Merge branch 'main' into client-wrr

Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>

Author: jukie

api/v1alpha1/envoyproxy_accesslogging_types.go

@@ -39,7 +39,7 @@ type ProxyAccessLogSetting struct {
 	// (1) All Routes.
 	// (2) Listeners if and only if Envoy does not find a matching route for a request.
 	// If type is defined, the accesslog settings would apply to the relevant component (as-is).
-	// +kubebuilder:validation:Enum=Listener;Route
+	// +kubebuilder:validation:Enum=Listener;Route;Upstream
 	// +optional
 	Type *ProxyAccessLogType `json:"type,omitempty"`
 }
@@ -55,6 +55,9 @@ const (
 	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/tcp_proxy/v3/tcp_proxy.proto#envoy-v3-api-field-extensions-filters-network-tcp-proxy-v3-tcpproxy-access-log
 	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-access-log
 	ProxyAccessLogTypeRoute ProxyAccessLogType = "Route"
+
+	// ProxyAccessLogTypeUpstream defines the accesslog for upstream.
+	ProxyAccessLogTypeUpstream ProxyAccessLogType = "Upstream"
 )
 
 type ProxyAccessLogFormatType string
@@ -67,7 +70,7 @@ const (
 )
 
 // ProxyAccessLogFormat defines the format of accesslog.
-// By default accesslogs are written to standard output.
+// By default, accesslogs are written to standard output.
 //
 // +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'Text' ? has(self.text) : true",message="If AccessLogFormat type is Text, text field needs to be set."
 // +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'Text' ? !has(self.json) : true",message="If AccessLogFormat type is Text, json field must not be set."

api/v1alpha1/tls_types.go

@@ -157,9 +157,17 @@ const (
 type ClientValidationContext struct {
 	// Optional set to true accepts connections even when a client doesn't present a certificate.
 	// Defaults to false, which rejects connections without a valid client certificate.
+	//
+	// Deprecated: Use Mode instead.
 	// +optional
 	Optional bool `json:"optional,omitempty"`
 
+	// Mode defines how the Gateway or Listener validates client certificates.
+	// If not specified, defaults to RequireAndVerify.
+	//
+	// +optional
+	Mode *ClientValidationModeType `json:"mode,omitempty"`
+
 	// CACertificateRefs contains one or more references to
 	// Kubernetes objects that contain TLS certificates of
 	// the Certificate Authorities that can be used
@@ -199,6 +207,31 @@ type ClientValidationContext struct {
 	Crl *CrlContext `json:"crl,omitempty"`
 }
 
+// ClientValidationModeType defines how a Gateway or Listener validates client certificates.
+//
+// +kubebuilder:validation:Enum=Request;RequireAny;VerifyIfGiven;RequireAndVerify
+type ClientValidationModeType string
+
+const (
+	// Request indicates that a client certificate is requested
+	// during the TLS handshake but does not require one.
+	ClientValidationRequest ClientValidationModeType = "Request"
+
+	// RequireAny indicates that a client certificate is required during
+	// the handshake, but the connection is permitted even when the
+	// client certificate verification fails.
+	ClientValidationRequireAny ClientValidationModeType = "RequireAny"
+
+	// VerifyIfGiven indicates that a client certificate is requested
+	// but not required. If presented, the certificate must be valid.
+	ClientValidationVerifyIfGiven ClientValidationModeType = "VerifyIfGiven"
+
+	// RequireAndVerify indicates that a valid client certificate must be
+	// presented during the handshake and validated
+	// using CA certificates defined in CACertificateRefs.
+	ClientValidationRequireAndVerify ClientValidationModeType = "RequireAndVerify"
+)
+
 // CrlContext holds certificate revocation list configuration that can be used to validate the client initiating the TLS connection
 type CrlContext struct {
 	// Refs contains one or more references to a Kubernetes ConfigMap or a Kubernetes Secret,

api/v1alpha1/zz_generated.deepcopy.go

@@ -1408,10 +1408,22 @@ spec:
                         required:
                         - refs
                         type: object
+                      mode:
+                        description: |-
+                          Mode defines how the Gateway or Listener validates client certificates.
+                          If not specified, defaults to RequireAndVerify.
+                        enum:
+                        - Request
+                        - RequireAny
+                        - VerifyIfGiven
+                        - RequireAndVerify
+                        type: string
                       optional:
                         description: |-
                           Optional set to true accepts connections even when a client doesn't present a certificate.
                           Defaults to false, which rejects connections without a valid client certificate.
+
+                          Deprecated: Use Mode instead.
                         type: boolean
                       spkiHashes:
                         description: |-

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -14332,6 +14332,7 @@ spec:
                               enum:
                               - Listener
                               - Route
+                              - Upstream
                               type: string
                           required:
                           - sinks

