Skip to content

Commit fd1cc6a

Browse files
sbueringersbueringer
committed
Add tls options to manager.Options
1 parent 8ad090e commit fd1cc6a

File tree

6 files changed

+84
-18
lines changed

6 files changed

+84
-18
lines changed

‎pkg/config/v1alpha1/types.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ limitations under the License.
1717
package v1alpha1
1818

1919
import (
20+
"crypto/tls"
2021
"time"
2122

2223
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -140,6 +141,13 @@ type ControllerWebhook struct {
140141
// must be named tls.key and tls.crt, respectively.
141142
// +optional
142143
CertDir string `json:"certDir,omitempty"`
144+
145+
// TLSVersion is the minimum version of TLS supported. Accepts
146+
// "", "1.0", "1.1", "1.2" and "1.3" only ("" is equivalent to "1.0" for backwards compatibility)
147+
TLSMinVersion string
148+
149+
// TLSOpts is used to allow configuring the TLS config used for the server
150+
TLSOpts []func(*tls.Config)
143151
}
144152

145153
// +kubebuilder:object:root=true

‎pkg/envtest/webhook_test.go‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package envtest
1818

1919
import (
2020
"context"
21+
"crypto/tls"
2122
"path/filepath"
2223
"time"
2324

@@ -27,6 +28,7 @@ import (
2728
corev1 "k8s.io/api/core/v1"
2829
apierrors "k8s.io/apimachinery/pkg/api/errors"
2930
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
31+
3032
"sigs.k8s.io/controller-runtime/pkg/client"
3133
"sigs.k8s.io/controller-runtime/pkg/manager"
3234
"sigs.k8s.io/controller-runtime/pkg/webhook"
@@ -38,9 +40,13 @@ var _ = Describe("Test", func() {
3840
Describe("Webhook", func() {
3941
It("should reject create request for webhook that rejects all requests", func() {
4042
m, err := manager.New(env.Config, manager.Options{
41-
Port: env.WebhookInstallOptions.LocalServingPort,
42-
Host: env.WebhookInstallOptions.LocalServingHost,
43-
CertDir: env.WebhookInstallOptions.LocalServingCertDir,
43+
Port: env.WebhookInstallOptions.LocalServingPort,
44+
Host: env.WebhookInstallOptions.LocalServingHost,
45+
CertDir: env.WebhookInstallOptions.LocalServingCertDir,
46+
TLSMinVersion: "1.2",
47+
TLSOpts: []func(*tls.Config){
48+
func(config *tls.Config) {},
49+
},
4450
}) // we need manager here just to leverage manager.SetFields
4551
Expect(err).NotTo(HaveOccurred())
4652
server := m.GetWebhookServer()

‎pkg/manager/internal.go‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package manager
1818

1919
import (
2020
"context"
21+
"crypto/tls"
2122
"errors"
2223
"fmt"
2324
"net"
@@ -135,6 +136,11 @@ type controllerManager struct {
135136
// if not set, webhook server would look up the server key and certificate in
136137
// {TempDir}/k8s-webhook-server/serving-certs
137138
certDir string
139+
// tlsMinVersion is the minimum version of TLS supported by the webhook server.
140+
// Accepts "", "1.0", "1.1", "1.2" and "1.3" only ("" is equivalent to "1.0" for backwards compatibility).
141+
tlsMinVersion string
142+
// tlsOpts is used to allow configuring the TLS config used for the webhook server.
143+
tlsOpts []func(*tls.Config)
138144

139145
webhookServer *webhook.Server
140146
// webhookServerOnce will be called in GetWebhookServer() to optionally initialize
@@ -302,9 +308,11 @@ func (cm *controllerManager) GetWebhookServer() *webhook.Server {
302308
cm.webhookServerOnce.Do(func() {
303309
if cm.webhookServer == nil {
304310
cm.webhookServer = &webhook.Server{
305-
Port: cm.port,
306-
Host: cm.host,
307-
CertDir: cm.certDir,
311+
Port: cm.port,
312+
Host: cm.host,
313+
CertDir: cm.certDir,
314+
TLSMinVersion: cm.tlsMinVersion,
315+
TLSOpts: cm.tlsOpts,
308316
}
309317
}
310318
if err := cm.Add(cm.webhookServer); err != nil {

‎pkg/manager/manager.go‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package manager
1818

