Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: TLS termination on Pod level #77

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

WIP: TLS termination on Pod level #77

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
67928e0
Progress on TLS Termination PoC
cloud-j-luna Jan 20, 2023
39e5c5f
Address feedback on issue
cloud-j-luna Feb 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions cluster/kube/client_ingress.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,11 @@ func kubeNginxIngressAnnotations(directive ctypes.ConnectHostnameToDeploymentDir
fmt.Sprintf("%s/proxy-body-size", root): strconv.Itoa(int(directive.MaxBodySize)),
}

if directive.SslPassthrough {
result[fmt.Sprintf("%s/backend-protocol", root)] = "HTTPS"
result[fmt.Sprintf("%s/ssl-passthrough", root)] = "true"
}

nextTimeoutKey := fmt.Sprintf("%s/proxy-next-upstream-timeout", root)
nextTimeout := 0 // default magic value for disable
if directive.NextTimeout > 0 {
Expand Down
21 changes: 11 additions & 10 deletions cluster/types/v1beta2/directives.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,16 +6,17 @@ import (
)

type ConnectHostnameToDeploymentDirective struct {
Hostname string
LeaseID mtypes.LeaseID
ServiceName string
ServicePort int32
ReadTimeout uint32
SendTimeout uint32
NextTimeout uint32
MaxBodySize uint32
NextTries uint32
NextCases []string
Hostname string
LeaseID mtypes.LeaseID
ServiceName string
ServicePort int32
ReadTimeout uint32
SendTimeout uint32
NextTimeout uint32
MaxBodySize uint32
NextTries uint32
NextCases []string
SslPassthrough bool
}

type ClusterIPPassthroughDirective struct {
Expand Down
2 changes: 2 additions & 0 deletions operator/hostnameoperator/hostname_operator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,8 @@ func buildDirective(ev ctypes.HostnameResourceEvent, serviceExpose crd.ManifestS
directive.NextCases = serviceExpose.HTTPOptions.NextCases
}

directive.SslPassthrough = serviceExpose.HTTPOptions.SslPassthrough

return directive
}

Expand Down
15 changes: 9 additions & 6 deletions pkg/apis/akash.network/v2beta1/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -315,12 +315,13 @@ type ManifestServiceExpose struct {
}

type ManifestServiceExposeHTTPOptions struct {
MaxBodySize uint32 `json:"max_body_size,omitempty"`
ReadTimeout uint32 `json:"read_timeout,omitempty"`
SendTimeout uint32 `json:"send_timeout,omitempty"`
NextTries uint32 `json:"next_tries,omitempty"`
NextTimeout uint32 `json:"next_timeout,omitempty"`
NextCases []string `json:"next_cases,omitempty"`
MaxBodySize uint32 `json:"max_body_size,omitempty"`
ReadTimeout uint32 `json:"read_timeout,omitempty"`
SendTimeout uint32 `json:"send_timeout,omitempty"`
NextTries uint32 `json:"next_tries,omitempty"`
NextTimeout uint32 `json:"next_timeout,omitempty"`
NextCases []string `json:"next_cases,omitempty"`
SslPassthrough bool `json:"ssl_passthrough,omitempty"`
}

func (mse ManifestServiceExpose) toAkash() (maniv2beta1.ServiceExpose, error) {
Expand All @@ -344,6 +345,7 @@ func (mse ManifestServiceExpose) toAkash() (maniv2beta1.ServiceExpose, error) {
NextTries: mse.HTTPOptions.NextTries,
NextTimeout: mse.HTTPOptions.NextTimeout,
NextCases: mse.HTTPOptions.NextCases,
// SslPassthrough: mse.HTTPOptions.SslPassthrough, //Needs to be added to maniv2beta1.ServiceExposeHTTPOptions
},
}, nil
}
Expand Down Expand Up @@ -372,6 +374,7 @@ func manifestServiceExposeFromAkash(amse maniv2beta1.ServiceExpose) ManifestServ
NextTries: amse.HTTPOptions.NextTries,
NextTimeout: amse.HTTPOptions.NextTimeout,
NextCases: amse.HTTPOptions.NextCases,
// SslPassthrough: amse.HTTPOptions.SslPassthrough, Needs to be added.
},
}
}
Expand Down
4 changes: 2 additions & 2 deletions script/provider_migrate_to_hostname_operator.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ kubectl apply -f _run/ingress-nginx-class.yaml

*Step 7*: Install the new kubernetes hostname operator, which manages hostnames going forward.

The hostname operator is implemented in `_docs/kustomize/akash-hostname-operator`. It normally uses the latest version of the docker container image but you should specify the version you are deploying. This is done by editing `_docs/kustomize/akash-hostname-operator/kustomization.yaml` and appending the following section
The hostname operator is implemented in `_docs/kustomize/akash-operator-hostname`. It normally uses the latest version of the docker container image but you should specify the version you are deploying. This is done by editing `_docs/kustomize/akash-hostname-operator/kustomization.yaml` and appending the following section

```
images:
Expand All @@ -69,5 +69,5 @@ The last line specifies the image tag and should correspond to whatever version
To install the operator into kubernetes perform the following from the `/_docs` directory.

```
kubectl kustomize ./kustomize/akash-hostname-operator | kubectl apply -f -
kubectl kustomize ./kustomize/akash-operator-hostname | kubectl apply -f -
```