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml

@@ -1407,10 +1407,22 @@ spec:
                         required:
                         - refs
                         type: object
+                      mode:
+                        description: |-
+                          Mode defines how the Gateway or Listener validates client certificates.
+                          If not specified, defaults to RequireAndVerify.
+                        enum:
+                        - Request
+                        - RequireAny
+                        - VerifyIfGiven
+                        - RequireAndVerify
+                        type: string
                       optional:
                         description: |-
                           Optional set to true accepts connections even when a client doesn't present a certificate.
                           Defaults to false, which rejects connections without a valid client certificate.
+
+                          Deprecated: Use Mode instead.
                         type: boolean
                       spkiHashes:
                         description: |-

charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -14331,6 +14331,7 @@ spec:
                               enum:
                               - Listener
                               - Route
+                              - Upstream
                               type: string
                           required:
                           - sinks

charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml

@@ -871,6 +871,34 @@ func (t *Translator) buildListenerTLSParameters(
 			namespace: policy.Namespace,
 		}
 
+		// Determine the effective client validation mode.
+		mode := egv1a1.ClientValidationRequireAndVerify
+		if tlsParams.ClientValidation.Mode != nil {
+			mode = *tlsParams.ClientValidation.Mode
+		} else if tlsParams.ClientValidation.Optional {
+			// Legacy mapping: Optional=true means VerifyIfGiven.
+			mode = egv1a1.ClientValidationVerifyIfGiven
+		}
+
+		irTLSConfig.ClientValidationEnabled = true
+		switch mode {
+		case egv1a1.ClientValidationRequest:
+			irTLSConfig.RequireClientCertificate = false
+			irTLSConfig.AcceptUntrusted = true
+		case egv1a1.ClientValidationRequireAny:
+			irTLSConfig.RequireClientCertificate = true
+			irTLSConfig.AcceptUntrusted = true
+		case egv1a1.ClientValidationVerifyIfGiven:
+			irTLSConfig.RequireClientCertificate = false
+			irTLSConfig.AcceptUntrusted = false
+		case egv1a1.ClientValidationRequireAndVerify:
+			irTLSConfig.RequireClientCertificate = true
+			irTLSConfig.AcceptUntrusted = false
+		default:
+			irTLSConfig.RequireClientCertificate = true
+			irTLSConfig.AcceptUntrusted = false
+		}
+
 		irCACert := &ir.TLSCACertificate{
 			Name: irTLSCACertName(policy.Namespace, policy.Name),
 		}
@@ -894,12 +922,21 @@ func (t *Translator) buildListenerTLSParameters(
 			}
 			irCACert.Certificate = append(irCACert.Certificate, validCaCertBytes...)
 		}
+
+		// CA certificates are required for verification modes.
+		if (mode == egv1a1.ClientValidationVerifyIfGiven || mode == egv1a1.ClientValidationRequireAndVerify) && len(irCACert.Certificate) == 0 {
+			if tlsParams.ClientValidation.Mode == nil && tlsParams.ClientValidation.Optional {
+				return irTLSConfig, fmt.Errorf(`tls.clientValidation.optional=true requires caCertificateRefs (maps to mode %q)`, mode)
+			}
+			return irTLSConfig, fmt.Errorf(`tls.clientValidation.mode %q requires caCertificateRefs`, mode)
+		}
 		if len(irCACert.Certificate) > 0 {
 			irTLSConfig.CACertificate = irCACert
-			irTLSConfig.RequireClientCertificate = !tlsParams.ClientValidation.Optional
-			setTLSClientValidationContext(tlsParams.ClientValidation, irTLSConfig)
 		}
 
+		// Apply additional validation context fields (SPKI/cert hashes and SAN matchers) regardless of CA presence.
+		setTLSClientValidationContext(tlsParams.ClientValidation, irTLSConfig)
+
 		irCrl := &ir.TLSCrl{
 			Name: irTLSCrlName(policy.Namespace, policy.Name),
 		}

internal/gatewayapi/clienttrafficpolicy.go

@@ -551,6 +551,8 @@ func (t *Translator) processAccessLog(envoyproxy *egv1a1.EnvoyProxy, resources *
 				accessLogType = ptr.To(ir.ProxyAccessLogTypeRoute)
 			case egv1a1.ProxyAccessLogTypeListener:
 				accessLogType = ptr.To(ir.ProxyAccessLogTypeListener)
+			case egv1a1.ProxyAccessLogTypeUpstream:
+				accessLogType = ptr.To(ir.ProxyAccessLogTypeUpstream)
 			}
 		}
 

internal/gatewayapi/listener.go

@@ -0,0 +1,66 @@
+envoyProxyForGatewayClass:
+  apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: envoy-gateway-system
+    name: test
+  spec:
+    telemetry:
+      accessLog:
+        settings:
+          - format:
+              type: Text
+              text: |
+                Route access log: [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE%\n
+            sinks:
+              - type: File
+                file:
+                  path: /dev/stdout
+            type: Route
+          - format:
+              type: Text
+              text: |
+                Listener access log: [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE%\n
+            sinks:
+              - type: File
+                file:
+                  path: /dev/stdout
+            type: Listener
+          - format:
+              type: Text
+              text: |
+                Upstream access log: [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE%\n
+            sinks:
+              - type: File
+                file:
+                  path: /dev/stdout
+            type: Upstream
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: http-route-1
+    spec:
+      parentRefs:
+        - name: gateway-1
+          namespace: envoy-gateway
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080