Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Gep 2907 update - TLS mode and allowed routes #3458

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

mlavacca
Copy link
Member

@mlavacca mlavacca commented Nov 19, 2024

What type of PR is this?

/kind gep

What this PR does / why we need it:

This PR supersedes #3190.

This PR updates GEP-2907 with two different aspects:

  • definition of TLS mode (Terminate and Passthrough)
  • what routes can be attached to Listeners that specify TLS configuration.

This PR intends to reach an agreement that will make #2111 and #1474 addressable.

Which issue(s) this PR fixes:

Does this PR introduce a user-facing change?:

NONE

Signed-off-by: Mattia Lavacca <[email protected]>
Signed-off-by: Mattia Lavacca <[email protected]>
@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. kind/gep PRs related to Gateway Enhancement Proposal(GEP) do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. labels Nov 19, 2024
@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. approved Indicates a PR has been approved by an approver from all required OWNERS files. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Nov 19, 2024
@mlavacca
Copy link
Member Author

/cc @candita @youngnick

@youngnick
Copy link
Contributor

youngnick commented Nov 21, 2024

Yeah, this accurately conveys the current state, although I think that we do not have any conformance testing at all about TLSRoute with Terminate behavior.

Edit LGTM, but I'd like to hear from others too.

@mlavacca
Copy link
Member Author

Yeah, this accurately conveys the current state, although I think that we do not have any conformance testing at all about TLSRoute with Terminate behavior.

Edit LGTM, but I'd like to hear from others too.

Yep, I just created #3466 to track conformance tests with TLSRoutes in Terminate Mode.

@mlavacca
Copy link
Member Author

/cc @robscott @shaneutt

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mlavacca, shaneutt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@shaneutt shaneutt requested review from kflynn, gcs278 and arkodg January 23, 2025 13:45
Copy link
Member

@robscott robscott left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @mlavacca! Sorry I missed this one!

| `HTTPRoute` | yes | no |
| `GRPCRoute` | yes | no |
| `TLSRoute` | yes | yes |
| `TCPRoute` | no | no |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not TLS with passthrough here?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you are doing TLS passthrough and a TCPRoute, its no different than just TCP + TCPRoute. Unless you want to say we allow TLSRoute and TCPRoute to bind to the same listener here, then you would have something like

  1. Highest priority: TLS route matching SNI
  2. Lowest priority: the (at most 1) TCP route
    ?

Comment on lines +271 to +275
> [!NOTE]
> When the traffic is routed to the backend via `TCPRoute`, the packets
> are left untouched by the gateway. In order to terminate the TLS connection to
> the gateway and forward the traffic unencrypted to the backend, a `TLSRoute` configured
> with `Terminate` as TLS mode has to be used.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a bit confusing to me. Why does the route type matter here? In the case of TLS passthrough, it seems like you'd have two options if you wanted to use SNI to select the backend:

  1. Multiple Listeners with different hostnames specified
  2. One Listener with multiple TLSRoutes attached, each specifying a different SNI

On the other hand, if you wanted to do TLS termination, you'd have the following options:

  1. Route based on HTTP attributes: HTTPRoute
  2. Send all traffic attached to a Listener to the same set of backends: HTTPRoute or TCPRoute

Writing that all out makes me continue to think that our <L7 route types may not be entirely necessary (x-ref the related doc).

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is a third plausible option, you could do "One Listener with multiple TLSRoutes attached, each specifying a different SNI" but still use terminate. I mean hypothetically, I believe we say this isn't the semantics of the routes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. kind/gep PRs related to Gateway Enhancement Proposal(GEP) release-note-none Denotes a PR that doesn't merit a release note. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants