Allow proxy-ssl-* annotations without proxy-ssl-secret

Signed-off-by: Tamal Saha <tamal@appscode.com>
kubernetes · Oct 24, 2023 · cfb8d42 · cfb8d42
1 parent b1ac371
commit cfb8d42
Showing 1 changed file with 18 additions and 17 deletions.
diff --git a/internal/ingress/annotations/proxyssl/main.go b/internal/ingress/annotations/proxyssl/main.go
@@ -17,6 +17,7 @@ limitations under the License.
 package proxyssl
 
 import (
+	"errors"
 	"fmt"
 	"regexp"
 	"sort"
@@ -190,27 +191,27 @@ func (p proxySSL) Parse(ing *networking.Ingress) (interface{}, error) {
 	config := &Config{}
 
 	proxysslsecret, err := parser.GetStringAnnotation(proxySSLSecretAnnotation, ing, p.annotationConfig.Annotations)
-	if err != nil {
+	if err != nil && !errors.Is(err, ing_errors.ErrMissingAnnotations) {
 		return &Config{}, err
-	}
-
-	ns, _, err := k8s.ParseNameNS(proxysslsecret)
-	if err != nil {
-		return &Config{}, ing_errors.NewLocationDenied(err.Error())
-	}
+	} else if err == nil {
+		ns, _, err := k8s.ParseNameNS(proxysslsecret)
+		if err != nil {
+			return &Config{}, ing_errors.NewLocationDenied(err.Error())
+		}
 
-	secCfg := p.r.GetSecurityConfiguration()
-	// We don't accept different namespaces for secrets.
-	if !secCfg.AllowCrossNamespaceResources && ns != ing.Namespace {
-		return &Config{}, ing_errors.NewLocationDenied("cross namespace secrets are not supported")
-	}
+		secCfg := p.r.GetSecurityConfiguration()
+		// We don't accept different namespaces for secrets.
+		if !secCfg.AllowCrossNamespaceResources && ns != ing.Namespace {
+			return &Config{}, ing_errors.NewLocationDenied("cross namespace secrets are not supported")
+		}
 
-	proxyCert, err := p.r.GetAuthCertificate(proxysslsecret)
-	if err != nil {
-		e := fmt.Errorf("error obtaining certificate: %w", err)
-		return &Config{}, ing_errors.LocationDeniedError{Reason: e}
+		proxyCert, err := p.r.GetAuthCertificate(proxysslsecret)
+		if err != nil {
+			e := fmt.Errorf("error obtaining certificate: %w", err)
+			return &Config{}, ing_errors.LocationDeniedError{Reason: e}
+		}
+		config.AuthSSLCert = *proxyCert
 	}
-	config.AuthSSLCert = *proxyCert
 
 	config.Ciphers, err = parser.GetStringAnnotation(proxySSLCiphersAnnotation, ing, p.annotationConfig.Annotations)
 	if err != nil {