Skip to content

Commit 94f7ad6

Browse files
zirainzirain
committed
support ClusterTrustBundle
Signed-off-by: zirain <zirain2009@gmail.com>
1 parent 1be47b2 commit 94f7ad6

31 files changed

+2448
-159
lines changed

‎internal/gatewayapi/backendtlspolicy.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -316,6 +316,16 @@ func getCaCertsFromCARefs(namespace string, caCertificates []gwapiv1.LocalObject
316316
} else {
317317
return nil, fmt.Errorf("secret %s not found in namespace %s", caRef.Name, namespace)
318318
}
319+
case resource.KindClusterTrustBundle:
320+
ctb := resources.GetClusterTrustBundle(string(caRef.Name))
321+
if ctb != nil {
322+
if ca != "" {
323+
ca += "\n"
324+
}
325+
ca += ctb.Spec.TrustBundle
326+
} else {
327+
return nil, fmt.Errorf("cluster trust bundle %s not found", caRef.Name)
328+
}
319329
}
320330
}
321331

‎internal/gatewayapi/clienttrafficpolicy.go

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -819,47 +819,49 @@ func (t *Translator) buildListenerTLSParameters(policy *egv1a1.ClientTrafficPoli
819819
}
820820

821821
for _, caCertRef := range tlsParams.ClientValidation.CACertificateRefs {
822-
caCertRefKind := string(ptr.Deref[gwapiv1.Kind](caCertRef.Kind, resource.KindSecret))
822+
caCertRefKind := string(ptr.Deref(caCertRef.Kind, resource.KindSecret))
823+
var caCertBytes []byte
823824
switch caCertRefKind {
824825
case resource.KindSecret:
825826
secret, err := t.validateSecretRef(false, from, caCertRef, resources)
826827
if err != nil {
827828
return irTLSConfig, err
828829
}
829830

830-
secretBytes, ok := getCaCertFromSecret(secret)
831-
if !ok || len(secretBytes) == 0 {
831+
secretCertBytes, ok := getCaCertFromSecret(secret)
832+
if !ok || len(secretCertBytes) == 0 {
832833
return irTLSConfig, fmt.Errorf(
833834
"caCertificateRef not found in secret %s", caCertRef.Name)
834835
}
835-
836-
if err := validateCertificate(secretBytes); err != nil {
837-
return irTLSConfig, fmt.Errorf(
838-
"invalid certificate in secret %s: %w", caCertRef.Name, err)
839-
}
840-
841-
irCACert.Certificate = append(irCACert.Certificate, secretBytes...)
836+
caCertBytes = secretCertBytes
842837
case resource.KindConfigMap:
843838
configMap, err := t.validateConfigMapRef(false, from, caCertRef, resources)
844839
if err != nil {
845840
return irTLSConfig, err
846841
}
847842

848-
configMapBytes, ok := getCaCertFromConfigMap(configMap)
849-
if !ok || len(configMapBytes) == 0 {
843+
configMapData, ok := getCaCertFromConfigMap(configMap)
844+
if !ok || len(configMapData) == 0 {
850845
return irTLSConfig, fmt.Errorf(
851-
"caCertificateRef not found in configMap %s", caCertRef.Name)
846+
"caCertificateRef not found in configmap %s", caCertRef.Name)
852847
}
853-
854-
if err := validateCertificate([]byte(configMapBytes)); err != nil {
848+
caCertBytes = []byte(configMapData)
849+
case resource.KindClusterTrustBundle:
850+
trustBundle := resources.GetClusterTrustBundle(string(caCertRef.Name))
851+
if trustBundle == nil {
855852
return irTLSConfig, fmt.Errorf(
856-
"invalid certificate in configmap %s: %w", caCertRef.Name, err)
853+
"caCertificateRef not found in ClusterTrustBundle %s", caCertRef.Name)
857854
}
858-
859-
irCACert.Certificate = append(irCACert.Certificate, configMapBytes...)
855+
caCertBytes = []byte(trustBundle.Spec.TrustBundle)
860856
default:
861857
return irTLSConfig, fmt.Errorf("unsupported caCertificateRef kind:%s", caCertRefKind)
862858
}
859+
860+
if err := validateCertificate(caCertBytes); err != nil {
861+
return irTLSConfig, fmt.Errorf(
862+
"invalid certificate in %s %s: %w", caCertRefKind, caCertRef.Name, err)
863+
}
864+
irCACert.Certificate = append(irCACert.Certificate, caCertBytes...)
863865
}
864866

