Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Supports multi-ssl protocols for different ingress (domain) #1835

Closed
lianglli opened this issue Aug 4, 2023 · 1 comment · Fixed by #1863
Closed

Supports multi-ssl protocols for different ingress (domain) #1835

lianglli opened this issue Aug 4, 2023 · 1 comment · Fixed by #1863
Assignees

Comments

@lianglli
Copy link
Member

lianglli commented Aug 4, 2023

支持不同独立的域名(server)配置多个不同的SSL protocols。

例如
a.taobao.com "TLSv1.2 TLSv1.3"
仅允许使用TLSv1.2和TLSv1.3访问应用域名a.taobao.com

b.taobao.com "TLSv1.3"
仅允许使用TLSv1.3访问应用域名b.taobao.com

支持动态无损生效,无需tengine reload

@lianglli lianglli added this to the 3.0.1 milestone Aug 4, 2023
@lianglli lianglli self-assigned this Aug 4, 2023
@lianglli lianglli removed this from the 3.0.1 milestone Sep 18, 2023
@lianglli
Copy link
Member Author

lianglli commented Nov 2, 2023

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/canary-weight-total: "1000"
    nginx.ingress.kubernetes.io/ssl-protocols: TLSv1.2 TLSv1.3
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  creationTimestamp: "2023-10-30T09:33:15Z"
  generation: 1
  name: tengine-ingress-echo-ing
  namespace: default
  resourceVersion: "28867854"
  uid: 34ff03fa-0e52-4ff4-b992-3b3625664cba
spec:
  ingressClassName: opensource-ingress
  rules:
  - host: echo.w1.com
    http:
      paths:
      - backend:
          service:
            name: tengine-ingress-echo-service
            port:
              number: 80
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - echo.w1.com
    secretName: https-server-1
status:
  loadBalancer:
    ingress:
    - {}
$ ./curl -i -k --tlsv1.0 --tls-max 1.0 https://echo.w1.com
curl: (35) error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version

$ ./curl -i -k --tlsv1.1 --tls-max 1.1 https://echo.w1.com
curl: (35) error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version

$ ./curl -i -k --tlsv1.2 --tls-max 1.2 https://echo.w1.com
HTTP/2 200 
server: Tengine/3.1.0
date: Thu, 02 Nov 2023 07:05:11 GMT
content-type: text/plain; charset=utf-8
content-length: 7
strict-transport-security: max-age=31536000
ups-target-key: default-tengine-ingress-echo-service-80
x-protocol: HTTP/2.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

echo ok

$ ./curl -i -k --tlsv1.3 --tls-max 1.3 https://echo.w1.com
HTTP/2 200 
server: Tengine/3.1.0
date: Thu, 02 Nov 2023 07:05:19 GMT
content-type: text/plain; charset=utf-8
content-length: 7
strict-transport-security: max-age=31536000
ups-target-key: default-tengine-ingress-echo-service-80
x-protocol: HTTP/2.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

@lianglli lianglli closed this as completed Nov 2, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant