Skip to content

Commit f902961

Browse files
ronethingAlinsRan
ronething
and
AlinsRan
authored
backport: part 1 (#351)
Co-authored-by: AlinsRan <[email protected]>
1 parent e6128ed commit f902961

File tree

16 files changed

+2581
-107
lines changed

16 files changed

+2581
-107
lines changed

‎internal/adc/translator/apisixtls.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import (
2727
"github.com/apache/apisix-ingress-controller/internal/controller/label"
2828
"github.com/apache/apisix-ingress-controller/internal/id"
2929
"github.com/apache/apisix-ingress-controller/internal/provider"
30+
sslutils "github.com/apache/apisix-ingress-controller/internal/ssl"
3031
internaltypes "github.com/apache/apisix-ingress-controller/internal/types"
3132
)
3233

@@ -44,7 +45,7 @@ func (t *Translator) TranslateApisixTls(tctx *provider.TranslateContext, tls *ap
4445
}
4546

4647
// Extract cert and key from secret
47-
cert, key, err := extractKeyPair(secret, true)
48+
cert, key, err := sslutils.ExtractKeyPair(secret, true)
4849
if err != nil {
4950
return nil, err
5051
}
@@ -81,7 +82,7 @@ func (t *Translator) TranslateApisixTls(tctx *provider.TranslateContext, tls *ap
8182
return nil, fmt.Errorf("client CA secret %s not found", caSecretKey.String())
8283
}
8384

84-
ca, _, err := extractKeyPair(caSecret, false)
85+
ca, _, err := sslutils.ExtractKeyPair(caSecret, false)
8586
if err != nil {
8687
return nil, err
8788
}

‎internal/adc/translator/apisixupstream.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ import (
2929
"github.com/apache/apisix-ingress-controller/api/adc"
3030
apiv2 "github.com/apache/apisix-ingress-controller/api/v2"
3131
"github.com/apache/apisix-ingress-controller/internal/provider"
32+
sslutils "github.com/apache/apisix-ingress-controller/internal/ssl"
3233
"github.com/apache/apisix-ingress-controller/internal/utils"
3334
)
3435

@@ -187,7 +188,7 @@ func translateApisixUpstreamClientTLS(tctx *provider.TranslateContext, config *a
187188
return errors.Errorf("sercret %s not found", secretNN)
188189
}
189190

190-
cert, key, err := extractKeyPair(secret, true)
191+
cert, key, err := sslutils.ExtractKeyPair(secret, true)
191192
if err != nil {
192193
return err
193194
}

‎internal/adc/translator/gateway.go‎

Lines changed: 3 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,10 @@
1818
package translator
1919

2020
import (
21-
"crypto/x509"
2221
"encoding/json"
23-
"encoding/pem"
2422
"fmt"
2523

2624
"github.com/pkg/errors"
27-
corev1 "k8s.io/api/core/v1"
2825
"k8s.io/apimachinery/pkg/types"
2926
gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
3027

@@ -33,6 +30,7 @@ import (
3330
"github.com/apache/apisix-ingress-controller/internal/controller/label"
3431
"github.com/apache/apisix-ingress-controller/internal/id"
3532
"github.com/apache/apisix-ingress-controller/internal/provider"
33+
sslutils "github.com/apache/apisix-ingress-controller/internal/ssl"
3634
internaltypes "github.com/apache/apisix-ingress-controller/internal/types"
3735
"github.com/apache/apisix-ingress-controller/internal/utils"
3836
)
@@ -97,7 +95,7 @@ func (t *Translator) translateSecret(tctx *provider.TranslateContext, listener g
9795
t.Log.Error(errors.New("secret data is nil"), "failed to get secret data", "secret", secretNN)
9896
return nil, fmt.Errorf("no secret data found for %s/%s", ns, name)
9997
}
100-
cert, key, err := extractKeyPair(secret, true)
98+
cert, key, err := sslutils.ExtractKeyPair(secret, true)
10199
if err != nil {
102100
t.Log.Error(err, "extract key pair", "secret", secretNN)
103101
return nil, err
@@ -110,7 +108,7 @@ func (t *Translator) translateSecret(tctx *provider.TranslateContext, listener g
110108
if listener.Hostname != nil && *listener.Hostname != "" {
111109
sslObj.Snis = append(sslObj.Snis, string(*listener.Hostname))
112110
} else {
113-
hosts, err := extractHost(cert)
111+
hosts, err := sslutils.ExtractHostsFromCertificate(cert)
114112
if err != nil {
115113
return nil, err
116114
}
@@ -137,68 +135,6 @@ func (t *Translator) translateSecret(tctx *provider.TranslateContext, listener g
137135
return sslObjs, nil
138136
}
139137

