Skip to content

Commit 0678aae

Browse files
codefromthecryptcodefromthecrypt
authored
Merge branch 'main' into fix/proxy-context-map-race
2 parents 4e85357 + afaa7e3 commit 0678aae

30 files changed

+1534
-63
lines changed

‎api/v1alpha1/authorization_types.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,14 @@ type Principal struct {
8585
// You can use the `ClientIPDetection` or the `ProxyProtocol` field in
8686
// the `ClientTrafficPolicy` to configure how the client IP is detected.
8787
//
88+
// For TCPRoute targets (raw TCP connections), HTTP headers such as
89+
// X-Forwarded-For are not available. The client IP is obtained from the
90+
// TCP connection's peer address. If intermediaries (load balancers, NAT)
91+
// terminate or proxy TCP, the original client IP will only be available
92+
// if the intermediary preserves the source address (for example by
93+
// enabling the PROXY protocol or avoiding SNAT). Ensure your L4 proxy is
94+
// configured to preserve the source IP to enable correct client-IP
95+
// matching for TCPRoute targets.
8896
// +optional
8997
// +kubebuilder:validation:MinItems=1
9098
ClientCIDRs []CIDR `json:"clientCIDRs,omitempty"`

‎api/v1alpha1/backend_types.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,18 @@ type BackendTLSSettings struct {
204204
// +kubebuilder:default=false
205205
// +optional
206206
InsecureSkipVerify *bool `json:"insecureSkipVerify,omitempty"`
207+
208+
// SNI is specifies the SNI value used when establishing an upstream TLS connection to the backend.
209+
//
210+
// Envoy Gateway will use the HTTP host header value for SNI, when all resources referenced in BackendRefs are:
211+
// 1. Backend resources that do not set SNI, or
212+
// 2. Service/ServiceImport resources that do not have a BackendTLSPolicy attached to them
213+
//
214+
// When a BackendTLSPolicy attaches to a Backend resource, the BackendTLSPolicy's Hostname value takes precedence
215+
// over this value.
216+
//
217+
// +optional
218+
SNI *gwapiv1.PreciseHostname `json:"sni,omitempty"`
207219
}
208220

209221
// BackendType defines the type of the Backend.

‎api/v1alpha1/securitypolicy_types.go‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,18 @@ type SecurityPolicy struct {
3636
// +kubebuilder:validation:XValidation:rule="(has(self.targetRef) && !has(self.targetRefs)) || (!has(self.targetRef) && has(self.targetRefs)) || (has(self.targetSelectors) && self.targetSelectors.size() > 0) ", message="either targetRef or targetRefs must be used"
3737
//
3838
// +kubebuilder:validation:XValidation:rule="has(self.targetRef) ? self.targetRef.group == 'gateway.networking.k8s.io' : true", message="this policy can only have a targetRef.group of gateway.networking.k8s.io"
39-
// +kubebuilder:validation:XValidation:rule="has(self.targetRef) ? self.targetRef.kind in ['Gateway', 'HTTPRoute', 'GRPCRoute'] : true", message="this policy can only have a targetRef.kind of Gateway/HTTPRoute/GRPCRoute"
39+
// +kubebuilder:validation:XValidation:rule="has(self.targetRef) ? self.targetRef.kind in ['Gateway', 'HTTPRoute', 'GRPCRoute', 'TCPRoute'] : true", message="this policy can only have a targetRef.kind of Gateway/HTTPRoute/GRPCRoute/TCPRoute"
4040
// +kubebuilder:validation:XValidation:rule="has(self.targetRefs) ? self.targetRefs.all(ref, ref.group == 'gateway.networking.k8s.io') : true ", message="this policy can only have a targetRefs[*].group of gateway.networking.k8s.io"
41-
// +kubebuilder:validation:XValidation:rule="has(self.targetRefs) ? self.targetRefs.all(ref, ref.kind in ['Gateway', 'HTTPRoute', 'GRPCRoute']) : true ", message="this policy can only have a targetRefs[*].kind of Gateway/HTTPRoute/GRPCRoute"
41+
// +kubebuilder:validation:XValidation:rule="has(self.targetRefs) ? self.targetRefs.all(ref, ref.kind in ['Gateway', 'HTTPRoute', 'GRPCRoute', 'TCPRoute']) : true ", message="this policy can only have a targetRefs[*].kind of Gateway/HTTPRoute/GRPCRoute/TCPRoute"
4242
// +kubebuilder:validation:XValidation:rule="(has(self.authorization) && has(self.authorization.rules) && self.authorization.rules.exists(r, has(r.principal.jwt))) ? has(self.jwt) : true", message="if authorization.rules.principal.jwt is used, jwt must be defined"
4343
//
4444
// SecurityPolicySpec defines the desired state of SecurityPolicy.
45+
//
46+
// NOTE: SecurityPolicy can target Gateway, HTTPRoute, GRPCRoute, and TCPRoute.
47+
// When a SecurityPolicy targets a TCPRoute, only client-IP based authorization
48+
// (Authorization rules that use Principal.ClientCIDRs) is applied. Other
49+
// authentication/authorization features such as JWT, API Key, Basic Auth,
50+
// OIDC, or External Authorization are not applicable to TCPRoute targets.
4551
type SecurityPolicySpec struct {
4652
PolicyTargetReferences `json:",inline"`
4753

