Skip to content

Added SNI support for JWT secrets retrieved from HTTPS URL #7500

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 12 commits into
base: main
Choose a base branch
from
Open
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,16 @@ For example, if you want to use version 3.5.1, the command would be `git clone h

This guide assumes you are using the latest release.

Change the active directory.

```shell
cd kubernetes-ingress
```

### App Protect DoS

To use App Protect DoS, install the App Protect DoS Arbitrator using the provided manifests in the same namespace as the NGINX Ingress Controller. If you install multiple NGINX Ingress Controllers in the same namespace, they will need to share the same Arbitrator because there can only be one Arbitrator in a single namespace.

---

## Set up role-based access control (RBAC) {#configure-rbac}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ To pull an image, follow these steps. Replace `<version-tag>` with the specific
docker pull private-registry.nginx.com/nginx-ic-dos/nginx-plus-ingress:<version-tag>
```

- For NGINX Plus Ingress Controller with NGINX App Protect WAF and DoS, run:
- For NGINX Plus Ingress Controller with NGINX App Protect WAF and NGINX App Protect DoS, run:

```shell
docker pull private-registry.nginx.com/nginx-ic-nap-dos/nginx-plus-ingress:<version-tag>
Expand Down
2 changes: 2 additions & 0 deletions internal/configs/version2/nginx-plus.virtualserver.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -216,6 +216,8 @@ server {
{{- end }}
{{- with .JwksURI }}
proxy_set_header Host {{ .JwksHost }};
proxy_ssl_name {{ .JwksHost }};
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is not needed. By default the value of proxy_ssl_name is the host part of the proxy_pass URL, which is defined 4 lines later.

I've asked about the port part of the URL though, so we might still need this.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, this probably isn't needed. Could be moved to be after the line set $idp_backend with the value proxy_ssl_name $idp_backend

proxy_ssl_server_name on;
set $idp_backend {{ .JwksHost }};
proxy_pass {{ .JwksScheme}}://$idp_backend{{ if .JwksPort }}:{{ .JwksPort }}{{ end }}{{ .JwksPath }};
{{- end }}
Expand Down