Skip to content

Commit 1655f71

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4313 from shraddhabang/gwrulesauthcfg
[feat gw api] Add auth cognito action for secure listeners on ALBs
2 parents 8f7aaa3 + 5ec3c44 commit 1655f71

23 files changed

+1169
-145
lines changed

‎apis/gateway/v1beta1/listenerruleconfig_types.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ type AuthenticateCognitoActionConfig struct {
166166
// +kubebuilder:default=604800
167167
// +kubebuilder:validation:Minimum=1
168168
// +kubebuilder:validation:Maximum=604800
169-
SessionTimeout *int32 `json:"sessionTimeout,omitempty"`
169+
SessionTimeout *int64 `json:"sessionTimeout,omitempty"`
170170
}
171171

172172
// Information about an authenticate-oidc action
@@ -259,12 +259,12 @@ type Action struct {
259259
AuthenticateOIDCConfig *AuthenticateOidcActionConfig `json:"authenticateOIDCConfig,omitempty"`
260260
}
261261

262-
// ListenerRuleSpec defines the desired state of ListenerRuleConfiguration
262+
// ListenerRuleConfigurationSpec defines the desired state of ListenerRuleConfiguration
263263
// +kubebuilder:validation:XValidation:rule="!has(self.actions) || size(self.actions) > 0",message="At least one action must be specified if actions field is present"
264264
// +kubebuilder:validation:XValidation:rule="!has(self.actions) || self.actions.all(a, a.type == 'authenticate-oidc' || a.type == 'authenticate-cognito' || a.type == 'fixed-response' || a.type == 'forward' || a.type == 'redirect')",message="Only forward, redirect, authenticate-oidc, authenticate-cognito, and fixed-response action types are supported"
265265
// +kubebuilder:validation:XValidation:rule="!has(self.actions) || size(self.actions.filter(a, a.type == 'authenticate-oidc' || a.type == 'authenticate-cognito')) <= 1",message="At most one authentication action (either authenticate-oidc or authenticate-cognito) can be specified"
266266
// +kubebuilder:validation:XValidation:rule="!has(self.actions) || size(self.actions.filter(a, a.type == 'fixed-response' || a.type == 'forward' || a.type == 'redirect')) <= 1",message="At most one routing action (fixed-response or forward or redirect) can be specified"
267-
type ListenerRuleSpec struct {
267+
type ListenerRuleConfigurationSpec struct {
268268
// Actions defines the set of actions to be performed when conditions match.
269269
// This CRD implementation currently supports only authenticate-oidc, authenticate-cognito, and fixed-response action types fully and forward and redirect actions partially
270270
//
@@ -292,8 +292,8 @@ type ListenerRuleSpec struct {
292292
Tags *map[string]string `json:"tags,omitempty"`
293293
}
294294

295-
// ListenerRuleStatus defines the observed state of ListenerRuleConfiguration
296-
type ListenerRuleStatus struct {
295+
// ListenerRuleConfigurationStatus defines the observed state of ListenerRuleConfiguration
296+
type ListenerRuleConfigurationStatus struct {
297297

298298
// The observed generation of the rule configuration
299299
// +optional
@@ -309,8 +309,8 @@ type ListenerRuleConfiguration struct {
309309
metav1.TypeMeta `json:",inline"`
310310
metav1.ObjectMeta `json:"metadata,omitempty"`
311311

312-
Spec ListenerRuleSpec `json:"spec,omitempty"`
313-
Status ListenerRuleStatus `json:"status,omitempty"`
312+
Spec ListenerRuleConfigurationSpec `json:"spec,omitempty"`
313+
Status ListenerRuleConfigurationStatus `json:"status,omitempty"`
314314
}
315315

316316
// +kubebuilder:object:root=true

‎apis/gateway/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 9 additions & 9 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/gateway/gateway-crds.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,8 @@ spec:
4141
metadata:
4242
type: object
4343
spec:
44-
description: ListenerRuleSpec defines the desired state of ListenerRuleConfiguration
44+
description: ListenerRuleConfigurationSpec defines the desired state of
45+
ListenerRuleConfiguration
4546
properties:
4647
actions:
4748
description: |-
@@ -97,7 +98,7 @@ spec:
9798
description: |-
9899
The maximum duration of the authentication session, in seconds. The default is
99100
604800 seconds (7 days).
100-
format: int32
101+
format: int64
101102
maximum: 604800
102103
minimum: 1
103104
type: integer
@@ -373,7 +374,8 @@ spec:
373374
rule: '!has(self.actions) || size(self.actions.filter(a, a.type == ''fixed-response''
374375
|| a.type == ''forward'' || a.type == ''redirect'')) <= 1'
375376
status:
376-
description: ListenerRuleStatus defines the observed state of ListenerRuleConfiguration
377+
description: ListenerRuleConfigurationStatus defines the observed state
378+
of ListenerRuleConfiguration
377379
properties:
378380
observedGeneration:
379381
description: The observed generation of the rule configuration

