Skip to content

Commit d652a42

Browse files
Dean-CoakleyDean-Coakley
committed
Add preview policies feature flag
1 parent 1be9ab0 commit d652a42

File tree

14 files changed

+196
-58
lines changed

14 files changed

+196
-58
lines changed

‎cmd/nginx-ingress/main.go

+5-1
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,9 @@ var (
157157
enableCustomResources = flag.Bool("enable-custom-resources", true,
158158
"Enable custom resources")
159159

160+
enablePreviewPolicies = flag.Bool("enable-preview-policies", false,
161+
"Enable preview policies")
162+
160163
enableSnippets = flag.Bool("enable-snippets", false,
161164
"Enable custom NGINX configuration snippets in VirtualServer and VirtualServerRoute resources.")
162165

@@ -227,7 +230,7 @@ func main() {
227230
}
228231

229232
if *enableTLSPassthrough && !*enableCustomResources {
230-
glog.Fatalf("enable-tls-passthrough flag requires -enable-custom-resources")
233+
glog.Fatal("enable-tls-passthrough flag requires -enable-custom-resources")
231234
}
232235

233236
if *appProtect && !*nginxPlus {
@@ -624,6 +627,7 @@ func main() {
624627
ConfigMaps: *nginxConfigMaps,
625628
GlobalConfiguration: *globalConfiguration,
626629
AreCustomResourcesEnabled: *enableCustomResources,
630+
EnablePreviewPolicies: *enablePreviewPolicies,
627631
MetricsCollector: controllerCollector,
628632
GlobalConfigurationValidator: globalConfigurationValidator,
629633
TransportServerValidator: transportServerValidator,

‎deployments/common/crds-v1beta1/k8s.nginx.org_policies.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ spec:
3434
type: object
3535
properties:
3636
accessControl:
37-
description: AccessControl defines an access policy based on the source IP of a request.
37+
description: 'AccessControl defines an access policy based on the source IP of a request. policy status: production-ready'
3838
type: object
3939
properties:
4040
allow:
@@ -46,7 +46,7 @@ spec:
4646
items:
4747
type: string
4848
egressMTLS:
49-
description: EgressMTLS defines an Egress MTLS policy.
49+
description: 'EgressMTLS defines an Egress MTLS policy. policy status: preview'
5050
type: object
5151
properties:
5252
ciphers:
@@ -68,7 +68,7 @@ spec:
6868
verifyServer:
6969
type: boolean
7070
ingressMTLS:
71-
description: IngressMTLS defines an Ingress MTLS policy.
71+
description: 'IngressMTLS defines an Ingress MTLS policy. policy status: preview'
7272
type: object
7373
properties:
7474
clientCertSecret:
@@ -78,7 +78,7 @@ spec:
7878
verifyDepth:
7979
type: integer
8080
jwt:
81-
description: JWTAuth holds JWT authentication configuration.
81+
description: 'JWTAuth holds JWT authentication configuration. policy status: preview'
8282
type: object
8383
properties:
8484
realm:
@@ -88,7 +88,7 @@ spec:
8888
token:
8989
type: string
9090
rateLimit:
91-
description: RateLimit defines a rate limit policy.
91+
description: 'RateLimit defines a rate limit policy. policy status: preview'
9292
type: object
9393
properties:
9494
burst:

‎deployments/common/crds/k8s.nginx.org_policies.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ spec:
3535
type: object
3636
properties:
3737
accessControl:
38-
description: AccessControl defines an access policy based on the source IP of a request.
38+
description: 'AccessControl defines an access policy based on the source IP of a request. policy status: production-ready'
3939
type: object
4040
properties:
4141
allow:
@@ -47,7 +47,7 @@ spec:
4747
items:
4848
type: string
4949
egressMTLS:
50-
description: EgressMTLS defines an Egress MTLS policy.
50+
description: 'EgressMTLS defines an Egress MTLS policy. policy status: preview'
5151
type: object
5252
properties:
5353
ciphers:
@@ -69,7 +69,7 @@ spec:
6969
verifyServer:
7070
type: boolean
7171
ingressMTLS:
72-
description: IngressMTLS defines an Ingress MTLS policy.
72+
description: 'IngressMTLS defines an Ingress MTLS policy. policy status: preview'
7373
type: object
7474
properties:
7575
clientCertSecret:
@@ -79,7 +79,7 @@ spec:
7979
verifyDepth:
8080
type: integer
8181
jwt:
82-
description: JWTAuth holds JWT authentication configuration.
82+
description: 'JWTAuth holds JWT authentication configuration. policy status: preview'
8383
type: object
8484
properties:
8585
realm:
@@ -89,7 +89,7 @@ spec:
8989
token:
9090
type: string
9191
rateLimit:
92-
description: RateLimit defines a rate limit policy.
92+
description: 'RateLimit defines a rate limit policy. policy status: preview'
9393
type: object
9494
properties:
9595
burst:

‎deployments/helm-chart/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,7 @@ Parameter | Description | Default
170170
`controller.setAsDefaultIngress` | New Ingresses without an `"ingressClassName"` field specified will be assigned the class specified in `controller.ingressClass`. Only for kubernetes versions >= 1.18. | false
171171
`controller.watchNamespace` | Namespace to watch for Ingress resources. By default the Ingress controller watches all namespaces. | ""
172172
`controller.enableCustomResources` | Enable the custom resources. | true
173+
`controller.enablePreviewPolicies` | Enable preview policies. | false
173174
`controller.enableTLSPassthrough` | Enable TLS Passthrough on port 443. Requires `controller.enableCustomResources`. | false
174175
`controller.globalConfiguration.create` | Creates the GlobalConfiguration custom resource. Requires `controller.enableCustomResources`. | false
175176
`controller.globalConfiguration.spec` | The spec of the GlobalConfiguration for defining the global configuration parameters of the Ingress Controller. | {}

‎deployments/helm-chart/crds/k8s.nginx.org_policies.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ spec:
3434
type: object
3535
properties:
3636
accessControl:
37-
description: AccessControl defines an access policy based on the source IP of a request.
37+
description: 'AccessControl defines an access policy based on the source IP of a request. policy status: production-ready'
3838
type: object
3939
properties:
4040
allow:
@@ -46,7 +46,7 @@ spec:
4646
items:
4747
type: string
4848
egressMTLS:
49-
description: EgressMTLS defines an Egress MTLS policy.
49+
description: 'EgressMTLS defines an Egress MTLS policy. policy status: preview'
5050
type: object
5151
properties:
5252
ciphers:
@@ -68,7 +68,7 @@ spec:
6868
verifyServer:
6969
type: boolean
7070
ingressMTLS:
71-
description: IngressMTLS defines an Ingress MTLS policy.
71+
description: 'IngressMTLS defines an Ingress MTLS policy. policy status: preview'
7272
type: object
7373
properties:
7474
clientCertSecret:
@@ -78,7 +78,7 @@ spec:
7878
verifyDepth:
7979
type: integer
8080
jwt:
81-
description: JWTAuth holds JWT authentication configuration.
81+
description: 'JWTAuth holds JWT authentication configuration. policy status: preview'
8282
type: object
8383
properties:
8484
realm:
@@ -88,7 +88,7 @@ spec:
8888
token:
8989
type: string
9090
rateLimit:
91-
description: RateLimit defines a rate limit policy.
91+
description: 'RateLimit defines a rate limit policy. policy status: preview'
9292
type: object
9393
properties:
9494
burst:

‎deployments/helm-chart/templates/controller-deployment.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,7 @@ spec:
144144
{{- if .Values.controller.enableCustomResources }}
145145
- -enable-tls-passthrough={{ .Values.controller.enableTLSPassthrough }}
146146
- -enable-snippets={{ .Values.controller.enableSnippets }}
147+
- -enable-preview-policies={{ .Values.controller.enablePreviewPolicies }}
147148
{{- if .Values.controller.globalConfiguration.create }}
148149
- -global-configuration=$(POD_NAMESPACE)/{{ include "nginx-ingress.name" . }}
149150
{{- end }}

‎deployments/helm-chart/values.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,9 @@ controller:
146146
## Enable the custom resources.
147147
enableCustomResources: true
148148

149+
## Enable preview policies.
150+
enablePreviewPolicies: false
151+
149152
## Enable TLS Passthrough on port 443. Requires controller.enableCustomResources.
150153
enableTLSPassthrough: false
151154

