Skip to content

Commit ab077dd

Browse files
rudrakhprudrakhp
committed
api: support crls in client traffic policies
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
1 parent 61c8d5e commit ab077dd

File tree

7 files changed

+373
-0
lines changed

7 files changed

+373
-0
lines changed

‎api/v1alpha1/tls_types.go‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,32 @@ type ClientValidationContext struct {
161161
// matches one of the specified matchers
162162
// +optional
163163
SubjectAltNames *SubjectAltNames `json:"subjectAltNames,omitempty"`
164+
165+
// Crl specifies the crl configuration that can be used to validate the client initiating the TLS connection
166+
// +optional
167+
// +notImplementedHide
168+
Crl *CrlContext `json:"crl,omitempty"`
169+
}
170+
171+
// CrlContext holds certificate revocation list configuration that can be used to validate the client initiating the TLS connection
172+
type CrlContext struct {
173+
// Refs contains one or more references to a Kubernetes ConfigMap or a Kubernetes Secret,
174+
// containing the certificate revocation list in PEM format
175+
// Expects the content in a key named `ca.crl`.
176+
//
177+
// References to a resource in different namespace are invalid UNLESS there
178+
// is a ReferenceGrant in the target namespace that allows the crl
179+
// to be attached.
180+
//
181+
// +kubebuilder:validation:Required
182+
// +kubebuilder:validation:MinItems=1
183+
// +kubebuilder:validation:MaxItems=8
184+
Refs []gwapiv1.SecretObjectReference `json:"refs"`
185+
186+
// If this option is set to true, Envoy will only verify the certificate at the end of the certificate chain against the CRL.
187+
// Defaults to false, which will verify the entire certificate chain against the CRL.
188+
// +optional
189+
OnlyVerifyLeafCertificate *bool `json:"onlyVerifyLeafCertificate,omitempty"`
164190
}
165191

166192
type SubjectAltNames struct {

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 32 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1043,6 +1043,81 @@ spec:
10431043
items:
10441044
type: string
10451045
type: array
1046+
crl:
1047+
description: Crl specifies the crl configuration that can
1048+
be used to validate the client initiating the TLS connection
1049+
properties:
1050+
onlyVerifyLeafCertificate:
1051+
description: |-
1052+
If this option is set to true, Envoy will only verify the certificate at the end of the certificate chain against the CRL.
1053+
Defaults to false, which will verify the entire certificate chain against the CRL.
1054+
type: boolean
1055+
refs:
1056+
description: |-
1057+
Refs contains one or more references to a Kubernetes ConfigMap or a Kubernetes Secret,
1058+
containing the certificate revocation list in PEM format
1059+
Expects the content in a key named `ca.crl`.
1060+
1061+
References to a resource in different namespace are invalid UNLESS there
1062+
is a ReferenceGrant in the target namespace that allows the crl
1063+
to be attached.
1064+
items:
1065+
description: |-
1066+
SecretObjectReference identifies an API object including its namespace,
1067+
defaulting to Secret.
1068+
1069+
The API object must be valid in the cluster; the Group and Kind must
1070+
be registered in the cluster for this reference to be valid.
1071+
1072+
References to objects with invalid Group and Kind are not valid, and must
1073+
be rejected by the implementation, with appropriate Conditions set
1074+
on the containing object.
1075+
properties:
1076+
group:
1077+
default: ""
1078+
description: |-
1079+
Group is the group of the referent. For example, "gateway.networking.k8s.io".
1080+
When unspecified or empty string, core API group is inferred.
1081+
maxLength: 253
1082+
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
1083+
type: string
1084+
kind:
1085+
default: Secret
1086+
description: Kind is kind of the referent. For example
1087+
"Secret".
1088+
maxLength: 63
1089+
minLength: 1
1090+
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
1091+
type: string
1092+
name:
1093+
description: Name is the name of the referent.
1094+
maxLength: 253
1095+
minLength: 1
1096+
type: string
1097+
namespace:
1098+
description: |-
1099+
Namespace is the namespace of the referenced object. When unspecified, the local
1100+
namespace is inferred.
1101+
1102+
Note that when a namespace different than the local namespace is specified,
1103+
a ReferenceGrant object is required in the referent namespace to allow that
1104+
namespace's owner to accept the reference. See the ReferenceGrant
1105+
documentation for details.
1106+
1107+
Support: Core
1108+
maxLength: 63
1109+
minLength: 1
1110+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
1111+
type: string
1112+
required:
1113+
- name
1114+
type: object
1115+
maxItems: 8
1116+
minItems: 1
1117+
type: array
1118+
required:
1119+
- refs
1120+
type: object
10461121
optional:
10471122
description: |-
10481123
Optional set to true accepts connections even when a client doesn't present a certificate.

