Add support for mutual TLS (client certificate verification)

[przemeklal]

Enhancement Proposal

It would be great if the charm supported mTLS by allowing to set annotations such as:

• nginx.ingress.kubernetes.io/auth-tls-secret
• nginx.ingress.kubernetes.io/auth-tls-verify-client

and other similar options through juju config. Alternatively, it would be nice to be able to specify additional annotations via a single config option.

[javierdelapuente]

hi @weiiwang01 , can you have a look at this issue? Thanks!

[syncronize-issues-to-jira]

Thank you for reporting your feedback to us!

The internal ticket has been created: https://warthogs.atlassian.net/browse/ISD-4117.

This message was autogenerated

[weiiwang01]

hi @weiiwang01 , can you have a look at this issue? Thanks!

Yes, I think this is a very simple feature to implement. The only uncertainty about this feature concerns the auth-tls-secret.

Should the auth-tls-secret configuration accept a Juju secret or a Kubernetes secret name? Other existing similar configurations, like tls-secret-name, accept a Kubernetes secret name, but those were created long before Juju secrets existed. So I am not sure whether we should follow the tradition in the current configuration options or adopt the new Juju secret.