Skip to content

Commit f668339

Browse files
andrew-suandrew-su
authored
[FlowExporter] Update FlowExporterDestination to handle TLS config (#7549)
This change provides a way for users to specify the namespace and name of a `ConfigMap` which contains the CA certificate with key 'ca.crt' and a `Secret` which contains the client certificate and private key with the 'tls.crt' and 'tls.key' keys. Signed-off-by: Andrew Su <[email protected]>
1 parent b36df94 commit f668339

File tree

9 files changed

+479
-0
lines changed

9 files changed

+479
-0
lines changed

‎build/charts/antrea/crds/flowexporterdestination.yaml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,66 @@ spec:
9696
packet matching this flow has been observed since the last export event.
9797
minimum: 1
9898
default: 15
99+
tlsConfig:
100+
type: object
101+
required:
102+
- caConfigMap
103+
properties:
104+
minTLSVersion:
105+
type: string
106+
description: >
107+
minTLSVersion specifies which version of TLS the client should accept from the server.
108+
This defaults to VersionTLS12 if unspecified.
109+
enum:
110+
- VersionTLS12
111+
- VersionTLS13
112+
default: VersionTLS12
113+
serverName:
114+
type: string
115+
description: >
116+
serverName is used to verify the hostname on the returned certificate. If specified
117+
it will be included in the client's handshake (SNI) to support virtual hosting unless
118+
it is an IP address. If this field is omitted, the hostname used for certificate
119+
verification will default to the provided server address (spec.address).
120+
minLength: 1
121+
caConfigMap:
122+
type: object
123+
description: >
124+
Specify the location of the ConfigMap containing the CA certificate used to authenticate
125+
the collector service. The ConfigMap must store the certificate under the key 'ca.crt'.
126+
To ensure flow exporter will have access to this resource it must be granted the proper
127+
RBAC permissions.
128+
required:
129+
- namespace
130+
- name
131+
properties:
132+
namespace:
133+
type: string
134+
description: Namespace of the ConfigMap containing the CA certificate.
135+
minLength: 1
136+
name:
137+
type: string
138+
description: Name of the ConfigMap containing the CA certificate.
139+
minLength: 1
140+
clientSecret:
141+
type: object
142+
description: >
143+
Specify the location of the Secret containing the client certificate and private
144+
key for mTLS. The Secret must contain the keys 'tls.crt' and 'tls.key'.
145+
If omitted, client authentication will be disabled. To ensure flow exporter will
146+
have access to this resource it must be granted the proper RBAC permissions.
147+
required:
148+
- namespace
149+
- name
150+
properties:
151+
namespace:
152+
type: string
153+
description: Namespace of the Secret containing the client certificate/key.
154+
minLength: 1
155+
name:
156+
type: string
157+
description: Name of the Secret containing the client certificate/key.
158+
minLength: 1
99159
scope: Cluster
100160
names:
101161
plural: flowexporterdestinations

‎build/yamls/antrea-aks.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1895,6 +1895,66 @@ spec:
18951895
packet matching this flow has been observed since the last export event.
18961896
minimum: 1
18971897
default: 15
1898+
tlsConfig:
1899+
type: object
1900+
required:
1901+
- caConfigMap
1902+
properties:
1903+
minTLSVersion:
1904+
type: string
1905+
description: >
1906+
minTLSVersion specifies which version of TLS the client should accept from the server.
1907+
This defaults to VersionTLS12 if unspecified.
1908+
enum:
1909+
- VersionTLS12
1910+
- VersionTLS13
1911+
default: VersionTLS12
1912+
serverName:
1913+
type: string
1914+
description: >
1915+
serverName is used to verify the hostname on the returned certificate. If specified
1916+
it will be included in the client's handshake (SNI) to support virtual hosting unless
1917+
it is an IP address. If this field is omitted, the hostname used for certificate
1918+
verification will default to the provided server address (spec.address).
1919+
minLength: 1
1920+
caConfigMap:
1921+
type: object
1922+
description: >
1923+
Specify the location of the ConfigMap containing the CA certificate used to authenticate
1924+
the collector service. The ConfigMap must store the certificate under the key 'ca.crt'.
1925+
To ensure flow exporter will have access to this resource it must be granted the proper
1926+
RBAC permissions.
1927+
required:
1928+
- namespace
1929+
- name
1930+
properties:
1931+
namespace:
1932+
type: string
1933+
description: Namespace of the ConfigMap containing the CA certificate.
1934+
minLength: 1
1935+
name:
1936+
type: string
1937+
description: Name of the ConfigMap containing the CA certificate.
1938+
minLength: 1
1939+
clientSecret:
1940+
type: object
1941+
description: >
1942+
Specify the location of the Secret containing the client certificate and private
1943+
key for mTLS. The Secret must contain the keys 'tls.crt' and 'tls.key'.
1944+
If omitted, client authentication will be disabled. To ensure flow exporter will
1945+
have access to this resource it must be granted the proper RBAC permissions.
1946+
required:
1947+
- namespace
1948+
- name
1949+
properties:
1950+
namespace:
1951+
type: string
1952+
description: Namespace of the Secret containing the client certificate/key.
1953+
minLength: 1
1954+
name:
1955+
type: string
1956+
description: Name of the Secret containing the client certificate/key.
1957+
minLength: 1
18981958
scope: Cluster
18991959
names:
19001960
plural: flowexporterdestinations

