Skip to content

Webhook: validate certificateRefs when tls is set and mode is Terminate. #1460

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Oct 19, 2022
Merged

Webhook: validate certificateRefs when tls is set and mode is Terminate. #1460

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
57d2a64
Webhook: validate certificateRefs when tls is set and mode is Terminate.
Oct 17, 2022
505ce6c
Remove check for whether TLS mode is nil and add certificateRefs vali…
Oct 18, 2022
8b54657
Use length to check CertificateRefs
Oct 18, 2022
cf6b856
Update comments of validateTLSCertificateRefs
Oct 18, 2022
7b2d1bb
Keep the v1beta1 validation code and tests, and include that in the v…
Oct 19, 2022
3e80016
Fix comments format
Oct 19, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions apis/v1alpha2/validation/gateway.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ import (
"k8s.io/apimachinery/pkg/util/validation/field"

gatewayv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
gatewayvalidationv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1/validation"
)

var (
Expand All @@ -36,6 +37,11 @@ var (
gatewayv1a2.UDPProtocolType: {},
gatewayv1a2.TCPProtocolType: {},
}

// ValidateTLSCertificateRefs validates the certificateRefs
// must be set and not empty when tls config is set and
// TLSModeType is terminate
validateTLSCertificateRefs = gatewayvalidationv1b1.ValidateTLSCertificateRefs
)

// ValidateGateway validates gw according to the Gateway API specification.
Expand All @@ -62,6 +68,7 @@ func validateGatewayListeners(listeners []gatewayv1a2.Listener, path *field.Path
var errs field.ErrorList
errs = append(errs, validateListenerTLSConfig(listeners, path)...)
errs = append(errs, validateListenerHostname(listeners, path)...)
errs = append(errs, validateTLSCertificateRefs(listeners, path)...)
return errs
}

Expand Down
16 changes: 16 additions & 0 deletions apis/v1beta1/validation/gateway.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,7 @@ func validateGatewayListeners(listeners []gatewayv1b1.Listener, path *field.Path
var errs field.ErrorList
errs = append(errs, validateListenerTLSConfig(listeners, path)...)
errs = append(errs, validateListenerHostname(listeners, path)...)
errs = append(errs, ValidateTLSCertificateRefs(listeners, path)...)
return errs
}

Expand Down Expand Up @@ -91,3 +92,18 @@ func validateListenerHostname(listeners []gatewayv1b1.Listener, path *field.Path
}
return errs
}

// ValidateTLSCertificateRefs validates the certificateRefs
// must be set and not empty when tls config is set and
// TLSModeType is terminate
func ValidateTLSCertificateRefs(listeners []gatewayv1b1.Listener, path *field.Path) field.ErrorList {
var errs field.ErrorList
for i, c := range listeners {
if c.Protocol == gatewayv1b1.HTTPSProtocolType && c.TLS != nil {
if *c.TLS.Mode == gatewayv1b1.TLSModeTerminate && len(c.TLS.CertificateRefs) == 0 {
errs = append(errs, field.Forbidden(path.Index(i).Child("tls").Child("certificateRefs"), fmt.Sprintln("should be set and not empty when TLSModeType is Terminate")))
}
}
}
return errs
}
11 changes: 11 additions & 0 deletions apis/v1beta1/validation/gateway_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,17 @@ func TestValidateGateway(t *testing.T) {
},
expectErrsOnFields: []string{"spec.listeners[0].hostname"},
},
"certificatedRefs not set with TLS terminate mode": {
mutate: func(gw *gatewayv1b1.Gateway) {
hostname := gatewayv1b1.Hostname("foo.bar.com")
tlsMode := gatewayv1b1.TLSModeType("Terminate")
gw.Spec.Listeners[0].Protocol = gatewayv1b1.HTTPSProtocolType
gw.Spec.Listeners[0].Hostname = &hostname
gw.Spec.Listeners[0].TLS = &tlsConfig
gw.Spec.Listeners[0].TLS.Mode = &tlsMode
},
expectErrsOnFields: []string{"spec.listeners[0].tls.certificateRefs"},
},
}

for name, tc := range testCases {
Expand Down