865867
if len(irCACert.Certificate) > 0 {

‎internal/gatewayapi/resource/resource.go

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"reflect"
1111

1212
"golang.org/x/exp/slices"
13+
certificatesv1b1 "k8s.io/api/certificates/v1beta1"
1314
corev1 "k8s.io/api/core/v1"
1415
discoveryv1 "k8s.io/api/discovery/v1"
1516
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -66,6 +67,8 @@ type Resources struct {
6667
Backends []*egv1a1.Backend `json:"backends,omitempty" yaml:"backends,omitempty"`
6768
HTTPRouteFilters []*egv1a1.HTTPRouteFilter `json:"httpFilters,omitempty" yaml:"httpFilters,omitempty"`
6869

70+
ClusterTrustBundles []*certificatesv1b1.ClusterTrustBundle `json:"clusterTrustBundles,omitempty" yaml:"clusterTrustBundles,omitempty"`
71+
6972
serviceMap map[types.NamespacedName]*corev1.Service
7073
}
7174

@@ -160,6 +163,16 @@ func (r *Resources) GetSecret(namespace, name string) *corev1.Secret {
160163
return nil
161164
}
162165

166+
func (r *Resources) GetClusterTrustBundle(name string) *certificatesv1b1.ClusterTrustBundle {
167+
for _, ctb := range r.ClusterTrustBundles {
168+
if ctb.Name == name {
169+
return ctb
170+
}
171+
}
172+
173+
return nil
174+
}
175+
163176
func (r *Resources) GetConfigMap(namespace, name string) *corev1.ConfigMap {
164177
for _, configMap := range r.ConfigMaps {
165178
if configMap.Namespace == namespace && configMap.Name == name {

‎internal/gatewayapi/resource/supported_kind.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,4 +28,5 @@ const (
2828
KindSecret = "Secret"
2929
KindHTTPRouteFilter = "HTTPRouteFilter"
3030
KindReferenceGrant = "ReferenceGrant"
31+
KindClusterTrustBundle = "ClusterTrustBundle"
3132
)

‎internal/gatewayapi/resource/zz_generated.deepcopy.go

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎internal/gatewayapi/testdata/backendtlspolicy-ca-clustertrustbundle.in.yaml

