From 5bf9c64fab6bac67caf077423b0b69e7d46cfca7 Mon Sep 17 00:00:00 2001 From: Travis Raines <571832+rainest@users.noreply.github.com> Date: Fri, 18 Mar 2022 11:50:36 -0700 Subject: [PATCH] feat(config) add disable CA certificate flag --- CHANGELOG.md | 3 +++ internal/dataplane/kong_client.go | 23 ++++++++++++++------- internal/dataplane/sendconfig/sendconfig.go | 6 ++++-- internal/manager/config.go | 2 ++ internal/manager/run.go | 5 ++++- 5 files changed, 28 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 715ce012ea..c0e6831d11 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -72,6 +72,9 @@ `allowedRoutes` filters are merged into generated listeners with the same protocol. [#2389](https://github.com/Kong/kubernetes-ingress-controller/issues/2389) +- Added `--skip-ca-certificates` flag to ignore CA certificate resources for + [use with multi-workspace environments](https://github.com/Kong/deck/blob/main/CHANGELOG.md#v1120). + [#2341](https://github.com/Kong/kubernetes-ingress-controller/issues/2341) #### Fixed diff --git a/internal/dataplane/kong_client.go b/internal/dataplane/kong_client.go index acf3714e8c..9a97d4c68c 100644 --- a/internal/dataplane/kong_client.go +++ b/internal/dataplane/kong_client.go @@ -41,6 +41,10 @@ type KongClient struct { // updates to the data-plane. enableReverseSync bool + // skipCACertificates disables CA certificates, to avoid fighting over configuration in multi-workspace + // environments. See https://github.com/Kong/deck/pull/617 + skipCACertificates bool + // requestTimeout is the maximum amount of time that should be waited for // requests to the data-plane to receive a response. requestTimeout time.Duration @@ -99,20 +103,22 @@ func NewKongClient( timeout time.Duration, ingressClass string, enableReverseSync bool, + skipCACertificates bool, diagnostic util.ConfigDumpDiagnostic, kongConfig sendconfig.Kong, ) (*KongClient, error) { // build the client object cache := store.NewCacheStores() c := &KongClient{ - logger: logger, - ingressClass: ingressClass, - enableReverseSync: enableReverseSync, - requestTimeout: timeout, - diagnostic: diagnostic, - prometheusMetrics: metrics.NewCtrlFuncMetrics(), - cache: &cache, - kongConfig: kongConfig, + logger: logger, + ingressClass: ingressClass, + enableReverseSync: enableReverseSync, + skipCACertificates: skipCACertificates, + requestTimeout: timeout, + diagnostic: diagnostic, + prometheusMetrics: metrics.NewCtrlFuncMetrics(), + cache: &cache, + kongConfig: kongConfig, } // download the kong root configuration (and validate connectivity to the proxy API) @@ -305,6 +311,7 @@ func (c *KongClient) Update(ctx context.Context) error { &c.kongConfig, c.kongConfig.InMemory, c.enableReverseSync, + c.skipCACertificates, targetConfig, c.kongConfig.FilterTags, nil, diff --git a/internal/dataplane/sendconfig/sendconfig.go b/internal/dataplane/sendconfig/sendconfig.go index cbbb9d3e6b..c6e346ebbe 100644 --- a/internal/dataplane/sendconfig/sendconfig.go +++ b/internal/dataplane/sendconfig/sendconfig.go @@ -35,6 +35,7 @@ func PerformUpdate(ctx context.Context, kongConfig *Kong, inMemory bool, reverseSync bool, + skipCACertificates bool, targetContent *file.Content, selectorTags []string, customEntities []byte, @@ -77,7 +78,7 @@ func PerformUpdate(ctx context.Context, err = onUpdateInMemoryMode(ctx, log, targetContent, customEntities, kongConfig) } else { metricsProtocol = metrics.ProtocolDeck - err = onUpdateDBMode(ctx, targetContent, kongConfig, selectorTags) + err = onUpdateDBMode(ctx, targetContent, kongConfig, selectorTags, skipCACertificates) } timeEnd := time.Now() @@ -199,8 +200,9 @@ func onUpdateDBMode(ctx context.Context, targetContent *file.Content, kongConfig *Kong, selectorTags []string, + skipCACertificates bool, ) error { - dumpConfig := dump.Config{SelectorTags: selectorTags} + dumpConfig := dump.Config{SelectorTags: selectorTags, SkipCACerts: skipCACertificates} // read the current state rawState, err := dump.Get(ctx, kongConfig.Client, dumpConfig) if err != nil { diff --git a/internal/manager/config.go b/internal/manager/config.go index b5a7e514be..39f630cc58 100644 --- a/internal/manager/config.go +++ b/internal/manager/config.go @@ -40,6 +40,7 @@ type Config struct { AnonymousReports bool EnableReverseSync bool SyncPeriod time.Duration + SkipCACertificates bool // Kong Proxy configurations APIServerHost string @@ -122,6 +123,7 @@ func (c *Config) FlagSet() *pflag.FlagSet { flagSet.BoolVar(&c.AnonymousReports, "anonymous-reports", true, `Send anonymized usage data to help improve Kong`) flagSet.BoolVar(&c.EnableReverseSync, "enable-reverse-sync", false, `Send configuration to Kong even if the configuration checksum has not changed since previous update.`) flagSet.DurationVar(&c.SyncPeriod, "sync-period", time.Hour*48, `Relist and confirm cloud resources this often`) // 48 hours derived from controller-runtime defaults + flagSet.BoolVar(&c.SkipCACertificates, "skip-ca-certificates", false, `disable syncing CA certificate syncing (for use with multi-workspace environments)`) flagSet.StringVar(&c.KongAdminAPIConfig.TLSClientCertPath, "kong-admin-tls-client-cert-file", "", "mTLS client certificate file for authentication.") flagSet.StringVar(&c.KongAdminAPIConfig.TLSClientKeyPath, "kong-admin-tls-client-key-file", "", "mTLS client key file for authentication.") diff --git a/internal/manager/run.go b/internal/manager/run.go index b4635fa8f3..8672af82f6 100644 --- a/internal/manager/run.go +++ b/internal/manager/run.go @@ -104,6 +104,9 @@ func Run(ctx context.Context, c *Config, diagnostic util.ConfigDumpDiagnostic) e if !ok { return fmt.Errorf("invalid database configuration, expected a string got %T", kongRootConfig["database"]) } + if dbmode == "off" && c.SkipCACertificates { + return fmt.Errorf("--skip-ca-certificates is not available for use with DB-less Kong instances") + } setupLog.Info("configuring and building the controller manager") controllerOpts, err := setupControllerOptions(setupLog, c, scheme, dbmode) @@ -125,7 +128,7 @@ func Run(ctx context.Context, c *Config, diagnostic util.ConfigDumpDiagnostic) e if err != nil { return fmt.Errorf("%f is not a valid number of seconds to the timeout config for the kong client: %w", c.ProxyTimeoutSeconds, err) } - dataplaneClient, err := dataplane.NewKongClient(deprecatedLogger, timeoutDuration, c.IngressClassName, c.EnableReverseSync, diagnostic, kongConfig) + dataplaneClient, err := dataplane.NewKongClient(deprecatedLogger, timeoutDuration, c.IngressClassName, c.EnableReverseSync, c.SkipCACertificates, diagnostic, kongConfig) if err != nil { return fmt.Errorf("failed to initialize kong data-plane client: %w", err) }