feat: NLB Certificate autodiscovery using ssl-domains annotations #3269

Kavinraja-G · 2023-07-02T08:01:45Z

Issue

#3210

Description

Added a new annotation service.beta.kubernetes.io/aws-load-balancer-ssl-domains which helps to reuse the CertificateDiscovery implementation done for Ingress.
Auto discovery will happen only when the ssl-certs annotation not exists and ssl-domains annotation is provided. If both annotations are present, ssl-certs take precedence.

Checklist

Added tests that cover your change (if possible)
Added/modified documentation as required (such as the README.md, or the docs directory)
Manually tested
Made sure the title of the PR is a good description that can go into the release notes

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

Backfilled missing tests for code in same general area 🎉
Refactored something and made the world a better place 🌟

linux-foundation-easycla · 2023-07-02T08:01:49Z

The committers listed above are authorized under a signed CLA.

✅ login: Kavinraja-G / name: Kavinraja Ganesan (195f6a2, a78c443, a1ba0f8, 16274a4, 736e120, 48915c6)

k8s-ci-robot · 2023-07-02T08:01:53Z

Welcome @Kavinraja-G!

It looks like this is your first PR to kubernetes-sigs/aws-load-balancer-controller 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/aws-load-balancer-controller has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2023-07-02T08:01:54Z

Hi @Kavinraja-G. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Kavinraja-G · 2023-07-02T08:16:22Z

@M00nF1sh -- This is my first PR out in AWS LB controller, please do guide me if anything I had missed.

QQ: I guess, we need to cover some tests around CertDiscovery for NLB since I incorporated a new annotation. There is no MockACMClients available to proceed with the tests, let me know from where I need to start for the UnitTests. Thanks & Happy to contribute! :)

docs/guide/service/annotations.md

pkg/service/model_build_listener.go

pkg/service/model_builder.go

johngmyers · 2023-07-03T08:15:49Z

There's a NewMockCertDiscovery(). You should be building your unit tests around that.

johngmyers · 2023-07-03T08:16:27Z

/ok-to-test

Kavinraja-G · 2023-07-03T09:25:31Z

There's a NewMockCertDiscovery(). You should be building your unit tests around that.

@johngmyers The NewDefaultModelBuilder function now requires acmClient & logger need to be passed, so in order make the tests happy I would need the MockACMClient.

Let me know if I'm missing any. Thanks!

johngmyers · 2023-07-03T15:34:51Z

@k8s-ci-robot please refactor that so one passes a CertDiscovery instead.

Kavinraja-G · 2023-07-06T11:35:24Z

please refactor that so one passes a CertDiscovery instead

@johngmyers Thanks, I refactored the code to use CertDiscovery in this method, and now the tests are passing in my local.

Let me know if anything I need to do from my side to trigger this pull-aws-load-balancer-controller-unit-test job?

controllers/service/service_controller.go

pkg/service/model_builder.go

pkg/service/model_builder_test.go

Kavinraja-G · 2023-07-07T05:10:18Z

@johngmyers Fixed the above suggestions on imports as well. Thanks!

johngmyers · 2023-07-07T05:29:40Z

/lgtm
/assign @M00nF1sh

Kavinraja-G · 2023-07-11T13:27:09Z

@M00nF1sh Are we good with this PR ? Let me know if anything I had missed, thanks!

johngmyers · 2023-07-21T19:11:39Z

/retest

Kavinraja-G · 2023-07-27T02:12:38Z

@johngmyers Any idea on why these workflows are failing?

johngmyers · 2023-07-28T21:47:12Z

/retest

Kavinraja-G · 2024-04-22T10:08:38Z

@M00nF1sh Any updated on this PR?

/remove-lifecycle stale

Kavinraja-G · 2024-05-19T13:46:58Z

@sergeyshevch @M00nF1sh ^^ Bumping again, thanks!

M00nF1sh · 2024-05-29T23:13:36Z

docs/guide/service/annotations.md

@@ -13,42 +13,43 @@
    These annotations are specific to the kubernetes [service resources reconciled](#lb-type) by the AWS Load Balancer Controller. Although the list was initially derived from the k8s in-tree `kube-controller-manager`, this
    documentation is not an accurate reference for the services reconciled by the in-tree controller. 

-| Name                                                                                             | Type                    | Default                   | Notes                                                  |


Nit: can we fix the formatting issue by only add a new line instead of change existing lines.

M00nF1sh

Thanks a lot for the contribution, i think it's fine to merge this into main and do a appsec review in next minor release(i don't think there will be security concerns given we already have similar features in ingress)

@Kavinraja-G Kavinraja-GNit: we need to rebase and fix the formatting issue in the doc page

/lgtm
/approve

k8s-ci-robot · 2024-05-29T23:17:47Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Kavinraja-G, M00nF1sh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [M00nF1sh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2024-06-01T16:28:21Z

New changes are detected. LGTM label has been removed.

k8s-ci-robot · 2024-06-01T16:41:31Z

@Kavinraja-G: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-aws-load-balancer-controller-unit-test	`a78c443`	link	true	`/test pull-aws-load-balancer-controller-unit-test`
pull-aws-load-balancer-controller-e2e-test	`a78c443`	link	true	`/test pull-aws-load-balancer-controller-e2e-test`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

k8s-triage-robot · 2024-08-30T17:18:26Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

Kavinraja-G · 2024-08-31T17:38:31Z

@M00nF1sh Anything you need help on this PR?

/remove-lifecycle stale

PG2000 · 2024-12-20T19:09:56Z

@Kavinraja-G, @M00nF1sh can i help out here. I'm interested in this feature to be completed.

