Skip to content

Commit b4282a6

Browse files
guydczirain
guydc
and
zirain
authored
api: Backend TLS SNI (#7014)
* api: add support for auto SNI and auto SAN SNI validation options Signed-off-by: Guy Daich <[email protected]> * fix validation context building Signed-off-by: Guy Daich <[email protected]> * fix docs Signed-off-by: Guy Daich <[email protected]> * more fixes Signed-off-by: Guy Daich <[email protected]> * rebase Signed-off-by: Guy Daich <[email protected]> * fix settings for dynamic resolver Signed-off-by: Guy Daich <[email protected]> * rebase Signed-off-by: Guy Daich <[email protected]> * fix lint Signed-off-by: Guy Daich <[email protected]> * infer auto sni and auto san without API Signed-off-by: Guy Daich <[email protected]> * rebase Signed-off-by: Guy Daich <[email protected]> * remove old api Signed-off-by: Guy Daich <[email protected]> * fix gen Signed-off-by: Guy Daich <[email protected]> * fix typo Signed-off-by: Guy Daich <[email protected]> --------- Signed-off-by: Guy Daich <[email protected]> Co-authored-by: zirain <[email protected]>
1 parent 160c4aa commit b4282a6

24 files changed

+1381
-41
lines changed

‎api/v1alpha1/backend_types.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,18 @@ type BackendTLSSettings struct {
204204
// +kubebuilder:default=false
205205
// +optional
206206
InsecureSkipVerify *bool `json:"insecureSkipVerify,omitempty"`
207+
208+
// SNI is specifies the SNI value used when establishing an upstream TLS connection to the backend.
209+
//
210+
// Envoy Gateway will use the HTTP host header value for SNI, when all resources referenced in BackendRefs are:
211+
// 1. Backend resources that do not set SNI, or
212+
// 2. Service/ServiceImport resources that do not have a BackendTLSPolicy attached to them
213+
//
214+
// When a BackendTLSPolicy attaches to a Backend resource, the BackendTLSPolicy's Hostname value takes precedence
215+
// over this value.
216+
//
217+
// +optional
218+
SNI *gwapiv1.PreciseHostname `json:"sni,omitempty"`
207219
}
208220

209221
// BackendType defines the type of the Backend.

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backends.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,20 @@ spec:
223223
InsecureSkipVerify indicates whether the upstream's certificate verification
224224
should be skipped. Defaults to "false".
225225
type: boolean
226+
sni:
227+
description: |-
228+
SNI is specifies the SNI value used when establishing an upstream TLS connection to the backend.
229+
230+
Envoy Gateway will use the HTTP host header value for SNI, when all resources referenced in BackendRefs are:
231+
1. Backend resources that do not set SNI, or
232+
2. Service/ServiceImport resources that do not have a BackendTLSPolicy attached to them
233+
234+
When a BackendTLSPolicy attaches to a Backend resource, the BackendTLSPolicy's Hostname value takes precedence
235+
over this value.
236+
maxLength: 253
237+
minLength: 1
238+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
239+
type: string
226240
wellKnownCACertificates:
227241
description: |-
228242
WellKnownCACertificates specifies whether system CA certificates may be used in

‎charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backends.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,20 @@ spec:
222222
InsecureSkipVerify indicates whether the upstream's certificate verification
223223
should be skipped. Defaults to "false".
224224
type: boolean
225+
sni:
226+
description: |-
227+
SNI is specifies the SNI value used when establishing an upstream TLS connection to the backend.
228+
229+
Envoy Gateway will use the HTTP host header value for SNI, when all resources referenced in BackendRefs are:
230+
1. Backend resources that do not set SNI, or
231+
2. Service/ServiceImport resources that do not have a BackendTLSPolicy attached to them
232+
233+
When a BackendTLSPolicy attaches to a Backend resource, the BackendTLSPolicy's Hostname value takes precedence
234+
over this value.
235+
maxLength: 253
236+
minLength: 1
237+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
238+
type: string
225239
wellKnownCACertificates:
226240
description: |-
227241
WellKnownCACertificates specifies whether system CA certificates may be used in

‎internal/gatewayapi/backendtlspolicy.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,8 @@ func (t *Translator) applyBackendTLSSetting(
7676
return t.applyEnvoyProxyBackendTLSSetting(upstreamConfig, resources, envoyProxy)
7777
}
7878

