How to handle Ingress annotations mentioned below

Projects NGINX Gateway Fabric
, , ,
1

Please use this template for troubleshooting questions.

My issue: I am able to address below annotations in the HTTPRoute or Gateway.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
meta.helm.sh/release-name: dev-dc
meta.helm.sh/release-namespace: default
nginx.ingress.kubernetes.io/auth-tls-match-cn: CN=Pipeline Builder
nginx.ingress.kubernetes.io/auth-tls-secret: default/wac-certs
nginx.ingress.kubernetes.io/auth-tls-verify-client: “true”
nginx.ingress.kubernetes.io/auth-tls-verify-depth: “5”
nginx.ingress.kubernetes.io/proxy-body-size: 512m

How I encountered the problem: While I am running pipeline, I am not able to authenticate as the above annotations or not handled properly in my Gateway or HTTPRoute

Solutions I’ve tried:

Version of NGF and/or NGINX: 3.0.0

Deployment environment: Dev

1 Like
2

Hi @rajasekhar.yannam , thanks so much for your interest in our project!

Here’s how these annotations map to NGF with Gateway API:

auth-tls-secret + auth-tls-verify-client These are addressed by FrontendTLSValidation, which is coming in the next NGF release. You’ll configure this on your Gateway listener:

tls:
  frontendValidation:
    caCertificateRefs:
      - kind: ConfigMap
        name: wac-certs

See the Gateway API FrontendTLSConfig spec for full details.

auth-tls-match-cn Gateway API has no native concept of filtering by client certificate CN. One approach is to propagate the cert subject as a request header using RequestHeaderModifier and have your backend perform the CN check. Support for NGINX variables in RequestHeaderModifier is also coming in the next release, so you’ll be able to do:

filters:
  - type: RequestHeaderModifier
    requestHeaderModifier:
      set:
        - name: X-SSL-Client-DN
          value: $ssl_client_s_dn

However - Note that auth-tls-match-cn enforces CN validation at the gateway, returning 403 before the request reaches your backend. The RequestHeaderModifier approach shifts that enforcement to the backend and so it is not an equivalent replacement if you require the gateway to be the enforcement point. If this is important for your use case, please let us know by opening an issue!

auth-tls-verify-depth There is currently no equivalent for this in Gateway API or NGF. As above, if this is important for your use case, please let us know by opening an issue!

proxy-body-size This is supported today via ProxySettingsPolicy. See the proxy settings documentation for configuration details.

I hope this helps!

Ciara

2 Likes
3

Hi @Ciara , Thank you for prompt response. I will definitely verify the given solutions. Meanwhile, Could you please let me know when can we expect the next release, So u am eager to apply these changes.

1 Like
4

We are targeting the week of May 4th for our next release including these changes @rajasekhar.yannam!