Unable to use openshift HA proxy for cluster-wide TLS configuration

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

Configured to use openshift ingress

ssp.ingress.type: "openshiftroute"
ssp.ingress.ingressClassName: "default-ingress"

When updated with the above parameters, the ingress is configured with tls configuration. Such as:

 tls:
  - hosts:
    - <HOST>.example.com
    secretName: ssp-keys-isk

However, HAProxy is configured cluster-wide for TLS and rejects the above configuration. The recommended way is to skip the TLS entirely, or to declare it like below

 tls:
  - {}

Do not see any setting in the SSP chart to be able to remove it.

Environment

IDSP: Authentication Hub 4.0.3 or prior

Resolution

IDSP 4.0.4 is now officially available.

 

In this new release, it has the fix for it, which addresses this specific problem.

 

In release 4.0.4, just need to pass: ssp.ingress.tls.enabled=false and the chart will emit "tls: {}".

Additional Information

4.0.4 Release Notes: https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/identity-security-platform/4-0/isp-release-notes/release-notes-4-0-4.html

Ingress Parameters: https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/identity-security-platform/4-0/Installing/modes-of-deployment/configuring-gateway-api-for-ingress/gateway-api-setup-and-ingress-configuration-reference.html