initial TLSRoute support #10601
initial TLSRoute support #10601
Conversation
|
/kick-ci |
| @@ -248,6 +248,16 @@ func (p *plugin) computeTcpFilterChain( | |||
| }, nil | |||
| } | |||
|
|
|||
| // needed to handle passthrough | |||
| if sslConfig.GetSslSecrets() == nil && len(sslConfig.GetSniDomains()) != 0 { | |||
There was a problem hiding this comment.
in the case of passthrough, we don't have ssl secrets, only sni domain.
There was a problem hiding this comment.
nit: Call len(sslConfig.GetSniDomains() once and store the results in a var. Then you can use the var here and in L256.
|
Visit the preview URL for this PR (updated for commit fb523b5): https://gloo-edge--pr10601-puertomontt-tls-rout-e8bxf1cb.web.app (expires Sun, 02 Mar 2025 13:31:07 GMT) 🔥 via Firebase Hosting GitHub Action 🌎 Sign: 77c2b86e287749579b7ff9cadb81e099042ef677 |
| @@ -128,6 +128,8 @@ func (r *gatewayQueries) GetRouteChain( | |||
| case *gwv1a2.TCPRoute: | |||
| backends = r.resolveRouteBackends(ctx, typedRoute) | |||
| // TODO (danehans): Should TCPRoute delegation support be added in the future? | |||
| case *gwv1a2.TLSRoute: | |||
There was a problem hiding this comment.
@puertomontt can you create an issue to rename projects/gateway2/query/httproute.go to projects/gateway2/query/route.go and link to this PR?
| @@ -813,6 +813,35 @@ var _ = Describe("Query", func() { | |||
| Expect(err).To(MatchError(query.ErrMissingReferenceGrant)) | |||
| Expect(backend).To(BeNil()) | |||
| }) | |||
|
|
|||
| It("should match TLSRoutes for Listener", func() { | |||
There was a problem hiding this comment.
Please add more test cases (see TCPRoute). Disregard the RefGrant test cases if this PR does not support TLSRoute RefGrants. Ensure one of the test cases includes a Gateway with multiple listeners with different protocols and hostnames to ensure the listener selection logic is correct.
projects/gateway2/translator/listener/gateway_listener_translator.go
Outdated
Show resolved
Hide resolved
projects/gateway2/translator/listener/gateway_listener_translator.go
Outdated
Show resolved
Hide resolved
projects/gateway2/translator/listener/gateway_listener_translator.go
Outdated
Show resolved
Hide resolved
| @@ -248,6 +248,16 @@ func (p *plugin) computeTcpFilterChain( | |||
| }, nil | |||
| } | |||
|
|
|||
| // needed to handle passthrough | |||
| if sslConfig.GetSslSecrets() == nil && len(sslConfig.GetSniDomains()) != 0 { | |||
There was a problem hiding this comment.
nit: Call len(sslConfig.GetSniDomains() once and store the results in a var. Then you can use the var here and in L256.
...ernetes/e2e/features/services/tlsroute/testdata/cross-ns-no-refgrant-gateway-and-client.yaml
Outdated
Show resolved
Hide resolved
|
Issues linked to changelog: |
|
|
||
| // Assert expected responses | ||
| for i, port := range tc.ports { | ||
| if tc.name == crossNsNoRefGrantTestName { |
There was a problem hiding this comment.
| if tc.name == crossNsNoRefGrantTestName { | |
| if tc.expectedErrorCode != 0 { |
Description
Adds initial support for TLSRoutes. TLSRoutes are similar to TCPRoutes, but the distinction between them is that TLSRoutes allows routing decisions by SNI. See docs.
This PR adds support for TLS Passthrough on a TLS listener using a TLSRoute.
API changes
Code changes
CI changes
Docs changes
Context
Interesting decisions
Testing steps
Notes for reviewers
This PR doesn't add TLS support for TCPRoutes (kgateway-dev#10621)
Checklist: