-
Notifications
You must be signed in to change notification settings - Fork 454
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat:add higress automatic https #854
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #854 +/- ##
==========================================
- Coverage 38.01% 36.24% -1.78%
==========================================
Files 61 69 +8
Lines 10474 11464 +990
==========================================
+ Hits 3982 4155 +173
- Misses 6192 6993 +801
- Partials 300 316 +16
|
4c8e4b5
to
a14dc76
Compare
已经重新提交,麻烦再看一下 |
a14dc76
to
fba6b6e
Compare
fba6b6e
to
25a9286
Compare
这个configmap,有可能考虑改成CRD的模式吗,配置在一个configmap里面,不同的域名的RBAC会比较难控制 |
@zzjin 这个configmap我们不希望放到用户命名空间下,而是放在系统命名空间下(如:higress-system),统一交由集群SRE来管理 |
@2456868764 这个配置里的cert字段是否应该是higress的子字段比较合理 |
现在 cert 是保存新 higress-https configmap 里,是要保存到 higress-config configmap 里 higress 属性下? |
1 similar comment
现在 cert 是保存新 higress-https configmap 里,是要保存到 higress-config configmap 里 higress 属性下? |
哦,独立出来也有好处,可以用hgctl简化运维 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
似乎没有看到在将ingress转换为istio gateway资源时,根据此份configmap配置credential的逻辑?
higress/pkg/ingress/kube/ingressv1/controller.go Lines 411 to 442 in 9c112a0
@2456868764 即这段逻辑需要调整适配 |
好的,我修改一下 |
@johnlanni 已经适配,麻烦看一下 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
能否添加一个e2e test,可以只验证static secret的方式,校验服务端返回的证书与配置的是否一致
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
现在区分了ingressv1和ingress两个目录对应不同的ingress版本,除了 ingressv1, ingress目录下的controller也需要调整一下
ingress & ingressv1 都修改,增加了 e2e test , 另外配置在 higress-https 里 secret 应该在 higress-system namespace 下? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Ⅰ. Describe what this PR did
在Higress控制面集成支持域名静态配置 和 支持secret对接lets encrypt自动续签,在higress-system namesapce 新增一个 configmap ,其配置格式如下
在这个ConfigMap中,data字段中 cert 配置如下:
automaticHttps: 设置为true,表示启用自动letsencrypt等自动签发功能。
renewBeforeDays: 设置为30,表示在证书到期前30天自动续订证书。
credentialConfig: 是一个列表,包含多个TLS证书的配置项。
acmeIssuer
Ⅱ. Does this pull request fix one issue?
Ⅲ. Why don't you add test cases (unit test/integration test)?
fixes #841
fixes #64
Ⅳ. Describe how to verify it
Ⅴ. Special notes for reviews