Skip to content

Commit 3f29b52

Browse files
rudrakhprudrakhp
committed
api: support crls in client traffic policies
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
1 parent 9b7744a commit 3f29b52

File tree

7 files changed

+264
-0
lines changed

7 files changed

+264
-0
lines changed

‎api/v1alpha1/tls_types.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,7 @@ const (
119119
// ClientValidationContext holds configuration that can be used to validate the client initiating the TLS connection
120120
// to the Gateway.
121121
// By default, no client specific configuration is validated.
122+
// +kubebuilder:validation:XValidation:rule="has(self.onlyVerifyLeafCertificateCrl) ? has(self.crlRef) : true", message="onlyVerifyLeafCertificateCrl can be set only if crlRef is set"
122123
type ClientValidationContext struct {
123124
// Optional set to true accepts connections even when a client doesn't present a certificate.
124125
// Defaults to false, which rejects connections without a valid client certificate.
@@ -158,6 +159,21 @@ type ClientValidationContext struct {
158159
// matches one of the specified matchers
159160
// +optional
160161
SubjectAltNames *SubjectAltNames `json:"subjectAltNames,omitempty"`
162+
163+
// A reference to a Kubernetes ConfigMap or a Kubernetes Secret,
164+
// containing the certificate revocation list in PEM format
165+
// Expects the content in a key named `crl.pem`.
166+
//
167+
// References to a resource in different namespace are invalid UNLESS there
168+
// is a ReferenceGrant in the target namespace that allows the crl
169+
// to be attached.
170+
// +optional
171+
CrlRef *gwapiv1.SecretObjectReference `json:"crlRef,omitempty"`
172+
173+
// If this option is set to true, Envoy will only verify the certificate at the end of the certificate chain against the CRL.
174+
// Defaults to false, which will verify the entire certificate chain against the CRL.
175+
// +optional
176+
OnlyVerifyLeafCertificateCrl *bool `json:"onlyVerifyLeafCertificateCrl,omitempty"`
161177
}
162178

163179
type SubjectAltNames struct {

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 10 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1013,6 +1013,60 @@ spec:
10131013
items:
10141014
type: string
10151015
type: array
1016+
crlRef:
1017+
description: |-
1018+
A reference to a Kubernetes ConfigMap or a Kubernetes Secret,
1019+
containing the certificate revocation list in PEM format
1020+
Expects the content in a key named `crl.pem`.
1021+
1022+
References to a resource in different namespace are invalid UNLESS there
1023+
is a ReferenceGrant in the target namespace that allows the crl
1024+
to be attached.
1025+
properties:
1026+
group:
1027+
default: ""
1028+
description: |-
1029+
Group is the group of the referent. For example, "gateway.networking.k8s.io".
1030+
When unspecified or empty string, core API group is inferred.
1031+
maxLength: 253
1032+
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
1033+
type: string
1034+
kind:
1035+
default: Secret
1036+
description: Kind is kind of the referent. For example
1037+
"Secret".
1038+
maxLength: 63
1039+
minLength: 1
1040+
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
1041+
type: string
1042+
name:
1043+
description: Name is the name of the referent.
1044+
maxLength: 253
1045+
minLength: 1
1046+
type: string
1047+
namespace:
1048+
description: |-
1049+
Namespace is the namespace of the referenced object. When unspecified, the local
1050+
namespace is inferred.
1051+
1052+
Note that when a namespace different than the local namespace is specified,
1053+
a ReferenceGrant object is required in the referent namespace to allow that
1054+
namespace's owner to accept the reference. See the ReferenceGrant
1055+
documentation for details.
1056+
1057+
Support: Core
1058+
maxLength: 63
1059+
minLength: 1
1060+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
1061+
type: string
1062+
required:
1063+
- name
1064+
type: object
1065+
onlyVerifyLeafCertificateCrl:
1066+
description: |-
1067+
If this option is set to true, Envoy will only verify the certificate at the end of the certificate chain against the CRL.
1068+
Defaults to false, which will verify the entire certificate chain against the CRL.
1069+
type: boolean
10161070
optional:
10171071
description: |-
10181072
Optional set to true accepts connections even when a client doesn't present a certificate.
@@ -1174,6 +1228,11 @@ spec:
11741228
type: array
11751229
type: object
11761230
type: object
1231+
x-kubernetes-validations:
1232+
- message: onlyVerifyLeafCertificateCrl can be set only if crlRef
1233+
is set
1234+
rule: 'has(self.onlyVerifyLeafCertificateCrl) ? has(self.crlRef)
1235+
: true'
11771236
ecdhCurves:
11781237
description: |-
11791238
ECDHCurves specifies the set of supported ECDH curves.

