Skip to content

Commit 259e072

Browse files
zhaohuabingzhaohuabing
committed
API for Wasm code source TLS configuration
Signed-off-by: Huabing Zhao <[email protected]>
1 parent 26ec49a commit 259e072

File tree

5 files changed

+187
-0
lines changed

5 files changed

+187
-0
lines changed

‎api/v1alpha1/wasm_types.go

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,11 @@ type HTTPWasmCodeSource struct {
115115
// kubebuilder:validation:Pattern=`^[a-f0-9]{64}$`
116116
// +optional
117117
SHA256 *string `json:"sha256"`
118+
119+
// TLS configuration when connecting to the Wasm code source.
120+
// +optional
121+
// +notImplementedHide
122+
TLS *WasmCodeSourceTLSConfig `json:"tls,omitempty"`
118123
}
119124

120125
// ImageWasmCodeSource defines the OCI image containing the Wasm code.
@@ -137,6 +142,11 @@ type ImageWasmCodeSource struct {
137142
// +kubebuilder:validation:XValidation:message="only support Secret kind.",rule="self.kind == 'Secret'"
138143
// +optional
139144
PullSecretRef *gwapiv1.SecretObjectReference `json:"pullSecretRef,omitempty"`
145+
146+
// TLS configuration when connecting to the Wasm code source.
147+
// +optional
148+
// +notImplementedHide
149+
TLS *WasmCodeSourceTLSConfig `json:"tls,omitempty"`
140150
}
141151

142152
// ImagePullPolicy defines the policy to use when pulling an OIC image.
@@ -151,3 +161,14 @@ const (
151161
// Note: EG does not update the Wasm module every time an Envoy proxy requests the Wasm module.
152162
ImagePullPolicyAlways ImagePullPolicy = "Always"
153163
)
164+
165+
// WasmCodeSourceTLSConfig defines the TLS configuration when connecting to the Wasm code source.
166+
type WasmCodeSourceTLSConfig struct {
167+
// CACertificateRef contains a references to
168+
// Kubernetes objects that contain TLS certificates of
169+
// the Certificate Authorities that can be used
170+
// as a trust anchor to validate the certificates presented by the Wasm code source.
171+
//
172+
// Kubernetes ConfigMap and Kubernetes Secret are supported.
173+
CACertificateRef gwapiv1.SecretObjectReference `json:"caCertificateRef"`
174+
}

‎api/v1alpha1/zz_generated.deepcopy.go

Lines changed: 26 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1115,6 +1115,61 @@ spec:
11151115
If not specified, Envoy Gateway will not verify the downloaded Wasm code.
11161116
kubebuilder:validation:Pattern=`^[a-f0-9]{64}$`
11171117
type: string
1118+
tls:
1119+
description: TLS configuration when connecting to the
1120+
Wasm code source.
1121+
properties:
1122+
caCertificateRef:
1123+
description: |-
1124+
CACertificateRef contains a references to
1125+
Kubernetes objects that contain TLS certificates of
1126+
the Certificate Authorities that can be used
1127+
as a trust anchor to validate the certificates presented by the Wasm code source.
1128+
1129+
Kubernetes ConfigMap and Kubernetes Secret are supported.
1130+
properties:
1131+
group:
1132+
default: ""
1133+
description: |-
1134+
Group is the group of the referent. For example, "gateway.networking.k8s.io".
1135+
When unspecified or empty string, core API group is inferred.
1136+
maxLength: 253
1137+
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
1138+
type: string
1139+
kind:
1140+
default: Secret
1141+
description: Kind is kind of the referent. For
1142+
example "Secret".
1143+
maxLength: 63
1144+
minLength: 1
1145+
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
1146+
type: string
1147+
name:
1148+
description: Name is the name of the referent.
1149+
maxLength: 253
1150+
minLength: 1
1151+
type: string
1152+
namespace:
1153+
description: |-
1154+
Namespace is the namespace of the referenced object. When unspecified, the local
1155+
namespace is inferred.
1156+
1157+
Note that when a namespace different than the local namespace is specified,
1158+
a ReferenceGrant object is required in the referent namespace to allow that
1159+
namespace's owner to accept the reference. See the ReferenceGrant
1160+
documentation for details.
1161+
1162+
Support: Core
1163+
maxLength: 63
1164+
minLength: 1
1165+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
1166+
type: string
1167+
required:
1168+
- name
1169+
type: object
1170+
required:
1171+
- caCertificateRef
1172+
type: object
11181173
url:
11191174
description: URL is the URL containing the Wasm code.
11201175
pattern: ^((https?:)(\/\/\/?)([\w]*(?::[\w]*)?@)?([\d\w\.-]+)(?::(\d+))?)?([\/\\\w\.()-]*)?(?:([?][^#]*)?(#.*)?)*
@@ -1184,6 +1239,61 @@ spec:
11841239
If not specified, Envoy Gateway will not verify the downloaded OCI image.
11851240
kubebuilder:validation:Pattern=`^[a-f0-9]{64}$`
11861241
type: string
1242+
tls:
1243+
description: TLS configuration when connecting to the
1244+
Wasm code source.
1245+
properties:
1246+
caCertificateRef:
1247+
description: |-
1248+
CACertificateRef contains a references to
1249+
Kubernetes objects that contain TLS certificates of
1250+
the Certificate Authorities that can be used
1251+
as a trust anchor to validate the certificates presented by the Wasm code source.
1252+
1253+
Kubernetes ConfigMap and Kubernetes Secret are supported.
1254+
properties:
1255+
group:
1256+
default: ""
1257+
description: |-
1258+
Group is the group of the referent. For example, "gateway.networking.k8s.io".
1259+
When unspecified or empty string, core API group is inferred.
1260+
maxLength: 253
1261+
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
1262+
type: string
1263+
kind:
1264+
default: Secret
1265+
description: Kind is kind of the referent. For
1266+
example "Secret".
1267+
maxLength: 63
1268+
minLength: 1
1269+
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
1270+
type: string
1271+
name:
1272+
description: Name is the name of the referent.
1273+
maxLength: 253
1274+
minLength: 1
1275+
type: string
1276+
namespace:
1277+
description: |-
1278+
Namespace is the namespace of the referenced object. When unspecified, the local
1279+
namespace is inferred.
1280+
1281+
Note that when a namespace different than the local namespace is specified,
1282+
a ReferenceGrant object is required in the referent namespace to allow that
1283+
namespace's owner to accept the reference. See the ReferenceGrant
1284+
documentation for details.
1285+
1286+
Support: Core
1287+
maxLength: 63
1288+
minLength: 1
1289+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
1290+
type: string
1291+
required:
1292+
- name
1293+
type: object
1294+
required:
1295+
- caCertificateRef
1296+
type: object
11871297
url:
11881298
description: |-
11891299
URL is the URL of the OCI image.

‎site/content/en/latest/api/extension_types.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4118,6 +4118,21 @@ _Appears in:_
41184118
| `pullPolicy` | _[ImagePullPolicy](#imagepullpolicy)_ | false | PullPolicy is the policy to use when pulling the Wasm module by either the HTTP or Image source.<br />This field is only applicable when the SHA256 field is not set.<br /><br />If not specified, the default policy is IfNotPresent except for OCI images whose tag is latest.<br /><br />Note: EG does not update the Wasm module every time an Envoy proxy requests<br />the Wasm module even if the pull policy is set to Always.<br />It only updates the Wasm module when the EnvoyExtension resource version changes. |
41194119

41204120

4121+
#### WasmCodeSourceTLSConfig
4122+
4123+
4124+
4125+
WasmCodeSourceTLSConfig defines the TLS configuration when connecting to the Wasm code source.
4126+
4127+
_Appears in:_
4128+
- [HTTPWasmCodeSource](#httpwasmcodesource)
4129+
- [ImageWasmCodeSource](#imagewasmcodesource)
4130+
4131+
| Field | Type | Required | Description |
4132+
| --- | --- | --- | --- |
4133+
| `caCertificateRef` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)_ | true | CACertificateRef contains a references to<br />Kubernetes objects that contain TLS certificates of<br />the Certificate Authorities that can be used<br />as a trust anchor to validate the certificates presented by the Wasm code source.<br /><br />Kubernetes ConfigMap and Kubernetes Secret are supported. |
4134+
4135+
41214136
#### WasmCodeSourceType
41224137

41234138
_Underlying type:_ _string_

‎site/content/zh/latest/api/extension_types.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4118,6 +4118,21 @@ _Appears in:_
41184118
| `pullPolicy` | _[ImagePullPolicy](#imagepullpolicy)_ | false | PullPolicy is the policy to use when pulling the Wasm module by either the HTTP or Image source.<br />This field is only applicable when the SHA256 field is not set.<br /><br />If not specified, the default policy is IfNotPresent except for OCI images whose tag is latest.<br /><br />Note: EG does not update the Wasm module every time an Envoy proxy requests<br />the Wasm module even if the pull policy is set to Always.<br />It only updates the Wasm module when the EnvoyExtension resource version changes. |
41194119

41204120

4121+
#### WasmCodeSourceTLSConfig
4122+
4123+
4124+
4125+
WasmCodeSourceTLSConfig defines the TLS configuration when connecting to the Wasm code source.
4126+
4127+
_Appears in:_
4128+
- [HTTPWasmCodeSource](#httpwasmcodesource)
4129+
- [ImageWasmCodeSource](#imagewasmcodesource)
4130+
4131+
| Field | Type | Required | Description |
4132+
| --- | --- | --- | --- |
4133+
| `caCertificateRef` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)_ | true | CACertificateRef contains a references to<br />Kubernetes objects that contain TLS certificates of<br />the Certificate Authorities that can be used<br />as a trust anchor to validate the certificates presented by the Wasm code source.<br /><br />Kubernetes ConfigMap and Kubernetes Secret are supported. |
4134+
4135+
41214136
#### WasmCodeSourceType
41224137

41234138
_Underlying type:_ _string_

0 commit comments

Comments
 (0)