Merge ~mthaddon/charm-k8s-ingress/+git/charm-k8s-ingress:tls into charm-k8s-ingress:master

[Tom Haddon]

Add support for TLS

[🤖 prod-jenkaas-is (prod-jenkaas-is)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[🤖 prod-jenkaas-is (prod-jenkaas-is)]

PASSED: Continuous integration, rev:c8e467cd4432896107685a886826c85aea3ea0bd
https://jenkins.canonical.com/is/job/lp-charm-k8s-ingress-ci/5/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/is/job/lp-charm-test/35/
    None: https://jenkins.canonical.com/is/job/lp-update-mp/49240/

Click here to trigger a rebuild:
https://jenkins.canonical.com/is/job/lp-charm-k8s-ingress-ci/5//rebuild

review: Approve (continuous-integration)

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 1eac8971aa12609e24a5c2c4056093333ccdbbc4

diff --git a/config.yaml b/config.yaml
index fe2691d..e9d5df8 100644
--- a/config.yaml
+++ b/config.yaml
@@ -21,3 +21,7 @@ options:
     default: 0
     description: The port of the service to create an ingress for.
     type: int
+  tls_secret_name:
+    default: ""
+    description: The name of the TLS secret to use. Leaving this empty will configure an Ingress with TLS disabled.
+    type: string
diff --git a/src/charm.py b/src/charm.py
index 5e48538..7639bdb 100755
--- a/src/charm.py
+++ b/src/charm.py
@@ -102,34 +102,44 @@ class CharmK8SIngressCharm(CharmBase):
 
     def _get_k8s_ingress(self):
         """Get a K8s ingress definition."""
+        spec = kubernetes.client.NetworkingV1beta1IngressSpec(
+            rules=[
+                kubernetes.client.NetworkingV1beta1IngressRule(
+                    host=self.config["service-hostname"],
+                    http=kubernetes.client.NetworkingV1beta1HTTPIngressRuleValue(
+                        paths=[
+                            kubernetes.client.NetworkingV1beta1HTTPIngressPath(
+                                path="/",
+                                backend=kubernetes.client.NetworkingV1beta1IngressBackend(
+                                    service_port=self.config["service-port"],
+                                    service_name=self._service_name,
+                                ),
+                            )
+                        ]
+                    ),
+                )
+            ]
+        )
+        annotations = {
+            "nginx.ingress.kubernetes.io/rewrite-target": "/",
+        }
+        tls_secret_name = self.config.get("tls_secret_name")
+        if tls_secret_name:
+            spec.tls = kubernetes.client.NetworkingV1beta1IngressTLS(
+                hosts=[self.config["service-hostname"]],
+                secret_name=tls_secret_name,
+            )
+        else:
+            annotations["nginx.ingress.kubernetes.io/ssl-redirect"] = "false"
+
         return kubernetes.client.NetworkingV1beta1Ingress(
             api_version="networking.k8s.io/v1beta1",
             kind="Ingress",
             metadata=kubernetes.client.V1ObjectMeta(
                 name=self._ingress_name,
-                annotations={
-                    "nginx.ingress.kubernetes.io/rewrite-target": "/",
-                    "nginx.ingress.kubernetes.io/ssl-redirect": "false",
-                },
-            ),
-            spec=kubernetes.client.NetworkingV1beta1IngressSpec(
-                rules=[
-                    kubernetes.client.NetworkingV1beta1IngressRule(
-                        host=self.config["service-hostname"],
-                        http=kubernetes.client.NetworkingV1beta1HTTPIngressRuleValue(
-                            paths=[
-                                kubernetes.client.NetworkingV1beta1HTTPIngressPath(
-                                    path="/",
-                                    backend=kubernetes.client.NetworkingV1beta1IngressBackend(
-                                        service_port=self.config["service-port"],
-                                        service_name=self._service_name,
-                                    ),
-                                )
-                            ]
-                        ),
-                    )
-                ]
+                annotations=annotations,
             ),
+            spec=spec,
         )
 
     def _report_service_ips(self):
diff --git a/tests/unit/test_charm.py b/tests/unit/test_charm.py
index b861cb0..2d335c7 100644
--- a/tests/unit/test_charm.py
+++ b/tests/unit/test_charm.py
@@ -88,6 +88,41 @@ class TestCharm(unittest.TestCase):
             ),
         )
         self.assertEqual(self.harness.charm._get_k8s_ingress(), expected)
+        # Test with TLS.
+        expected = kubernetes.client.NetworkingV1beta1Ingress(
+            api_version="networking.k8s.io/v1beta1",
+            kind="Ingress",
+            metadata=kubernetes.client.V1ObjectMeta(
+                name="gunicorn-ingress",
+                annotations={
+                    "nginx.ingress.kubernetes.io/rewrite-target": "/",
+                },
+            ),
+            spec=kubernetes.client.NetworkingV1beta1IngressSpec(
+                rules=[
+                    kubernetes.client.NetworkingV1beta1IngressRule(
+                        host="foo.internal",
+                        http=kubernetes.client.NetworkingV1beta1HTTPIngressRuleValue(
+                            paths=[
+                                kubernetes.client.NetworkingV1beta1HTTPIngressPath(
+                                    path="/",
+                                    backend=kubernetes.client.NetworkingV1beta1IngressBackend(
+                                        service_port=80,
+                                        service_name="gunicorn-service",
+                                    ),
+                                )
+                            ]
+                        ),
+                    )
+                ],
+                tls=kubernetes.client.NetworkingV1beta1IngressTLS(
+                    hosts=["foo.internal"],
+                    secret_name="gunicorn_tls",
+                ),
+            ),
+        )
+        self.harness.update_config({"tls_secret_name": "gunicorn_tls"})
+        self.assertEqual(self.harness.charm._get_k8s_ingress(), expected)
 
     def test_get_k8s_service(self):
         """Test getting our definition of a k8s service."""