envoyproxy / envoyproxy/gateway

Update CTP status to highlight that any TLS setting requires HTTPS to be enabled in the listener

Đang mở
#3,083 1 bình luận 0 reaction 0 người được giao Xem trên GitHub
help wanted
Ngôn ngữ chính
Go
Star
3k
Fork
864
Merge trung bình
2 ngày 2 giờ
Pull request đã merge (30 ngày)
140

Mô tả

@jhouston1604

Looking at the listener configuration, none of those listeners are configured to use TLS.

Your gateway is defined like this:
```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: envoy-public
namespace: envoy-public
spec:
gatewayClassName: envoy-public
listeners:
- name: http
protocol: HTTP
port: 80
allowedRoutes:
namespaces:
from: All
- name: https
protocol: HTTP
port: 443
allowedRoutes:
namespaces:
from: All
```

Simply using port 443 doesn't transform the listener to a TLS enabled listener. You need to add a TLS section at the very least:

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: envoy-public
namespace: envoy-public
spec:
gatewayClassName: envoy-public
listeners:
- name: http
protocol: HTTP
port: 80
allowedRoutes:
namespaces:
from: All
- name: https
protocol: HTTPS # The protocol needs to be HTTPS and not HTTP
port: 443
allowedRoutes:
namespaces:
from: All
tls: # This section is missing in the configuration files you listed above
certificateRefs: # The place where the server X.509 certificate can be found
- group: ""
kind: Secret
name: example-cert
mode: Terminate
```

Since TLS is not configured for any of the listeners, limiting the supported TLS version to 1.3 in a `ClientTrafficPolicy` doesn't really make any sense here.

_Originally posted by @liorokman in https://github.com/envoyproxy/gateway/issues/3060#issuecomment-2029849962_

Hướng dẫn đóng góp

Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.