k8s-bigip-ctlr icon indicating copy to clipboard operation
k8s-bigip-ctlr copied to clipboard

Add ability to specify default TLS parent profile and TLS options

Open NaurisSadovskis opened this issue 3 years ago • 0 comments

Title

Add ability to specify default TLS parent profile and TLS options to autogenerated SSL profile from Ingress resources.

Description

We're managing our F5 resources exclusively via Kubernetes and we would like to have a field (annotation) allowing us to set a TLS parent profile. Currently, only specifying existing TLS profile is supported and this does not work for us as our certificates would have to be managed separately and we would not like that.

Furthermore, we'd like to specify different TLS options so those are added to the autogenerated

Actual Problem

Currently, our workflow is as follows:

  1. We create an ingress resource with TLS certificate.
  2. F5 creates a new SSL profile with appropriate certificates and some default configuration inherited from the F5 controller.
  3. Once created, we manually change TLS parent profile (created previously Terraform to enable/disable various options).
  4. We also add various TLS options since those are not automatically inherited from our previously created profile.

Solution Proposed

Ideally, we'd like steps 3 and 4 to be configurable via Ingress annotations.

Alternatives

We looked at managing TLS profiles via Terraform but due to our certificate renewal patterns (90 days) it's unfeasible, since someone would have to re-run Terraform periodically to upload new certificates to F5 (even if it's done via Terraform).

Additional context

There's a flag for setting default-ssl-profile on the controller, but this seems to work only on OpenShift?

NaurisSadovskis avatar Jun 15 '22 08:06 NaurisSadovskis