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
gateways:
2+
- apiVersion: gateway.networking.k8s.io/v1
3+
kind: Gateway
4+
metadata:
5+
name: gateway-btls
6+
namespace: envoy-gateway
7+
spec:
8+
gatewayClassName: envoy-gateway-class
9+
listeners:
10+
- name: http
11+
protocol: HTTP
12+
port: 80
13+
allowedRoutes:
14+
namespaces:
15+
from: All
16+
httpRoutes:
17+
- apiVersion: gateway.networking.k8s.io/v1
18+
kind: HTTPRoute
19+
metadata:
20+
name: httproute-btls
21+
namespace: envoy-gateway
22+
spec:
23+
parentRefs:
24+
- namespace: envoy-gateway
25+
name: gateway-btls
26+
sectionName: http
27+
rules:
28+
- matches:
29+
- path:
30+
type: Exact
31+
value: "/exact"
32+
backendRefs:
33+
- name: http-backend
34+
namespace: backends
35+
port: 8080
36+
37+
referenceGrants:
38+
- apiVersion: gateway.networking.k8s.io/v1alpha2
39+
kind: ReferenceGrant
40+
metadata:
41+
name: refg-route-svc
42+
namespace: backends
43+
spec:
44+
from:
45+
- group: gateway.networking.k8s.io
46+
kind: HTTPRoute
47+
namespace: envoy-gateway
48+
- group: gateway.networking.k8s.io
49+
kind: Gateway
50+
namespace: envoy-gateway
51+
- group: gateway.networking.k8s.io
52+
kind: BackendTLSPolicy
53+
namespace: policies
54+
to:
55+
- group: ""
56+
kind: Service
57+
services:
58+
- apiVersion: v1
59+
kind: Service
60+
metadata:
61+
name: http-backend
62+
namespace: backends
63+
spec:
64+
clusterIP: 10.11.12.13
65+
ports:
66+
- port: 8080
67+
name: http
68+
protocol: TCP
69+
targetPort: 8080
70+
71+
endpointSlices:
72+
- apiVersion: discovery.k8s.io/v1
73+
kind: EndpointSlice
74+
metadata:
75+
name: endpointslice-http-backend
76+
namespace: backends
77+
labels:
78+
kubernetes.io/service-name: http-backend
79+
addressType: IPv4
80+
ports:
81+
- name: http
82+
protocol: TCP
83+
port: 8080
84+
endpoints:
85+
- addresses:
86+
- "10.244.0.11"
87+
conditions:
88+
ready: true
89+
clusterTrustBundles:
90+
- apiVersion: certificates.k8s.io/v1beta1
91+
kind: ClusterTrustBundle
92+
metadata:
93+
creationTimestamp: "2025-06-18T03:19:03Z"
94+
name: ca-cluster-trust-bundle
95+
spec:
96+
trustBundle: |
97+
-----BEGIN CERTIFICATE-----
98+
MIIDQzCCAiugAwIBAgIBATANBgkqhkiG9w0BAQsFADBCMRMwEQYDVQQKEwpFbnZv
99+
eVByb3h5MRAwDgYDVQQLEwdHYXRld2F5MRkwFwYDVQQDExBFbnZveSBHYXRld2F5
100+
IENBMCAXDTI0MDMxMDE1MzIxN1oYDzIxMjQwMzEwMTYzMjE3WjBCMRMwEQYDVQQK
101+
EwpFbnZveVByb3h5MRAwDgYDVQQLEwdHYXRld2F5MRkwFwYDVQQDExBFbnZveSBH
102+
YXRld2F5IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7ZFmGB4e
103+
m1KdGEohAZBfqydAEGLDHJ1YyfHWdd+vBAevdW64bZx3pggJOtgCnePuFd02rDQS
104+
dlsJlX/6mFtoQilo6wvxDSJRfaTDbtfTjw+7k8yfd/Jsmh0RWG+UeyI7Na9sXAz7
105+
b57mpxsCoNowzeK5ETiOGGNWPcjENJkSnBarz5muN00xIZWBU+yN5PLJNxZvxpZJ
106+
Ol/SSI8sno0e0PxAmp3fe7QaXiZj/TAGJPGuTJkUxrHqyZGJtYUxsS8A0dT1zBjj
107+
izA5Dp+b5yzYo23Hh7BgpbZ7X4gsDThFuwCD6fHyepuv2zHPqvSsdqg2hAhDp91R
108+
zrn7a9GxG2VSIwIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUw
109+
AwEB/zAdBgNVHQ4EFgQUUpP1aZ1M2KIuPPWrNPDV2c5CngowDQYJKoZIhvcNAQEL
110+
BQADggEBAGSEkAVz+Z0qS4FmA0q4SCpIIq64bsdEjiUzev7pK1LEK0/Y28QBPixV
111+
cUXfax18VPR9pls1JgXto9qY+C0hnRZic6611QTJlWK1p6dinQ/eDdYCBC+nv5xx
112+
ssASwmplIxMvj3S1qF6dr7sMI2ZVD5HElTWdO19UBLyhiKKZW2KxDsYj+5NRwGFe
113+
G+JuDgq7njUM8mdyYk0NehefdBUEUUCQtnwUtW95/429XwqQROuRDteGT9kjD+Y5
114+
ea5mW4mfqLeuGJXZs9bdWjKKdLQPrn9IshPysWqz2Hz8dQ1f7N9/g8UWVSjd4cyx
115+
S5EAolzVv0yB7wHCWCgfG/ckdOTUNnE=
116+
-----END CERTIFICATE-----
117+
backendTLSPolicies:
118+
- apiVersion: gateway.networking.k8s.io/v1alpha2
119+
kind: BackendTLSPolicy
120+
metadata:
121+
name: policy-btls
122+
namespace: backends
123+
spec:
124+
targetRefs:
125+
- group: ""
126+
kind: Service
127+
name: http-backend
128+
sectionName: http
129+
validation:
130+
caCertificateRefs:
131+
- name: ca-cluster-trust-bundle
132+
group: ""
133+
kind: ClusterTrustBundle
134+
hostname: example.com

0 commit comments

Comments
 (0)