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backends.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,20 @@ spec:
223223
InsecureSkipVerify indicates whether the upstream's certificate verification
224224
should be skipped. Defaults to "false".
225225
type: boolean
226+
sni:
227+
description: |-
228+
SNI is specifies the SNI value used when establishing an upstream TLS connection to the backend.
229+
230+
Envoy Gateway will use the HTTP host header value for SNI, when all resources referenced in BackendRefs are:
231+
1. Backend resources that do not set SNI, or
232+
2. Service/ServiceImport resources that do not have a BackendTLSPolicy attached to them
233+
234+
When a BackendTLSPolicy attaches to a Backend resource, the BackendTLSPolicy's Hostname value takes precedence
235+
over this value.
236+
maxLength: 253
237+
minLength: 1
238+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
239+
type: string
226240
wellKnownCACertificates:
227241
description: |-
228242
WellKnownCACertificates specifies whether system CA certificates may be used in

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,15 @@ spec:
255255
or the proxy protocol.
256256
You can use the `ClientIPDetection` or the `ProxyProtocol` field in
257257
the `ClientTrafficPolicy` to configure how the client IP is detected.
258+
259+
For TCPRoute targets (raw TCP connections), HTTP headers such as
260+
X-Forwarded-For are not available. The client IP is obtained from the
261+
TCP connection's peer address. If intermediaries (load balancers, NAT)
262+
terminate or proxy TCP, the original client IP will only be available
263+
if the intermediary preserves the source address (for example by
264+
enabling the PROXY protocol or avoiding SNAT). Ensure your L4 proxy is
265+
configured to preserve the source IP to enable correct client-IP
266+
matching for TCPRoute targets.
258267
items:
259268
description: |-
260269
CIDR defines a CIDR Address range.
@@ -5267,15 +5276,15 @@ spec:
52675276
- message: this policy can only have a targetRef.group of gateway.networking.k8s.io
52685277
rule: 'has(self.targetRef) ? self.targetRef.group == ''gateway.networking.k8s.io''
52695278
: true'
5270-
- message: this policy can only have a targetRef.kind of Gateway/HTTPRoute/GRPCRoute
5279+
- message: this policy can only have a targetRef.kind of Gateway/HTTPRoute/GRPCRoute/TCPRoute
52715280
rule: 'has(self.targetRef) ? self.targetRef.kind in [''Gateway'', ''HTTPRoute'',
5272-
''GRPCRoute''] : true'
5281+
''GRPCRoute'', ''TCPRoute''] : true'
52735282
- message: this policy can only have a targetRefs[*].group of gateway.networking.k8s.io
52745283
rule: 'has(self.targetRefs) ? self.targetRefs.all(ref, ref.group ==
52755284
''gateway.networking.k8s.io'') : true '
5276-
- message: this policy can only have a targetRefs[*].kind of Gateway/HTTPRoute/GRPCRoute
5285+
- message: this policy can only have a targetRefs[*].kind of Gateway/HTTPRoute/GRPCRoute/TCPRoute
52775286
rule: 'has(self.targetRefs) ? self.targetRefs.all(ref, ref.kind in [''Gateway'',
5278-
''HTTPRoute'', ''GRPCRoute'']) : true '
5287+
''HTTPRoute'', ''GRPCRoute'', ''TCPRoute'']) : true '
52795288
- message: if authorization.rules.principal.jwt is used, jwt must be defined
52805289
rule: '(has(self.authorization) && has(self.authorization.rules) &&
52815290
self.authorization.rules.exists(r, has(r.principal.jwt))) ? has(self.jwt)

‎charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backends.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,20 @@ spec:
222222
InsecureSkipVerify indicates whether the upstream's certificate verification
223223
should be skipped. Defaults to "false".
224224
type: boolean
225+
sni:
226+
description: |-
227+
SNI is specifies the SNI value used when establishing an upstream TLS connection to the backend.
228+
229+
Envoy Gateway will use the HTTP host header value for SNI, when all resources referenced in BackendRefs are:
230+
1. Backend resources that do not set SNI, or
231+
2. Service/ServiceImport resources that do not have a BackendTLSPolicy attached to them
232+
233+
When a BackendTLSPolicy attaches to a Backend resource, the BackendTLSPolicy's Hostname value takes precedence
234+
over this value.
235+
maxLength: 253
236+
minLength: 1
237+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
238+
type: string
225239
wellKnownCACertificates:
226240
description: |-
227241
WellKnownCACertificates specifies whether system CA certificates may be used in

‎charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,15 @@ spec:
254254
or the proxy protocol.
255255
You can use the `ClientIPDetection` or the `ProxyProtocol` field in
256256
the `ClientTrafficPolicy` to configure how the client IP is detected.
257+
258+
For TCPRoute targets (raw TCP connections), HTTP headers such as
259+
X-Forwarded-For are not available. The client IP is obtained from the
260+
TCP connection's peer address. If intermediaries (load balancers, NAT)
261+
terminate or proxy TCP, the original client IP will only be available
262+
if the intermediary preserves the source address (for example by
263+
enabling the PROXY protocol or avoiding SNAT). Ensure your L4 proxy is
264+
configured to preserve the source IP to enable correct client-IP
265+
matching for TCPRoute targets.
257266
items:
258267
description: |-
259268
CIDR defines a CIDR Address range.
@@ -5266,15 +5275,15 @@ spec:
52665275
- message: this policy can only have a targetRef.group of gateway.networking.k8s.io
52675276
rule: 'has(self.targetRef) ? self.targetRef.group == ''gateway.networking.k8s.io''
52685277
: true'
5269-
- message: this policy can only have a targetRef.kind of Gateway/HTTPRoute/GRPCRoute
5278+
- message: this policy can only have a targetRef.kind of Gateway/HTTPRoute/GRPCRoute/TCPRoute
52705279
rule: 'has(self.targetRef) ? self.targetRef.kind in [''Gateway'', ''HTTPRoute'',
5271-
''GRPCRoute''] : true'
5280+
''GRPCRoute'', ''TCPRoute''] : true'
52725281
- message: this policy can only have a targetRefs[*].group of gateway.networking.k8s.io
52735282
rule: 'has(self.targetRefs) ? self.targetRefs.all(ref, ref.group ==
52745283
''gateway.networking.k8s.io'') : true '
5275-
- message: this policy can only have a targetRefs[*].kind of Gateway/HTTPRoute/GRPCRoute
5284+
- message: this policy can only have a targetRefs[*].kind of Gateway/HTTPRoute/GRPCRoute/TCPRoute
52765285
rule: 'has(self.targetRefs) ? self.targetRefs.all(ref, ref.kind in [''Gateway'',
5277-
''HTTPRoute'', ''GRPCRoute'']) : true '
5286+
''HTTPRoute'', ''GRPCRoute'', ''TCPRoute'']) : true '
52785287
- message: if authorization.rules.principal.jwt is used, jwt must be defined
52795288
rule: '(has(self.authorization) && has(self.authorization.rules) &&
52805289
self.authorization.rules.exists(r, has(r.principal.jwt))) ? has(self.jwt)

‎internal/gatewayapi/backendtlspolicy.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,8 @@ func (t *Translator) applyBackendTLSSetting(
7676
return t.applyEnvoyProxyBackendTLSSetting(upstreamConfig, resources, envoyProxy)
7777
}
7878

79+
// Merges TLS settings from Gateway API BackendTLSPolicy and Envoy Gateway Backend TL.
80+
// BackendTLSPolicy takes precedence for identical attributes that are set in both.
7981
func mergeBackendTLSConfigs(
8082
backendTLSSettingsConfig *ir.TLSUpstreamConfig,
8183
backendTLSPolicyConfig *ir.TLSUpstreamConfig,
@@ -91,8 +93,8 @@ func mergeBackendTLSConfigs(
9193
return backendTLSSettingsConfig
9294
}
9395

94-
// If both are set, we merge them, with BackendTLSPolicy settings taking precedence
9596
mergedConfig := backendTLSSettingsConfig.DeepCopy()
97+
9698
if backendTLSPolicyConfig.CACertificate != nil {
9799
mergedConfig.CACertificate = backendTLSPolicyConfig.CACertificate
98100
}
@@ -117,6 +119,10 @@ func (t *Translator) processBackendTLSSettings(
117119
InsecureSkipVerify: ptr.Deref(backend.Spec.TLS.InsecureSkipVerify, false),
118120
}
119121

122+
if backend.Spec.TLS.SNI != nil {
123+
tlsConfig.SNI = ptr.To(string(*backend.Spec.TLS.SNI))
124+
}
125+
120126
if !tlsConfig.InsecureSkipVerify {
121127
tlsConfig.UseSystemTrustStore = ptr.Deref(backend.Spec.TLS.WellKnownCACertificates, "") == gwapiv1a3.WellKnownCACertificatesSystem
122128

‎internal/gatewayapi/ext_service.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@ func (t *Translator) translateExtServiceBackendRefs(
8383
if rs.HasMixedEndpoints() {
8484
return nil, errors.New("external service destinations having multiple endpoint types are not supported")
8585
}
86+
8687
return rs, nil
8788
}
8889

0 commit comments

Comments
 (0)