-
Notifications
You must be signed in to change notification settings - Fork 671
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Gateway API: support TLS termination with TLSRoute/TCPRoute #5481
Conversation
internal/xdscache/v3/listener.go
Outdated
) | ||
|
||
tcpProxyFilter := envoy_v3.TCPProxy(listener.Name, listener.TCPProxy, cfg.newInsecureAccessLog()) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This ends up duplicating some of the code from the existing SecureVirtualHost + TCPProxy code path. It might be possible to change the implementation for TCPRoutes to just configure a SecureVirtualHost of *
along with a Secret/TCPProxy attached there, instead of using the Listener-level TCPProxy that I added to the DAG with the TCPRoute PR. Will look into it some, but at least what's here now works.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
OK, made this change in 5088897
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## main #5481 +/- ##
==========================================
+ Coverage 78.52% 78.55% +0.02%
==========================================
Files 138 138
Lines 19018 19027 +9
==========================================
+ Hits 14934 14946 +12
+ Misses 3801 3799 -2
+ Partials 283 282 -1
|
7e8ba6f
to
fadbf59
Compare
a058a75
to
acb3cff
Compare
The Contour project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to the #contour channel in the Kubernetes Slack |
I would love to get this into the upcoming release, but unfortunately there hasn't been a clear consensus on the upstream issue. We could merge it anyway, assuming that the upstream spec will eventually allow this (or at least not disallow it), but that does create a risk that we'd have to make a breaking behavior change in the future if something unexpected changes. @sunjayBhatia WDYT? |
Adds support for TLS termination with the TLS listener protocol. Envoy is configured to terminate TLS and then to proxy TCP traffic to the backend. Signed-off-by: Steve Kriss <[email protected]>
Code might be simpler if we add a secure vhost of "*" and use the existing TCPProxy code flow from there, I think it should already work. Signed-off-by: Steve Kriss <[email protected]>
Signed-off-by: Steve Kriss <[email protected]>
Signed-off-by: Steve Kriss <[email protected]>
Signed-off-by: Steve Kriss <[email protected]>
acb3cff
to
fea4b08
Compare
just pinged that issue to hopefully get it triaged it is a little funny since the Gateway fields are v1beta1 and core but the route resources are v1alpha2 so how does the api versioning guarantee work since TLSRoute etc. is still in alpha I think it'll be ok in the slim chance behavior has to change? We can push to get conformance etc. codified if we do merge this so it's less likely to change out from under us |
Ah that's a great point, kinda forgot that these are still alpha resources 😁 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM! e2e tests can come in the form of conformance tests once the upstream issue for this specification is triaged etc.
Adds support for TLS termination with the TLS
listener protocol. Envoy is configured to terminate
TLS and then to proxy TCP traffic to the backend.
This configuration is compatible with both TLSRoute
and TCPRoute.
Closes #5461.
Leaving as a draft for now until there's a clear consensus on the upstream issue (kubernetes-sigs/gateway-api#2111) around TLS termination with TLSRoute.