@@ -25,6 +25,7 @@ import (
2525 "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
2626 "k8s.io/apimachinery/pkg/runtime"
2727 "k8s.io/apimachinery/pkg/runtime/schema"
28+ "k8s.io/apimachinery/pkg/types"
2829 "k8s.io/apimachinery/pkg/util/yaml"
2930 "k8s.io/utils/ptr"
3031 "sigs.k8s.io/controller-runtime/pkg/client"
@@ -53,6 +54,11 @@ type Deployer struct {
5354type ControlPlaneInfo struct {
5455 XdsHost string
5556 XdsPort int32
57+ // The data in this struct is static, so is a good place to keep track of if mtls is enabled
58+ // and a bad place to store the actual mtls secret data
59+ GlooMtlsEnabled bool
60+ // We could lookup the pod namespace from the env, but it's cleaner to pass it in
61+ Namespace string
5662}
5763
5864type AwsInfo struct {
@@ -103,17 +109,21 @@ func (d *Deployer) GetGvksToWatch(ctx context.Context) ([]schema.GroupVersionKin
103109 // as we only care about the GVKs of the rendered resources)
104110 // - the minimal values that render all the proxy resources (HPA is not included because it's not
105111 // fully integrated/working at the moment)
112+ // - a flag to indicate whether mtls is enabled, so we can render the secret if needed
106113 //
107114 // Note: another option is to hardcode the GVKs here, but rendering the helm chart is a
108115 // _slightly_ more dynamic way of getting the GVKs. It isn't a perfect solution since if
109116 // we add more resources to the helm chart that are gated by a flag, we may forget to
110117 // update the values here to enable them.
118+ // Currently the only resource that is gated by a flag is the mtls secret.
119+
111120 emptyGw := & api.Gateway {
112121 ObjectMeta : metav1.ObjectMeta {
113122 Name : "default" ,
114123 Namespace : "default" ,
115124 },
116125 }
126+
117127 // TODO(Law): these must be set explicitly as we don't have defaults for them
118128 // and the internal template isn't robust enough.
119129 // This should be empty eventually -- the template must be resilient against nil-pointers
@@ -124,13 +134,20 @@ func (d *Deployer) GetGvksToWatch(ctx context.Context) ([]schema.GroupVersionKin
124134 "enabled" : false ,
125135 },
126136 "image" : map [string ]any {},
137+ // Render the secret based on the mtls flag so we can watch it.
138+ // This is an exception to the "TODO" above as this is not protection against nil-pointers,
139+ // it is determining which resources to render based on ControlPlane configuration.
140+ "glooMtls" : map [string ]any {
141+ "renderSecret" : d .inputs .ControlPlane .GlooMtlsEnabled ,
142+ },
127143 },
128144 }
129145
130146 objs , err := d .renderChartToObjects (emptyGw , vals )
131147 if err != nil {
132148 return nil , err
133149 }
150+
134151 var ret []schema.GroupVersionKind
135152 for _ , obj := range objs {
136153 gvk := obj .GetObjectKind ().GroupVersionKind ()
@@ -255,7 +272,7 @@ func (d *Deployer) getGatewayClassFromGateway(ctx context.Context, gw *api.Gatew
255272 return gwc , nil
256273}
257274
258- func (d * Deployer ) getValues (gw * api.Gateway , gwParam * v1alpha1.GatewayParameters ) (* helmConfig , error ) {
275+ func (d * Deployer ) getValues (ctx context. Context , gw * api.Gateway , gwParam * v1alpha1.GatewayParameters ) (* helmConfig , error ) {
259276 // construct the default values
260277 vals := & helmConfig {
261278 Gateway : & helmGateway {
@@ -361,9 +378,61 @@ func (d *Deployer) getValues(gw *api.Gateway, gwParam *v1alpha1.GatewayParameter
