Skip to content

Commit 28422ec

Browse files
salonichf5salonichf5
committed
update flags
1 parent 713e146 commit 28422ec

File tree

11 files changed

+71
-71
lines changed

11 files changed

+71
-71
lines changed

‎charts/nginx-gateway-fabric/README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -245,7 +245,7 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
245245
| `nginx.usage.resolver` | The nameserver used to resolve the NGINX Plus usage reporting endpoint. Used with NGINX Instance Manager. | string | `""` |
246246
| `nginx.usage.secretName` | The name of the Secret containing the JWT for NGINX Plus usage reporting. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `"nplus-license"` |
247247
| `nginx.usage.skipVerify` | Disable client verification of the NGINX Plus usage reporting server certificate. | bool | `false` |
248-
| `nginxGateway` | The nginxGateway section contains configuration for the NGINX Gateway Fabric control plane deployment. | object | `{"affinity":{},"autoscaling":{"enable":false},"config":{"logging":{"level":"info"}},"configAnnotations":{},"extraVolumeMounts":[],"extraVolumes":[],"gatewayClassAnnotations":{},"gatewayClassName":"nginx","gatewayControllerName":"gateway.nginx.org/nginx-gateway-controller","gwAPIExperimentalFeatures":{"enable":false},"gwAPIInferenceExtension":{"enable":false,"endpointPicker":{"disableTLS":false,"enableSecureVerify":false}},"image":{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric","tag":"edge"},"kind":"deployment","labels":{},"leaderElection":{"enable":true,"lockName":""},"lifecycle":{},"metrics":{"enable":true,"port":9113,"secure":false},"name":"","nodeSelector":{},"podAnnotations":{},"productTelemetry":{"enable":true},"readinessProbe":{"enable":true,"initialDelaySeconds":3,"port":8081},"replicas":1,"resources":{},"service":{"annotations":{},"labels":{}},"serviceAccount":{"annotations":{},"imagePullSecret":"","imagePullSecrets":[],"name":""},"snippetsFilters":{"enable":false},"terminationGracePeriodSeconds":30,"tolerations":[],"topologySpreadConstraints":[]}` |
248+
| `nginxGateway` | The nginxGateway section contains configuration for the NGINX Gateway Fabric control plane deployment. | object | `{"affinity":{},"autoscaling":{"enable":false},"config":{"logging":{"level":"info"}},"configAnnotations":{},"extraVolumeMounts":[],"extraVolumes":[],"gatewayClassAnnotations":{},"gatewayClassName":"nginx","gatewayControllerName":"gateway.nginx.org/nginx-gateway-controller","gwAPIExperimentalFeatures":{"enable":false},"gwAPIInferenceExtension":{"enable":false,"endpointPicker":{"disableTLS":false,"skipSecureVerify":true}},"image":{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric","tag":"edge"},"kind":"deployment","labels":{},"leaderElection":{"enable":true,"lockName":""},"lifecycle":{},"metrics":{"enable":true,"port":9113,"secure":false},"name":"","nodeSelector":{},"podAnnotations":{},"productTelemetry":{"enable":true},"readinessProbe":{"enable":true,"initialDelaySeconds":3,"port":8081},"replicas":1,"resources":{},"service":{"annotations":{},"labels":{}},"serviceAccount":{"annotations":{},"imagePullSecret":"","imagePullSecrets":[],"name":""},"snippetsFilters":{"enable":false},"terminationGracePeriodSeconds":30,"tolerations":[],"topologySpreadConstraints":[]}` |
249249
| `nginxGateway.affinity` | The affinity of the NGINX Gateway Fabric control plane pod. | object | `{}` |
250250
| `nginxGateway.autoscaling` | Autoscaling configuration for the NGINX Gateway Fabric control plane. | object | `{"enable":false}` |
251251
| `nginxGateway.autoscaling.enable` | Enable or disable Horizontal Pod Autoscaler for the control plane. | bool | `false` |
@@ -258,9 +258,9 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
258258
| `nginxGateway.gatewayControllerName` | The name of the Gateway controller. The controller name must be of the form: DOMAIN/PATH. The controller's domain is gateway.nginx.org. | string | `"gateway.nginx.org/nginx-gateway-controller"` |
259259
| `nginxGateway.gwAPIExperimentalFeatures.enable` | Enable the experimental features of Gateway API which are supported by NGINX Gateway Fabric. Requires the Gateway APIs installed from the experimental channel. | bool | `false` |
260260
| `nginxGateway.gwAPIInferenceExtension.enable` | Enable Gateway API Inference Extension support. Allows for configuring InferencePools to route traffic to AI workloads. | bool | `false` |
261-
| `nginxGateway.gwAPIInferenceExtension.endpointPicker` | EndpointPicker TLS configuration. | object | `{"disableTLS":false,"enableSecureVerify":false}` |
261+
| `nginxGateway.gwAPIInferenceExtension.endpointPicker` | EndpointPicker TLS configuration. | object | `{"disableTLS":false,"skipSecureVerify":true}` |
262262
| `nginxGateway.gwAPIInferenceExtension.endpointPicker.disableTLS` | Disable TLS for EndpointPicker communication. By default, TLS is enabled. Set to true only for development/testing or when using a service mesh for encryption. | bool | `false` |
263-
| `nginxGateway.gwAPIInferenceExtension.endpointPicker.enableSecureVerify` | Enable TLS certificate verification when connecting to the EndpointPicker. By default, certificate verification is disabled. REQUIRED: Must be false until Gateway API Inference Extension EndpointPicker supports mounting certificates. See: https://github.com/kubernetes-sigs/gateway-api-inference-extension/issues/1556 | bool | `false` |
263+
| `nginxGateway.gwAPIInferenceExtension.endpointPicker.skipSecureVerify` | Disables TLS certificate verification when connecting to the EndpointPicker. By default, certificate verification is disabled. REQUIRED: Must be true until Gateway API Inference Extension EndpointPicker supports mounting certificates. See: https://github.com/kubernetes-sigs/gateway-api-inference-extension/issues/1556 | bool | `true` |
264264
| `nginxGateway.image` | The image configuration for the NGINX Gateway Fabric control plane. | object | `{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric","tag":"edge"}` |
265265
| `nginxGateway.image.repository` | The NGINX Gateway Fabric image to use | string | `"ghcr.io/nginx/nginx-gateway-fabric"` |
266266
| `nginxGateway.kind` | The kind of the NGINX Gateway Fabric installation - currently, only deployment is supported. | string | `"deployment"` |

