Skip to content

[occm] Support backend re-encryption #3113

@pawcykca

Description

@pawcykca

/kind feature

What happened:
Currently, when creating a LoadBalancer with the annotations "loadbalancer.openstack.org/x-forwarded-for" and "loadbalancer.openstack.org/default-tls-container-ref" the connection between the LB and the K8S Worker Node is not encrypted, and encryption cannot be enabled (no annotations or other configuration method are available).

--enable-tls

What you expected to happen:
I wanted to be able to enable encryption for the connection between the LoadBalancer and the K8S Worker Node via an annotation. This can be done manually by setting the "--enable-tls" parameter for the LoadBalancer pool created by OCCM.

How to reproduce it:

  1. Create LoadBalancer service using below annotations:
    loadbalancer.openstack.org/x-forwarded-for: "true"
    loadbalancer.openstack.org/default-tls-container-ref: "..."
  2. Set "--enable-tls" for LoadBalancer HTTPS listener's pool created by OCCM

Anything else we need to know?:
Docs describing how to create LB with backend re-encryption
https://docs.openstack.org/octavia/latest/user/guides/basic-cookbook.html#deploy-a-http-2-load-balancer-with-alpn-tls-extension-and-backend-re-encryption

Environment:

  • openstack-cloud-controller-manager(or other related binary) version: v1.34.1
  • OpenStack version: 2024.01

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/featureCategorizes issue or PR as related to a new feature.

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions