feat: add TLS version annotation support for per-rule configuration #1592
Conversation
yunmaoQu
requested review from
SpecialYang,
johnlanni and
CH3CHO
as code owners
|
|
| @@ -138,6 +138,10 @@ type AnnotationHandler interface { | |||
| RouteHandler | |||
| TrafficPolicyHandler | |||
There was a problem hiding this comment.
It is suggested to extend this implementation, rather than creating a separate file.
https://github.com/alibaba/higress/blob/main/pkg/ingress/kube/annotations/downstreamtls.go
There was a problem hiding this comment.
ok,get it,i will get it a try ,thanks for your review.
There was a problem hiding this comment.
Thank you for contributing
| annotationMinTLSVersion = "tls-min-version" | ||
| annotationMaxTLSVersion = "tls-max-version" |
There was a problem hiding this comment.
| annotationMinTLSVersion = "tls-min-version" | |
| annotationMaxTLSVersion = "tls-max-version" | |
| annotationMinTLSVersion = "tls-min-protocol-version" | |
| annotationMaxTLSVersion = "tls-max-protocol-version" |
| case "TLSv1_3": | ||
| return networking.ServerTLSSettings_TLSV1_3 | ||
| default: | ||
| return networking.ServerTLSSettings_TLS_AUTO |
There was a problem hiding this comment.
version填写错误建议直接报错，明确的错误，好过模糊的缺省行为
| case "TLSv1_0": | ||
| return networking.ServerTLSSettings_TLSV1_0 | ||
| case "TLSv1_1": | ||
| return networking.ServerTLSSettings_TLSV1_1 | ||
| case "TLSv1_2": | ||
| return networking.ServerTLSSettings_TLSV1_2 | ||
| case "TLSv1_3": |
There was a problem hiding this comment.
| case "TLSv1_0": | |
| return networking.ServerTLSSettings_TLSV1_0 | |
| case "TLSv1_1": | |
| return networking.ServerTLSSettings_TLSV1_1 | |
| case "TLSv1_2": | |
| return networking.ServerTLSSettings_TLSV1_2 | |
| case "TLSv1_3": | |
| case "TLSv1.0": | |
| return networking.ServerTLSSettings_TLSV1_0 | |
| case "TLSv1.1": | |
| return networking.ServerTLSSettings_TLSV1_1 | |
| case "TLSv1.2": | |
| return networking.ServerTLSSettings_TLSV1_2 | |
| case "TLSv1.3": |
|
|
||
| ruleName := getRuleName(server) | ||
|
|
||
| // 优先使用规则级别的TLS版本设置 |
| @@ -52,6 +58,8 @@ func (d downstreamTLS) Parse(annotations Annotations, config *Ingress, _ *Global | |||
|
|
|||
| downstreamTLSConfig := &DownstreamTLSConfig{ | |||
| Mode: networking.ServerTLSSettings_SIMPLE, | |||
| RuleMinVersion: make(map[string]string), | |||
There was a problem hiding this comment.
这个规则的使用场景，看上去是用于对不同的 server 进行区别配置，是考虑到一个 ingress 规则下有多个域名的场景吗？
但是 server 的 name 现在应该是一个空值，是否用域名更好一些？
或者也可以考虑先不支持这个，等有用户需求再扩展，还是你们有这样的需求？
|
|
Co-authored-by: Kent Dong <[email protected]>
yunmaoQu
force-pushed
the
feature/tls-annotation
branch
from
c25f53e to
b500c32
Compare
Ⅰ. Describe what this PR did
support for setting TLS version annotations (
tls-min-versionandtls-max-version) for per-rule configurations in Higress. This allows users to override global TLS settings for specific ingress rules.Ⅱ. Does this pull request fix one issue?
fix #1586
Ⅲ. Why don't you add test cases (unit test/integration test)?
Ⅳ. Describe how to verify it
Verified functionality with unit tests (
TestTLSConfig) and integration tests.Manually tested with custom ingress rules.
Ⅴ. Special notes for reviews