‎charts/nginx-gateway-fabric/templates/deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ spec:
107107
- --endpoint-picker-disable-tls
108108
{{- end }}
109109
{{- if .Values.nginxGateway.gwAPIInferenceExtension.endpointPicker.enableSecureVerify }}
110-
- --endpoint-picker-enable-secure-verify
110+
- --endpoint-picker-tls-skip-verify
111111
{{- end }}
112112
{{- if .Values.nginxGateway.snippetsFilters.enable }}
113113
- --snippets-filters

‎charts/nginx-gateway-fabric/values.schema.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -857,11 +857,11 @@
857857
"title": "disableTLS",
858858
"type": "boolean"
859859
},
860-
"enableSecureVerify": {
861-
"default": false,
862-
"description": "Enable TLS certificate verification when connecting to the EndpointPicker.\nBy default, certificate verification is disabled.\nREQUIRED: Must be false until Gateway API Inference Extension EndpointPicker supports mounting certificates.\nSee: https://github.com/kubernetes-sigs/gateway-api-inference-extension/issues/1556",
860+
"skipSecureVerify": {
861+
"default": true,
862+
"description": "Disables TLS certificate verification when connecting to the EndpointPicker.\nBy default, certificate verification is disabled.\nREQUIRED: Must be true until Gateway API Inference Extension EndpointPicker supports mounting certificates.\nSee: https://github.com/kubernetes-sigs/gateway-api-inference-extension/issues/1556",
863863
"required": [],
864-
"title": "enableSecureVerify",
864+
"title": "skipSecureVerify",
865865
"type": "boolean"
866866
}
867867
},

‎charts/nginx-gateway-fabric/values.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -220,11 +220,11 @@ nginxGateway:
220220
# Set to true only for development/testing or when using a service mesh for encryption.
221221
disableTLS: false
222222

