api7 / api7/api7-ingress-controller
enhancement: support upstream mTLS configuration for Gateway API backends
@AlinsRan is already working on this.
Since Jun 15, 2026.
- Dominant language
- Go
- Stars
- 5
- Forks
- 5
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 10
Description
Summary
Please triage whether the controller should support configuring upstream mTLS when using Gateway API resources.
Current behavior
The controller already exposes an upstream client-certificate path through the APISIX CRD surface, for example ApisixUpstream.spec.tlsSecret.
However, I did not find an equivalent Gateway API-oriented surface in the current controller model for expressing upstream client-auth when APISIX connects to backend services.
The Gateway API docs currently mark BackendTLSPolicy as not supported, and BackendTrafficPolicy does not appear to expose client certificate material for this use case.
As a result, upstream mTLS setups supported through APISIX CRDs cannot currently be expressed through the Gateway API path in the controller.
Use cases affected
- connecting from APISIX to HTTPS backends that require client certificate authentication
- managing upstream TLS verification and upstream client-auth through the same Gateway API-oriented configuration flow
Code context
docs/en/latest/concepts/gateway-api.mdapi/v1alpha1/backendtrafficpolicy_types.goapi/v2/apisixupstream_types.go
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.