Skip to content

Commit 8f676d9

Browse files
sjbermansjberman
committed
Code review; watch for secret updates
1 parent 6ac55e0 commit 8f676d9

File tree

34 files changed

+706
-285
lines changed

34 files changed

+706
-285
lines changed

‎charts/nginx-gateway-fabric/README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -268,10 +268,10 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
268268
| `nginx.image.tag` | | string | `"edge"` |
269269
| `nginx.lifecycle` | The lifecycle of the nginx container. | object | `{}` |
270270
| `nginx.plus` | Is NGINX Plus image being used | bool | `false` |
271-
| `nginx.usage.caSecretName` | The name of the Secret containing the CA cert for verifying the NGINX Plus usage reporting server. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `""` |
272-
| `nginx.usage.clientSSLSecretName` | The name of the Secret containing the client cert/key for communicating with the NGINX Plus usage reporting server. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `""` |
271+
| `nginx.usage.caSecretName` | The name of the Secret containing the CA certificate for verifying the NGINX Plus usage reporting server. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `""` |
272+
| `nginx.usage.clientSSLSecretName` | The name of the Secret containing the client certificate/key for communicating with the NGINX Plus usage reporting server. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `""` |
273273
| `nginx.usage.endpoint` | The endpoint of the NGINX Plus usage reporting server. Default: product.connect.nginx.com | string | `""` |
274-
| `nginx.usage.resolver` | The resolver domain name or IP address with optional port for resolving the endpoint. | string | `""` |
274+
| `nginx.usage.resolver` | The nameserver used to resolve the NGINX Plus usage reporting endpoint. Used with NGINX Instance Manager. | string | `""` |
275275
| `nginx.usage.secretName` | The name of the Secret containing the JWT for NGINX Plus usage reporting. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `"nplus-license"` |
276276
| `nginx.usage.skipVerify` | Disable client verification of the NGINX Plus usage reporting server certificate. | bool | `false` |
277277
| `nginxGateway.config.logging.level` | Log level. | string | `"info"` |

‎charts/nginx-gateway-fabric/templates/configmap.yaml

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,18 @@ data:
1515
{{- if .Values.nginx.plus }}
1616
mgmt.conf: |
1717
mgmt {
18-
license_token /etc/nginx/license/license.jwt;
1918
{{- if .Values.nginx.usage.endpoint }}
2019
usage_report endpoint={{ .Values.nginx.usage.endpoint }};
2120
{{- end }}
2221
{{- if .Values.nginx.usage.skipVerify }}
2322
ssl_verify off;
2423
{{- end }}
2524
{{- if .Values.nginx.usage.caSecretName }}
26-
ssl_trusted_certificate /etc/nginx/usage-certs/ca/ca.crt;
25+
ssl_trusted_certificate /etc/nginx/certs-bootstrap/ca.crt;
2726
{{- end }}
2827
{{- if .Values.nginx.usage.clientSSLSecretName }}
29-
ssl_certificate /etc/nginx/usage-certs/client/tls.crt;
30-
ssl_certificate_key /etc/nginx/usage-certs/client/tls.key;
28+
ssl_certificate /etc/nginx/certs-bootstrap/tls.crt;
29+
ssl_certificate_key /etc/nginx/certs-bootstrap/tls.key;
3130
{{- end }}
3231
enforce_initial_report off;
3332
}

