support protocol TLS with TLS mode Terminate

Signed-off-by: Steve Kriss <[email protected]>

internal/dag/gatewayapi_processor.go

@@ -519,27 +519,35 @@ func (p *GatewayAPIProcessor) computeListener(
 	case gatewayapi_v1beta1.TLSProtocolType:
 		// The TLS protocol is used for TCP traffic encrypted with TLS.
 		// Gateway API allows TLS to be either terminated at the proxy
-		// or passed through to the backend, but the former requires using
-		// TCPRoute to route traffic since the underlying protocol is TCP
-		// not HTTP, which Contour doesn't support. Therefore, we only
-		// support "Passthrough" with the TLS protocol, which requires
-		// the use of TLSRoute to route to backends since the traffic is
-		// still encrypted.
+		// or passed through to the backend. This protocol is compatible
+		// with both TLSRoute (if SNI is needed for routing decisions) and
+		// TCPRoute (if SNI is not needed for routing decisions).
 
 		if listener.TLS == nil {
 			addInvalidListenerCondition(fmt.Sprintf("Listener.TLS is required when protocol is %q.", listener.Protocol))
 			return false, nil
 		}
 
-		if listener.TLS.Mode == nil || *listener.TLS.Mode != gatewayapi_v1beta1.TLSModePassthrough {
-			addInvalidListenerCondition(fmt.Sprintf("Listener.TLS.Mode must be %q when protocol is %q.", gatewayapi_v1beta1.TLSModePassthrough, listener.Protocol))
+		if listener.TLS.Mode == nil {
+			addInvalidListenerCondition(fmt.Sprintf("Listener.TLS.Mode is required when protocol is %q.", listener.Protocol))
 			return false, nil
 		}
 
-		if len(listener.TLS.CertificateRefs) != 0 {
-			addInvalidListenerCondition(fmt.Sprintf("Listener.TLS.CertificateRefs cannot be defined when Listener.TLS.Mode is %q.", gatewayapi_v1beta1.TLSModePassthrough))
-			return false, nil
+		switch *listener.TLS.Mode {
+		case gatewayapi_v1beta1.TLSModeTerminate:
+			// Resolve the TLS secret.
+			if listenerSecret = p.resolveListenerSecret(listener.TLS.CertificateRefs, string(listener.Name), gwAccessor); listenerSecret == nil {
+				// If TLS was configured on the Listener, but the secret ref is invalid, don't allow any
+				// routes to be bound to this listener since it can't serve TLS traffic.
+				return false, nil
+			}
+		case gatewayapi_v1beta1.TLSModePassthrough:
+			if len(listener.TLS.CertificateRefs) != 0 {
+				addInvalidListenerCondition(fmt.Sprintf("Listener.TLS.CertificateRefs cannot be defined when Listener.TLS.Mode is %q.", gatewayapi_v1beta1.TLSModePassthrough))
+				return false, nil
+			}
 		}
+
 	}
 
 	return true, &listenerInfo{