Clarifying that wildcard hostname matching is suffix matching

[robscott]

What type of PR is this?
/kind documentation
/area conformance

What this PR does / why we need it:
This is a follow up from #1159 that clarifies that wildcard hostname matching should be considered equivalent to suffix matching. This is a change from the Ingress spec but is more widely implementable and matches the most widespread default behavior, including nginx, envoy, GCP, and Azure.

Which issue(s) this PR fixes:
Fixes #1159

Does this PR introduce a user-facing change?:

Wildcard hostname matching behavior has been documented as equivalent to suffix matching.

If merged, this will cause conformance tests to start failing for some implementations, adding a temporary hold so everyone has a chance to weigh in.

/hold

/cc @bowei @shaneutt @youngnick @mikemorris @howardjohn

[k8s-ci-robot]

@robscott: GitHub didn't allow me to request PR reviews from the following users: howardjohn, mikemorris.

Note that only kubernetes-sigs members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

What type of PR is this?
/kind documentation
/area conformance

What this PR does / why we need it:
This is a follow up from #1159 that clarifies that wildcard hostname matching should be considered equivalent to suffix matching. This is a change from the Ingress spec but is more widely implementable and matches the most widespread default behavior, including nginx, envoy, GCP, and Azure.

Which issue(s) this PR fixes:
Fixes #1159

Does this PR introduce a user-facing change?:

Wildcard hostname matching behavior has been documented as equivalent to suffix matching.

If merged, this will cause conformance tests to start failing for some implementations, adding a temporary hold so everyone has a chance to weigh in.

/hold

/cc @bowei @shaneutt @youngnick @mikemorris @howardjohn

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: robscott

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [robscott]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[youngnick]

As I said in #1159, although I would slightly prefer to keep this similar to a single label, it's not worth excluding already-working implementations from conformance (which would be the cost of not making this change).

So, this LGTM to me, but interested to hear from others.

[howardjohn]

I would slightly prefer to keep it a single label [and have someone make Envoy support single labels efficiently].

[robscott]

I would slightly prefer to keep it a single label

Although I agree that it would be nice to match the Ingress spec and more closely align with TLS certs, I think there's likely a compelling reason that so many APIs/implementations (envoy, nginx, GCP, Azure, etc) chose to interpret this as suffix matching. The fact that some of those can only implement suffix matching makes me think it's our only real option here.

[shaneutt]

Overall I don't have a problem with the approach. It's implementable and if it's the thing that everyone can easily implement then that's good.

I do have a small comment/question about the testing for this, but it's possible I'm just missing something.

[shaneutt]

I might be reading this wrong: this test proves the change by making sure the * match works right? Are we missing the test for the assertion that the suffix without a prefix doesn't match?

e.g. we need these tests:

• *.ocean.example.com matches whales.ocean.example.com and sharks.ocean.example.com
• *.ocean.example.com does not match ocean.example.com

[robscott]

Good call, added test case for that. On a related note - I'm a big fan of those example domains. Trying to keep the surface area of this PR small, but if anyone wants to move our tests to ocean themed example.com/net/org domains, that would also be great.

[shaneutt]

fits right in with our already nautical software themes 😂

[robscott]

Also ran this by @mikemorris to confirm this made sense for their implementation. I think there's enough consensus here to remove the hold - still need someone to add an LGTM though.

/hold cancel

[youngnick]

/lgtm