‎charts/gateway-helm/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1012,6 +1012,60 @@ spec:
10121012
items:
10131013
type: string
10141014
type: array
1015+
crlRef:
1016+
description: |-
1017+
A reference to a Kubernetes ConfigMap or a Kubernetes Secret,
1018+
containing the certificate revocation list in PEM format
1019+
Expects the content in a key named `crl.pem`.
1020+
1021+
References to a resource in different namespace are invalid UNLESS there
1022+
is a ReferenceGrant in the target namespace that allows the crl
1023+
to be attached.
1024+
properties:
1025+
group:
1026+
default: ""
1027+
description: |-
1028+
Group is the group of the referent. For example, "gateway.networking.k8s.io".
1029+
When unspecified or empty string, core API group is inferred.
1030+
maxLength: 253
1031+
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
1032+
type: string
1033+
kind:
1034+
default: Secret
1035+
description: Kind is kind of the referent. For example
1036+
"Secret".
1037+
maxLength: 63
1038+
minLength: 1
1039+
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
1040+
type: string
1041+
name:
1042+
description: Name is the name of the referent.
1043+
maxLength: 253
1044+
minLength: 1
1045+
type: string
1046+
namespace:
1047+
description: |-
1048+
Namespace is the namespace of the referenced object. When unspecified, the local
1049+
namespace is inferred.
1050+
1051+
Note that when a namespace different than the local namespace is specified,
1052+
a ReferenceGrant object is required in the referent namespace to allow that
1053+
namespace's owner to accept the reference. See the ReferenceGrant
1054+
documentation for details.
1055+
1056+
Support: Core
1057+
maxLength: 63
1058+
minLength: 1
1059+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
1060+
type: string
1061+
required:
1062+
- name
1063+
type: object
1064+
onlyVerifyLeafCertificateCrl:
1065+
description: |-
1066+
If this option is set to true, Envoy will only verify the certificate at the end of the certificate chain against the CRL.
1067+
Defaults to false, which will verify the entire certificate chain against the CRL.
1068+
type: boolean
10151069
optional:
10161070
description: |-
10171071
Optional set to true accepts connections even when a client doesn't present a certificate.
@@ -1173,6 +1227,11 @@ spec:
11731227
type: array
11741228
type: object
11751229
type: object
1230+
x-kubernetes-validations:
1231+
- message: onlyVerifyLeafCertificateCrl can be set only if crlRef
1232+
is set
1233+
rule: 'has(self.onlyVerifyLeafCertificateCrl) ? has(self.crlRef)
1234+
: true'
11761235
ecdhCurves:
11771236
description: |-
11781237
ECDHCurves specifies the set of supported ECDH curves.

‎site/content/en/latest/api/extension_types.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -802,6 +802,8 @@ _Appears in:_
802802
| `spkiHashes` | _string array_ | false | | An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will<br />verify that the SHA-256 of the DER-encoded Subject Public Key Information<br />(SPKI) of the presented certificate matches one of the specified values. |
803803
| `certificateHashes` | _string array_ | false | | An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will<br />verify that the SHA-256 of the DER-encoded presented certificate matches<br />one of the specified values. |
804804
| `subjectAltNames` | _[SubjectAltNames](#subjectaltnames)_ | false | | An optional list of Subject Alternative name matchers. If specified, Envoy<br />will verify that the Subject Alternative Name of the presented certificate<br />matches one of the specified matchers |
805+
| `crlRef` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)_ | false | | A reference to a Kubernetes ConfigMap or a Kubernetes Secret,<br />containing the certificate revocation list in PEM format<br />Expects the content in a key named `crl.pem`.<br />References to a resource in different namespace are invalid UNLESS there<br />is a ReferenceGrant in the target namespace that allows the crl<br />to be attached. |
806+
| `onlyVerifyLeafCertificateCrl` | _boolean_ | false | | If this option is set to true, Envoy will only verify the certificate at the end of the certificate chain against the CRL.<br />Defaults to false, which will verify the entire certificate chain against the CRL. |
805807