361378
362379 gateway .Stats = getStatsValues (statsConfig )
363380
381+ // mtls values
382+ gateway .GlooMtls , err = d .getHelmMtlsConfig (ctx )
383+ if err != nil {
384+ return nil , err
385+ }
386+
364387 return vals , nil
365388}
366389
390+ func (d * Deployer ) getHelmMtlsConfig (ctx context.Context ) (* helmMtlsConfig , error ) {
391+
392+ if ! d .inputs .ControlPlane .GlooMtlsEnabled {
393+ return & helmMtlsConfig {
394+ Enabled : ptr .To (false ),
395+ }, nil
396+ }
397+
398+ helmTls , err := d .getHelmTlsSecretData (ctx )
399+
400+ if err != nil {
401+ return nil , err
402+ }
403+
404+ return & helmMtlsConfig {
405+ Enabled : ptr .To (true ),
406+ TlsSecret : helmTls ,
407+ }, nil
408+ }
409+
410+ // getHelmTlsSecretData builds a helmTls object built from the gloo-mtls-certs secret data, which it fetches
411+ // This function does not check if mtls is enabled, and a missing secret will return an error via getGlooMtlsCertsSecret
412+ func (d * Deployer ) getHelmTlsSecretData (ctx context.Context ) (* helmTlsSecretData , error ) {
413+
414+ mtlsSecret := & corev1.Secret {}
415+ mtlsSecretNns := types.NamespacedName {
416+ Name : wellknown .GlooMtlsCertName ,
417+ Namespace : d .inputs .ControlPlane .Namespace ,
418+ }
419+ err := d .cli .Get (ctx , mtlsSecretNns , mtlsSecret )
420+
421+ if err != nil {
422+ return nil , eris .Wrap (err , "failed to get gloo mtls secret" )
423+ }
424+
425+ if mtlsSecret .Type != corev1 .SecretTypeTLS {
426+ return nil , eris .New (fmt .Sprintf ("unexpected secret type, expected %s and got %s" , corev1 .SecretTypeTLS , mtlsSecret .Type ))
427+ }
428+
429+ return & helmTlsSecretData {
430+ TlsCert : mtlsSecret .Data [corev1 .TLSCertKey ],
431+ TlsKey : mtlsSecret .Data [corev1 .TLSPrivateKeyKey ],
432+ CaCert : mtlsSecret .Data [corev1 .ServiceAccountRootCAKey ],
433+ }, nil
434+ }
435+
367436// Render relies on a `helm install` to render the Chart with the injected values
368437// It returns the list of Objects that are rendered, and an optional error if rendering failed,
369438// or converting the rendered manifests to objects failed.
@@ -392,6 +461,7 @@ func (d *Deployer) Render(name, ns string, vals map[string]any) ([]client.Object
392461 if err != nil {
393462 return nil , fmt .Errorf ("failed to convert helm manifest yaml to objects for gateway %s.%s: %w" , ns , name , err )
394463 }
464+
395465 return objs , nil
396466}
397467
@@ -405,6 +475,8 @@ func (d *Deployer) Render(name, ns string, vals map[string]any) ([]client.Object
405475//
406476// * returns the objects to be deployed by the caller
407477func (d * Deployer ) GetObjsToDeploy (ctx context.Context , gw * api.Gateway ) ([]client.Object , error ) {
478+ logger := log .FromContext (ctx )
479+
408480 gwParam , err := d .getGatewayParametersForGateway (ctx , gw )
409481 if err != nil {
410482 return nil , err
@@ -414,9 +486,7 @@ func (d *Deployer) GetObjsToDeploy(ctx context.Context, gw *api.Gateway) ([]clie
414486 return nil , nil
415487 }
416488
417- logger := log .FromContext (ctx )
418-
419- vals , err := d .getValues (gw , gwParam )
489+ vals , err := d .getValues (ctx , gw , gwParam )
420490 if err != nil {
421491 return nil , fmt .Errorf ("failed to get values to render objects for gateway %s.%s: %w" , gw .GetNamespace (), gw .GetName (), err )
422492 }
0 commit comments