From 53a7d2f2c42e895f60f7705a85f08a68bbb5b933 Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Thu, 20 Feb 2025 15:16:49 +0100 Subject: [PATCH] istio: allow to change tls cipher suites and headers Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> --- charts/shuffle/README.md | 5 +++++ charts/shuffle/templates/istio/gateway.yaml | 3 +++ .../shuffle/templates/istio/virtual-service.yaml | 12 ++++++++++-- charts/shuffle/values.schema.json | 16 ++++++++++++++++ charts/shuffle/values.yaml | 12 ++++++++++++ 5 files changed, 46 insertions(+), 2 deletions(-) diff --git a/charts/shuffle/README.md b/charts/shuffle/README.md index 7241c640..27d7aeba 100644 --- a/charts/shuffle/README.md +++ b/charts/shuffle/README.md @@ -539,8 +539,11 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `istio.gateway.http.httpsRedirect` | If set to true, a 301 redirect is send for all HTTP connections | `false` | | `istio.gateway.https.enabled` | Enable HTTPS server on port 443 | `false` | | `istio.gateway.https.tlsCredentialName` | The name of the secret that holds the TLS certs including the CA certificates. | `""` | +| `istio.gateway.https.tlsCipherSuites` | If specified, only support the specified cipher list. | `[]` | | `istio.gateway.extraServers` | Additional servers for the Gateway resource | `[]` | | `istio.virtualService.annotations` | Additional annotations for the VirtualService resource. | `{}` | +| `istio.virtualService.backendHeaders` | Header manipulation rules for backend traffic | `{}` | +| `istio.virtualService.frontendHeaders` | Header manipulation rules for frontend traffic | `{}` | ### Persistence Parameters @@ -596,3 +599,5 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `vault.secrets` | A list of VaultSecrets to create | `[]` | ### Other Parameters + + diff --git a/charts/shuffle/templates/istio/gateway.yaml b/charts/shuffle/templates/istio/gateway.yaml index fe80084f..f30a5ecb 100644 --- a/charts/shuffle/templates/istio/gateway.yaml +++ b/charts/shuffle/templates/istio/gateway.yaml @@ -32,6 +32,9 @@ spec: tls: credentialName: {{ .Values.istio.gateway.https.tlsCredentialName }} mode: SIMPLE + {{- with .Values.istio.gateway.https.tlsCipherSuites }} + cipherSuites: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 10 }} + {{- end }} {{- end }} {{- if .Values.istio.gateway.extraServers }} {{- include "common.tplvalues.render" (dict "value" .Values.istio.gateway.extraServers "context" $) | nindent 4 }} diff --git a/charts/shuffle/templates/istio/virtual-service.yaml b/charts/shuffle/templates/istio/virtual-service.yaml index 902a1583..aae37e77 100644 --- a/charts/shuffle/templates/istio/virtual-service.yaml +++ b/charts/shuffle/templates/istio/virtual-service.yaml @@ -14,7 +14,8 @@ spec: gateways: - {{ include "common.names.fullname" . }} http: - - match: + - name: backend + match: - uri: prefix: /api route: @@ -22,9 +23,16 @@ spec: host: {{ include "shuffle.backend.name" . }} port: number: {{ .Values.backend.containerPorts.http }} - - route: + {{- with .Values.istio.virtualService.backendHeaders }} + headers: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 8 }} + {{- end }} + - name: frontend + route: - destination: host: {{ include "shuffle.frontend.name" . }} port: number: {{ .Values.frontend.containerPorts.http }} + {{- with .Values.istio.virtualService.frontendHeaders }} + headers: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 8 }} + {{- end }} {{- end }} diff --git a/charts/shuffle/values.schema.json b/charts/shuffle/values.schema.json index d70c16cb..d5ad8fe9 100644 --- a/charts/shuffle/values.schema.json +++ b/charts/shuffle/values.schema.json @@ -2366,6 +2366,12 @@ "type": "string", "description": "The name of the secret that holds the TLS certs including the CA certificates.", "default": "" + }, + "tlsCipherSuites": { + "type": "array", + "description": "If specified, only support the specified cipher list.", + "default": [], + "items": {} } } }, @@ -2384,6 +2390,16 @@ "type": "object", "description": "Additional annotations for the VirtualService resource.", "default": {} + }, + "backendHeaders": { + "type": "object", + "description": "Header manipulation rules for backend traffic", + "default": {} + }, + "frontendHeaders": { + "type": "object", + "description": "Header manipulation rules for frontend traffic", + "default": {} } } } diff --git a/charts/shuffle/values.yaml b/charts/shuffle/values.yaml index b9d47913..91103002 100644 --- a/charts/shuffle/values.yaml +++ b/charts/shuffle/values.yaml @@ -1632,18 +1632,30 @@ istio: httpsRedirect: false ## @param istio.gateway.https.enabled Enable HTTPS server on port 443 ## @param istio.gateway.https.tlsCredentialName The name of the secret that holds the TLS certs including the CA certificates. + ## @param istio.gateway.https.tlsCipherSuites If specified, only support the specified cipher list. ## NOTE: The secret must exist in the namespace of the istio gateway pod + ## https: enabled: false tlsCredentialName: "" + tlsCipherSuites: [] ## @param istio.gateway.extraServers Additional servers for the Gateway resource ## ref: https://istio.io/latest/docs/reference/config/networking/gateway/#Server + ## extraServers: [] virtualService: ## @param istio.virtualService.annotations Additional annotations for the VirtualService resource. ## annotations: {} + ## @param istio.virtualService.backendHeaders Header manipulation rules for backend traffic + ## ref: https://istio.io/latest/docs/reference/config/networking/virtual-service/#Headers + ## + backendHeaders: {} + ## @param istio.virtualService.frontendHeaders Header manipulation rules for frontend traffic + ## ref: https://istio.io/latest/docs/reference/config/networking/virtual-service/#Headers + ## + frontendHeaders: {} ## @section Persistence Parameters ##