Skip to content

Commit 9e3ae74

Browse files
lexfreilexfrei
committed
fix(ingress): keep tls section in operator wildcard mode
Dropping the whole tls block in wildcard mode disabled the forced HTTP-to-HTTPS redirect: ingress-nginx only issues the 308 redirect when TLS is enabled for the Ingress, while a host without a tls section is still served on 443 with the default certificate but stays reachable over plain HTTP. Keep the tls section with the host list and omit only the per-host secretName, so ingress-nginx falls back to the operator wildcard configured as the default SSL certificate and the redirect stays enforced, matching the non-wildcard behaviour. Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
1 parent b1f5d95 commit 9e3ae74

18 files changed

Lines changed: 124 additions & 63 deletions

File tree

‎packages/apps/harbor/templates/ingress.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,15 @@ metadata:
2626
{{- end }}
2727
spec:
2828
ingressClassName: {{ $ingress }}
29-
{{- if not $wildcardSecret }}
3029
tls:
3130
- hosts:
3231
- {{ $harborHost | quote }}
32+
{{- /* Operator wildcard mode: no per-host secret — ingress-nginx falls
33+
back to the default SSL certificate while the tls section keeps
34+
the HTTP-to-HTTPS redirect enforced. */}}
35+
{{- if not $wildcardSecret }}
3336
secretName: {{ .Release.Name }}-ingress-tls
34-
{{- end }}
37+
{{- end }}
3538
rules:
3639
- host: {{ $harborHost | quote }}
3740
http:

‎packages/apps/harbor/tests/ingress_wildcard_test.yaml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,13 @@ release:
77
namespace: tenant-root
88

99
# harbor gates its Ingress on an empty _namespace.gateway. In wildcard
10-
# mode the cert-manager + http01 annotations and the tls block are
11-
# dropped; the other nginx annotations stay.
10+
# mode the cert-manager + http01 annotations and the per-host tls
11+
# secretName are dropped (the tls section stays so the HTTPS redirect
12+
# keeps working against the default SSL certificate); the other nginx
13+
# annotations stay.
1214

1315
tests:
14-
- it: drops cert-manager annotation and tls block when wildcard secret is set
16+
- it: drops cert-manager annotation and tls secretName when wildcard secret is set
1517
set:
1618
_namespace:
1719
host: example.org
@@ -27,12 +29,14 @@ tests:
2729
value: Ingress
2830
- notExists:
2931
path: metadata.annotations["cert-manager.io/cluster-issuer"]
30-
- notExists:
32+
- exists:
3133
path: spec.tls
34+
- notExists:
35+
path: spec.tls[0].secretName
3236
- exists:
3337
path: metadata.annotations["nginx.ingress.kubernetes.io/proxy-body-size"]
3438

35-
- it: keeps cert-manager annotation and tls block without wildcard secret
39+
- it: keeps cert-manager annotation and tls secretName without wildcard secret
3640
set:
3741
_namespace:
3842
host: example.org

‎packages/extra/bootbox/templates/matchbox/ingress.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,15 @@ metadata:
2424
{{- end }}
2525
spec:
2626
ingressClassName: {{ $ingress }}
27-
{{- if not $wildcardSecret }}
2827
tls:
2928
- hosts:
3029
- "{{ printf "bootbox.%s" (.Values.host | default $host) }}"
30+
{{- /* Operator wildcard mode: no per-host secret — ingress-nginx falls
31+
back to the default SSL certificate while the tls section keeps
32+
the HTTP-to-HTTPS redirect enforced. */}}
33+
{{- if not $wildcardSecret }}
3134
secretName: bootbox-tls
32-
{{- end }}
35+
{{- end }}
3336
rules:
3437
- host: "{{ printf "bootbox.%s" (.Values.host | default $host) }}"
3538
http:

‎packages/extra/bootbox/tests/ingress_wildcard_test.yaml‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,15 @@ release:
99
# bootbox deploys into tenant-root and uses the publishing tenant's
1010
# ingress controller (_namespace.ingress), so in wildcard mode it must
1111
# also stop minting its own per-host ACME cert. The cert-manager + http01
12-
# annotations and the tls block are dropped. bootbox's only other
13-
# annotation (whitelist-source-range) is conditional, so the annotations
12+
# annotations and the per-host tls secretName are dropped; the tls
13+
# section itself stays so the HTTPS redirect keeps working against the
14+
# default SSL certificate. bootbox's only other annotation
15+
# (whitelist-source-range) is conditional, so the annotations
1416
# block must collapse entirely when wildcard is set and no whitelist is
1517
# configured.
1618

1719
tests:
18-
- it: collapses the annotations block and drops tls when wildcard set and no whitelist
20+
- it: collapses the annotations block and drops tls secretName when wildcard set and no whitelist
1921
set:
2022
whitelistHTTP: false
2123
_namespace:
@@ -31,10 +33,12 @@ tests:
3133
value: Ingress
3234
- notExists:
3335
path: metadata.annotations
34-
- notExists:
36+
- exists:
3537
path: spec.tls
38+
- notExists:
39+
path: spec.tls[0].secretName
3640

37-
- it: keeps cert-manager annotation and tls block without wildcard secret
41+
- it: keeps cert-manager annotation and tls secretName without wildcard secret
3842
set:
3943
_namespace:
4044
host: example.org
@@ -68,5 +72,7 @@ tests:
6872
- equal:
6973
path: metadata.annotations["nginx.ingress.kubernetes.io/whitelist-source-range"]
7074
value: "192.0.2.0/24"
71-
- notExists:
75+
- exists:
7276
path: spec.tls
77+
- notExists:
78+
path: spec.tls[0].secretName

‎packages/extra/seaweedfs/templates/seaweedfs.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -264,12 +264,15 @@ spec:
264264
{{- end }}
265265
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
266266
{{- end }}
267-
{{- if not $wildcardSecret }}
268267
tls:
269268
- hosts:
270269
- {{ .Values.host | default (printf "s3.%s" $host) }}
270+
{{- /* Operator wildcard mode: no per-host secret — ingress-nginx
271+
falls back to the default SSL certificate while the tls
272+
section keeps the HTTP-to-HTTPS redirect enforced. */}}
273+
{{- if not $wildcardSecret }}
271274
secretName: {{ .Release.Name }}-s3-ingress-tls
272-
{{- end }}
275+
{{- end }}
273276
resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.s3.resourcesPreset .Values.s3.resources $) | nindent 10 }}
274277
cosi:
275278
driverName: "{{ .Release.Namespace }}.seaweedfs.objectstorage.k8s.io"

‎packages/extra/seaweedfs/tests/ingress_wildcard_test.yaml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,12 @@ release:
1010
# S3 ingress (spec.values.seaweedfs.s3.ingress). documentSelector
1111
# targets that HelmRelease (the template also emits WorkloadMonitor
1212
# docs). In wildcard mode the cert-manager + http01 annotations and the
13-
# tls block are dropped; the other nginx annotations stay.
13+
# per-host tls secretName are dropped (the tls section stays so the
14+
# HTTPS redirect keeps working against the default SSL certificate);
15+
# the other nginx annotations stay.
1416

1517
tests:
16-
- it: drops cert-manager annotation and tls block when wildcard secret is set
18+
- it: drops cert-manager annotation and tls secretName when wildcard secret is set
1719
documentSelector:
1820
path: kind
1921
value: HelmRelease
@@ -30,12 +32,14 @@ tests:
3032
asserts:
3133
- notExists:
3234
path: spec.values.seaweedfs.s3.ingress.annotations["cert-manager.io/cluster-issuer"]
33-
- notExists:
35+
- exists:
3436
path: spec.values.seaweedfs.s3.ingress.tls
37+
- notExists:
38+
path: spec.values.seaweedfs.s3.ingress.tls[0].secretName
3539
- exists:
3640
path: spec.values.seaweedfs.s3.ingress.annotations["nginx.ingress.kubernetes.io/proxy-body-size"]
3741

38-
- it: keeps cert-manager annotation and tls block without wildcard secret
42+
- it: keeps cert-manager annotation and tls secretName without wildcard secret
3943
documentSelector:
4044
path: kind
4145
value: HelmRelease