‎charts/gateway-helm/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1042,6 +1042,81 @@ spec:
10421042
items:
10431043
type: string
10441044
type: array
1045+
crl:
1046+
description: Crl specifies the crl configuration that can
1047+
be used to validate the client initiating the TLS connection
1048+
properties:
1049+
onlyVerifyLeafCertificate:
1050+
description: |-
1051+
If this option is set to true, Envoy will only verify the certificate at the end of the certificate chain against the CRL.
1052+
Defaults to false, which will verify the entire certificate chain against the CRL.
1053+
type: boolean
1054+
refs:
1055+
description: |-
1056+
Refs contains one or more references to a Kubernetes ConfigMap or a Kubernetes Secret,
1057+
containing the certificate revocation list in PEM format
1058+
Expects the content in a key named `ca.crl`.
1059+
1060+
References to a resource in different namespace are invalid UNLESS there
1061+
is a ReferenceGrant in the target namespace that allows the crl
1062+
to be attached.
1063+
items:
1064+
description: |-
1065+
SecretObjectReference identifies an API object including its namespace,
1066+
defaulting to Secret.
1067+
1068+
The API object must be valid in the cluster; the Group and Kind must
1069+
be registered in the cluster for this reference to be valid.
1070+
1071+
References to objects with invalid Group and Kind are not valid, and must
1072+
be rejected by the implementation, with appropriate Conditions set
1073+
on the containing object.
1074+
properties:
1075+
group:
1076+
default: ""
1077+
description: |-
1078+
Group is the group of the referent. For example, "gateway.networking.k8s.io".
1079+
When unspecified or empty string, core API group is inferred.
1080+
maxLength: 253
1081+
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
1082+
type: string
1083+
kind:
1084+
default: Secret
1085+
description: Kind is kind of the referent. For example
1086+
"Secret".
1087+
maxLength: 63
1088+
minLength: 1
1089+
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
1090+
type: string
1091+
name:
1092+
description: Name is the name of the referent.
1093+
maxLength: 253
1094+
minLength: 1
1095+
type: string
1096+
namespace:
1097+
description: |-
1098+
Namespace is the namespace of the referenced object. When unspecified, the local
1099+
namespace is inferred.
1100+
1101+
Note that when a namespace different than the local namespace is specified,
1102+
a ReferenceGrant object is required in the referent namespace to allow that
1103+
namespace's owner to accept the reference. See the ReferenceGrant
1104+
documentation for details.
1105+
1106+
Support: Core
1107+
maxLength: 63
1108+
minLength: 1
1109+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
1110+
type: string
1111+
required:
1112+
- name
1113+
type: object
1114+
maxItems: 8
1115+
minItems: 1
1116+
type: array
1117+
required:
1118+
- refs
1119+
type: object
10451120
optional:
10461121
description: |-
10471122
Optional set to true accepts connections even when a client doesn't present a certificate.

