Uploaded image for project: 'OpenShift Request For Enhancement'
  1. OpenShift Request For Enhancement
  2. RFE-3605

[RFE] Allow users to pass their own CRL configmaps to ingresscontroller or CRL distribution points defined on ingress

XMLWordPrintable

    • Icon: Feature Request Feature Request
    • Resolution: Done
    • Icon: Major Major
    • None
    • None
    • Network Edge
    • False
    • None
    • False
    • Not Selected
    • 0
    • 0% 0%

      1. Proposed title of this feature request

            Allow users to pass their own CRL configmaps to ingresscontroller resource or CRL distribution points defined on ingresscontroller

      2. What is the nature and description of the request?

       

      Allow user to manually manage their CRL or CRL distribution points if desired vs having the ingress operator create it based on the CRL distribution points provided by certs in the the clientCA.  

       

      Example would be a user providing a configmap in project openshift-config containing the CRLs
      IngressController Object:

      ```
      spec:
        clientTLS:
          clientCA:
            name: router-ca-certs-default
          clientCRL:
            name: router-ca-crl-default
          clientCertificatePolicy: Required
      ```

      or

      ```

      spec:
        clientTLS:
          clientCA:
            name: router-ca-certs-default
          clientCrlDP:
             - name: rootclientca

               uri: cdp.rootcacrl.mydomain

             - name: Intermediateclientca

               uri: cdp.intermediateclientcacrl.mydomain

          clientCertificatePolicy: Required
      ```

       

        
      3. Why does the customer need this? (List the business requirements here)

        The CRL distribution points for an intermediate CA will be defined on the client cert and due to this a client cert with this info needs to be added to the clientCA in order for haproxy handle mTLS. Manual creation of the configmap that contains the CRLs, allows users to avoid adding their client certs to the cleintCA. 

      4. List any affected packages or components.

       Ingresscontroller operator

       

            ddharwar@redhat.com Deepthi Dharwar
            rhn-support-rhowe Ryan Howe
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated:
              Resolved: