Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add ssl ciphers and protocol version on gateway api #914

Open
wants to merge 1 commit into
base: feat/istio-1.19.0
Choose a base branch
from

Conversation

alexzzh
Copy link
Contributor

@alexzzh alexzzh commented Apr 18, 2024

Ⅰ. Describe what this PR did

  • 在 feat/istio-1.19.0 分支上 ,使得 gateway api支持配置ssl cipher suites 以及 ssl protocol version

Ⅱ. Does this pull request fix one issue?

Ⅲ. Why don't you add test cases (unit test/integration test)?

Ⅳ. Describe how to verify it

  • apply下方gateway api资源
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
 name: higress-gateways
spec:
 controllerName: "higress.io/gateway-controller"
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
 name: higress-gateway
 namespace: higress-system
spec:
 gatewayClassName: higress
 listeners:
 - name: fazheng
   port: 4006
   protocol: HTTPS
   allowedRoutes:
     namespaces:
       from: All
   tls:
     options:
       gateway.higress.io/tls-terminate-mode: "MUTUAL"
       gateway.higress.io/ssl-cipher: "ECDHE-ECDSA-AES128-GCM-SHA256:AES256-SHA"  ==》 1
       gateway.higress.io/tls_min_protocol_version: "TLSV1_1"  ==》 2
       gateway.higress.io/tls_max_protocol_version: "TLSV1_2"  ==》 2
     certificateRefs:
     - kind: Secret
       name: wildcard-foobar-com
 - name: yewu
   port: 4005
   protocol: HTTPS
   allowedRoutes:
     namespaces:
       from: All
   tls:
     certificateRefs:
     - kind: Secret
       name: wildcard-foobar-com
  • 查看数据平面envoy配置是否调整

5351713422355_ pic

Ⅴ. Special notes for reviews

@alexzzh alexzzh changed the title add ssl ciphers and protocol version on gateway api feat: add ssl ciphers and protocol version on gateway api Apr 18, 2024
serviceTypeOverride = "networking.higress.io/service-type"
defaultClassName = constants.DefaultGatewayClass
gatewayAliasForAnnotationKey = "gateway.higress.io/alias-for"
gatewayTLSTerminateModeKey = "gateway.higress.io/tls-terminate-mode"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这块是istio的实现迁移了过来,这里我倾向于使用ingress已有的注解来实现,例如:
higress.io/auth-tls-secret: tls-secret-cacert
nginx.ingress.kubernetes.io: tls-secret-cacert

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

好处是文档可以统一,ingress迁移到gateway api更容易一些

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants