Add support for ssl ciphers related annotations

internal/configs/annotations.go

@@ -18,6 +18,12 @@ const BasicAuthSecretAnnotation = "nginx.org/basic-auth-secret" // #nosec G101
 // PathRegexAnnotation is the annotation where the regex location (path) modifier is specified.
 const PathRegexAnnotation = "nginx.org/path-regex"
 
+// SSLCiphersAnnotation is the annotation where SSL ciphers are specified.
+const SSLCiphersAnnotation = "nginx.org/ssl-ciphers"
+
+// SSLPreferServerCiphersAnnotation is the annotation where SSL prefer server ciphers is specified.
+const SSLPreferServerCiphersAnnotation = "nginx.org/ssl-prefer-server-ciphers"
+
 // UseClusterIPAnnotation is the annotation where the use-cluster-ip boolean is specified.
 const UseClusterIPAnnotation = "nginx.org/use-cluster-ip"
 
@@ -60,6 +66,8 @@ var minionDenylist = map[string]bool{
 "nginx.org/listen-ports": true,
 "nginx.org/listen-ports-ssl": true,
 "nginx.org/server-snippets": true,
+"nginx.org/ssl-ciphers": true,
+"nginx.org/ssl-prefer-server-ciphers": true,
 "appprotect.f5.com/app_protect_enable": true,
 "appprotect.f5.com/app_protect_policy": true,
 "appprotect.f5.com/app_protect_security_log_enable": true,
@@ -252,6 +260,18 @@ func parseAnnotations(ingEx *IngressEx, baseCfgParams *ConfigParams, isPlus bool
 }
 }
 
+if sslCiphers, exists := ingEx.Ingress.Annotations[SSLCiphersAnnotation]; exists {
+cfgParams.ServerSSLCiphers = sslCiphers
+}
+
+if sslPreferServerCiphers, exists, err := GetMapKeyAsBool(ingEx.Ingress.Annotations, SSLPreferServerCiphersAnnotation, ingEx.Ingress); exists {
+if err != nil {
+nl.Error(l, err)
+} else {
+cfgParams.ServerSSLPreferServerCiphers = sslPreferServerCiphers
+}
+}
+
 if proxyBuffering, exists, err := GetMapKeyAsBool(ingEx.Ingress.Annotations, "nginx.org/proxy-buffering", ingEx.Ingress); exists {
 if err != nil {
 nl.Error(l, err)

internal/configs/config_params.go

@@ -87,6 +87,8 @@ type ConfigParams struct {
 ResolverValid string
 ServerSnippets []string
 ServerTokens string
+ServerSSLCiphers string
+ServerSSLPreferServerCiphers bool
 SlowStart string
 SSLRedirect bool
 UpstreamZoneSize string

internal/configs/ingress.go

@@ -151,30 +151,32 @@ func generateNginxCfg(p NginxCfgParams) (version1.IngressNginxConfig, Warnings)
 statusZone := rule.Host
 
 server := version1.Server{
-Name: serverName,
-ServerTokens: cfgParams.ServerTokens,
-HTTP2: cfgParams.HTTP2,
-RedirectToHTTPS: cfgParams.RedirectToHTTPS,
-SSLRedirect: cfgParams.SSLRedirect,
-ProxyProtocol: cfgParams.ProxyProtocol,
-HSTS: cfgParams.HSTS,
-HSTSMaxAge: cfgParams.HSTSMaxAge,
-HSTSIncludeSubdomains: cfgParams.HSTSIncludeSubdomains,
-HSTSBehindProxy: cfgParams.HSTSBehindProxy,
-StatusZone: statusZone,
-RealIPHeader: cfgParams.RealIPHeader,
-SetRealIPFrom: cfgParams.SetRealIPFrom,
-RealIPRecursive: cfgParams.RealIPRecursive,
-ProxyHideHeaders: cfgParams.ProxyHideHeaders,
-ProxyPassHeaders: cfgParams.ProxyPassHeaders,
-ServerSnippets: cfgParams.ServerSnippets,
-Ports: cfgParams.Ports,
-SSLPorts: cfgParams.SSLPorts,
-TLSPassthrough: p.staticParams.TLSPassthrough,
-AppProtectEnable: cfgParams.AppProtectEnable,
-AppProtectLogEnable: cfgParams.AppProtectLogEnable,
-SpiffeCerts: cfgParams.SpiffeServerCerts,
-DisableIPV6: p.staticParams.DisableIPV6,
+Name: serverName,
+ServerTokens: cfgParams.ServerTokens,
+HTTP2: cfgParams.HTTP2,
+RedirectToHTTPS: cfgParams.RedirectToHTTPS,
+SSLRedirect: cfgParams.SSLRedirect,
+SSLCiphers: cfgParams.ServerSSLCiphers,
+SSLPreferServerCiphers: cfgParams.ServerSSLPreferServerCiphers,
+ProxyProtocol: cfgParams.ProxyProtocol,
+HSTS: cfgParams.HSTS,
+HSTSMaxAge: cfgParams.HSTSMaxAge,
+HSTSIncludeSubdomains: cfgParams.HSTSIncludeSubdomains,
+HSTSBehindProxy: cfgParams.HSTSBehindProxy,
+StatusZone: statusZone,
+RealIPHeader: cfgParams.RealIPHeader,
+SetRealIPFrom: cfgParams.SetRealIPFrom,
+RealIPRecursive: cfgParams.RealIPRecursive,
+ProxyHideHeaders: cfgParams.ProxyHideHeaders,
+ProxyPassHeaders: cfgParams.ProxyPassHeaders,
+ServerSnippets: cfgParams.ServerSnippets,
+Ports: cfgParams.Ports,
+SSLPorts: cfgParams.SSLPorts,
+TLSPassthrough: p.staticParams.TLSPassthrough,
+AppProtectEnable: cfgParams.AppProtectEnable,
+AppProtectLogEnable: cfgParams.AppProtectLogEnable,
+SpiffeCerts: cfgParams.SpiffeServerCerts,
+DisableIPV6: p.staticParams.DisableIPV6,
 }
 