‎docs-web/configuration/global-configuration/command-line-arguments.md

+4
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ Below we describe the available command-line arguments:
3333
3434
Enables custom resources. (default true)
3535
36+
.. option:: -enable-preview-policies
37+
38+
Enables preview policies. (default false)
39+
3640
.. option:: -enable-leader-election
3741
3842
Enables Leader election to avoid multiple replicas of the controller reporting the status of Ingress, VirtualServer and VirtualServerRoute resources -- only one replica will report status. (default true)

‎docs-web/configuration/policy-resource.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ policies:
138138

139139
### RateLimit
140140

141-
> **Feature Status**: Rate-Limiting is available as a preview feature: it is suitable for experimenting and testing; however, it must be used with caution in production environments. Additionally, while the feature is in preview status, we might introduce some backward-incompatible changes to the resource specification in the next releases.
141+
> **Feature Status**: Rate-Limiting is available as a preview feature: it is suitable for experimenting and testing; however, it must be used with caution in production environments. Additionally, while the feature is in preview status, we might introduce some backward-incompatible changes to the resource specification in the next releases. The feature is disabled by default. To enable it, set the [enable-preview-policies](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/#cmdoption-enable-preview-policies) command-line argument of the Ingress Controller.
142142

143143
The rate limit policy configures NGINX to limit the processing rate of requests.
144144

@@ -212,7 +212,7 @@ When you reference more than one rate limit policy, the Ingress Controller will
212212

213213
### JWT
214214

215-
> **Feature Status**: JWT is available as a preview feature: it is suitable for experimenting and testing; however, it must be used with caution in production environments. Additionally, while the feature is in preview status, we might introduce some backward-incompatible changes to the resource specification in the next releases.
215+
> **Feature Status**: JWT is available as a preview feature: it is suitable for experimenting and testing; however, it must be used with caution in production environments. Additionally, while the feature is in preview status, we might introduce some backward-incompatible changes to the resource specification in the next releases. The feature is disabled by default. To enable it, set the [enable-preview-policies](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/#cmdoption-enable-preview-policies) command-line argument of the Ingress Controller.
216216

217217
> Note: This feature is only available in NGINX Plus.
218218

@@ -279,7 +279,7 @@ In this example the Ingress Controller will use the configuration from the first
279279

280280
### IngressMTLS
281281

282-
> **Feature Status**: IngressMTLS is available as a preview feature: it is suitable for experimenting and testing; however, it must be used with caution in production environments. Additionally, while the feature is in preview status, we might introduce some backward-incompatible changes to the resource specification in the next releases.
282+
> **Feature Status**: IngressMTLS is available as a preview feature: it is suitable for experimenting and testing; however, it must be used with caution in production environments. Additionally, while the feature is in preview status, we might introduce some backward-incompatible changes to the resource specification in the next releases. The feature is disabled by default. To enable it, set the [enable-preview-policies](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/#cmdoption-enable-preview-policies) command-line argument of the Ingress Controller.
283283

284284
The IngressMTLS policy configures client certificate verification.
285285

@@ -347,7 +347,7 @@ In this example the Ingress Controller will use the configuration from the first
347347

348348
### EgressMTLS
349349

350-
> **Feature Status**: EgressMTLS is available as a preview feature: it is suitable for experimenting and testing; however, it must be used with caution in production environments. Additionally, while the feature is in preview status, we might introduce some backward-incompatible changes to the resource specification in the next releases.
350+
> **Feature Status**: EgressMTLS is available as a preview feature: it is suitable for experimenting and testing; however, it must be used with caution in production environments. Additionally, while the feature is in preview status, we might introduce some backward-incompatible changes to the resource specification in the next releases. The feature is disabled by default. To enable it, set the [enable-preview-policies](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/#cmdoption-enable-preview-policies) command-line argument of the Ingress Controller.
351351

352352
The EgressMTLS policy configures upstreams authentication and certificate verification.
353353

‎docs-web/installation/installation-with-helm.md

+3
Original file line numberDiff line numberDiff line change
@@ -238,6 +238,9 @@ The following tables lists the configurable parameters of the NGINX Ingress cont
238238
* - ``controller.enableCustomResources``
239239
- Enable the custom resources.
240240
- true
241+
* - ``controller.enablePreviewPolicies``
242+
- Enable preview policies.
243+
- false
241244
* - ``controller.enableTLSPassthrough``
242245
- Enable TLS Passthrough on port 443. Requires ``controller.enableCustomResources``.
243246
- false