223-
# -- Enable TLS certificate verification when connecting to the EndpointPicker.
223+
# -- Disables TLS certificate verification when connecting to the EndpointPicker.
224224
# By default, certificate verification is disabled.
225-
# REQUIRED: Must be false until Gateway API Inference Extension EndpointPicker supports mounting certificates.
225+
# REQUIRED: Must be true until Gateway API Inference Extension EndpointPicker supports mounting certificates.
226226
# See: https://github.com/kubernetes-sigs/gateway-api-inference-extension/issues/1556
227-
enableSecureVerify: false
227+
skipSecureVerify: true
228228

229229

230230
snippetsFilters:

‎cmd/gateway/commands.go‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ const (
4141
agentTLSSecret = "agent-tls"
4242
nginxOneTelemetryEndpointHost = "agent.connect.nginx.com"
4343
endpointPickerDisableTLSFlag = "endpoint-picker-disable-tls"
44-
endpointPickerEnableSecureVerifyFlag = "endpoint-picker-enable-secure-verify"
44+
endpointPickerEnableSecureVerifyFlag = "endpoint-picker-tls-skip-verify"
4545
)
4646

4747
// usageReportParams holds the parameters for building the usage report configuration for PLUS.
@@ -165,8 +165,8 @@ func createControllerCommand() *cobra.Command {
165165
validator: validateResourceName,
166166
}
167167

168-
endpointPickerDisableTLS bool
169-
endpointPickerEnableSecureVerify bool
168+
endpointPickerDisableTLS bool
169+
endpointPickerSkipSecureVerify bool
170170
)
171171

172172
usageReportParams := usageReportParams{
@@ -293,8 +293,8 @@ func createControllerCommand() *cobra.Command {
293293
EndpointPort: nginxOneConsoleTelemetryEndpointPort.value,
294294
EndpointTLSSkipVerify: nginxOneConsoleTLSSkipVerify,
295295
},
296-
EndpointPickerDisableTLS: endpointPickerDisableTLS,
297-
EndpointPickerEnableSecureVerify: endpointPickerEnableSecureVerify,
296+
EndpointPickerDisableTLS: endpointPickerDisableTLS,
297+
EndpointPickerSkipSecureVerify: endpointPickerSkipSecureVerify,
298298
}
299299

300300
if err := controller.StartManager(conf); err != nil {
@@ -448,7 +448,7 @@ func createControllerCommand() *cobra.Command {
448448
"traffic to AI workloads.",
449449
)
450450

451-
addEPPConnectionFlags(cmd, endpointPickerDisableTLS, endpointPickerEnableSecureVerify)
451+
addEPPConnectionFlags(cmd, endpointPickerDisableTLS, endpointPickerSkipSecureVerify)
452452

453453
cmd.Flags().Var(
454454
&nginxDockerSecrets,
@@ -767,26 +767,26 @@ func createSleepCommand() *cobra.Command {
767767
}
768768

769769
func createEndpointPickerCommand() *cobra.Command {
770-
var endpointPickerDisableTLS, endpointPickerEnableSecureVerify bool
770+
var endpointPickerDisableTLS, endpointPickerSkipSecureVerify bool
771771
cmd := &cobra.Command{
772772
Use: "endpoint-picker",
773773
Short: "Shim server for communication between NGINX and the Gateway API Inference Extension Endpoint Picker",
774774
RunE: func(_ *cobra.Command, _ []string) error {
775775
logger := ctlrZap.New().WithName("endpoint-picker-shim")
776776
handler := createEndpointPickerHandler(
777-
realExtProcClientFactory(endpointPickerDisableTLS, endpointPickerEnableSecureVerify),
777+
realExtProcClientFactory(endpointPickerDisableTLS, endpointPickerSkipSecureVerify),
778778
logger,
779779
)
780780
return endpointPickerServer(handler)
781781
},
782782
}
783783

784-
addEPPConnectionFlags(cmd, endpointPickerDisableTLS, endpointPickerEnableSecureVerify)
784+
addEPPConnectionFlags(cmd, endpointPickerDisableTLS, endpointPickerSkipSecureVerify)
785785

