github.com/projectcontour/contour@v1.28.2/site/content/posts/2020-04-27-client-cert-auth-ingress-improvements.md (about)

     1  ---
     2  title: Client Certificate Authentication and Ingress improvements in Contour 1.4
     3  excerpt: Contour 1.4 adds support for client certificate authentication to HTTPProxy objects. Additionally, some Ingress behaviors are fixed - Ingress addresses are now recorded correctly, and Contour's `--ingress-class` argument behaves more as you would expect. 
     4  author_name: Nick Young
     5  author_avatar: /img/contributors/nick-young.png
     6  categories: [kubernetes]
     7  # Tag should match author to drive author pages
     8  tags: ['Contour Team', 'Nick Young', 'release']
     9  date: 2020-04-27
    10  slug: client-cert-auth-ingress-improvements
    11  ---
    12  
    13  Our latest release of Contour is 1.4, which includes support for Client Certificate authentication in your HTTPProxy objects, and also updates Contour’s Ingress support to fix some missing or incorrect behaviors. In addition Contour 1.4 upgrades Envoy to 1.14.1, to keep up with Envoy’s current supported version.
    14  
    15  ## TLS Client authentication
    16  
    17  This release adds support for client authentication through the use of certificates.
    18  
    19  So what does this mean? Well, you can now configure your HTTPProxy routes so that they require a client certificate supplied by your client (usually your browser), which allows you to use that client certificate for authentication.
    20  
    21  To use this feature, add the new `clientValidation` field to the `tls` stanza of your HTTPProxy document:
    22  
    23  ```
    24  apiVersion: projectcontour.io/v1
    25  kind: HTTPProxy
    26  metadata:
    27    name: with-client-auth
    28  spec:
    29    virtualhost:
    30      fqdn: www.example.com
    31      tls:
    32        secretName: secret
    33        clientValidation:                  
    34          caSecret: client-root-ca
    35    routes:
    36      - services:
    37          - name: s1
    38            port: 80
    39  
    40  ```
    41  
    42  The `caSecret` field is a reference to a Kubernetes Secret that holds the CA certificate used to validate the client certificate. The Secret must contain a `ca.crt` key that holds a PEM-encoded bundle of the full trust chain for any CA used to validate certificates.
    43  
    44  It’s important to note that this only provides *authentication*, not *authorization*. To put this another way, Contour and Envoy can only give you a guarantee that the supplied person is the bearer of a valid certificate, not they are allowed to do something.
    45  
    46  Thanks very much to [@tsaarni](https://github.com/tsaarni) for getting this implemented!
    47  
    48  ## Ingress changes
    49  
    50  ### Ingress class
    51  
    52  Before this release of Contour, when configured to accept a certain `ingress.class` annotation, Contour would watch objects with that annotation and *also* with *no annotation*. This caused problems in clusters with more than one ingress controller.
    53  
    54  Starting with Contour 1.4, having an `ingress.class` annotation configured means that *only* objects that have a matching annotation will cause changes in Contour.
    55  
    56  Note that this logic change applies to both Ingress and HTTPProxy objects.
    57  
    58  If you don’t give Contour an `ingress.class` on its command line, then Contour will look at all objects with no `ingress.class`, *and* objects with an `ingress.class` of `contour`. This preserves the old behavior so that we don’t break you if that’s what you expect.
    59  
    60  ### Ingress Status
    61  
    62  Contour now has the ability to write a `status.loadBalancer.addresses` block to Ingress objects. This block is used by services which need to know how to reach an Ingress' backing service from outside the cluster, like [external-dns](https://github.com/kubernetes-sigs/external-dns).
    63  
    64  There are two ways for Contour to find this information:
    65  - by watching a Service object for the Envoy service, and putting the associated `status.loadBalancer` block from that Service into all associated Ingress objects. This is what is used in the example deployment.
    66  - Operators can also specify an address on Contour's command line, using the `--ingress-status-address` flag. The address that’s passed on the command line will be passed straight through to the Ingress status.
    67  
    68  This also means that when you `kubectl get` a Contour-owned Ingress, instead of this:
    69  
    70  ```
    71  $ kubectl get ingress httpbin
    72  NAME      HOSTS                   ADDRESS   PORTS     AGE
    73  httpbin   httpbin.youngnick.dev             80, 443   336d
    74  ```
    75  you will see this:
    76  
    77  ```
    78  $ kubectl get ingress httpbin
    79  NAME      HOSTS                   ADDRESS   PORTS     AGE
    80  httpbin   httpbin.youngnick.dev   x.x.x.x   80, 443   336d
    81  
    82  ```
    83  
    84  ### Removed the `--use-extensions-v1beta1-ingress` flag
    85  
    86  The `--use-extensions-v1beta1-ingress` flag was removed from the contour serve command in Contour 1.3. If you have a previous deployment that specifies this command, you must remove it or Contour will fail to start.
    87  
    88  ## Future Plans
    89  
    90  The Contour project is very community-driven and the team would love to hear your feedback! 
    91  
    92  - Come talk about topics at our next community meeting.
    93  - We’ve heard that a number of teams have forked Contour and we would love to hear about what changes you needed, and to see if we can help to bring them upstream.
    94  Please consider coming to our community meeting, or contact us: either via an issue, or hit me up on Twitter [@youngnick](https://twitter.com/youngnick).
    95  
    96  If you are interested in contributing, a great place to start is to comment on one of the issues labeled with [Help Wanted]({{< param github_url >}}/issues?utf8=%E2%9C%93&q=is%3Aopen+is%3Aissue+label%3A%22Help+wanted%22+) and work with the team on how to resolve them. 
    97  
    98  ## Are you a Contour user? We would love to know!
    99  If you're using Contour and want to add your organization to our adopters list, please visit this [page](https://github.com/projectcontour/contour/blob/main/ADOPTERS.md).
   100  If you prefer to keep your organization name anonymous but still give us feedback into your usage and scenarios for Contour, please post on this [GitHub thread](https://github.com/projectcontour/contour/issues/1269)          
   101  
   102  ## Thanks to our contributors
   103  
   104  We’re immensely grateful for all the community contributions that help make Contour even better! Special thanks go out to:
   105  - Tero Saarni ([@tsaarni](https://github.com/tsaarni))
   106  - Peter Grant ([@pickledrick](https://github.com/pickledrick))