MINOR: kubernetes-ingress: add TLS ticket keys support

kubernetes-ingress/Chart.yaml

@@ -16,7 +16,7 @@ apiVersion: v2
 name: kubernetes-ingress
 description: A Helm chart for HAProxy Kubernetes Ingress Controller
 type: application
-version: 1.54.4
+version: 1.55.0
 appVersion: 3.2.19
 kubeVersion: ">=1.23.0-0"
 keywords:

kubernetes-ingress/README.md

@@ -477,6 +477,10 @@ To override defaults, either pass a values file with `-f my-values.yaml` (recomm
 | `controller.extraContainers` | Additional sidecar containers. | `[]` |
 | `controller.extraVolumeMounts` | Extra `volumeMounts` on the controller container (needed e.g. when running with `readOnlyRootFilesystem`). | `[]` |
 | `controller.extraVolumes` | Extra `volumes` on the pod. | `[]` |
+| `controller.tlsTicketKeys.enabled` | Mount a Secret with TLS session ticket keys and set the `tls-ticket-keys` controller config key (shared across replicas). | `false` |
+| `controller.tlsTicketKeys.existingSecret` | Existing Secret holding the ticket keys file (3 base64 keys, one per line). Required when enabled. | `""` |
+| `controller.tlsTicketKeys.secretKey` | Key of the file inside the Secret. | `tls-ticket-keys` |
+| `controller.tlsTicketKeys.mountPath` | Directory where the Secret file is mounted. | `/etc/haproxy/tls-ticket-keys` |
 
 ### Prometheus integrations (ServiceMonitor / PodMonitor)
 

kubernetes-ingress/ci/daemonset-tlsticketkeys-values.yaml

@@ -0,0 +1,5 @@
+controller:
+  kind: DaemonSet
+  tlsTicketKeys:
+    enabled: true
+    existingSecret: tls-ticket-keys

kubernetes-ingress/ci/deployment-tlsticketkeys-values.yaml

@@ -0,0 +1,5 @@
+controller:
+  kind: Deployment
+  tlsTicketKeys:
+    enabled: true
+    existingSecret: tls-ticket-keys

kubernetes-ingress/templates/_podspec.tpl

@@ -275,6 +275,11 @@ containers:
       {{- else if gt (len $ctlr.extraVolumeMounts) 0 }}
 {{ toYaml $ctlr.extraVolumeMounts | indent 6 }}
       {{- end }}
+      {{- if and $ctlr.tlsTicketKeys $ctlr.tlsTicketKeys.enabled }}
+      - name: tls-ticket-keys
+        mountPath: {{ $ctlr.tlsTicketKeys.mountPath }}
+        readOnly: true
+      {{- end }}
       {{- if $ctlr.auxiliaryConfig }}
       - name: haproxy-aux-cfg
         mountPath: /etc/haproxy/haproxy-aux.cfg
@@ -304,6 +309,14 @@ volumes:
   {{- else if gt (len $ctlr.extraVolumes) 0 }}
 {{ toYaml $ctlr.extraVolumes | indent 2 }}
   {{- end }}
+  {{- if and $ctlr.tlsTicketKeys $ctlr.tlsTicketKeys.enabled }}
+  - name: tls-ticket-keys
+    secret:
+      secretName: {{ required "controller.tlsTicketKeys.existingSecret is required when controller.tlsTicketKeys.enabled is true" $ctlr.tlsTicketKeys.existingSecret }}
+      items:
+        - key: {{ $ctlr.tlsTicketKeys.secretKey }}
+          path: {{ $ctlr.tlsTicketKeys.secretKey }}
+  {{- end }}
   {{- if $ctlr.auxiliaryConfig }}
   - name: haproxy-aux-cfg
     configMap:

kubernetes-ingress/templates/controller-configmap.yaml

@@ -25,7 +25,11 @@ metadata:
   annotations:
 {{ toYaml .Values.controller.configAnnotations | indent 4 }}
 {{- end }}
-{{- if or .Values.controller.logging.traffic .Values.controller.config }}
+{{- $tlsTicketKeys := .Values.controller.tlsTicketKeys | default dict }}
+{{- if and $tlsTicketKeys.enabled (not $tlsTicketKeys.existingSecret) }}
+{{- fail "controller.tlsTicketKeys.existingSecret is required when controller.tlsTicketKeys.enabled is true" }}
+{{- end }}
+{{- if or .Values.controller.logging.traffic .Values.controller.config $tlsTicketKeys.enabled }}
 data:
 {{- if .Values.controller.logging.traffic }}
   syslog-server: {{ include "kubernetes-ingress.syslogServer" . }}
@@ -37,4 +41,14 @@ data:
 {{ toYaml .Values.controller.config | indent 2 }}
 {{- end }}
 {{- end }}
+{{- if $tlsTicketKeys.enabled }}
+{{- /* A user-set controller.config["tls-ticket-keys"] wins */}}
+{{- if eq "string" (printf "%T" .Values.controller.config) }}
+{{- if not (regexMatch "(?m)^\\s*tls-ticket-keys:" (tpl .Values.controller.config .)) }}
+  tls-ticket-keys: {{ printf "%s/%s" $tlsTicketKeys.mountPath $tlsTicketKeys.secretKey | quote }}
+{{- end }}
+{{- else if not (hasKey (.Values.controller.config | default dict) "tls-ticket-keys") }}
+  tls-ticket-keys: {{ printf "%s/%s" $tlsTicketKeys.mountPath $tlsTicketKeys.secretKey | quote }}
+{{- end }}
+{{- end }}
 {{- end }}

kubernetes-ingress/values.yaml

@@ -612,6 +612,16 @@ controller:
     #   command: ["/bin/sh"]
     #   args: ["-c", "while true; do date; sleep 5;done"]
 
+  ## Share TLS session ticket keys across replicas (sets the `tls-ticket-keys` controller config key)
+  ## Rotation of the Secret content is up to the user
+  tlsTicketKeys:
+    enabled: false
+    ## Existing Secret holding the ticket keys file (3 base64 keys, one per line)
+    existingSecret: ""
+    ## Key of the file inside the Secret
+    secretKey: tls-ticket-keys
+    mountPath: /etc/haproxy/tls-ticket-keys
+
   ## Additional volumeMounts to the controller main container
   extraVolumeMounts: []
     ## Example empty volume mounts when using securityContext->readOnlyRootFilesystem