‎config/crd/gateway/gateway.k8s.aws_listenerruleconfigurations.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@ spec:
4242
metadata:
4343
type: object
4444
spec:
45-
description: ListenerRuleSpec defines the desired state of ListenerRuleConfiguration
45+
description: ListenerRuleConfigurationSpec defines the desired state of
46+
ListenerRuleConfiguration
4647
properties:
4748
actions:
4849
description: |-
@@ -98,7 +99,7 @@ spec:
9899
description: |-
99100
The maximum duration of the authentication session, in seconds. The default is
100101
604800 seconds (7 days).
101-
format: int32
102+
format: int64
102103
maximum: 604800
103104
minimum: 1
104105
type: integer
@@ -374,7 +375,8 @@ spec:
374375
rule: '!has(self.actions) || size(self.actions.filter(a, a.type == ''fixed-response''
375376
|| a.type == ''forward'' || a.type == ''redirect'')) <= 1'
376377
status:
377-
description: ListenerRuleStatus defines the observed state of ListenerRuleConfiguration
378+
description: ListenerRuleConfigurationStatus defines the observed state
379+
of ListenerRuleConfiguration
378380
properties:
379381
observedGeneration:
380382
description: The observed generation of the rule configuration

‎docs/guide/gateway/spec.md‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,7 @@ _Appears in:_
219219

220220
| Field | Description | Default | Validation |
221221
| --- | --- | --- | --- |
222-
| `targetGroupStickinessConfig` _[TargetGroupStickinessConfig](#targetgroupstickinessconfig)_ | The target group stickiness for the rule.<br />Note: ForwardActionConfig only supports target group stickiness configuration through CRD.<br />All other forward action fields must be set through the Gateway API native way. | | |
222+
| `targetGroupStickinessConfig` _[TargetGroupStickinessConfig](#targetgroupstickinessconfig)_ | The target group stickiness for the rule.<br />Note: ForwardActionConfig only supports target group stickiness configuration through CRD.<br />All other forward action fields must be set through the Gateway API native way. | \{ \} | |
223223

224224

225225
#### HealthCheckConfiguration
@@ -476,6 +476,8 @@ _Appears in:_
476476
| `enableICMP` _boolean_ | EnableICMP [Network LoadBalancer]<br />enables the creation of security group rules to the managed security group<br />to allow explicit ICMP traffic for Path MTU discovery for IPv4 and dual-stack VPCs | | |
477477
| `manageBackendSecurityGroupRules` _boolean_ | ManageBackendSecurityGroupRules [Application / Network LoadBalancer]<br />specifies whether you want the controller to configure security group rules on Node/Pod for traffic access<br />when you specify securityGroups | | |
478478
| `minimumLoadBalancerCapacity` _[MinimumLoadBalancerCapacity](#minimumloadbalancercapacity)_ | MinimumLoadBalancerCapacity define the capacity reservation for LoadBalancers | | |
479+
| `wafV2` _[WAFv2Configuration](#wafv2configuration)_ | WAFv2 define the AWS WAFv2 settings for a Gateway [Application Load Balancer] | | |
480+
| `shieldConfiguration` _[ShieldConfiguration](#shieldconfiguration)_ | ShieldAdvanced define the AWS Shield settings for a Gateway [Application Load Balancer] | | |
479481

480482

481483
#### LoadBalancerConfigurationStatus
@@ -731,6 +733,22 @@ _Appears in:_
731733
| `namespace` _string_ | Namespace is namespace of secret. If empty it will be considered to be in same namespace as of the resource referring it | | |
732734

733735

736+
#### ShieldConfiguration
737+
738+
739+
740+
ShieldConfiguration configuration parameters used to configure Shield
741+
742+
743+
744+
_Appears in:_
745+
- [LoadBalancerConfigurationSpec](#loadbalancerconfigurationspec)
746+
747+
| Field | Description | Default | Validation |
748+
| --- | --- | --- | --- |
749+
| `enabled` _boolean_ | Enabled whether Shield Advanced should be configured with the Gateway | | |
750+
751+
734752
#### SourceIPConditionConfig
735753

736754

@@ -942,3 +960,19 @@ _Appears in:_
942960
| `ip` | |
943961

944962

963+
#### WAFv2Configuration
964+
965+
966+
967+
WAFv2Configuration configuration parameters used to configure WAFv2
968+
969+
970+
971+
_Appears in:_
972+
- [LoadBalancerConfigurationSpec](#loadbalancerconfigurationspec)
973+
974+
| Field | Description | Default | Validation |
975+
| --- | --- | --- | --- |
976+
| `webACL` _string_ | ACL The WebACL to configure with the Gateway | | |
977+
978+

