Repository: zalando-incubator/kube-ingress-aws-controller
Pull request #403 (2021-02-16 14:13:43)

Fix README on deny internal domains usage
This commit fixes the usage indication of the `--deny-internal-domain`.
[Kingpin][0] generates a negation flag instead of supporting the values
`true` or `false`.

[0]: https://github.com/alecthomas/kingpin

jonathanbeber: :+1: 

jonathanbeber: :+
jonathanbeber: :+1: 
mikkeloscar: :+1: 

Patch:
diff --git a/README.md b/README.md
index 9c0a8dc..1f0ddf9 100644
--- a/README.md
+++ b/README.md
@@ -375,7 +375,8 @@ values from the `--internal-domains` flag and the
 default. The following are the default values to its config flags:
 
 - `internal-domains`: `*.cluster.local`
-- `deny-internal-domains`: `false`
+- `deny-internal-domains`: `false` (same as explicitly passing
+  `--no-deny-internal-domains`)
 - `deny-internal-domains-response`: `Unauthorized`
 - `deny-internal-domains-response-content-type`: `text/plain`
 - `deny-internal-domains-response-status-code`: `401`
@@ -392,7 +393,7 @@ This feature is not supported by NLBs.
 
 Example:
 
-Running the controller with `--deny-internal-domains=true` and
+Running the controller with `--deny-internal-domains` and
 `--internal-domains=*.cluster.local` will generate a rule in the ALB
 that matches any request to domains ending in `.cluster.local` and answer
 the request with an [HTTP 401 Unauthorized][401].
diff --git a/aws/cf_template.go b/aws/cf_template.go
index 86b9324..3bf8b3c 100644
--- a/aws/cf_template.go
+++ b/aws/cf_template.go
@@ -151,7 +151,8 @@ func generateTemplate(spec *stackSpec) (string, error) {
 			Port:            cloudformation.Integer(80),
 			Protocol:        cloudformation.String(protocol),
 		})
-		if spec.denyInternalDomains {
+		// Just ALBs support Rules
+		if spec.denyInternalDomains && spec.loadbalancerType == LoadBalancerTypeApplication {
 			template.AddResource(
 				"HTTPRuleBlockInternalTraffic",
 				generateDenyInternalTrafficRule(
@@ -193,7 +194,8 @@ func generateTemplate(spec *stackSpec) (string, error) {
 			Protocol:        cloudformation.String(tlsProtocol),
 			SslPolicy:       cloudformation.Ref(parameterListenerSslPolicyParameter).String(),
 		})
-		if spec.denyInternalDomains {
+		// Just ALBs support Rules
+		if spec.denyInternalDomains && spec.loadbalancerType == LoadBalancerTypeApplication {
 			template.AddResource(
 				"HTTPSRuleBlockInternalTraffic",
 				generateDenyInternalTrafficRule(


Test patch:
diff --git a/aws/cf_template_test.go b/aws/cf_template_test.go
index 33a9219..16860e9 100644
--- a/aws/cf_template_test.go
+++ b/aws/cf_template_test.go
@@ -341,6 +341,20 @@ func TestGenerateTemplate(t *testing.T) {
 				require.NotContains(t, template.Resources, "HTTPRuleBlockInternalTraffic")
 			},
 		},
+		{
+			name: "Does not create deny internal traffic rule on NLBs",
+			spec: &stackSpec{
+				loadbalancerType: LoadBalancerTypeNetwork,
+				certificateARNs:  map[string]time.Time{"domain.company.com": time.Now()},
+				nlbHTTPEnabled:   true,
+
+				denyInternalDomains: true,
+			},
+			validate: func(t *testing.T, template *cloudformation.Template) {
+				require.NotContains(t, template.Resources, "HTTPSRuleBlockInternalTraffic")
+				require.NotContains(t, template.Resources, "HTTPRuleBlockInternalTraffic")
+			},
+		},
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			generated, err := generateTemplate(test.spec)