Skip to content

Commit 01b9231

Browse files
pmalekpmalek
authored
fix: fix generating SNIs in dbless (#7853) (#7857)
* fix: fix generating SNIs in dbless (#7853) * fix: fix generating SNIs in dbless * tests: fix golden tests files * tests: fix golden tests files * chore: add changelog * chore: update kong-ee test dependency to 3.10.0.9
1 parent 7378d1b commit 01b9231

16 files changed

Lines changed: 160 additions & 46 deletions

File tree

‎.github/test_dependencies.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,14 +46,14 @@ integration:
4646
# renovate: datasource=docker depName=kong versioning=docker
4747
kong-oss: '3.9.0'
4848
# renovate: datasource=docker depName=kong/kong-gateway versioning=docker
49-
kong-ee: '3.9.1.1'
49+
kong-ee: '3.10.0.9'
5050

5151
kongintegration:
5252
# renovate: datasource=docker depName=kong versioning=docker
5353
kong-oss: '3.9.0'
5454
# renovate: datasource=docker depName=kong/kong-gateway versioning=docker
55-
kong-ee: '3.9.1.1'
55+
kong-ee: '3.10.0.9'
5656

5757
envtests:
5858
# renovate: datasource=docker depName=kong/kong-gateway versioning=docker
59-
kong-ee: '3.9.1.1'
59+
kong-ee: '3.10.0.9'

‎CHANGELOG.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,15 @@ Adding a new version? You'll need three changes:
111111
- [0.0.5](#005)
112112
- [0.0.4 and prior](#004-and-prior)
113113

114+
## Unreleased
115+
116+
> Release date: TBA
117+
118+
### Fixed
119+
120+
- Fixed an issue with SNI generation in dbless mode.
121+
[#7853](https://github.com/Kong/kubernetes-ingress-controller/pull/7853)
122+
114123
## [3.4.11]
115124

116125
> Release date: 2025-02-17

‎internal/dataplane/deckgen/deckgen.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ func GenerateSHA(targetContent *file.Content, customEntities map[string][]custom
3232
}
3333

3434
// GetFCertificateFromKongCert converts a kong.Certificate to a file.FCertificate.
35-
func GetFCertificateFromKongCert(kongCert kong.Certificate) file.FCertificate {
35+
func GetFCertificateFromKongCert(inmemory bool, kongCert kong.Certificate) file.FCertificate {
3636
var res file.FCertificate
3737
if kongCert.ID != nil {
3838
res.ID = kong.String(*kongCert.ID)
@@ -43,17 +43,17 @@ func GetFCertificateFromKongCert(kongCert kong.Certificate) file.FCertificate {
4343
if kongCert.Cert != nil {
4444
res.Cert = kong.String(*kongCert.Cert)
4545
}
46-
res.SNIs = getCertsSNIs(kongCert)
46+
res.SNIs = getCertsSNIs(inmemory, kongCert)
4747
return res
4848
}
4949

50-
func getCertsSNIs(kongCert kong.Certificate) []kong.SNI {
50+
func getCertsSNIs(inmemory bool, kongCert kong.Certificate) []kong.SNI {
5151
snis := make([]kong.SNI, 0, len(kongCert.SNIs))
5252
for _, sni := range kongCert.SNIs {
5353
kongSNI := kong.SNI{
5454
Name: sni,
5555
}
56-
if kongCert.ID != nil {
56+
if !inmemory && kongCert.ID != nil {
5757
kongSNI.Certificate = &kong.Certificate{
5858
ID: kongCert.ID,
5959
}

‎internal/dataplane/deckgen/deckgen_test.go‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,102 @@ import (
1010
"github.com/kong/kubernetes-ingress-controller/v3/internal/dataplane/deckgen"
1111
)
1212

