diff --git a/api/swagger-spec/extensions_v1beta1.json b/api/swagger-spec/extensions_v1beta1.json index 35a6a1b0e3..6d6b08b09c 100644 --- a/api/swagger-spec/extensions_v1beta1.json +++ b/api/swagger-spec/extensions_v1beta1.json @@ -8291,7 +8291,7 @@ "items": { "$ref": "v1beta1.IngressTLS" }, - "description": "TLS configuration. Currently the Ingress only supports a single TLS port, 443, and assumes TLS termination. If multiple members of this list specify different hosts, they will be multiplexed on the same port according to the hostname specified through the SNI TLS extension." + "description": "TLS configuration. Currently the Ingress only supports a single TLS port, 443. If multiple members of this list specify different hosts, they will be multiplexed on the same port according to the hostname specified through the SNI TLS extension, if the ingress controller fulfilling the ingress supports SNI." }, "rules": { "type": "array", diff --git a/docs/api-reference/extensions/v1beta1/definitions.html b/docs/api-reference/extensions/v1beta1/definitions.html index 70a8c73e04..684f19f8c2 100755 --- a/docs/api-reference/extensions/v1beta1/definitions.html +++ b/docs/api-reference/extensions/v1beta1/definitions.html @@ -806,7 +806,7 @@ span.icon > [class^="icon-"], span.icon > [class*=" icon-"] { cursor: default; }

tls

-

TLS configuration. Currently the Ingress only supports a single TLS port, 443, and assumes TLS termination. If multiple members of this list specify different hosts, they will be multiplexed on the same port according to the hostname specified through the SNI TLS extension.

+

TLS configuration. Currently the Ingress only supports a single TLS port, 443. If multiple members of this list specify different hosts, they will be multiplexed on the same port according to the hostname specified through the SNI TLS extension, if the ingress controller fulfilling the ingress supports SNI.

