Skip to content

Add activator-ca and activator-name keys in config-network #608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
knative-prow-robot merged 2 commits into from
Feb 8, 2022
Merged

Add activator-ca and activator-name keys in config-network #608

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9bcb4be
Add `activator-ca` and `activator-name` keys in `config-network`
nak3 Jan 26, 2022
af5ee0c
Rename activator-name to activator-san
nak3 Feb 8, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion config/config-network.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ metadata:
app.kubernetes.io/version: devel
serving.knative.dev/release: devel
annotations:
knative.dev/example-checksum: "6e2033e0"
knative.dev/example-checksum: "ddc3250f"
data:
_example: |
################################
Expand Down Expand Up @@ -172,3 +172,19 @@ data:
# fronting Knative with an external loadbalancer that deals with TLS termination and
# Knative doesn't know about that otherwise.
default-external-scheme: "http"

# The CA public certificate used to sign the activator TLS certificate.
# It is specified by the secret name, which has the "ca.crt" data field.
# Use an empty value to disable the feature (default).
#
# NOTE: This flag is in an alpha state and is mostly here to enable internal testing
# for now. Use with caution.
activator-ca: ""

# The SAN (Subject Alt Name) used to validate the activator TLS certificate.
# It is available only when "activator-ca" is specified.
# Use an empty value to disable the feature (default).
#
# NOTE: This flag is in an alpha state and is mostly here to enable internal testing
# for now. Use with caution.
activator-san: ""
19 changes: 19 additions & 0 deletions pkg/network.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,6 +189,13 @@ const (

// DefaultExternalSchemeKey is the config for defining the scheme of external URLs.
DefaultExternalSchemeKey = "default-external-scheme"

// ActivatorCAKey is the config for the secret name, which stores CA public certificate used
// to sign the activator TLS certificate.
ActivatorCAKey = "activator-ca"

// ActivatorSANKey is the config for the SAN used to validate the activator TLS certificate.
ActivatorSANKey = "activator-san"
)

// DomainTemplateValues are the available properties people can choose from
Expand Down Expand Up @@ -287,6 +294,14 @@ type Config struct {
// DefaultExternalScheme defines the scheme used in external URLs if AutoTLS is
// not enabled. Defaults to "http".
DefaultExternalScheme string

// ActivatorCA defines the secret name of the CA public certificate used to sign the activator TLS certificate.
// The traffic is not encrypted if ActivatorCA is empty.
ActivatorCA string

// ActivatorSAN defines the SAN (Subject Alt Name) used to validate the activator TLS certificate.
// It is used only when ActivatorCA is specified.
ActivatorSAN string
}

// HTTPProtocol indicates a type of HTTP endpoint behavior
Expand Down Expand Up @@ -342,6 +357,8 @@ func defaultConfig() *Config {
AutocreateClusterDomainClaims: false,
DefaultExternalScheme: "http",
MeshCompatibilityMode: MeshCompatibilityModeAuto,
ActivatorCA: "",
ActivatorSAN: "",
}
}

Expand Down Expand Up @@ -373,6 +390,8 @@ func NewConfigFromMap(data map[string]string) (*Config, error) {
cm.AsBool(AutocreateClusterDomainClaimsKey, &nc.AutocreateClusterDomainClaims),
cm.AsBool(EnableMeshPodAddressabilityKey, &nc.EnableMeshPodAddressability),
cm.AsString(DefaultExternalSchemeKey, &nc.DefaultExternalScheme),
cm.AsString(ActivatorCAKey, &nc.ActivatorCA),
cm.AsString(ActivatorSANKey, &nc.ActivatorSAN),
asMode(MeshCompatibilityModeKey, &nc.MeshCompatibilityMode),
asLabelSelector(NamespaceWildcardCertSelectorKey, &nc.NamespaceWildcardCertSelector),
); err != nil {
Expand Down