13+
func TestGetFCertificateFromKongCert(t *testing.T) {
14+
testCases := []struct {
15+
name string
16+
inmemory bool
17+
cert kong.Certificate
18+
want file.FCertificate
19+
}{
20+
{
21+
name: "empty certificate",
22+
inmemory: false,
23+
cert: kong.Certificate{},
24+
want: file.FCertificate{
25+
SNIs: []kong.SNI{},
26+
},
27+
},
28+
{
29+
name: "all fields set, inmemory=true, SNIs have no certificate ref",
30+
inmemory: true,
31+
cert: kong.Certificate{
32+
ID: kong.String("cert-id"),
33+
Key: kong.String("cert-key"),
34+
Cert: kong.String("cert-pem"),
35+
SNIs: []*string{kong.String("example.com"), kong.String("other.com")},
36+
},
37+
want: file.FCertificate{
38+
ID: kong.String("cert-id"),
39+
Key: kong.String("cert-key"),
40+
Cert: kong.String("cert-pem"),
41+
SNIs: []kong.SNI{
42+
{Name: kong.String("example.com")},
43+
{Name: kong.String("other.com")},
44+
},
45+
},
46+
},
47+
{
48+
name: "all fields set, inmemory=false, SNIs have certificate ref",
49+
inmemory: false,
50+
cert: kong.Certificate{
51+
ID: kong.String("cert-id"),
52+
Key: kong.String("cert-key"),
53+
Cert: kong.String("cert-pem"),
54+
SNIs: []*string{kong.String("example.com")},
55+
},
56+
want: file.FCertificate{
57+
ID: kong.String("cert-id"),
58+
Key: kong.String("cert-key"),
59+
Cert: kong.String("cert-pem"),
60+
SNIs: []kong.SNI{
61+
{
62+
Name: kong.String("example.com"),
63+
Certificate: &kong.Certificate{ID: kong.String("cert-id")},
64+
},
65+
},
66+
},
67+
},
68+
{
69+
name: "nil ID, inmemory=false, SNIs have no certificate ref",
70+
inmemory: false,
71+
cert: kong.Certificate{
72+
Key: kong.String("cert-key"),
73+
Cert: kong.String("cert-pem"),
74+
SNIs: []*string{kong.String("example.com")},
75+
},
76+
want: file.FCertificate{
77+
Key: kong.String("cert-key"),
78+
Cert: kong.String("cert-pem"),
79+
SNIs: []kong.SNI{
80+
{Name: kong.String("example.com")},
81+
},
82+
},
83+
},
84+
{
85+
name: "no SNIs",
86+
inmemory: false,
87+
cert: kong.Certificate{
88+
ID: kong.String("cert-id"),
89+
Key: kong.String("cert-key"),
90+
Cert: kong.String("cert-pem"),
91+
},
92+
want: file.FCertificate{
93+
ID: kong.String("cert-id"),
94+
Key: kong.String("cert-key"),
95+
Cert: kong.String("cert-pem"),
96+
SNIs: []kong.SNI{},
97+
},
98+
},
99+
}
100+
101+
for _, tc := range testCases {
102+
t.Run(tc.name, func(t *testing.T) {
103+
got := deckgen.GetFCertificateFromKongCert(tc.inmemory, tc.cert)
104+
require.Equal(t, tc.want, got)
105+
})
106+
}
107+
}
108+
13109
func TestIsContentEmpty(t *testing.T) {
14110
testCases := []struct {
15111
name string

‎internal/dataplane/deckgen/generate.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,11 @@ type GenerateDeckContentParams struct {
3232
// the configuration is empty. It is used to workaround behavior in Kong where sending an empty configuration
3333
// does not make its `GET /status/ready` endpoint return 200s.
3434
AppendStubEntityWhenConfigEmpty bool
35+
36+
// InMemory indicates whether the generated deck content is intended to be used in-memory.
37+
// This is used to determine whether to include certain fields in the generated content
38+
// that are not relevant for in-memory use but are required for db based / konnect configurations.
39+
InMemory bool
3540
}
3641

3742
// ToDeckContent generates a decK configuration from `k8sState` and auxiliary parameters.
@@ -125,7 +130,7 @@ func ToDeckContent(
125130
})
126131

127132
for _, c := range k8sState.Certificates {
128-
cert := GetFCertificateFromKongCert(c.Certificate)
133+
cert := GetFCertificateFromKongCert(params.InMemory, c.Certificate)
129134
content.Certificates = append(content.Certificates, cert)
130135
}
131136
sort.SliceStable(content.Certificates, func(i, j int) bool {

