DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add proxy_ssl_* directives

Browse source 
Add support for backends which require client certificate (eg. NiFi)
authentication. The `proxy-ssl-secret` k8s annotation references a
secret which is used to authenticate to the backend server. All other
directives fine tune the backend communication.

The following annotations are supported:
* proxy-ssl-secret
* proxy-ssl-ciphers
* proxy-ssl-protocol
* proxy-ssl-verify
* proxy-ssl-verify-depth
This commit is contained in:
Gabor Lekeny 2019-07-17 02:23:32 +02:00
parent 589c9a20f9
commit def13fc06c
8 changed files with 476 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
internal/ingress/types.go
View file

@ -33,6 +33,7 @@ import (
"k8s.io/ingress-nginx/internal/ingress/annotations/luarestywaf"
"k8s.io/ingress-nginx/internal/ingress/annotations/modsecurity"
"k8s.io/ingress-nginx/internal/ingress/annotations/proxy"
"k8s.io/ingress-nginx/internal/ingress/annotations/proxyssl"
"k8s.io/ingress-nginx/internal/ingress/annotations/ratelimit"
"k8s.io/ingress-nginx/internal/ingress/annotations/redirect"
"k8s.io/ingress-nginx/internal/ingress/annotations/rewrite"
@ -188,6 +189,9 @@ type Server struct {
// CertificateAuth indicates the this server requires mutual authentication
// +optional
CertificateAuth authtls.Config `json:"certificateAuth"`
// ProxySSL indicates the this server uses client certificate to access backends
// +optional
ProxySSL proxyssl.Config `json:"proxySSL"`
// ServerSnippet returns the snippet of server
// +optional
ServerSnippet string `json:"serverSnippet"`
@ -273,6 +277,10 @@ type Location struct {
// to be used in connections against endpoints
// +optional
Proxy proxy.Config `json:"proxy,omitempty"`
// ProxySSL contains information about SSL configuration parameters
// to be used in connections against endpoints
// +optional
ProxySSL proxyssl.Config `json:"proxySSL,omitempty"`
// UsePortInRedirects indicates if redirects must specify the port
// +optional
UsePortInRedirects bool `json:"usePortInRedirects"`