shreemaan-abhishek opened a new pull request, #2826:
URL: https://github.com/apache/apisix-ingress-controller/pull/2826
## What this PR does
`GatewayProxy.spec.provider.controlPlane.tlsVerify` offers only two states
today:
1. `tlsVerify: false` — no verification.
2. `tlsVerify: true` — verify against the **system trust store only**, which
works only if the control plane's certificate chains to a publicly trusted CA.
There is no way to supply a custom CA, so for the common case of a
self-signed or private-CA control plane a user who wants verification on has no
path to make it succeed. The only escape from the resulting connection error is
`tlsVerify: false` — which risks turning the insecure opt-out into copy-paste
boilerplate, and undercuts the secure default being introduced in #2811.
This adds the missing third state — **`tlsVerify: true` + a CA bundle**:
```yaml
apiVersion: apisix.apache.org/v1alpha1
kind: GatewayProxy
spec:
provider:
type: ControlPlane
controlPlane:
endpoints:
- https://apisix-admin.default.svc:9180
tlsVerify: true
caBundle: |
-----BEGIN CERTIFICATE-----
MIID...
-----END CERTIFICATE-----
auth:
type: AdminKey
adminKey:
valueFrom:
secretKeyRef:
name: admin-key
key: token
```
Raised from the review discussion on #2811
(https://github.com/apache/apisix-ingress-controller/pull/2811#discussion_r3654031187),
thanks @AlinsRan.
## Design notes
**Inline PEM, not a Secret/ConfigMap ref.** A CA certificate is public
material, so a Secret buys no confidentiality here, and an inline field is what
Kubernetes itself uses for the same job (`WebhookClientConfig.CABundle`). It
also keeps the change to the data path: no new watch, index, or RBAC rule, and
rotating the bundle is an edit of the GatewayProxy the controller already
reconciles on. A `caBundleRef` can be layered on later without breaking this
field.
**Invalid CA material fails fast, in two places.** A CEL rule rejects a
non-PEM `caBundle` at admission, and the translator parses it with
`x509.CertPool.AppendCertsFromPEM` and returns an error before any config is
pushed — so a typo surfaces as a clear message instead of an opaque TLS failure
at connect time.
**Interaction with `tlsVerify`.** The bundle replaces the system trust store
when verification is on, and is ignored when it is off — the controller logs
that case rather than silently doing nothing. It is still sent, so flipping
`tlsVerify` back on needs no other change.
**Wire compatibility.** The bundle reaches the ADC server as `caCert` in the
task options, `omitempty` so that a GatewayProxy without a CA bundle produces
byte-for-byte the request an older ADC server already accepts. Logging carries
only `hasCaCert` / `hasCaBundle` booleans, never the material itself.
## Dependency
Honoring `caCert` requires the companion ADC change in api7/adc#537 — the
ADC server currently picks between two static agents (`rejectUnauthorized`
true/false) and has no way to trust a custom CA. Until an ADC build carrying
that change ships, the field is accepted, validated, and transmitted, but not
yet acted on by the ADC server. Same change for the enterprise controller:
api7/api7-ingress-controller#448 (tracked by api7/api7-ingress-controller#446).
## Changes
- `api/v1alpha1/gatewayproxy_types.go`: `caBundle` on
`ControlPlaneProvider`, plus the CEL validation rule.
- `api/adc/types.go`: `Config.CaBundle`; `MarshalJSON` reports `hasCaBundle`
rather than the PEM.
- `internal/adc/translator/gatewayproxy.go`: validate the PEM, warn when
`tlsVerify` is off, set it on the config.
- `internal/adc/client/executor.go`: carry it to the ADC server as `caCert`.
- Regenerated CRD; API reference updated by hand to match.
## Tests
- `internal/adc/translator/gatewayproxy_test.go` (new): the bundle reaches
`Config`, stays empty when unset, is rejected when not PEM, and survives
`tlsVerify: false`.
- `internal/adc/client/executor_test.go`: `caCert` is absent from the
request body without a bundle and present with one, with `tlsSkipVerify` still
false.
```
go build ./... ok
go test ./internal/adc/... ./api/... ok
go vet ./api/... ./internal/adc/... ok
```
The CEL rule was also exercised against a real API server via envtest (CRDs
from `config/crd/bases`): a PEM bundle and an absent bundle are admitted,
`not-a-certificate` is rejected with `caBundle must be a PEM-encoded
certificate`. That check is not committed, since this package has no envtest
specs today and adding the first one would make `go test ./internal/controller`
require the kubebuilder assets.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