1919
import (
2020
"context"
21+
"crypto/tls"
2122
"fmt"
2223
"net"
2324
"net/http"
@@ -32,6 +33,7 @@ import (
3233
"k8s.io/client-go/tools/leaderelection/resourcelock"
3334
"k8s.io/client-go/tools/record"
3435
"k8s.io/utils/pointer"
36+
3537
"sigs.k8s.io/controller-runtime/pkg/cache"
3638
"sigs.k8s.io/controller-runtime/pkg/client"
3739
"sigs.k8s.io/controller-runtime/pkg/cluster"
@@ -242,6 +244,13 @@ type Options struct {
242244
// It is used to set webhook.Server.CertDir if WebhookServer is not set.
243245
CertDir string
244246

247+
// TLSMinVersion is the minimum version of TLS supported by the webhook server.
248+
// Accepts "", "1.0", "1.1", "1.2" and "1.3" only ("" is equivalent to "1.0" for backwards compatibility).
249+
TLSMinVersion string
250+
251+
// TLSOpts is used to allow configuring the TLS config used for the webhook server.
252+
TLSOpts []func(*tls.Config)
253+
245254
// WebhookServer is an externally configured webhook.Server. By default,
246255
// a Manager will create a default server using Port, Host, and CertDir;
247256
// if this is set, the Manager will use this server instead.
@@ -422,6 +431,8 @@ func New(config *rest.Config, options Options) (Manager, error) {
422431
port: options.Port,
423432
host: options.Host,
424433
certDir: options.CertDir,
434+
tlsMinVersion: options.TLSMinVersion,
435+
tlsOpts: options.TLSOpts,
425436
webhookServer: options.WebhookServer,
426437
leaseDuration: *options.LeaseDuration,
427438
renewDeadline: *options.RenewDeadline,
@@ -490,6 +501,14 @@ func (o Options) AndFrom(loader config.ControllerManagerConfiguration) (Options,
490501
o.CertDir = newObj.Webhook.CertDir
491502
}
492503

504+
if o.TLSMinVersion == "" && newObj.Webhook.TLSMinVersion != "" {
505+
o.TLSMinVersion = newObj.Webhook.TLSMinVersion
506+
}
507+
508+
if o.TLSOpts == nil && newObj.Webhook.TLSOpts != nil {
509+
o.TLSOpts = newObj.Webhook.TLSOpts
510+
}
511+
493512
if newObj.Controller != nil {
494513
if o.Controller.CacheSyncTimeout == nil && newObj.Controller.CacheSyncTimeout != nil {
495514
o.Controller.CacheSyncTimeout = newObj.Controller.CacheSyncTimeout

‎pkg/manager/manager_test.go‎

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package manager
1818

1919
import (
2020
"context"
21+
"crypto/tls"
2122
"errors"
2223
"fmt"
2324
"io"
@@ -126,6 +127,9 @@ var _ = Describe("manger.Manager", func() {
126127
port := int(6090)
127128
leaderElect := false
128129

130+
tlsOptsFuncs := []func(*tls.Config){
131+
func(config *tls.Config) {},
132+
}
129133
ccfg := &v1alpha1.ControllerManagerConfiguration{
130134
ControllerManagerConfigurationSpec: v1alpha1.ControllerManagerConfigurationSpec{
131135
SyncPeriod: &duration,
@@ -148,9 +152,11 @@ var _ = Describe("manger.Manager", func() {
148152
LivenessEndpointName: "/livez",
149153
},
150154
Webhook: v1alpha1.ControllerWebhook{
151-
Port: &port,
152-
Host: "localhost",
153-
CertDir: "/certs",
155+
Port: &port,
156+
Host: "localhost",
157+
CertDir: "/certs",
158+
TLSMinVersion: "1.2",
159+
TLSOpts: tlsOptsFuncs,
154160
},
155161
},
156162
}
@@ -174,6 +180,8 @@ var _ = Describe("manger.Manager", func() {
174180
Expect(m.Port).To(Equal(port))
175181
Expect(m.Host).To(Equal("localhost"))
176182
Expect(m.CertDir).To(Equal("/certs"))
183+
Expect(m.TLSMinVersion).To(Equal("1.2"))
184+
Expect(m.TLSOpts).To(Equal(tlsOptsFuncs))
177185
})
178186

179187
It("should be able to keep Options when cfg.ControllerManagerConfiguration set", func() {
@@ -182,6 +190,9 @@ var _ = Describe("manger.Manager", func() {
182190
port := int(6090)
183191
leaderElect := false
184192