140-
func extractHost(cert []byte) ([]string, error) {
141-
block, _ := pem.Decode(cert)
142-
if block == nil {
143-
return nil, errors.New("parse certificate: not in PEM format")
144-
}
145-
der, err := x509.ParseCertificate(block.Bytes)
146-
if err != nil {
147-
return nil, errors.Wrap(err, "parse certificate")
148-
}
149-
hosts := make([]string, 0, len(der.DNSNames))
150-
for _, dnsName := range der.DNSNames {
151-
if dnsName != "*" {
152-
hosts = append(hosts, dnsName)
153-
}
154-
}
155-
return hosts, nil
156-
}
157-
158-
func extractKeyPair(s *corev1.Secret, hasPrivateKey bool) ([]byte, []byte, error) {
159-
if _, ok := s.Data["cert"]; ok {
160-
return extractApisixSecretKeyPair(s, hasPrivateKey)
161-
} else if _, ok := s.Data[corev1.TLSCertKey]; ok {
162-
return extractKubeSecretKeyPair(s, hasPrivateKey)
163-
} else if ca, ok := s.Data[corev1.ServiceAccountRootCAKey]; ok && !hasPrivateKey {
164-
return ca, nil, nil
165-
} else {
166-
return nil, nil, errors.New("unknown secret format")
167-
}
168-
}
169-
170-
func extractApisixSecretKeyPair(s *corev1.Secret, hasPrivateKey bool) (cert []byte, key []byte, err error) {
171-
var ok bool
172-
cert, ok = s.Data["cert"]
173-
if !ok {
174-
return nil, nil, errors.New("missing cert field")
175-
}
176-
177-
if hasPrivateKey {
178-
key, ok = s.Data["key"]
179-
if !ok {
180-
return nil, nil, errors.New("missing key field")
181-
}
182-
}
183-
return
184-
}
185-
186-
func extractKubeSecretKeyPair(s *corev1.Secret, hasPrivateKey bool) (cert []byte, key []byte, err error) {
187-
var ok bool
188-
cert, ok = s.Data[corev1.TLSCertKey]
189-
if !ok {
190-
return nil, nil, errors.New("missing cert field")
191-
}
192-
193-
if hasPrivateKey {
194-
key, ok = s.Data[corev1.TLSPrivateKeyKey]
195-
if !ok {
196-
return nil, nil, errors.New("missing key field")
197-
}
198-
}
199-
return
200-
}
201-
202138
// fillPluginsFromGatewayProxy fill plugins from GatewayProxy to given plugins
203139
func (t *Translator) fillPluginsFromGatewayProxy(plugins adctypes.GlobalRule, gatewayProxy *v1alpha1.GatewayProxy) {
204140
if gatewayProxy == nil {

‎internal/adc/translator/ingress.go‎

Lines changed: 18 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -25,25 +25,27 @@ import (
2525
discoveryv1 "k8s.io/api/discovery/v1"
2626
networkingv1 "k8s.io/api/networking/v1"
2727
"k8s.io/apimachinery/pkg/types"
28+
"k8s.io/apimachinery/pkg/util/intstr"
2829
"k8s.io/utils/ptr"
2930

3031
adctypes "github.com/apache/apisix-ingress-controller/api/adc"
3132
"github.com/apache/apisix-ingress-controller/internal/controller/label"
3233
"github.com/apache/apisix-ingress-controller/internal/id"
3334
"github.com/apache/apisix-ingress-controller/internal/provider"
35+
sslutils "github.com/apache/apisix-ingress-controller/internal/ssl"
3436
internaltypes "github.com/apache/apisix-ingress-controller/internal/types"
3537
)
3638

3739
func (t *Translator) translateIngressTLS(namespace, name string, tlsIndex int, ingressTLS *networkingv1.IngressTLS, secret *corev1.Secret, labels map[string]string) (*adctypes.SSL, error) {
3840
// extract the key pair from the secret
39-
cert, key, err := extractKeyPair(secret, true)
41+
cert, key, err := sslutils.ExtractKeyPair(secret, true)
4042
if err != nil {
4143
return nil, err
4244
}
4345

