envoyproxy / envoyproxy/gateway

Update CTP status to highlight that any TLS setting requires HTTPS to be enabled in the listener

Ouverte
#3,083 1 commentaire 0 réactions 0 personnes assignées Voir sur GitHub
help wanted
Langage dominant
Go
Étoiles
3k
Forks
864
Merge moyen
2 j 2 h
PR mergées (30 j)
140

Description

@jhouston1604

Looking at the listener configuration, none of those listeners are configured to use TLS.

Your gateway is defined like this:
```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: envoy-public
namespace: envoy-public
spec:
gatewayClassName: envoy-public
listeners:
- name: http
protocol: HTTP
port: 80
allowedRoutes:
namespaces:
from: All
- name: https
protocol: HTTP
port: 443
allowedRoutes:
namespaces:
from: All
```

Simply using port 443 doesn't transform the listener to a TLS enabled listener. You need to add a TLS section at the very least:

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: envoy-public
namespace: envoy-public
spec:
gatewayClassName: envoy-public
listeners:
- name: http
protocol: HTTP
port: 80
allowedRoutes:
namespaces:
from: All
- name: https
protocol: HTTPS # The protocol needs to be HTTPS and not HTTP
port: 443
allowedRoutes:
namespaces:
from: All
tls: # This section is missing in the configuration files you listed above
certificateRefs: # The place where the server X.509 certificate can be found
- group: ""
kind: Secret
name: example-cert
mode: Terminate
```

Since TLS is not configured for any of the listeners, limiting the supported TLS version to 1.3 in a `ClientTrafficPolicy` doesn't really make any sense here.

_Originally posted by @liorokman in https://github.com/envoyproxy/gateway/issues/3060#issuecomment-2029849962_

Guide de contribution

Aucun guide de contribution indexé pour ce dépôt

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.