193+
tlsOptsFuncs := []func(*tls.Config){
194+
func(config *tls.Config) {},
195+
}
185196
ccfg := &v1alpha1.ControllerManagerConfiguration{
186197
ControllerManagerConfigurationSpec: v1alpha1.ControllerManagerConfigurationSpec{
187198
SyncPeriod: &duration,
@@ -204,13 +215,18 @@ var _ = Describe("manger.Manager", func() {
204215
LivenessEndpointName: "/livez",
205216
},
206217
Webhook: v1alpha1.ControllerWebhook{
207-
Port: &port,
208-
Host: "localhost",
209-
CertDir: "/certs",
218+
Port: &port,
219+
Host: "localhost",
220+
CertDir: "/certs",
221+
TLSMinVersion: "1.1",
222+
TLSOpts: tlsOptsFuncs,
210223
},
211224
},
212225
}
213226

227+
optionsTlSOptsFuncs := []func(*tls.Config){
228+
func(config *tls.Config) {},
229+
}
214230
m, err := Options{
215231
SyncPeriod: &optDuration,
216232
LeaderElection: true,
@@ -228,6 +244,8 @@ var _ = Describe("manger.Manager", func() {
228244
Port: 8080,
229245
Host: "example.com",
230246
CertDir: "/pki",
247+
TLSMinVersion: "1.2",
248+
TLSOpts: optionsTlSOptsFuncs,
231249
}.AndFrom(&fakeDeferredLoader{ccfg})
232250
Expect(err).To(BeNil())
233251

@@ -247,6 +265,8 @@ var _ = Describe("manger.Manager", func() {
247265
Expect(m.Port).To(Equal(8080))
248266
Expect(m.Host).To(Equal("example.com"))
249267
Expect(m.CertDir).To(Equal("/pki"))
268+
Expect(m.TLSMinVersion).To(Equal("1.2"))
269+
Expect(m.TLSOpts).To(Equal(optionsTlSOptsFuncs))
250270
})
251271

252272
It("should lazily initialize a webhook server if needed", func() {

‎pkg/webhook/webhook_integration_test.go‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ import (
3434
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
3535
"k8s.io/apimachinery/pkg/runtime/schema"
3636
"k8s.io/client-go/kubernetes/scheme"
37+
3738
"sigs.k8s.io/controller-runtime/pkg/certwatcher"
3839
"sigs.k8s.io/controller-runtime/pkg/client"
3940
"sigs.k8s.io/controller-runtime/pkg/internal/httpserver"
@@ -82,9 +83,11 @@ var _ = Describe("Webhook", func() {
8283
Context("when running a webhook server with a manager", func() {
8384
It("should reject create request for webhook that rejects all requests", func() {
8485
m, err := manager.New(cfg, manager.Options{
85-
Port: testenv.WebhookInstallOptions.LocalServingPort,
86-
Host: testenv.WebhookInstallOptions.LocalServingHost,
87-
CertDir: testenv.WebhookInstallOptions.LocalServingCertDir,
86+
Port: testenv.WebhookInstallOptions.LocalServingPort,
87+
Host: testenv.WebhookInstallOptions.LocalServingHost,
88+
CertDir: testenv.WebhookInstallOptions.LocalServingCertDir,
89+
TLSMinVersion: "1.2",
90+
TLSOpts: []func(*tls.Config){func(config *tls.Config) {}},
8891
}) // we need manager here just to leverage manager.SetFields
8992
Expect(err).NotTo(HaveOccurred())
9093
server := m.GetWebhookServer()
@@ -105,9 +108,11 @@ var _ = Describe("Webhook", func() {
105108
})
106109
It("should reject create request for multi-webhook that rejects all requests", func() {
107110
m, err := manager.New(cfg, manager.Options{
108-
Port: testenv.WebhookInstallOptions.LocalServingPort,
109-
Host: testenv.WebhookInstallOptions.LocalServingHost,
110-
CertDir: testenv.WebhookInstallOptions.LocalServingCertDir,
111+
Port: testenv.WebhookInstallOptions.LocalServingPort,
112+
Host: testenv.WebhookInstallOptions.LocalServingHost,
113+
CertDir: testenv.WebhookInstallOptions.LocalServingCertDir,
114+
TLSMinVersion: "1.2",
115+
TLSOpts: []func(*tls.Config){func(config *tls.Config) {}},
111116
}) // we need manager here just to leverage manager.SetFields
112117
Expect(err).NotTo(HaveOccurred())
113118
server := m.GetWebhookServer()

0 commit comments

Comments
 (0)