4446
hosts := ingressTLS.Hosts
4547
if len(hosts) == 0 {
46-
certHosts, err := extractHost(cert)
48+
certHosts, err := sslutils.ExtractHostsFromCertificate(cert)
4749
if err != nil {
4850
return nil, err
4951
}
@@ -172,12 +174,11 @@ func (t *Translator) resolveIngressUpstream(
172174
t.AttachBackendTrafficPolicyToUpstream(backendRef, tctx.BackendTrafficPolicies, upstream)
173175
// determine service port/port name
174176
var protocol string
175-
var servicePort int32 = 0
176-
var servicePortName string
177+
var port intstr.IntOrString
177178
if backendService.Port.Number != 0 {
178-
servicePort = backendService.Port.Number
179+
port = intstr.FromInt32(backendService.Port.Number)
179180
} else if backendService.Port.Name != "" {
180-
servicePortName = backendService.Port.Name
181+
port = intstr.FromString(backendService.Port.Name)
181182
}
182183

183184
getService := tctx.Services[types.NamespacedName{
@@ -187,43 +188,28 @@ func (t *Translator) resolveIngressUpstream(
187188
if getService == nil {
188189
return protocol
189190
}
190-
191+
getServicePort, _ := findMatchingServicePort(getService, port)
192+
if getServicePort != nil && getServicePort.AppProtocol != nil {
193+
protocol = *getServicePort.AppProtocol
194+
if upstream.Scheme == "" {
195+
upstream.Scheme = appProtocolToUpstreamScheme(*getServicePort.AppProtocol)
196+
}
197+
}
191198
if getService.Spec.Type == corev1.ServiceTypeExternalName {
192-
defaultServicePort := 80
193-
if servicePort > 0 {
194-
defaultServicePort = int(servicePort)
199+
servicePort := 80
200+
if getServicePort != nil {
201+
servicePort = int(getServicePort.Port)
195202
}
196203
upstream.Nodes = adctypes.UpstreamNodes{
197204
{
198205
Host: getService.Spec.ExternalName,
199-
Port: defaultServicePort,
206+
Port: servicePort,
200207
Weight: 1,
201208
},
202209
}
203210
return protocol
204211
}
205212

206-
// find matching service port object
207-
var getServicePort *corev1.ServicePort
208-
for _, port := range getService.Spec.Ports {
209-
p := port
210-
if servicePort > 0 && p.Port == servicePort {
211-
getServicePort = &p
212-
break
213-
}
214-
if servicePortName != "" && p.Name == servicePortName {
215-
getServicePort = &p
216-
break
217-
}
218-
}
219-
220-
if getServicePort != nil && getServicePort.AppProtocol != nil {
221-
protocol = *getServicePort.AppProtocol
222-
if upstream.Scheme == "" {
223-
upstream.Scheme = appProtocolToUpstreamScheme(*getServicePort.AppProtocol)
224-
}
225-
}
226-
227213
endpointSlices := tctx.EndpointSlices[types.NamespacedName{
228214
Namespace: obj.Namespace,
229215
Name: backendService.Name,

‎internal/controller/indexer/indexer.go‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ const (
5050
IngressClassParametersRef = "ingressClassParametersRef"
5151
ConsumerGatewayRef = "consumerGatewayRef"
5252
PolicyTargetRefs = "targetRefs"
53+
TLSHostIndexRef = "tlsHostRefs"
5354
GatewayClassIndexRef = "gatewayClassRef"
5455
ApisixUpstreamRef = "apisixUpstreamRef"
5556
PluginConfigIndexRef = "pluginConfigRefs"
@@ -140,6 +141,16 @@ func setupGatewayIndexer(mgr ctrl.Manager) error {
140141
); err != nil {
141142
return err
142143
}
144+
145+
if err := mgr.GetFieldIndexer().IndexField(
146+
context.Background(),
147+
&gatewayv1.Gateway{},
148+
TLSHostIndexRef,
149+
GatewayTLSHostIndexFunc,
150+
); err != nil {
151+
return err
152+
}
153+
143154
return nil
144155
}
145156

@@ -460,6 +471,15 @@ func setupIngressIndexer(mgr ctrl.Manager) error {
460471
return err
461472
}
462473

474+
if err := mgr.GetFieldIndexer().IndexField(
475+
context.Background(),
476+
&networkingv1.Ingress{},
477+
TLSHostIndexRef,
478+
IngressTLSHostIndexFunc,
479+
); err != nil {
480+
return err
481+
}
482+
463483
return nil
464484
}
465485

@@ -925,6 +945,15 @@ func setupApisixTlsIndexer(mgr ctrl.Manager) error {
925945
return err
926946
}
927947

948+
if err := mgr.GetFieldIndexer().IndexField(
949+
context.Background(),
950+
&apiv2.ApisixTls{},
951+
TLSHostIndexRef,
952+
ApisixTlsHostIndexFunc,
953+
); err != nil {
954+
return err
955+
}
956+
928957
return nil
929958
}
930959

0 commit comments

Comments
 (0)