‎internal/k8s/controller.go

+6-3
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,7 @@ type LoadBalancerController struct {
171171
controllerNamespace string
172172
wildcardTLSSecret string
173173
areCustomResourcesEnabled bool
174+
enablePreviewPolicies bool
174175
metricsCollector collectors.ControllerCollector
175176
globalConfigurationValidator *validation.GlobalConfigurationValidator
176177
transportServerValidator *validation.TransportServerValidator
@@ -210,6 +211,7 @@ type NewLoadBalancerControllerInput struct {
210211
ConfigMaps string
211212
GlobalConfiguration string
212213
AreCustomResourcesEnabled bool
214+
EnablePreviewPolicies bool
213215
MetricsCollector collectors.ControllerCollector
214216
GlobalConfigurationValidator *validation.GlobalConfigurationValidator
215217
TransportServerValidator *validation.TransportServerValidator
@@ -240,6 +242,7 @@ func NewLoadBalancerController(input NewLoadBalancerControllerInput) *LoadBalanc
240242
controllerNamespace: input.ControllerNamespace,
241243
wildcardTLSSecret: input.WildcardTLSSecret,
242244
areCustomResourcesEnabled: input.AreCustomResourcesEnabled,
245+
enablePreviewPolicies: input.EnablePreviewPolicies,
243246
metricsCollector: input.MetricsCollector,
244247
globalConfigurationValidator: input.GlobalConfigurationValidator,
245248
transportServerValidator: input.TransportServerValidator,
@@ -843,7 +846,7 @@ func (lbc *LoadBalancerController) syncPolicy(task task) {
843846

844847
if polExists {
845848
pol := obj.(*conf_v1.Policy)
846-
err := validation.ValidatePolicy(pol, lbc.isNginxPlus)
849+
err := validation.ValidatePolicy(pol, lbc.isNginxPlus, lbc.enablePreviewPolicies)
847850
if err != nil {
848851
lbc.recorder.Eventf(pol, api_v1.EventTypeWarning, "Rejected", "Policy %v is invalid and was rejected: %v", key, err)
849852
} else {
@@ -2326,7 +2329,7 @@ func (lbc *LoadBalancerController) getAllPolicies() []*conf_v1.Policy {
23262329
for _, obj := range lbc.policyLister.List() {
23272330
pol := obj.(*conf_v1.Policy)
23282331

2329-
err := validation.ValidatePolicy(pol, lbc.isNginxPlus)
2332+
err := validation.ValidatePolicy(pol, lbc.isNginxPlus, lbc.enablePreviewPolicies)
23302333
if err != nil {
23312334
glog.V(3).Infof("Skipping invalid Policy %s/%s: %v", pol.Namespace, pol.Name, err)
23322335
continue
@@ -2363,7 +2366,7 @@ func (lbc *LoadBalancerController) getPolicies(policies []conf_v1.PolicyReferenc
23632366

23642367
policy := policyObj.(*conf_v1.Policy)
23652368

2366-
err = validation.ValidatePolicy(policy, lbc.isNginxPlus)
2369+
err = validation.ValidatePolicy(policy, lbc.isNginxPlus, lbc.enablePreviewPolicies)
23672370
if err != nil {
23682371
errors = append(errors, fmt.Errorf("Policy %s is invalid: %v", policyKey, err))
23692372
continue

‎pkg/apis/configuration/v1/types.go

+5
Original file line numberDiff line numberDiff line change
@@ -349,12 +349,14 @@ type PolicyList struct {
349349
}
350350

351351
// AccessControl defines an access policy based on the source IP of a request.
352+
// policy status: production-ready
352353
type AccessControl struct {
353354
Allow []string `json:"allow"`
354355
Deny []string `json:"deny"`
355356
}
356357

357358
// RateLimit defines a rate limit policy.
359+
// policy status: preview
358360
type RateLimit struct {
359361
Rate string `json:"rate"`
360362
Key string `json:"key"`
@@ -368,20 +370,23 @@ type RateLimit struct {
368370
}
369371