Kavinraja-G · 2024-12-22T10:21:02Z

@Kavinraja-G, @M00nF1sh can i help out here. I'm interested in this feature to be completed.

This is almost done @PG2000 Need further comments from @M00nF1sh on what needs to be done here.

k8s-ci-robot requested review from kishorj and M00nF1sh July 2, 2023 08:01

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Jul 2, 2023

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jul 2, 2023

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Jul 2, 2023

johngmyers suggested changes Jul 3, 2023

View reviewed changes

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 3, 2023

Kavinraja-G requested a review from johngmyers July 6, 2023 11:38

johngmyers suggested changes Jul 7, 2023

View reviewed changes

controllers/service/service_controller.go Outdated Show resolved Hide resolved

pkg/service/model_builder.go Outdated Show resolved Hide resolved

pkg/service/model_builder_test.go Outdated Show resolved Hide resolved

k8s-ci-robot assigned M00nF1sh and johngmyers Jul 7, 2023

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 7, 2023

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 21, 2024

shraddhabang modified the milestones: v2.7.0, v2.8.0 Feb 13, 2024

M00nF1sh reviewed May 29, 2024

View reviewed changes

M00nF1sh approved these changes May 29, 2024

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 29, 2024

Kavinraja-G added 5 commits June 1, 2024 21:39

Enable autodiscovery for ACM using SSL hosts annotation

195f6a2

Refactor ACM auto-discovery logic

48915c6

Added docs for NLB ssl-domains usage

736e120

Fix docs and run goimports

16274a4

Fix CertDiscovery logic for Service NLBs

a1ba0f8

Kavinraja-G force-pushed the feature/svc-acm-autodiscovery branch from 679f538 to 7c1b2f6 Compare June 1, 2024 16:28

Fix imports and cleanup returns in certificates

a78c443

Kavinraja-G force-pushed the feature/svc-acm-autodiscovery branch from 7c1b2f6 to a78c443 Compare June 1, 2024 16:37

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 30, 2024

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 31, 2024

shraddhabang added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 8, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: NLB Certificate autodiscovery using ssl-domains annotations #3269

feat: NLB Certificate autodiscovery using ssl-domains annotations #3269

Kavinraja-G commented Jul 2, 2023 •

edited

Loading

linux-foundation-easycla bot commented Jul 2, 2023 •

edited

Loading

k8s-ci-robot commented Jul 2, 2023

k8s-ci-robot commented Jul 2, 2023

Kavinraja-G commented Jul 2, 2023

johngmyers commented Jul 3, 2023

johngmyers commented Jul 3, 2023

Kavinraja-G commented Jul 3, 2023 •

edited

Loading

johngmyers commented Jul 3, 2023

Kavinraja-G commented Jul 6, 2023 •

edited

Loading

Kavinraja-G commented Jul 7, 2023

johngmyers commented Jul 7, 2023

Kavinraja-G commented Jul 11, 2023

johngmyers commented Jul 21, 2023

Kavinraja-G commented Jul 27, 2023

johngmyers commented Jul 28, 2023

Kavinraja-G commented Apr 22, 2024

Kavinraja-G commented May 19, 2024

M00nF1sh May 29, 2024

M00nF1sh left a comment •

edited

Loading

k8s-ci-robot commented May 29, 2024

k8s-ci-robot commented Jun 1, 2024

k8s-ci-robot commented Jun 1, 2024

k8s-triage-robot commented Aug 30, 2024

Kavinraja-G commented Aug 31, 2024

PG2000 commented Dec 20, 2024 •

edited

Loading

Kavinraja-G commented Dec 22, 2024

feat: NLB Certificate autodiscovery using ssl-domains annotations #3269

Are you sure you want to change the base?

feat: NLB Certificate autodiscovery using ssl-domains annotations #3269

Conversation

Kavinraja-G commented Jul 2, 2023 • edited Loading

Issue

Description

Checklist

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

linux-foundation-easycla bot commented Jul 2, 2023 • edited Loading

k8s-ci-robot commented Jul 2, 2023

k8s-ci-robot commented Jul 2, 2023

Kavinraja-G commented Jul 2, 2023

johngmyers commented Jul 3, 2023

johngmyers commented Jul 3, 2023

Kavinraja-G commented Jul 3, 2023 • edited Loading

johngmyers commented Jul 3, 2023

Kavinraja-G commented Jul 6, 2023 • edited Loading

Kavinraja-G commented Jul 7, 2023

johngmyers commented Jul 7, 2023

Kavinraja-G commented Jul 11, 2023

johngmyers commented Jul 21, 2023

Kavinraja-G commented Jul 27, 2023

johngmyers commented Jul 28, 2023

Kavinraja-G commented Apr 22, 2024

Kavinraja-G commented May 19, 2024

M00nF1sh May 29, 2024

Choose a reason for hiding this comment

M00nF1sh left a comment • edited Loading

Choose a reason for hiding this comment

k8s-ci-robot commented May 29, 2024

k8s-ci-robot commented Jun 1, 2024

k8s-ci-robot commented Jun 1, 2024

k8s-triage-robot commented Aug 30, 2024

Kavinraja-G commented Aug 31, 2024

PG2000 commented Dec 20, 2024 • edited Loading

Kavinraja-G commented Dec 22, 2024

Kavinraja-G commented Jul 2, 2023 •

edited

Loading

linux-foundation-easycla bot commented Jul 2, 2023 •

edited

Loading

Kavinraja-G commented Jul 3, 2023 •

edited

Loading

Kavinraja-G commented Jul 6, 2023 •

edited

Loading

M00nF1sh left a comment •

edited

Loading

PG2000 commented Dec 20, 2024 •

edited

Loading