 warnings := addSSLConfig(&server, p.ingEx.Ingress, rule.Host, p.ingEx.Ingress.Spec.TLS, p.ingEx.SecretRefs, p.isWildcardEnabled)

internal/configs/version1/config.go

@@ -78,27 +78,29 @@ type LimitReqZone struct {
 
 // Server describes an NGINX server.
 type Server struct {
-ServerSnippets []string
-Name string
-ServerTokens string
-Locations []Location
-SSL bool
-SSLCertificate string
-SSLCertificateKey string
-SSLRejectHandshake bool
-TLSPassthrough bool
-GRPCOnly bool
-StatusZone string
-HTTP2 bool
-RedirectToHTTPS bool
-SSLRedirect bool
-ProxyProtocol bool
-HSTS bool
-HSTSMaxAge int64
-HSTSIncludeSubdomains bool
-HSTSBehindProxy bool
-ProxyHideHeaders []string
-ProxyPassHeaders []string
+ServerSnippets []string
+Name string
+ServerTokens string
+Locations []Location
+SSL bool
+SSLCertificate string
+SSLCertificateKey string
+SSLCiphers string
+SSLPreferServerCiphers bool
+SSLRejectHandshake bool
+TLSPassthrough bool
+GRPCOnly bool
+StatusZone string
+HTTP2 bool
+RedirectToHTTPS bool
+SSLRedirect bool
+ProxyProtocol bool
+HSTS bool
+HSTSMaxAge int64
+HSTSIncludeSubdomains bool
+HSTSBehindProxy bool
+ProxyHideHeaders []string
+ProxyPassHeaders []string
 
 HealthChecks map[string]HealthCheck
 

internal/configs/version1/nginx-plus.ingress.tmpl

@@ -59,6 +59,12 @@ server {
 {{- else}}
 ssl_certificate {{ makeSecretPath $server.SSLCertificate $.StaticSSLPath "$secret_dir_path" $.DynamicSSLReloadEnabled }};
 ssl_certificate_key {{ makeSecretPath $server.SSLCertificateKey $.StaticSSLPath "$secret_dir_path" $.DynamicSSLReloadEnabled }};
+{{- if $server.SSLCiphers}}
+ssl_ciphers "{{$server.SSLCiphers}}";
+{{- end}}
+{{- if $server.SSLPreferServerCiphers}}
+ssl_prefer_server_ciphers on;
+{{- end}}
 {{- end}}
 {{- end}}
 {{- end}}

internal/configs/version1/nginx.ingress.tmpl

@@ -50,6 +50,12 @@ server {
 {{- else}}
 ssl_certificate {{ makeSecretPath $server.SSLCertificate $.StaticSSLPath "$secret_dir_path" $.DynamicSSLReloadEnabled }};
 ssl_certificate_key {{ makeSecretPath $server.SSLCertificateKey $.StaticSSLPath "$secret_dir_path" $.DynamicSSLReloadEnabled }};
+{{- if $server.SSLCiphers}}
+ssl_ciphers "{{$server.SSLCiphers}}";
+{{- end}}
+{{- if $server.SSLPreferServerCiphers}}
+ssl_prefer_server_ciphers on;
+{{- end}}
 {{- end}}
 {{- end}}
 {{- end}}