370372
// JWTAuth holds JWT authentication configuration.
373+
// policy status: preview
371374
type JWTAuth struct {
372375
Realm string `json:"realm"`
373376
Secret string `json:"secret"`
374377
Token string `json:"token"`
375378
}
376379

377380
// IngressMTLS defines an Ingress MTLS policy.
381+
// policy status: preview
378382
type IngressMTLS struct {
379383
ClientCertSecret string `json:"clientCertSecret"`
380384
VerifyClient string `json:"verifyClient"`
381385
VerifyDepth *int `json:"verifyDepth"`
382386
}
383387

384388
// EgressMTLS defines an Egress MTLS policy.
389+
// policy status: preview
385390
type EgressMTLS struct {
386391
TLSSecret string `json:"tlsSecret"`
387392
VerifyServer bool `json:"verifyServer"`

‎pkg/apis/configuration/validation/policy.go

+19-3
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,12 @@ import (
1313
)
1414

1515
// ValidatePolicy validates a Policy.
16-
func ValidatePolicy(policy *v1.Policy, isPlus bool) error {
17-
allErrs := validatePolicySpec(&policy.Spec, field.NewPath("spec"), isPlus)
16+
func ValidatePolicy(policy *v1.Policy, isPlus bool, enablePreviewPolicies bool) error {
17+
allErrs := validatePolicySpec(&policy.Spec, field.NewPath("spec"), isPlus, enablePreviewPolicies)
1818
return allErrs.ToAggregate()
1919
}
2020

21-
func validatePolicySpec(spec *v1.PolicySpec, fieldPath *field.Path, isPlus bool) field.ErrorList {
21+
func validatePolicySpec(spec *v1.PolicySpec, fieldPath *field.Path, isPlus bool, enablePreviewPolicies bool) field.ErrorList {
2222
allErrs := field.ErrorList{}
2323

2424
fieldCount := 0
@@ -29,11 +29,19 @@ func validatePolicySpec(spec *v1.PolicySpec, fieldPath *field.Path, isPlus bool)
2929
}
3030

3131
if spec.RateLimit != nil {
32+
if !enablePreviewPolicies {
33+
return append(allErrs, field.Forbidden(fieldPath.Child("rateLimit"),
34+
"rateLimit is a preview policy. Preview policies must be enabled to use via cli argument -enable-preview-policies"))
35+
}
3236
allErrs = append(allErrs, validateRateLimit(spec.RateLimit, fieldPath.Child("rateLimit"), isPlus)...)
3337
fieldCount++
3438
}
3539

3640
if spec.JWTAuth != nil {
41+
if !enablePreviewPolicies {
42+
allErrs = append(allErrs, field.Forbidden(fieldPath.Child("jwt"),
43+
"jwt is a preview policy. Preview policies must be enabled to use via cli argument -enable-preview-policies"))
44+
}
3745
if !isPlus {
3846
return append(allErrs, field.Forbidden(fieldPath.Child("jwt"), "jwt secrets are only supported in NGINX Plus"))
3947
}
@@ -43,11 +51,19 @@ func validatePolicySpec(spec *v1.PolicySpec, fieldPath *field.Path, isPlus bool)
4351
}
4452

4553
if spec.IngressMTLS != nil {
54+
if !enablePreviewPolicies {
55+
return append(allErrs, field.Forbidden(fieldPath.Child("ingressMTLS"),
56+
"ingressMTLS is a preview policy. Preview policies must be enabled to use via cli argument -enable-preview-policies"))
57+
}
4658
allErrs = append(allErrs, validateIngressMTLS(spec.IngressMTLS, fieldPath.Child("ingressMTLS"))...)
4759
fieldCount++
4860
}
4961

5062
if spec.EgressMTLS != nil {
63+
if !enablePreviewPolicies {
64+
return append(allErrs, field.Forbidden(fieldPath.Child("egressMTLS"),
65+
"egressMTLS is a preview policy. Preview policies must be enabled to use via cli argument -enable-preview-policies"))
66+
}
5167
allErrs = append(allErrs, validateEgressMTLS(spec.EgressMTLS, fieldPath.Child("egressMTLS"))...)
5268
fieldCount++
5369
}

0 commit comments

Comments
 (0)