‎build/yamls/antrea-crds.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1872,6 +1872,66 @@ spec:
18721872
packet matching this flow has been observed since the last export event.
18731873
minimum: 1
18741874
default: 15
1875+
tlsConfig:
1876+
type: object
1877+
required:
1878+
- caConfigMap
1879+
properties:
1880+
minTLSVersion:
1881+
type: string
1882+
description: >
1883+
minTLSVersion specifies which version of TLS the client should accept from the server.
1884+
This defaults to VersionTLS12 if unspecified.
1885+
enum:
1886+
- VersionTLS12
1887+
- VersionTLS13
1888+
default: VersionTLS12
1889+
serverName:
1890+
type: string
1891+
description: >
1892+
serverName is used to verify the hostname on the returned certificate. If specified
1893+
it will be included in the client's handshake (SNI) to support virtual hosting unless
1894+
it is an IP address. If this field is omitted, the hostname used for certificate
1895+
verification will default to the provided server address (spec.address).
1896+
minLength: 1
1897+
caConfigMap:
1898+
type: object
1899+
description: >
1900+
Specify the location of the ConfigMap containing the CA certificate used to authenticate
1901+
the collector service. The ConfigMap must store the certificate under the key 'ca.crt'.
1902+
To ensure flow exporter will have access to this resource it must be granted the proper
1903+
RBAC permissions.
1904+
required:
1905+
- namespace
1906+
- name
1907+
properties:
1908+
namespace:
1909+
type: string
1910+
description: Namespace of the ConfigMap containing the CA certificate.
1911+
minLength: 1
1912+
name:
1913+
type: string
1914+
description: Name of the ConfigMap containing the CA certificate.
1915+
minLength: 1
1916+
clientSecret:
1917+
type: object
1918+
description: >
1919+
Specify the location of the Secret containing the client certificate and private
1920+
key for mTLS. The Secret must contain the keys 'tls.crt' and 'tls.key'.
1921+
If omitted, client authentication will be disabled. To ensure flow exporter will
1922+
have access to this resource it must be granted the proper RBAC permissions.
1923+
required:
1924+
- namespace
1925+
- name
1926+
properties:
1927+
namespace:
1928+
type: string
1929+
description: Namespace of the Secret containing the client certificate/key.
1930+
minLength: 1
1931+
name:
1932+
type: string
1933+
description: Name of the Secret containing the client certificate/key.
1934+
minLength: 1
18751935
scope: Cluster
18761936
names:
18771937
plural: flowexporterdestinations