‎packages/system/bucket/templates/ingress.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,15 @@ metadata:
2323
{{- end }}
2424
spec:
2525
ingressClassName: {{ $ingress }}
26-
{{- if not $wildcardSecret }}
2726
tls:
2827
- hosts:
2928
- "{{ .Values.bucketName }}.{{ $host }}"
29+
{{- /* Operator wildcard mode: no per-host secret — ingress-nginx falls
30+
back to the default SSL certificate while the tls section keeps
31+
the HTTP-to-HTTPS redirect enforced. */}}
32+
{{- if not $wildcardSecret }}
3033
secretName: {{ .Values.bucketName }}-ui-tls
31-
{{- end }}
34+
{{- end }}
3235
rules:
3336
- host: {{ .Values.bucketName }}.{{ $host }}
3437
http:

‎packages/system/bucket/tests/ingress_wildcard_test.yaml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,13 @@ release:
77
namespace: tenant-root
88

99
# bucket gates its Ingress on an empty _namespace.gateway. In wildcard
10-
# mode the cert-manager + http01 annotations and the tls block are
11-
# dropped; the other nginx annotations stay so the annotations map is
12-
# never empty.
10+
# mode the cert-manager + http01 annotations and the per-host tls
11+
# secretName are dropped (the tls section stays so the HTTPS redirect
12+
# keeps working against the default SSL certificate); the other nginx
13+
# annotations stay so the annotations map is never empty.
1314

1415
tests:
15-
- it: drops cert-manager annotation and tls block when wildcard secret is set
16+
- it: drops cert-manager annotation and tls secretName when wildcard secret is set
1617
set:
1718
_namespace:
1819
host: example.org
@@ -28,12 +29,14 @@ tests:
2829
value: Ingress
2930
- notExists:
3031
path: metadata.annotations["cert-manager.io/cluster-issuer"]
31-
- notExists:
32+
- exists:
3233
path: spec.tls
34+
- notExists:
35+
path: spec.tls[0].secretName
3336
- exists:
3437
path: metadata.annotations["nginx.ingress.kubernetes.io/proxy-body-size"]
3538

36-
- it: keeps cert-manager annotation and tls block without wildcard secret
39+
- it: keeps cert-manager annotation and tls secretName without wildcard secret
3740
set:
3841
_namespace:
3942
host: example.org

‎packages/system/dashboard/templates/ingress.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,10 +43,13 @@ spec:
4343
number: 8000
4444
path: /
4545
pathType: Prefix
46-
{{- if not $wildcardSecret }}
4746
tls:
4847
- hosts:
4948
- dashboard.{{ $host }}
49+
{{- /* Operator wildcard mode: no per-host secret — ingress-nginx falls
50+
back to the default SSL certificate while the tls section keeps
51+
the HTTP-to-HTTPS redirect enforced. */}}
52+
{{- if not $wildcardSecret }}
5053
secretName: dashboard-web-tls
51-
{{- end }}
54+
{{- end }}
5255
{{- end }}

‎packages/system/dashboard/tests/ingress_wildcard_test.yaml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,13 @@ release:
99
# In operator-supplied wildcard mode (_cluster.wildcard-secret-name set)
1010
# the ingress controller serves the wildcard as its default SSL cert, so
1111
# the dashboard Ingress must not request its own cert-manager cert: the
12-
# cert-manager annotation and the tls block are dropped. Without wildcard
13-
# mode the per-host ACME path is unchanged.
12+
# cert-manager annotation and the per-host tls secretName are dropped
13+
# (the tls section stays so the HTTPS redirect keeps working against
14+
# the default SSL certificate). Without wildcard mode the per-host ACME
15+
# path is unchanged.
1416

1517
tests:
16-
- it: drops cert-manager annotation and tls block when wildcard secret is set
18+
- it: drops cert-manager annotation and tls secretName when wildcard secret is set
1719
set:
1820
_cluster:
1921
root-host: example.org
@@ -26,10 +28,12 @@ tests:
2628
value: Ingress
2729
- notExists:
2830
path: metadata.annotations["cert-manager.io/cluster-issuer"]
29-
- notExists:
31+
- exists:
3032
path: spec.tls
33+
- notExists:
34+
path: spec.tls[0].secretName
3135

32-
- it: keeps cert-manager annotation and tls block without wildcard secret
36+
- it: keeps cert-manager annotation and tls secretName without wildcard secret
3337
set:
3438
_cluster:
3539
root-host: example.org

0 commit comments

Comments
 (0)