kubernetes-sigs / kubernetes-sigs/gateway-api
Azure Application Gateway for Containers mTLS header forwarding possible?
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 3k
- Forks
- 790
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 45
Description
We are migrating to Azure Kubernetes Service with Azure Application Gateway for Containers and we have the following use case:
Some of our clients use mTLS when calling our APIs, while others do not.
What we want to achieve is to have TLS termination at the Gateway level, and after that the certificate thumbprint/fingerprint to be passed downstream to the backend target(s) as a Request Header (because this is needed for a logic that the service has).
Is that achievable?
Based on the documentation specific here - I can't find anything that explains that so I would like to see if someone has any recommendations on if and how can this be achieved.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Gateway API TLS guide and the linked Azure Application Gateway for Containers mTLS documentation. Determine whether the requested client-certificate thumbprint forwarding is supported or requires a documented design change, and record the achievable approach or limitation for mixed mTLS and non-mTLS clients.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, kubernetes
- Domain
- api, cloud, networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100