Skip to content

fix: add BackendTLSPolicy features to GATEWAY-HTTP profile #4199

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+2 −0
Open

fix: add BackendTLSPolicy features to GATEWAY-HTTP profile #4199

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions conformance/utils/suite/profiles.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,8 @@ var (
Insert(features.SetsToNamesSet(
features.GatewayExtendedFeatures,
features.HTTPRouteExtendedFeatures,
features.BackendTLSPolicyCoreFeatures,
features.BackendTLSPolicyExtendedFeatures,
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added now the BackendTLSPolicy Core feature to the Extended features of the profile, I wasn’t sure if the overall BackendTLSPolicy is considered Core or Extended.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if we should create a new profile for Policies.

Copy link
Member Author

@snorwin snorwin Oct 25, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my opinion, I don’t think it’s worth creating a new profile at this point. Currently, there are only two features that would be part of such a dedicated profile, and both require the Gateway and HTTPRoute feature to execute the tests anyway. Therefore, it would make much more sense to include them under GATEWAY-HTTP for now, and potentially later also under GATEWAY-GRPC and GATEWAY-TLS, once we’ve written the corresponding conformance tests.

The main question for me is whether BackendTLSPolicy is considered part of the Core or Extended. I couldn’t find any information about this in the GEP. If we add it to Core, all implementations would need to support it before achieving conformance for version 1.4, which, in my opinion, would be quite challenging for some. Therefore, I’d suggest adding it as part of the Extended features for now.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The guideline is that all additional objects should be considered Extended unless there is a good reason.

This comes back to "what does Extended mean?". The word "Extended" is relevant for a field and all of its child features. So, when a whole object is Extended, that means that you don't have to support that object. However, if you do support it, then within that object, Core features are MUST, and Extended features are SHOULD.

So, the BackendTLSPolicyExtendedFeatures really require BackendTLSPolicyCoreFeatures and BackendTLSPolicyExtendedFeatures.

So, yes, I agree that BackendTLSPolicy should be Extended. At some point, it may be worth moving it into overall Core support for the HTTP Profile, but not yet.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@youngnick Just to make sure I understand correctly, are you suggesting that we add BackendTLSPolicyCoreFeatures to BackendTLSPolicyExtendedFeatures, or should we keep the change as it is?

Copy link
Contributor

@candita candita Oct 27, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to see features.BackendTLSPolicyCoreFeatures added to a new conformanceProfile for policies.

Suggested change
features.BackendTLSPolicyExtendedFeatures,
PolicyConformanceProfile = ConformanceProfile{
Name: GatewayHTTPConformanceProfileName,
CoreFeatures: sets.New(
features.BackendTLSPolicyCoreFeatures,
),
ExtendedFeatures: sets.New[features.FeatureName]().
Insert(features.SetsToNamesSet(
features.BackendTLSPolicyExtendedFeatures,
...

).UnsortedList()...),
}

Expand Down