‎internal/dataplane/kong_client.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -794,6 +794,7 @@ func (c *KongClient) sendToClient(
794794
ExpressionRoutes: config.ExpressionRoutes,
795795
PluginSchemas: client.PluginSchemaStore(),
796796
AppendStubEntityWhenConfigEmpty: config.InMemory,
797+
InMemory: config.InMemory,
797798
}
798799
targetContent := deckgen.ToDeckContent(ctx, logger, s, deckGenParams)
799800
customEntities := make(sendconfig.CustomEntitiesByType)

‎internal/dataplane/kong_client_golden_test.go‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,9 @@ func pruneTestCaseDirectory(t *testing.T, path string) {
130130

131131
for _, fileInDirectory := range filesInDirectory {
132132
// First, let's skip the files we want to keep.
133-
if fileInDirectory.Name() == inFileName || strings.HasSuffix(fileInDirectory.Name(), settingsFileSuffix) {
133+
if fileInDirectory.Name() == inFileName ||
134+
strings.HasSuffix(fileInDirectory.Name(), settingsFileSuffix) ||
135+
strings.HasSuffix(fileInDirectory.Name(), ".txt") {
134136
continue
135137
}
136138

@@ -262,7 +264,9 @@ func runKongClientGoldenTest(t *testing.T, tc kongClientGoldenTestCase) {
262264
translatorConfig := translator.Config{
263265
ClusterDomain: consts.DefaultClusterDomain,
264266
}
265-
p, err := translator.NewTranslator(logger, s, "", tc.featureFlags, fakeSchemaServiceProvier{}, translatorConfig)
267+
p, err := translator.NewTranslator(logger, s, "", tc.featureFlags, fakeSchemaServiceProvier{},
268+
translatorConfig,
269+
)
266270
require.NoError(t, err, "failed creating translator")
267271

268272
// Start a mock Admin API server and create an Admin API client for inspecting the configuration.

internal/dataplane/testdata/golden/ingress-v1-rule-with-tls-and-consumer/default_golden.yaml renamed to internal/dataplane/testdata/golden/ingress-v1-rule-with-tls-and-consumer-ee/default_golden.yaml

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,8 @@ certificates:
3131
5GTyl7XJmyY/
3232
-----END PRIVATE KEY-----
3333
snis:
34-
- certificate:
35-
id: c6ac927c-4f5a-4e88-8b5d-c7b01d0f43af
36-
name: 1.example.com
37-
- certificate:
38-
id: c6ac927c-4f5a-4e88-8b5d-c7b01d0f43af
39-
name: 2.example.com
34+
- name: 1.example.com
35+
- name: 2.example.com
4036
consumers:
4137
- basicauth_credentials:
4238
- password: consumer-1-password

internal/dataplane/testdata/golden/ingress-v1-rule-with-tls-and-consumer/expression-routes-on_golden.yaml renamed to internal/dataplane/testdata/golden/ingress-v1-rule-with-tls-and-consumer-ee/expression-routes-on_golden.yaml

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,8 @@ certificates:
3131
5GTyl7XJmyY/
3232
-----END PRIVATE KEY-----
3333
snis:
34-
- certificate:
35-
id: c6ac927c-4f5a-4e88-8b5d-c7b01d0f43af
36-
name: 1.example.com
37-
- certificate:
38-
id: c6ac927c-4f5a-4e88-8b5d-c7b01d0f43af
39-
name: 2.example.com
34+
- name: 1.example.com
35+
- name: 2.example.com
4036
consumers:
4137
- basicauth_credentials:
4238
- password: consumer-1-password

internal/dataplane/testdata/golden/ingress-v1-rule-with-tls-and-consumer/expression-routes-on_settings.yaml renamed to internal/dataplane/testdata/golden/ingress-v1-rule-with-tls-and-consumer-ee/expression-routes-on_settings.yaml

File renamed without changes.

0 commit comments

Comments
 (0)