false

v1beta1.IngressTLS array

@@ -5910,7 +5910,7 @@ Both these may change in the future. Incoming requests are matched against the h diff --git a/pkg/apis/extensions/types.go b/pkg/apis/extensions/types.go index c6aed011b5..edcc939884 100644 --- a/pkg/apis/extensions/types.go +++ b/pkg/apis/extensions/types.go @@ -655,10 +655,11 @@ type IngressSpec struct { // specify a global default. Backend *IngressBackend `json:"backend,omitempty"` - // TLS is the TLS configuration. Currently the Ingress only supports a single TLS - // port, 443, and assumes TLS termination. If multiple members of this - // list specify different hosts, they will be multiplexed on the same - // port according to the hostname specified through the SNI TLS extension. + // TLS configuration. Currently the Ingress only supports a single TLS + // port, 443. If multiple members of this list specify different hosts, they + // will be multiplexed on the same port according to the hostname specified + // through the SNI TLS extension, if the ingress controller fulfilling the + // ingress supports SNI. TLS []IngressTLS `json:"tls,omitempty"` // A list of host rules used to configure the Ingress. If unspecified, or diff --git a/pkg/apis/extensions/v1beta1/types.go b/pkg/apis/extensions/v1beta1/types.go index da2e197100..5817b4497d 100644 --- a/pkg/apis/extensions/v1beta1/types.go +++ b/pkg/apis/extensions/v1beta1/types.go @@ -667,9 +667,10 @@ type IngressSpec struct { Backend *IngressBackend `json:"backend,omitempty"` // TLS configuration. Currently the Ingress only supports a single TLS - // port, 443, and assumes TLS termination. If multiple members of this - // list specify different hosts, they will be multiplexed on the same - // port according to the hostname specified through the SNI TLS extension. + // port, 443. If multiple members of this list specify different hosts, they + // will be multiplexed on the same port according to the hostname specified + // through the SNI TLS extension, if the ingress controller fulfilling the + // ingress supports SNI. TLS []IngressTLS `json:"tls,omitempty"` // A list of host rules used to configure the Ingress. If unspecified, or diff --git a/pkg/apis/extensions/v1beta1/types_swagger_doc_generated.go b/pkg/apis/extensions/v1beta1/types_swagger_doc_generated.go index 4bbf556a6d..8e92ffb782 100644 --- a/pkg/apis/extensions/v1beta1/types_swagger_doc_generated.go +++ b/pkg/apis/extensions/v1beta1/types_swagger_doc_generated.go @@ -322,7 +322,7 @@ func (IngressRuleValue) SwaggerDoc() map[string]string { var map_IngressSpec = map[string]string{ "": "IngressSpec describes the Ingress the user wishes to exist.", "backend": "A default backend capable of servicing requests that don't match any rule. At least one of 'backend' or 'rules' must be specified. This field is optional to allow the loadbalancer controller or defaulting logic to specify a global default.", - "tls": "TLS configuration. Currently the Ingress only supports a single TLS port, 443, and assumes TLS termination. If multiple members of this list specify different hosts, they will be multiplexed on the same port according to the hostname specified through the SNI TLS extension.", + "tls": "TLS configuration. Currently the Ingress only supports a single TLS port, 443. If multiple members of this list specify different hosts, they will be multiplexed on the same port according to the hostname specified through the SNI TLS extension, if the ingress controller fulfilling the ingress supports SNI.", "rules": "A list of host rules used to configure the Ingress. If unspecified, or no rule matches, all traffic is sent to the default backend.", } diff --git a/pkg/apis/extensions/validation/validation.go b/pkg/apis/extensions/validation/validation.go index b87bff219f..7025f61399 100644 --- a/pkg/apis/extensions/validation/validation.go +++ b/pkg/apis/extensions/validation/validation.go @@ -523,13 +523,6 @@ func ValidateIngressName(name string, prefix bool) (bool, string) { func validateIngressTLS(spec *extensions.IngressSpec, fldPath *field.Path) field.ErrorList { allErrs := field.ErrorList{} - // Currently the Ingress only supports HTTP(S), so a secretName is required. - // This will not be the case if we support SSL routing at L4 via SNI. - for i, t := range spec.TLS { - if t.SecretName == "" { - allErrs = append(allErrs, field.Required(fldPath.Index(i).Child("secretName"), spec.TLS[i].SecretName)) - } - } // TODO: Perform a more thorough validation of spec.TLS.Hosts that takes // the wildcard spec from RFC 6125 into account. return allErrs diff --git a/pkg/apis/extensions/validation/validation_test.go b/pkg/apis/extensions/validation/validation_test.go index d7e8ebc0bd..9b5d03092e 100644 --- a/pkg/apis/extensions/validation/validation_test.go +++ b/pkg/apis/extensions/validation/validation_test.go @@ -1320,8 +1320,6 @@ func TestValidateIngress(t *testing.T) { badHostIP := newValid() badHostIP.Spec.Rules[0].Host = hostIP badHostIPErr := fmt.Sprintf("spec.rules[0].host: Invalid value: '%v'", hostIP) - noSecretName := newValid() - noSecretName.Spec.TLS = []extensions.IngressTLS{{SecretName: ""}} errorCases := map[string]extensions.Ingress{ "spec.backend.serviceName: Required value": servicelessBackend, @@ -1330,7 +1328,6 @@ func TestValidateIngress(t *testing.T) { "spec.rules[0].host: Invalid value": badHost, "spec.rules[0].http.paths: Required value": noPaths, "spec.rules[0].http.paths[0].path: Invalid value": noForwardSlashPath, - "spec.tls[0].secretName: Required value": noSecretName, } errorCases[badPathErr] = badRegexPath errorCases[badHostIPErr] = badHostIP diff --git a/pkg/kubectl/describe.go b/pkg/kubectl/describe.go index 3aacbbb17c..9f95992f06 100644 --- a/pkg/kubectl/describe.go +++ b/pkg/kubectl/describe.go @@ -1264,7 +1264,11 @@ func (i *IngressDescriber) describeIngress(ing *extensions.Ingress) (string, err func describeIngressTLS(out io.Writer, ingTLS []extensions.IngressTLS) { fmt.Fprintf(out, "TLS:\n") for _, t := range ingTLS { - fmt.Fprintf(out, " %v terminates %v\n", t.SecretName, strings.Join(t.Hosts, ",")) + if t.SecretName == "" { + fmt.Fprintf(out, " SNI routes %v\n", strings.Join(t.Hosts, ",")) + } else { + fmt.Fprintf(out, " %v terminates %v\n", t.SecretName, strings.Join(t.Hosts, ",")) + } } return } diff --git a/pkg/registry/ingress/etcd/etcd_test.go b/pkg/registry/ingress/etcd/etcd_test.go index 101228e77d..14b0ce705e 100644 --- a/pkg/registry/ingress/etcd/etcd_test.go +++ b/pkg/registry/ingress/etcd/etcd_test.go @@ -163,15 +163,6 @@ func TestUpdate(t *testing.T) { "foo.bar.com": {"/invalid[": "svc"}}) return object }, - - func(obj runtime.Object) runtime.Object { - object := obj.(*extensions.Ingress) - object.Spec.TLS = append(object.Spec.TLS, extensions.IngressTLS{ - Hosts: []string{"foo.bar.com"}, - SecretName: "", - }) - return object - }, ) }