-
Feature Request
-
Resolution: Done
-
Major
-
None
-
None
-
False
-
None
-
False
-
Not Selected
-
-
-
-
-
1. Proposed title of this feature request
Allow users to pass their own CRL configmaps to ingresscontroller resource or CRL distribution points defined on ingresscontroller
2. What is the nature and description of the request?
Allow user to manually manage their CRL or CRL distribution points if desired vs having the ingress operator create it based on the CRL distribution points provided by certs in the the clientCA.
Example would be a user providing a configmap in project openshift-config containing the CRLs
IngressController Object:
```
spec:
clientTLS:
clientCA:
name: router-ca-certs-default
clientCRL:
name: router-ca-crl-default
clientCertificatePolicy: Required
```
or
```
spec:
clientTLS:
clientCA:
name: router-ca-certs-default
clientCrlDP:
- name: rootclientca
uri: cdp.rootcacrl.mydomain
- name: Intermediateclientca
uri: cdp.intermediateclientcacrl.mydomain
clientCertificatePolicy: Required
```
3. Why does the customer need this? (List the business requirements here)
The CRL distribution points for an intermediate CA will be defined on the client cert and due to this a client cert with this info needs to be added to the clientCA in order for haproxy handle mTLS. Manual creation of the configmap that contains the CRLs, allows users to avoid adding their client certs to the cleintCA.
4. List any affected packages or components.
Ingresscontroller operator
- is duplicated by
-
RFE-5016 Allow to define CRLs when configuring mtls on OpenShift ingress
- Accepted