‎build/yamls/antrea-eks.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1891,6 +1891,66 @@ spec:
18911891
packet matching this flow has been observed since the last export event.
18921892
minimum: 1
18931893
default: 15
1894+
tlsConfig:
1895+
type: object
1896+
required:
1897+
- caConfigMap
1898+
properties:
1899+
minTLSVersion:
1900+
type: string
1901+
description: >
1902+
minTLSVersion specifies which version of TLS the client should accept from the server.
1903+
This defaults to VersionTLS12 if unspecified.
1904+
enum:
1905+
- VersionTLS12
1906+
- VersionTLS13
1907+
default: VersionTLS12
1908+
serverName:
1909+
type: string
1910+
description: >
1911+
serverName is used to verify the hostname on the returned certificate. If specified
1912+
it will be included in the client's handshake (SNI) to support virtual hosting unless
1913+
it is an IP address. If this field is omitted, the hostname used for certificate
1914+
verification will default to the provided server address (spec.address).
1915+
minLength: 1
1916+
caConfigMap:
1917+
type: object
1918+
description: >
1919+
Specify the location of the ConfigMap containing the CA certificate used to authenticate
1920+
the collector service. The ConfigMap must store the certificate under the key 'ca.crt'.
1921+
To ensure flow exporter will have access to this resource it must be granted the proper
1922+
RBAC permissions.
1923+
required:
1924+
- namespace
1925+
- name
1926+
properties:
1927+
namespace:
1928+
type: string
1929+
description: Namespace of the ConfigMap containing the CA certificate.
1930+
minLength: 1
1931+
name:
1932+
type: string
1933+
description: Name of the ConfigMap containing the CA certificate.
1934+
minLength: 1
1935+
clientSecret:
1936+
type: object
1937+
description: >
1938+
Specify the location of the Secret containing the client certificate and private
1939+
key for mTLS. The Secret must contain the keys 'tls.crt' and 'tls.key'.
1940+
If omitted, client authentication will be disabled. To ensure flow exporter will
1941+
have access to this resource it must be granted the proper RBAC permissions.
1942+
required:
1943+
- namespace
1944+
- name
1945+
properties:
1946+
namespace:
1947+
type: string
1948+
description: Namespace of the Secret containing the client certificate/key.
1949+
minLength: 1
1950+
name:
1951+
type: string
1952+
description: Name of the Secret containing the client certificate/key.
1953+
minLength: 1
18941954
scope: Cluster
18951955
names:
18961956
plural: flowexporterdestinations

‎build/yamls/antrea-gke.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1891,6 +1891,66 @@ spec:
18911891
packet matching this flow has been observed since the last export event.
18921892
minimum: 1
18931893
default: 15
1894+
tlsConfig:
1895+
type: object
1896+
required:
1897+
- caConfigMap
1898+
properties:
1899+
minTLSVersion:
1900+
type: string
1901+
description: >
1902+
minTLSVersion specifies which version of TLS the client should accept from the server.
1903+
This defaults to VersionTLS12 if unspecified.
1904+
enum:
1905+
- VersionTLS12
1906+
- VersionTLS13
1907+
default: VersionTLS12
1908+
serverName:
1909+
type: string
1910+
description: >
1911+
serverName is used to verify the hostname on the returned certificate. If specified
1912+
it will be included in the client's handshake (SNI) to support virtual hosting unless
1913+
it is an IP address. If this field is omitted, the hostname used for certificate
1914+
verification will default to the provided server address (spec.address).
1915+
minLength: 1
1916+
caConfigMap:
1917+
type: object
1918+
description: >
1919+
Specify the location of the ConfigMap containing the CA certificate used to authenticate
1920+
the collector service. The ConfigMap must store the certificate under the key 'ca.crt'.
1921+
To ensure flow exporter will have access to this resource it must be granted the proper
1922+
RBAC permissions.
1923+
required:
1924+
- namespace
1925+
- name
1926+
properties:
1927+
namespace:
1928+
type: string
1929+
description: Namespace of the ConfigMap containing the CA certificate.
1930+
minLength: 1
1931+
name:
1932+
type: string
1933+
description: Name of the ConfigMap containing the CA certificate.
1934+
minLength: 1
1935+
clientSecret:
1936+
type: object
1937+
description: >
1938+
Specify the location of the Secret containing the client certificate and private
1939+
key for mTLS. The Secret must contain the keys 'tls.crt' and 'tls.key'.
1940+
If omitted, client authentication will be disabled. To ensure flow exporter will
1941+
have access to this resource it must be granted the proper RBAC permissions.
1942+
required:
1943+
- namespace
1944+
- name
1945+
properties:
1946+
namespace:
1947+
type: string
1948+
description: Namespace of the Secret containing the client certificate/key.
1949+
minLength: 1
1950+
name:
1951+
type: string
1952+
description: Name of the Secret containing the client certificate/key.
1953+
minLength: 1
18941954
scope: Cluster
18951955
names:
18961956
plural: flowexporterdestinations

0 commit comments

Comments
 (0)