‎helm/aws-load-balancer-controller/crds/gateway-crds.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,8 @@ spec:
4141
metadata:
4242
type: object
4343
spec:
44-
description: ListenerRuleSpec defines the desired state of ListenerRuleConfiguration
44+
description: ListenerRuleConfigurationSpec defines the desired state of
45+
ListenerRuleConfiguration
4546
properties:
4647
actions:
4748
description: |-
@@ -97,7 +98,7 @@ spec:
9798
description: |-
9899
The maximum duration of the authentication session, in seconds. The default is
99100
604800 seconds (7 days).
100-
format: int32
101+
format: int64
101102
maximum: 604800
102103
minimum: 1
103104
type: integer
@@ -373,7 +374,8 @@ spec:
373374
rule: '!has(self.actions) || size(self.actions.filter(a, a.type == ''fixed-response''
374375
|| a.type == ''forward'' || a.type == ''redirect'')) <= 1'
375376
status:
376-
description: ListenerRuleStatus defines the observed state of ListenerRuleConfiguration
377+
description: ListenerRuleConfigurationStatus defines the observed state
378+
of ListenerRuleConfiguration
377379
properties:
378380
observedGeneration:
379381
description: The observed generation of the rule configuration

‎pkg/gateway/model/model_build_listener.go‎

Lines changed: 38 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -205,8 +205,12 @@ func (l listenerBuilderImpl) buildListenerRules(stack core.Stack, ls *elbv2model
205205

206206
// set up for building routing actions
207207
var actions []elbv2model.Action
208+
var preRoutingAction *elbv2gw.Action
208209
var routingAction *elbv2gw.Action
209210
if rule.GetListenerRuleConfig() != nil {
211+
if isSecureProtocol(ls.Spec.Protocol) {
212+
preRoutingAction = getPreRoutingAction(rule.GetListenerRuleConfig())
213+
}
210214
routingAction = getRoutingAction(rule.GetListenerRuleConfig())
211215
}
212216
targetGroupTuples := make([]elbv2model.TargetGroupTuple, 0, len(rule.GetBackends()))
@@ -222,17 +226,31 @@ func (l listenerBuilderImpl) buildListenerRules(stack core.Stack, ls *elbv2model
222226
Weight: &weight,
223227
})
224228
}
229+
230+
// Build Rule PreRoutingAction
231+
if preRoutingAction != nil {
232+
var rulePreRoutingAction *elbv2model.Action
233+
rulePreRoutingAction, err = routeutils.BuildRulePreRoutingAction(route, preRoutingAction)
234+
if err != nil {
235+
return err
236+
}
237+
if rulePreRoutingAction != nil {
238+
actions = append(actions, *rulePreRoutingAction)
239+
}
240+
}
241+
225242
// Build Rule Routing Actions
226-
actions, err = routeutils.BuildRuleRoutingActions(rule, route, routingAction, targetGroupTuples)
243+
var ruleRoutingAction *elbv2model.Action
244+
ruleRoutingAction, err = routeutils.BuildRuleRoutingAction(rule, route, routingAction, targetGroupTuples)
227245
if err != nil {
228246
return err
229247
}
230248

231-
// TODO: build rule auth actions
232-
233-
if len(actions) == 0 {
249+
if ruleRoutingAction == nil {
234250
l.logger.Info("Filling in no backend actions with fixed 503")
235-
actions = buildL7ListenerNoBackendActions()
251+
actions = append(actions, buildL7ListenerNoBackendActions())
252+
} else {
253+
actions = append(actions, *ruleRoutingAction)
236254
}
237255

238256
tags, tagsErr := l.tagHelper.getGatewayTags(lbCfg)
@@ -351,15 +369,15 @@ func buildL7ListenerDefaultActions() []elbv2model.Action {
351369
}
352370

353371
// returns 503 when no backends are configured
354-
func buildL7ListenerNoBackendActions() []elbv2model.Action {
372+
func buildL7ListenerNoBackendActions() elbv2model.Action {
355373
action503 := elbv2model.Action{
356374
Type: elbv2model.ActionTypeFixedResponse,
357375
FixedResponseConfig: &elbv2model.FixedResponseActionConfig{
358376
ContentType: awssdk.String("text/plain"),
359377
StatusCode: "503",
360378
},
361379
}
362-
return []elbv2model.Action{action503}
380+
return action503
363381
}
364382

365383
func buildL4ListenerDefaultActions(targetGroup *elbv2model.TargetGroup) []elbv2model.Action {
@@ -526,6 +544,19 @@ func newListenerBuilder(ctx context.Context, loadBalancerType elbv2model.LoadBal
526544
}
527545
}
528546

547+
// getPreRoutingAction: returns pre routing action for secure listeners from listener rule configuration
548+
// action will only be one of authenticate-oidc or authenticate-cognito
549+
func getPreRoutingAction(config *elbv2gw.ListenerRuleConfiguration) *elbv2gw.Action {
550+
if config != nil && config.Spec.Actions != nil {
551+
for _, action := range config.Spec.Actions {
552+
if action.Type == elbv2gw.ActionTypeAuthenticateCognito || action.Type == elbv2gw.ActionTypeAuthenticateOIDC {
553+
return &action
554+
}
555+
}
556+
}
557+
return nil
558+
}
559+
529560
// getRoutingAction: returns routing action from listener rule configuration
530561
// action will only be one of forward, fixed response or redirect
531562
func getRoutingAction(config *elbv2gw.ListenerRuleConfiguration) *elbv2gw.Action {

0 commit comments

Comments
 (0)