Skip to content
This repository was archived by the owner on May 24, 2023. It is now read-only.

Commit fba21a8

Browse files
committed
Add tls secret option
1 parent 607365b commit fba21a8

File tree

6 files changed

+22
-0
lines changed

6 files changed

+22
-0
lines changed

api/v1alpha1/nginxingresscontroller_types.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -263,6 +263,8 @@ type Prometheus struct {
263263
// +kubebuilder:validation:Optional
264264
// +nullable
265265
Port *uint16 `json:"port"`
266+
// Specifies an TLS Secret in the format namespace/name to use to secure the Prometheus endpoint.
267+
Secret string `json:"secret"`
266268
}
267269

268270
// AppProtect support configuration.

bundle/manifests/k8s.nginx.org_nginxingresscontrollers.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,13 @@ spec:
195195
minimum: 1023
196196
nullable: true
197197
type: integer
198+
secret:
199+
description: A Secret with a TLS certificate and key for TLS termination
200+
of the Prometheus endpoint. If the argument is set,
201+
but the Ingress controller is not able to fetch the Secret from
202+
Kubernetes API, the Ingress Controller will fail to start. Format
203+
is namespace/name.
204+
type: string
198205
required:
199206
- enable
200207
type: object

config/crd/bases/k8s.nginx.org_nginxingresscontrollers.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,8 +197,13 @@ spec:
197197
minimum: 1023
198198
nullable: true
199199
type: integer
200+
secret:
201+
description: Specifies an TLS Secret in the format namespace/name
202+
to use to secure the Prometheus endpoint.
203+
type: string
200204
required:
201205
- enable
206+
- secret
202207
type: object
203208
replicas:
204209
description: The number of replicas of the Ingress Controller pod.

controllers/utils.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,10 @@ func generatePodArgs(instance *k8sv1alpha1.NginxIngressController) []string {
111111
if instance.Spec.EnableLatencyMetrics {
112112
args = append(args, "-enable-latency-metrics")
113113
}
114+
115+
if instance.Spec.Prometheus.Secret != "" {
116+
args = append(args, fmt.Sprintf("-prometheus-tls-secret=%v", instance.Spec.Prometheus.Secret))
117+
}
114118
}
115119

116120
if instance.Spec.EnableCRDs != nil && !*instance.Spec.EnableCRDs {

controllers/utils_test.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,7 @@ func TestGeneratePodArgs(t *testing.T) {
225225
Prometheus: &k8sv1alpha1.Prometheus{
226226
Enable: true,
227227
Port: &promPort,
228+
Secret: "my-nginx-ingress/prometheus-secret",
228229
},
229230
EnableLatencyMetrics: true,
230231
GlobalConfiguration: "my-nginx-ingress/globalconfiguration",
@@ -260,6 +261,7 @@ func TestGeneratePodArgs(t *testing.T) {
260261
"-enable-prometheus-metrics",
261262
"-prometheus-metrics-listen-port=9114",
262263
"-enable-latency-metrics",
264+
"-prometheus-tls-secret=my-nginx-ingress/prometheus-secret",
263265
"-enable-custom-resources=false",
264266
"-nginx-reload-timeout=5000",
265267
},

docs/nginx-ingress-controller.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ spec:
6565
prometheus:
6666
enable: true
6767
port: 9114
68+
secret: my-nginx-ingress/prometheus-secret
6869
enableLatencyMetrics: false
6970
configMapData:
7071
error-log-level: debug
@@ -147,6 +148,7 @@ spec:
147148
| --- | --- | --- | --- |
148149
| `enable` | `boolean` | Enable Prometheus metrics. | Yes |
149150
| `port` | `int` | Sets the port where the Prometheus metrics are exposed. Default is 9113. Format is `1023 - 65535`. | No |
151+
| `secret` | `string` | Sets the namespace/name of a TLS Secret Resource to use to enable TLS for the Prometheus endpoint. | No |
150152
| `enableLatencyMetrics` | `boolean` | Bucketed response times from when NGINX establishes a connection to an upstream server to when the last byte of the response body is received by NGINX. **Note** The metric for the upstream isn't available until traffic is sent to the upstream. Requires prometheus set to true | No |
151153

152154
## NginxIngressController.AppProtect

0 commit comments

Comments
 (0)