79+
// Merges TLS settings from Gateway API BackendTLSPolicy and Envoy Gateway Backend TL.
80+
// BackendTLSPolicy takes precedence for identical attributes that are set in both.
7981
func mergeBackendTLSConfigs(
8082
backendTLSSettingsConfig *ir.TLSUpstreamConfig,
8183
backendTLSPolicyConfig *ir.TLSUpstreamConfig,
@@ -91,8 +93,8 @@ func mergeBackendTLSConfigs(
9193
return backendTLSSettingsConfig
9294
}
9395

94-
// If both are set, we merge them, with BackendTLSPolicy settings taking precedence
9596
mergedConfig := backendTLSSettingsConfig.DeepCopy()
97+
9698
if backendTLSPolicyConfig.CACertificate != nil {
9799
mergedConfig.CACertificate = backendTLSPolicyConfig.CACertificate
98100
}
@@ -117,6 +119,10 @@ func (t *Translator) processBackendTLSSettings(
117119
InsecureSkipVerify: ptr.Deref(backend.Spec.TLS.InsecureSkipVerify, false),
118120
}
119121

122+
if backend.Spec.TLS.SNI != nil {
123+
tlsConfig.SNI = ptr.To(string(*backend.Spec.TLS.SNI))
124+
}
125+
120126
if !tlsConfig.InsecureSkipVerify {
121127
tlsConfig.UseSystemTrustStore = ptr.Deref(backend.Spec.TLS.WellKnownCACertificates, "") == gwapiv1a3.WellKnownCACertificatesSystem
122128

‎internal/gatewayapi/ext_service.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@ func (t *Translator) translateExtServiceBackendRefs(
8383
if rs.HasMixedEndpoints() {
8484
return nil, errors.New("external service destinations having multiple endpoint types are not supported")
8585
}
86+
8687
return rs, nil
8788
}
8889