786786
return cmd
787787
}
788788

789-
func addEPPConnectionFlags(cmd *cobra.Command, disableTLS, enableSecureVerify bool) {
789+
func addEPPConnectionFlags(cmd *cobra.Command, disableTLS, skipSecureVerify bool) {
790790
cmd.Flags().BoolVar(
791791
&disableTLS,
792792
endpointPickerDisableTLSFlag,
@@ -796,11 +796,11 @@ func addEPPConnectionFlags(cmd *cobra.Command, disableTLS, enableSecureVerify bo
796796
)
797797

798798
cmd.Flags().BoolVar(
799-
&enableSecureVerify,
799+
&skipSecureVerify,
800800
endpointPickerEnableSecureVerifyFlag,
801-
false,
802-
"Enables server certificate verification when connecting to the EndpointPicker, if TLS is enabled. "+
803-
"REQUIRED: Must be false until Gateway API Inference Extension EndpointPicker supports mounting certificates.",
801+
true,
802+
"Disables server certificate verification when connecting to the EndpointPicker, if TLS is enabled. "+
803+
"REQUIRED: Must be true until Gateway API Inference Extension EndpointPicker supports mounting certificates.",
804804
)
805805
}
806806

‎cmd/gateway/commands_test.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ func TestControllerCmdFlagValidation(t *testing.T) {
162162
"--nginx-one-telemetry-endpoint-port=443",
163163
"--nginx-one-tls-skip-verify",
164164
"--endpoint-picker-disable-tls",
165-
"--endpoint-picker-enable-secure-verify",
165+
"--endpoint-picker-tls-skip-verify",
166166
},
167167
wantErr: false,
168168
},
@@ -934,15 +934,15 @@ func TestEndpointPickerFlags(t *testing.T) {
934934
name: "valid flags with default values",
935935
args: []string{
936936
"--endpoint-picker-disable-tls=false",
937-
"--endpoint-picker-enable-secure-verify=false",
937+
"--endpoint-picker-tls-skip-verify=true",
938938
},
939939
wantErr: false,
940940
},
941941
{
942942
name: "valid flags with changed values",
943943
args: []string{
944944
"--endpoint-picker-disable-tls=true",
945-
"--endpoint-picker-enable-secure-verify=true",
945+
"--endpoint-picker-tls-skip-verify=false",
946946
},
947947
wantErr: false,
948948
},
@@ -956,12 +956,12 @@ func TestEndpointPickerFlags(t *testing.T) {
956956
` strconv.ParseBool: parsing "not-a-bool": invalid syntax`,
957957
},
958958
{
959-
name: "endpoint-picker-enable-secure-verify is not a bool",
959+
name: "endpoint-picker-tls-skip-verify is not a bool",
960960
args: []string{
961-
"--endpoint-picker-enable-secure-verify=not-a-bool",
961+
"--endpoint-picker-tls-skip-verify=not-a-bool",
962962
},
963963
wantErr: true,
964-
expectedErrPrefix: `invalid argument "not-a-bool" for "--endpoint-picker-enable-secure-verify" flag:` +
964+
expectedErrPrefix: `invalid argument "not-a-bool" for "--endpoint-picker-tls-skip-verify" flag:` +
965965
` strconv.ParseBool: parsing "not-a-bool": invalid syntax`,
966966
},
967967
}

‎internal/controller/config/config.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,8 @@ type Config struct {
5454
SnippetsFilters bool
5555
// EndpointPickerDisableTLS indicates if TLS is disabled for EndpointPicker communication.
5656
EndpointPickerDisableTLS bool
57-
// EndpointPickerEnableSecureVerify indicates if secure verification is enabled for EndpointPicker communication.
58-
EndpointPickerEnableSecureVerify bool
57+
// EndpointPickerSkipSecureVerify indicates if secure verification is skipped for EndpointPicker communication.
58+
EndpointPickerSkipSecureVerify bool
5959
}
6060

6161
// GatewayPodConfig contains information about this Pod.