806808

807809
#### ClusterSettings

‎test/helm/gateway-crds-helm/all.out.yaml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21016,6 +21016,60 @@ spec:
2101621016
items:
2101721017
type: string
2101821018
type: array
21019+
crlRef:
21020+
description: |-
21021+
A reference to a Kubernetes ConfigMap or a Kubernetes Secret,
21022+
containing the certificate revocation list in PEM format
21023+
Expects the content in a key named `crl.pem`.
21024+
21025+
References to a resource in different namespace are invalid UNLESS there
21026+
is a ReferenceGrant in the target namespace that allows the crl
21027+
to be attached.
21028+
properties:
21029+
group:
21030+
default: ""
21031+
description: |-
21032+
Group is the group of the referent. For example, "gateway.networking.k8s.io".
21033+
When unspecified or empty string, core API group is inferred.
21034+
maxLength: 253
21035+
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
21036+
type: string
21037+
kind:
21038+
default: Secret
21039+
description: Kind is kind of the referent. For example
21040+
"Secret".
21041+
maxLength: 63
21042+
minLength: 1
21043+
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
21044+
type: string
21045+
name:
21046+
description: Name is the name of the referent.
21047+
maxLength: 253
21048+
minLength: 1
21049+
type: string
21050+
namespace:
21051+
description: |-
21052+
Namespace is the namespace of the referenced object. When unspecified, the local
21053+
namespace is inferred.
21054+
21055+
Note that when a namespace different than the local namespace is specified,
21056+
a ReferenceGrant object is required in the referent namespace to allow that
21057+
namespace's owner to accept the reference. See the ReferenceGrant
21058+
documentation for details.
21059+
21060+
Support: Core
21061+
maxLength: 63
21062+
minLength: 1
21063+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
21064+
type: string
21065+
required:
21066+
- name
21067+
type: object
21068+
onlyVerifyLeafCertificateCrl:
21069+
description: |-
21070+
If this option is set to true, Envoy will only verify the certificate at the end of the certificate chain against the CRL.
21071+
Defaults to false, which will verify the entire certificate chain against the CRL.
21072+
type: boolean
2101921073
optional:
2102021074
description: |-
2102121075
Optional set to true accepts connections even when a client doesn't present a certificate.
@@ -21177,6 +21231,11 @@ spec:
2117721231
type: array
2117821232
type: object
2117921233
type: object
21234+
x-kubernetes-validations:
21235+
- message: onlyVerifyLeafCertificateCrl can be set only if crlRef
21236+
is set
21237+
rule: 'has(self.onlyVerifyLeafCertificateCrl) ? has(self.crlRef)
21238+
: true'
2118021239
ecdhCurves:
2118121240
description: |-
2118221241
ECDHCurves specifies the set of supported ECDH curves.

‎test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3704,6 +3704,60 @@ spec:
37043704
items:
37053705
type: string
37063706
type: array
3707+
crlRef:
3708+
description: |-
3709+
A reference to a Kubernetes ConfigMap or a Kubernetes Secret,
3710+
containing the certificate revocation list in PEM format
3711+
Expects the content in a key named `crl.pem`.
3712+
3713+
References to a resource in different namespace are invalid UNLESS there
3714+
is a ReferenceGrant in the target namespace that allows the crl
3715+
to be attached.
3716+
properties:
3717+
group:
3718+
default: ""
3719+
description: |-
3720+
Group is the group of the referent. For example, "gateway.networking.k8s.io".
3721+
When unspecified or empty string, core API group is inferred.
3722+
maxLength: 253
3723+
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
3724+
type: string
3725+
kind:
3726+
default: Secret
3727+
description: Kind is kind of the referent. For example
3728+
"Secret".
3729+
maxLength: 63
3730+
minLength: 1
3731+
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
3732+
type: string
3733+
name:
3734+
description: Name is the name of the referent.
3735+
maxLength: 253
3736+
minLength: 1
3737+
type: string
3738+
namespace:
3739+
description: |-
3740+
Namespace is the namespace of the referenced object. When unspecified, the local
3741+
namespace is inferred.
3742+
3743+
Note that when a namespace different than the local namespace is specified,
3744+
a ReferenceGrant object is required in the referent namespace to allow that
3745+
namespace's owner to accept the reference. See the ReferenceGrant
3746+
documentation for details.
3747+
3748+
Support: Core
3749+
maxLength: 63
3750+
minLength: 1
3751+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
3752+
type: string
3753+
required:
3754+
- name
3755+
type: object
3756+
onlyVerifyLeafCertificateCrl:
3757+
description: |-
3758+
If this option is set to true, Envoy will only verify the certificate at the end of the certificate chain against the CRL.
3759+
Defaults to false, which will verify the entire certificate chain against the CRL.
3760+
type: boolean
37073761
optional:
37083762
description: |-
37093763
Optional set to true accepts connections even when a client doesn't present a certificate.
@@ -3865,6 +3919,11 @@ spec:
38653919
type: array
38663920
type: object
38673921
type: object
3922+
x-kubernetes-validations:
3923+
- message: onlyVerifyLeafCertificateCrl can be set only if crlRef
3924+
is set
3925+
rule: 'has(self.onlyVerifyLeafCertificateCrl) ? has(self.crlRef)
3926+
: true'
38683927
ecdhCurves:
38693928
description: |-
38703929
ECDHCurves specifies the set of supported ECDH curves.

0 commit comments

Comments
 (0)