‎internal/gatewayapi/testdata/backend-with-auto-san-sni.in.yaml‎

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
gateways:
2+
- apiVersion: gateway.networking.k8s.io/v1
3+
kind: Gateway
4+
metadata:
5+
name: gateway-btls
6+
namespace: envoy-gateway
7+
spec:
8+
gatewayClassName: envoy-gateway-class
9+
listeners:
10+
- name: http
11+
protocol: HTTP
12+
port: 80
13+
allowedRoutes:
14+
namespaces:
15+
from: All
16+
httpRoutes:
17+
- apiVersion: gateway.networking.k8s.io/v1
18+
kind: HTTPRoute
19+
metadata:
20+
name: httproute-backend-without-sni
21+
namespace: envoy-gateway
22+
spec:
23+
parentRefs:
24+
- namespace: envoy-gateway
25+
name: gateway-btls
26+
sectionName: http
27+
hostnames:
28+
- backend-without-sni.example.com
29+
rules:
30+
- matches:
31+
- path:
32+
type: Exact
33+
value: "/backend-without-sni"
34+
backendRefs:
35+
- kind: Backend
36+
group: gateway.envoyproxy.io
37+
name: backend-without-sni
38+
namespace: backends
39+
port: 8080
40+
- apiVersion: gateway.networking.k8s.io/v1
41+
kind: HTTPRoute
42+
metadata:
43+
name: httproute-backend-with-sni
44+
namespace: envoy-gateway
45+
spec:
46+
parentRefs:
47+
- namespace: envoy-gateway
48+
name: gateway-btls
49+
sectionName: http
50+
hostnames:
51+
- backend-with-sni.example.com
52+
rules:
53+
- matches:
54+
- path:
55+
type: Exact
56+
value: "/backend-with-sni"
57+
backendRefs:
58+
- kind: Backend
59+
group: gateway.envoyproxy.io
60+
name: backend-with-sni
61+
namespace: backends
62+
port: 8080
63+
- apiVersion: gateway.networking.k8s.io/v1
64+
kind: HTTPRoute
65+
metadata:
66+
name: httproute-backend-with-sni-and-btlsp
67+
namespace: envoy-gateway
68+
spec:
69+
parentRefs:
70+
- namespace: envoy-gateway
71+
name: gateway-btls
72+
sectionName: http
73+
hostnames:
74+
- backend-with-sni-and-btlsp.example.com
75+
rules:
76+
- matches:
77+
- path:
78+
type: Exact
79+
value: "/backend-with-sni-and-btlsp"
80+
backendRefs:
81+
- kind: Backend
82+
group: gateway.envoyproxy.io
83+
name: backend-with-sni-and-btlsp
84+
namespace: backends
85+
port: 8080
86+
- apiVersion: gateway.networking.k8s.io/v1
87+
kind: HTTPRoute
88+
metadata:
89+
name: httproute-backend-without-sni-and-btlsp
90+
namespace: envoy-gateway
91+
spec:
92+
parentRefs:
93+
- namespace: envoy-gateway
94+
name: gateway-btls
95+
sectionName: http
96+
hostnames:
97+
- "backend-without-sni-and-btlsp.example.com"
98+
rules:
99+
- matches:
100+
- path:
101+
type: Exact
102+
value: "/backend-without-sni-and-btlsp"
103+
backendRefs:
104+
- kind: Backend
105+
group: gateway.envoyproxy.io
106+
name: backend-without-sni-and-btlsp
107+
namespace: backends
108+
port: 8080
109+
referenceGrants:
110+
- apiVersion: gateway.networking.k8s.io/v1alpha2
111+
kind: ReferenceGrant
112+
metadata:
113+
name: refg-route-svc
114+
namespace: backends
115+
spec:
116+
from:
117+
- group: gateway.networking.k8s.io
118+
kind: HTTPRoute
119+
namespace: envoy-gateway
120+
- group: gateway.networking.k8s.io
121+
kind: Gateway
122+
namespace: envoy-gateway
123+
- group: gateway.networking.k8s.io
124+
kind: BackendTLSPolicy
125+
namespace: policies
126+
to:
127+
- group: gateway.envoyproxy.io
128+
kind: Backend
129+
130+
backends:
131+
- apiVersion: gateway.envoyproxy.io/v1alpha1
132+
kind: Backend
133+
metadata:
134+
name: backend-without-sni
135+
namespace: backends
136+
spec:
137+
endpoints:
138+
- ip:
139+
address: 1.1.1.1
140+
port: 3001
141+
tls:
142+
caCertificateRefs:
143+
- name: ca-secret
144+
group: ""
145+
kind: Secret
146+
- apiVersion: gateway.envoyproxy.io/v1alpha1
147+
kind: Backend
148+
metadata:
149+
name: backend-with-sni
150+
namespace: backends
151+
spec:
152+
endpoints:
153+
- ip:
154+
address: 1.1.1.1
155+
port: 3001
156+
tls:
157+
caCertificateRefs:
158+
- name: ca-secret
159+
group: ""
160+
kind: Secret
161+
sni: "backend.sni.com"
162+
- apiVersion: gateway.envoyproxy.io/v1alpha1
163+
kind: Backend
164+
metadata:
165+
name: backend-without-sni-and-btlsp
166+
namespace: backends
167+
spec:
168+
endpoints:
169+
- ip:
170+
address: 1.1.1.1
171+
port: 3001
172+
tls:
173+
caCertificateRefs:
174+
- name: ca-secret
175+
group: ""
176+
kind: Secret
177+
- apiVersion: gateway.envoyproxy.io/v1alpha1
178+
kind: Backend
179+
metadata:
180+
name: backend-with-sni-and-btlsp
181+
namespace: backends
182+
spec:
183+
endpoints:
184+
- ip:
185+
address: 1.1.1.1
186+
port: 3001
187+
tls:
188+
caCertificateRefs:
189+
- name: ca-secret
190+
group: ""
191+
kind: Secret
192+
sni: "backend.sni.com"
193+
secrets:
194+
- apiVersion: v1
195+
kind: Secret
196+
metadata:
197+
name: ca-secret
198+
namespace: backends
199+
data:
200+
ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
201+
202+
backendTLSPolicies:
203+
- apiVersion: gateway.networking.k8s.io/v1alpha2
204+
kind: BackendTLSPolicy
205+
metadata:
206+
name: policy-btls
207+
namespace: backends
208+
spec:
209+
targetRefs:
210+
- kind: Backend
211+
group: gateway.envoyproxy.io
212+
name: backend-without-sni-and-btlsp
213+
- kind: Backend
214+
group: gateway.envoyproxy.io
215+
name: backend-with-sni-and-btlsp
216+
validation:
217+
caCertificateRefs:
218+
- name: ca-secret
219+
group: ""
220+
kind: Secret
221+
hostname: example.com
222+
subjectAltNames:
223+
- type: URI
224+
uri: spiffe://cluster.local/ns/istio-demo/sa/echo-v1
225+
- hostname: subdomain.secondexample.com

0 commit comments

Comments
 (0)