‎internal/controller/manager.go‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -208,21 +208,21 @@ func StartManager(cfg config.Config) error {
208208
ctx,
209209
mgr,
210210
provisioner.Config{
211-
DeploymentStore: nginxUpdater.NginxDeployments,
212-
StatusQueue: statusQueue,
213-
Logger: cfg.Logger.WithName("provisioner"),
214-
EventRecorder: recorder,
215-
GatewayPodConfig: &cfg.GatewayPodConfig,
216-
GCName: cfg.GatewayClassName,
217-
AgentTLSSecretName: cfg.AgentTLSSecretName,
218-
NGINXSCCName: cfg.NGINXSCCName,
219-
Plus: cfg.Plus,
220-
NginxDockerSecretNames: cfg.NginxDockerSecretNames,
221-
PlusUsageConfig: &cfg.UsageReportConfig,
222-
NginxOneConsoleTelemetryConfig: cfg.NginxOneConsoleTelemetryConfig,
223-
InferenceExtension: cfg.InferenceExtension,
224-
EndpointPickerDisableTLS: cfg.EndpointPickerDisableTLS,
225-
EndpointPickerEnableSecureVerify: cfg.EndpointPickerEnableSecureVerify,
211+
DeploymentStore: nginxUpdater.NginxDeployments,
212+
StatusQueue: statusQueue,
213+
Logger: cfg.Logger.WithName("provisioner"),
214+
EventRecorder: recorder,
215+
GatewayPodConfig: &cfg.GatewayPodConfig,
216+
GCName: cfg.GatewayClassName,
217+
AgentTLSSecretName: cfg.AgentTLSSecretName,
218+
NGINXSCCName: cfg.NGINXSCCName,
219+
Plus: cfg.Plus,
220+
NginxDockerSecretNames: cfg.NginxDockerSecretNames,
221+
PlusUsageConfig: &cfg.UsageReportConfig,
222+
NginxOneConsoleTelemetryConfig: cfg.NginxOneConsoleTelemetryConfig,
223+
InferenceExtension: cfg.InferenceExtension,
224+
EndpointPickerDisableTLS: cfg.EndpointPickerDisableTLS,
225+
EndpointPickerSkipSecureVerify: cfg.EndpointPickerSkipSecureVerify,
226226
},
227227
)
228228
if err != nil {

‎internal/controller/provisioner/objects.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1129,8 +1129,8 @@ func (p *NginxProvisioner) buildNginxPodTemplateSpec(
11291129
if p.cfg.EndpointPickerDisableTLS {
11301130
command = append(command, "--endpoint-picker-disable-tls")
11311131
}
1132-
if p.cfg.EndpointPickerEnableSecureVerify {
1133-
command = append(command, "--endpoint-picker-enable-secure-verify")
1132+
if p.cfg.EndpointPickerSkipSecureVerify {
1133+
command = append(command, "--endpoint-picker-tls-skip-verify")
11341134
}
11351135

11361136
spec.Spec.Containers = append(spec.Spec.Containers, corev1.Container{

‎internal/controller/provisioner/objects_test.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1784,10 +1784,10 @@ func TestBuildNginxResourceObjects_InferenceExtension(t *testing.T) {
17841784
GatewayPodConfig: &config.GatewayPodConfig{
17851785
Namespace: ngfNamespace,
17861786
},
1787-
AgentTLSSecretName: agentTLSTestSecretName,
1788-
InferenceExtension: true,
1789-
EndpointPickerDisableTLS: true,
1790-
EndpointPickerEnableSecureVerify: true,
1787+
AgentTLSSecretName: agentTLSTestSecretName,
1788+
InferenceExtension: true,
1789+
EndpointPickerDisableTLS: true,
1790+
EndpointPickerSkipSecureVerify: true,
17911791
},
17921792
k8sClient: fakeClient,
17931793
baseLabelSelector: metav1.LabelSelector{
@@ -1821,7 +1821,7 @@ func TestBuildNginxResourceObjects_InferenceExtension(t *testing.T) {
18211821
"/usr/bin/gateway",
18221822
"endpoint-picker",
18231823
"--endpoint-picker-disable-tls",
1824-
"--endpoint-picker-enable-secure-verify",
1824+
"--endpoint-picker-tls-skip-verify",
18251825
}
18261826

18271827
g.Expect(deployment).ToNot(BeNil())

0 commit comments

Comments
 (0)