,8 +334,12 @@ func requiresCertificate(svc *v1.Service) bool {
if getLoadBalancerType(svc) == NLB {
return false
}
_, ok := svc.Annotations[ServiceAnnotationLoadBalancerSSLPorts]
return ok
if _, ok := svc.Annotations[ServiceAnnotationLoadBalancerSSLPorts]; ok {
return true
}
// A CA Bundle alone (without SSL ports) must still trigger SSLConfig
// construction so backend-set trust configuration can be built.
return svc.Annotations[ServiceAnnotationLoadbalancerBackendSetCABundle] != ""
}

func requiresNsgManagement(svc *v1.Service) bool {
Expand Down Expand Up @@ -838,10 +855,18 @@ func getBackendSets(logger *zap.SugaredLogger, svc *v1.Service, provisionedNodes
for backendSetName, servicePort := range getBackendSetNamePortMap(svc) {
var secretName string
var sslConfiguration *client.GenericSslConfigurationDetails
if sslCfg != nil && len(sslCfg.BackendSetSSLSecretName) != 0 && getLoadBalancerType(svc) == LB {
caBundleId := svc.Annotations[ServiceAnnotationLoadbalancerBackendSetCABundle]
if sslCfg != nil && (len(sslCfg.BackendSetSSLSecretName) != 0 || caBundleId != "") && getLoadBalancerType(svc) == LB {
secretName = sslCfg.BackendSetSSLSecretName
backendSetSSLConfig, _ := svc.Annotations[ServiceAnnotationLoadbalancerBackendSetSSLConfig]
sslConfiguration, err = getSSLConfiguration(sslCfg, secretName, int(servicePort.Port), backendSetSSLConfig)
verifyPeerCertValue := false
if vpVal, ok := svc.Annotations[ServiceAnnotationLoadbalancerBackendSetVerifyPeerCertificate]; ok {
vpVal = strings.ToLower(strings.TrimSpace(vpVal))
if vpVal == "true" || vpVal == "yes" || vpVal == "1" {
verifyPeerCertValue = true
}
}
sslConfiguration, err = getSSLConfiguration(sslCfg, secretName, int(servicePort.Port), backendSetSSLConfig, caBundleId, verifyPeerCertValue)
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -1019,15 +1044,18 @@ func getHealthCheckTimeout(svc *v1.Service) (int, error) {
}

func GetSSLConfiguration(cfg *SSLConfig, name string, port int, sslConfigAnnotation string) (*client.GenericSslConfigurationDetails, error) {
sslConfig, err := getSSLConfiguration(cfg, name, port, sslConfigAnnotation)
sslConfig, err := getSSLConfiguration(cfg, name, port, sslConfigAnnotation, "", false)
if err != nil {
return nil, err
}
return sslConfig, nil
}

func getSSLConfiguration(cfg *SSLConfig, name string, port int, lbSslConfigurationAnnotation string) (*client.GenericSslConfigurationDetails, error) {
if cfg == nil || !cfg.Ports.Has(port) || len(name) == 0 {
func getSSLConfiguration(cfg *SSLConfig, name string, port int, lbSslConfigurationAnnotation string, caBundleId string, verifyPeerCertificate bool) (*client.GenericSslConfigurationDetails, error) {
if cfg == nil || (!cfg.Ports.Has(port) && caBundleId == "") {
return nil, nil
}
if len(name) == 0 && caBundleId == "" {
return nil, nil
}
// TODO: fast-follow to pass the sslconfiguration object directly to loadbalancer
Expand All @@ -1040,9 +1068,17 @@ func getSSLConfiguration(cfg *SSLConfig, name string, port int, lbSslConfigurati
}
}
genericSSLConfigurationDetails := &client.GenericSslConfigurationDetails{
CertificateName: &name,
VerifyDepth: common.Int(0),
VerifyPeerCertificate: common.Bool(false),
VerifyPeerCertificate: common.Bool(verifyPeerCertificate),
}
if len(name) != 0 {
genericSSLConfigurationDetails.CertificateName = &name
}
if caBundleId != "" {
genericSSLConfigurationDetails.TrustedCertificateAuthorityIds = []string{caBundleId}
if genericSSLConfigurationDetails.VerifyDepth == nil || *genericSSLConfigurationDetails.VerifyDepth == 0 {
genericSSLConfigurationDetails.VerifyDepth = common.Int(1)
}
}
if extractCipherSuite != nil {
genericSSLConfigurationDetails.CipherSuiteName = extractCipherSuite.CipherSuiteName
Expand Down Expand Up @@ -1113,7 +1149,7 @@ func getListenersOciLoadBalancer(svc *v1.Service, sslCfg *SSLConfig) (map[string
if sslCfg != nil && len(sslCfg.ListenerSSLSecretName) != 0 {
secretName = sslCfg.ListenerSSLSecretName
listenerCipherSuiteAnnotation, _ := svc.Annotations[ServiceAnnotationLoadbalancerListenerSSLConfig]
sslConfiguration, err = getSSLConfiguration(sslCfg, secretName, port, listenerCipherSuiteAnnotation)
sslConfiguration, err = getSSLConfiguration(sslCfg, secretName, port, listenerCipherSuiteAnnotation, "", false)
if err != nil {
return nil, err
}
Expand Down
Loading