‎charts/nginx-gateway-fabric/templates/deployment.yaml

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -229,15 +229,12 @@ spec:
229229
{{- if .Values.nginx.plus }}
230230
{{- if .Values.nginx.usage.secretName }}
231231
- name: nginx-plus-license
232-
mountPath: /etc/nginx/license
232+
mountPath: /etc/nginx/license.jwt
233+
subPath: license.jwt
233234
{{- end }}
234-
{{- if .Values.nginx.usage.clientSSLSecretName }}
235-
- name: usage-client-ssl-secret
236-
mountPath: /etc/nginx/usage-certs/client
237-
{{- end }}
238-
{{- if .Values.nginx.usage.caSecretName }}
239-
- name: usage-ca-secret
240-
mountPath: /etc/nginx/usage-certs/ca
235+
{{- if or .Values.nginx.usage.caSecretName .Values.nginx.usage.clientSSLSecretName }}
236+
- name: nginx-plus-usage-certs
237+
mountPath: /etc/nginx/certs-bootstrap/
241238
{{- end }}
242239
{{- end }}
243240
{{- with .Values.nginx.extraVolumeMounts -}}
@@ -294,15 +291,18 @@ spec:
294291
secret:
295292
secretName: {{ .Values.nginx.usage.secretName }}
296293
{{- end }}
297-
{{- if .Values.nginx.usage.clientSSLSecretName }}
298-
- name: usage-client-ssl-secret
299-
secret:
300-
secretName: {{ .Values.nginx.usage.clientSSLSecretName }}
301-
{{- end }}
302-
{{- if .Values.nginx.usage.caSecretName }}
303-
- name: usage-ca-secret
304-
secret:
305-
secretName: {{ .Values.nginx.usage.caSecretName }}
294+
{{- if or .Values.nginx.usage.caSecretName .Values.nginx.usage.clientSSLSecretName }}
295+
- name: nginx-plus-usage-certs
296+
projected:
297+
sources:
298+
{{- if .Values.nginx.usage.caSecretName }}
299+
- secret:
300+
name: {{ .Values.nginx.usage.caSecretName }}
301+
{{- end }}
302+
{{- if .Values.nginx.usage.clientSSLSecretName }}
303+
- secret:
304+
name: {{ .Values.nginx.usage.clientSSLSecretName }}
305+
{{- end }}
306306
{{- end }}
307307
{{- end }}
308308
{{- with .Values.extraVolumes -}}

‎charts/nginx-gateway-fabric/templates/scc.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ volumes:
3333
- emptyDir
3434
- secret
3535
- configMap
36+
- projected
3637
users:
3738
- {{ printf "system:serviceaccount:%s:%s" .Release.Namespace (include "nginx-gateway.serviceAccountName" .) }}
3839
allowedCapabilities:

‎charts/nginx-gateway-fabric/values.schema.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -264,14 +264,14 @@
264264
"properties": {
265265
"caSecretName": {
266266
"default": "",
267-
"description": "The name of the Secret containing the CA cert for verifying the NGINX Plus usage reporting\nserver. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway).",
267+
"description": "The name of the Secret containing the CA certificate for verifying the NGINX Plus usage reporting\nserver. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway).",
268268
"required": [],
269269
"title": "caSecretName",
270270
"type": "string"
271271
},
272272
"clientSSLSecretName": {
273273
"default": "",
274-
"description": "The name of the Secret containing the client cert/key for communicating with the NGINX Plus usage reporting\nserver. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway).",
274+
"description": "The name of the Secret containing the client certificate/key for communicating with the NGINX Plus usage reporting\nserver. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway).",
275275
"required": [],
276276
"title": "clientSSLSecretName",
277277
"type": "string"
@@ -285,7 +285,7 @@
285285
},
286286
"resolver": {
287287
"default": "",
288-
"description": "The resolver domain name or IP address with optional port for resolving the endpoint.",
288+
"description": "The nameserver used to resolve the NGINX Plus usage reporting endpoint. Used with NGINX Instance Manager.",
289289
"required": [],
290290
"title": "resolver",
291291
"type": "string"

‎charts/nginx-gateway-fabric/values.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -143,17 +143,17 @@ nginx:
143143
# -- The endpoint of the NGINX Plus usage reporting server. Default: product.connect.nginx.com
144144
endpoint: ""
145145

146-
# -- The resolver domain name or IP address with optional port for resolving the endpoint.
146+
# -- The nameserver used to resolve the NGINX Plus usage reporting endpoint. Used with NGINX Instance Manager.
147147
resolver: ""
148148

149149
# -- Disable client verification of the NGINX Plus usage reporting server certificate.
150150
skipVerify: false
151151

152-
# -- The name of the Secret containing the CA cert for verifying the NGINX Plus usage reporting
152+
# -- The name of the Secret containing the CA certificate for verifying the NGINX Plus usage reporting
153153
# server. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway).
154154
caSecretName: ""
155155

