TLS: allow support for different protocols on different hosts (same m…

[lianglli]

…achine) based on ingress

[lianglli]

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/canary-weight-total: "1000"
    nginx.ingress.kubernetes.io/ssl-protocols: TLSv1.2 TLSv1.3
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  creationTimestamp: "2023-10-30T09:33:15Z"
  generation: 1
  name: tengine-ingress-echo-ing
  namespace: default
  resourceVersion: "28867854"
  uid: 34ff03fa-0e52-4ff4-b992-3b3625664cba
spec:
  ingressClassName: opensource-ingress
  rules:
  - host: echo.w1.com
    http:
      paths:
      - backend:
          service:
            name: tengine-ingress-echo-service
            port:
              number: 80
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - echo.w1.com
    secretName: https-server-1
status:
  loadBalancer:
    ingress:
    - {}

$ ./curl -i -k --tlsv1.0 --tls-max 1.0 https://echo.w1.com
curl: (35) error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version

$ ./curl -i -k --tlsv1.1 --tls-max 1.1 https://echo.w1.com
curl: (35) error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version

$ ./curl -i -k --tlsv1.2 --tls-max 1.2 https://echo.w1.com
HTTP/2 200 
server: Tengine/3.1.0
date: Thu, 02 Nov 2023 07:05:11 GMT
content-type: text/plain; charset=utf-8
content-length: 7
strict-transport-security: max-age=31536000
ups-target-key: default-tengine-ingress-echo-service-80
x-protocol: HTTP/2.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

echo ok

$ ./curl -i -k --tlsv1.3 --tls-max 1.3 https://echo.w1.com
HTTP/2 200 
server: Tengine/3.1.0
date: Thu, 02 Nov 2023 07:05:19 GMT
content-type: text/plain; charset=utf-8
content-length: 7
strict-transport-security: max-age=31536000
ups-target-key: default-tengine-ingress-echo-service-80
x-protocol: HTTP/2.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000