‎site/content/en/latest/api/extension_types.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -968,6 +968,21 @@ _Appears in:_
968968
| `attributes` | _object (keys:string, values:string)_ | false | | Additional Attributes to set for the generated cookie. |
969969

970970

971+
#### CrlContext
972+
973+
974+
975+
CrlContext holds certificate revocation list configuration that can be used to validate the client initiating the TLS connection
976+
977+
_Appears in:_
978+
- [ClientValidationContext](#clientvalidationcontext)
979+
980+
| Field | Type | Required | Default | Description |
981+
| --- | --- | --- | --- | --- |
982+
| `refs` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference) array_ | true | | Refs contains one or more references to a Kubernetes ConfigMap or a Kubernetes Secret,<br />containing the certificate revocation list in PEM format<br />Expects the content in a key named `ca.crl`.<br />References to a resource in different namespace are invalid UNLESS there<br />is a ReferenceGrant in the target namespace that allows the crl<br />to be attached. |
983+
| `onlyVerifyLeafCertificate` | _boolean_ | false | | If this option is set to true, Envoy will only verify the certificate at the end of the certificate chain against the CRL.<br />Defaults to false, which will verify the entire certificate chain against the CRL. |
984+
985+
971986
#### CustomHeaderExtensionSettings
972987

973988

‎test/helm/gateway-crds-helm/all.out.yaml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21182,6 +21182,81 @@ spec:
2118221182
items:
2118321183
type: string
2118421184
type: array
21185+
crl:
21186+
description: Crl specifies the crl configuration that can
21187+
be used to validate the client initiating the TLS connection
21188+
properties:
21189+
onlyVerifyLeafCertificate:
21190+
description: |-
21191+
If this option is set to true, Envoy will only verify the certificate at the end of the certificate chain against the CRL.
21192+
Defaults to false, which will verify the entire certificate chain against the CRL.
21193+
type: boolean
21194+
refs:
21195+
description: |-
21196+
Refs contains one or more references to a Kubernetes ConfigMap or a Kubernetes Secret,
21197+
containing the certificate revocation list in PEM format
21198+
Expects the content in a key named `ca.crl`.
21199+
21200+
References to a resource in different namespace are invalid UNLESS there
21201+
is a ReferenceGrant in the target namespace that allows the crl
21202+
to be attached.
21203+
items:
21204+
description: |-
21205+
SecretObjectReference identifies an API object including its namespace,
21206+
defaulting to Secret.
21207+
21208+
The API object must be valid in the cluster; the Group and Kind must
21209+
be registered in the cluster for this reference to be valid.
21210+
21211+
References to objects with invalid Group and Kind are not valid, and must
21212+
be rejected by the implementation, with appropriate Conditions set
21213+
on the containing object.
21214+
properties:
21215+
group:
21216+
default: ""
21217+
description: |-
21218+
Group is the group of the referent. For example, "gateway.networking.k8s.io".
21219+
When unspecified or empty string, core API group is inferred.
21220+
maxLength: 253
21221+
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
21222+
type: string
21223+
kind:
21224+
default: Secret
21225+
description: Kind is kind of the referent. For example
21226+
"Secret".
21227+
maxLength: 63
21228+
minLength: 1
21229+
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
21230+
type: string
21231+
name:
21232+
description: Name is the name of the referent.
21233+
maxLength: 253
21234+
minLength: 1
21235+
type: string
21236+
namespace:
21237+
description: |-
21238+
Namespace is the namespace of the referenced object. When unspecified, the local
21239+
namespace is inferred.
21240+
21241+
Note that when a namespace different than the local namespace is specified,
21242+
a ReferenceGrant object is required in the referent namespace to allow that
21243+
namespace's owner to accept the reference. See the ReferenceGrant
21244+
documentation for details.
21245+
21246+
Support: Core
21247+
maxLength: 63
21248+
minLength: 1
21249+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
21250+
type: string
21251+
required:
21252+
- name
21253+
type: object
21254+
maxItems: 8
21255+
minItems: 1
21256+
type: array
21257+
required:
21258+
- refs
21259+
type: object
2118521260
optional:
2118621261
description: |-
2118721262
Optional set to true accepts connections even when a client doesn't present a certificate.

0 commit comments

Comments
 (0)