156-
# -- The name of the Secret containing the client cert/key for communicating with the NGINX Plus usage reporting
156+
# -- The name of the Secret containing the client certificate/key for communicating with the NGINX Plus usage reporting
157157
# server. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway).
158158
clientSSLSecretName: ""
159159

‎cmd/gateway/commands.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -392,6 +392,8 @@ func createStaticModeCommand() *cobra.Command {
392392
"that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway).",
393393
)
394394

395+
cmd.MarkFlagsRequiredTogether(plusFlag, usageReportSecretFlag)
396+
395397
cmd.Flags().Var(
396398
&usageReportEndpoint,
397399
usageReportEndpointFlag,
@@ -401,7 +403,7 @@ func createStaticModeCommand() *cobra.Command {
401403
cmd.Flags().Var(
402404
&usageReportResolver,
403405
usageReportResolverFlag,
404-
"The nameserver used to resolve the NGINX Plus usage reporting server name.",
406+
"The nameserver used to resolve the NGINX Plus usage reporting endpoint. Used with NGINX Instance Manager.",
405407
)
406408

407409
cmd.Flags().BoolVar(

‎cmd/gateway/commands_test.go

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,7 @@ func TestStaticModeCmdFlagValidation(t *testing.T) {
153153
"--nginx-plus",
154154
"--usage-report-secret=my-secret",
155155
"--usage-report-endpoint=example.com",
156+
"--usage-report-resolver=resolver.com",
156157
"--usage-report-ca-secret=ca-secret",
157158
"--usage-report-client-ssl-secret=client-secret",
158159
"--snippets-filters",
@@ -344,6 +345,23 @@ func TestStaticModeCmdFlagValidation(t *testing.T) {
344345
expectedErrPrefix: `invalid argument "$*(invalid)" for "--usage-report-endpoint" flag: ` +
345346
`"$*(invalid)" must be a domain name or IP address with optional port`,
346347
},
348+
{
349+
name: "usage-report-resolver is set to empty string",
350+
args: []string{
351+
"--usage-report-resolver=",
352+
},
353+
wantErr: true,
354+
expectedErrPrefix: `invalid argument "" for "--usage-report-resolver" flag: must be set`,
355+
},
356+
{
357+
name: "usage-report-resolveris an invalid endpoint",
358+
args: []string{
359+
"--usage-report-resolver=$*(invalid)",
360+
},
361+
wantErr: true,
362+
expectedErrPrefix: `invalid argument "$*(invalid)" for "--usage-report-resolver" flag: ` +
363+
`"$*(invalid)" must be a domain name or IP address with optional port`,
364+
},
347365
{
348366
name: "usage-report-ca-secret is set to empty string",
349367
args: []string{

‎deploy/experimental-nginx-plus/deploy.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,6 @@ data:
161161
error_log stderr info;
162162
mgmt.conf: |
163163
mgmt {
164-
license_token /etc/nginx/license/license.jwt;
165164
enforce_initial_report off;
166165
}
167166
kind: ConfigMap
@@ -323,8 +322,9 @@ spec:
323322
name: nginx-lib
324323
- mountPath: /etc/nginx/includes
325324
name: nginx-includes
326-
- mountPath: /etc/nginx/license
325+
- mountPath: /etc/nginx/license.jwt
327326
name: nginx-plus-license
327+
subPath: license.jwt
328328
initContainers:
329329
- command:
330330
- /usr/bin/gateway

‎deploy/nginx-plus/deploy.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,6 @@ data:
156156
error_log stderr info;
157157
mgmt.conf: |
158158
mgmt {
159-
license_token /etc/nginx/license/license.jwt;
160159
enforce_initial_report off;
161160
}
162161
kind: ConfigMap
@@ -317,8 +316,9 @@ spec:
317316
name: nginx-lib
318317
- mountPath: /etc/nginx/includes
319318
name: nginx-includes
320-
- mountPath: /etc/nginx/license
319+
- mountPath: /etc/nginx/license.jwt
321320
name: nginx-plus-license
321+
subPath: license.jwt
322322
initContainers:
323323
- command:
324324
- /usr/bin/gateway

0 commit comments

Comments
 (0)