diff --git a/api/v1alpha1/envoygateway_types.go b/api/v1alpha1/envoygateway_types.go index 1c7e2f0df17..34961be5c7b 100644 --- a/api/v1alpha1/envoygateway_types.go +++ b/api/v1alpha1/envoygateway_types.go @@ -162,7 +162,7 @@ type GatewayAPISettings struct { // RuntimeFlag defines a runtime flag used to guard breaking changes or risky experimental features in new Envoy Gateway releases. // A runtime flag may be enabled or disabled by default and can be toggled through the EnvoyGateway resource. // +enum -// +kubebuilder:validation:Enum=XDSNameSchemeV2;EndpointSliceIndex +// +kubebuilder:validation:Enum=XDSNameSchemeV2;EndpointSliceIndex;PerResourceSystemCASecret type RuntimeFlag string const ( @@ -175,6 +175,14 @@ const ( // If the additional controller memory usage for the indexes becomes a concern, // consider disabling this flag. EndpointSliceIndex RuntimeFlag = "EndpointSliceIndex" + + // PerResourceSystemCASecret restores the pre-1.x behavior of emitting one SDS secret per + // BackendTLSPolicy or Backend resource that uses WellKnownCACertificates: System, instead + // of sharing a single system_ca_certificates secret across all of them. + // Disabled by default (i.e. the shared secret is used). Enable this flag to opt out during + // upgrades — Envoy must warm the new system_ca_certificates secret before clusters can use + // it, which may cause a brief disruption to new connections on first enable. + PerResourceSystemCASecret RuntimeFlag = "PerResourceSystemCASecret" //nolint:gosec // not a credential ) // RuntimeFlags provide a mechanism to guard breaking changes or risky experimental features in new Envoy Gateway releases. diff --git a/internal/gatewayapi/backendtlspolicy.go b/internal/gatewayapi/backendtlspolicy.go index dca340143a1..ad82f94ca45 100644 --- a/internal/gatewayapi/backendtlspolicy.go +++ b/internal/gatewayapi/backendtlspolicy.go @@ -192,6 +192,11 @@ func mergeServerValidationTLSConfigs( if btpValidationTLSConfig.CACertificate != nil { mergedConfig.CACertificate = btpValidationTLSConfig.CACertificate + // If the BTLSP provides an explicit CA certificate, it overrides the backend's + // system trust store — clear UseSystemTrustStore so the IR is consistent. + if !btpValidationTLSConfig.UseSystemTrustStore { + mergedConfig.UseSystemTrustStore = false + } } if btpValidationTLSConfig.SNI != nil { // BTP takes precedence for SNI, if set, it will override Backend resource SNI and disable AutoSNIFromEndpointHostname mergedConfig.SNI = btpValidationTLSConfig.SNI @@ -276,8 +281,12 @@ func (t *Translator) processServerValidationTLSSettings( if !tlsConfig.InsecureSkipVerify { tlsConfig.UseSystemTrustStore = ptr.Deref(backend.Spec.TLS.WellKnownCACertificates, "") == gwapiv1.WellKnownCACertificatesSystem if tlsConfig.UseSystemTrustStore { + name := fmt.Sprintf("%s/%s-ca", backend.Name, backend.Namespace) + if !t.PerResourceSystemCASecret { + name = ir.SystemTrustStoreSecretName + } tlsConfig.CACertificate = &ir.TLSCACertificate{ - Name: fmt.Sprintf("%s/%s-ca", backend.Name, backend.Namespace), + Name: name, } } else if len(backend.Spec.TLS.CACertificateRefs) > 0 { caRefs := getObjectReferences(gwapiv1.Namespace(backend.Namespace), backend.Spec.TLS.CACertificateRefs) @@ -504,8 +513,12 @@ func (t *Translator) getBackendTLSBundle(backendTLSPolicy *gwapiv1.BackendTLSPol SubjectAltNames: subjectAltNames, } if tlsBundle.UseSystemTrustStore { + name := fmt.Sprintf("%s/%s-ca", backendTLSPolicy.Name, backendTLSPolicy.Namespace) + if !t.PerResourceSystemCASecret { + name = ir.SystemTrustStoreSecretName + } tlsBundle.CACertificate = &ir.TLSCACertificate{ - Name: fmt.Sprintf("%s/%s-ca", backendTLSPolicy.Name, backendTLSPolicy.Namespace), + Name: name, } return tlsBundle, nil } diff --git a/internal/gatewayapi/listener_test.go b/internal/gatewayapi/listener_test.go index 3905930964f..13005bcaf74 100644 --- a/internal/gatewayapi/listener_test.go +++ b/internal/gatewayapi/listener_test.go @@ -1433,7 +1433,7 @@ func TestProcessBackendRefsBackendTLSPolicy(t *testing.T) { backendMetadata := &ir.ResourceMetadata{Name: backendName, Namespace: ns} backendPolicyTLS := &ir.TLSUpstreamConfig{ SNI: new("otel.example.com"), UseSystemTrustStore: true, - CACertificate: &ir.TLSCACertificate{Name: "otel-tls/test-ns-ca"}, SubjectAltNames: []ir.SubjectAltName{}, + CACertificate: &ir.TLSCACertificate{Name: ir.SystemTrustStoreSecretName}, SubjectAltNames: []ir.SubjectAltName{}, TLSConfig: ir.TLSConfig{MinVersion: new(ir.TLSv12), MaxVersion: new(ir.TLSv13)}, } @@ -1472,7 +1472,7 @@ func TestProcessBackendRefsBackendTLSPolicy(t *testing.T) { serviceMetadata := &ir.ResourceMetadata{Name: serviceName, Namespace: ns, SectionName: "4317"} servicePolicyTLS := &ir.TLSUpstreamConfig{ SNI: new("otel-svc.example.com"), UseSystemTrustStore: true, - CACertificate: &ir.TLSCACertificate{Name: "otel-svc-tls/test-ns-ca"}, SubjectAltNames: []ir.SubjectAltName{}, + CACertificate: &ir.TLSCACertificate{Name: ir.SystemTrustStoreSecretName}, SubjectAltNames: []ir.SubjectAltName{}, TLSConfig: ir.TLSConfig{MinVersion: new(ir.TLSv12), MaxVersion: new(ir.TLSv13)}, } diff --git a/internal/gatewayapi/runner/runner.go b/internal/gatewayapi/runner/runner.go index bfc3e39c487..cecf456f070 100644 --- a/internal/gatewayapi/runner/runner.go +++ b/internal/gatewayapi/runner/runner.go @@ -299,6 +299,7 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re ControllerNamespace: r.ControllerNamespace, GatewayNamespaceMode: r.EnvoyGateway.GatewayNamespaceMode(), MergeGateways: gatewayapi.IsMergeGatewaysEnabled(resources), + PerResourceSystemCASecret: r.EnvoyGateway.RuntimeFlags.IsEnabled(egv1a1.PerResourceSystemCASecret), WasmCache: r.wasmCache, RunningOnHost: r.EnvoyGateway.Provider != nil && r.EnvoyGateway.Provider.IsRunningOnHost(), Logger: traceLogger, diff --git a/internal/gatewayapi/testdata/backend-system-truststore-btlsp-override-per-resource-secret.in.yaml b/internal/gatewayapi/testdata/backend-system-truststore-btlsp-override-per-resource-secret.in.yaml new file mode 100644 index 00000000000..5fe302cfcb3 --- /dev/null +++ b/internal/gatewayapi/testdata/backend-system-truststore-btlsp-override-per-resource-secret.in.yaml @@ -0,0 +1,142 @@ +# Two scenarios tested together: +# 1. Backend with wellKnownCACertificates: System overridden by a BackendTLSPolicy +# with an explicit caCertificateRefs — BTLSP's CA cert must win, UseSystemTrustStore cleared. +# 2. Backend with explicit caCertificateRefs overridden by a BackendTLSPolicy +# with wellKnownCACertificates: System — system trust store must win. +gateways: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + name: gateway-btls + namespace: envoy-gateway + spec: + gatewayClassName: envoy-gateway-class + listeners: + - name: http + protocol: HTTP + port: 80 + allowedRoutes: + namespaces: + from: All +httpRoutes: + - apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-btls + namespace: envoy-gateway + spec: + parentRefs: + - namespace: envoy-gateway + name: gateway-btls + sectionName: http + rules: + - matches: + - path: + type: Exact + value: /exact + backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-system-ca + namespace: envoy-gateway + port: 8080 + - matches: + - path: + type: Exact + value: /exact2 + backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-inline-ca + namespace: envoy-gateway + port: 8080 +backends: + - apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: backend-system-ca + namespace: envoy-gateway + spec: + endpoints: + - fqdn: + hostname: example.com + port: 8080 + tls: + # Scenario 1: Backend uses system trust store, BTLSP overrides with inline CA. + wellKnownCACertificates: System + - apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: backend-inline-ca + namespace: envoy-gateway + spec: + endpoints: + - fqdn: + hostname: example2.com + port: 8080 + tls: + # Scenario 2: Backend uses inline CA, BTLSP overrides with system trust store. + caCertificateRefs: + - name: ca-cmap + group: "" + kind: ConfigMap +backendTLSPolicies: + - apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-inline-override + namespace: envoy-gateway + spec: + targetRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-system-ca + validation: + # Scenario 1: BTLSP overrides with explicit CA cert — must win over system trust store. + caCertificateRefs: + - name: ca-cmap + group: "" + kind: ConfigMap + hostname: example.com + - apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-system-override + namespace: envoy-gateway + spec: + targetRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-inline-ca + validation: + # Scenario 2: BTLSP overrides with system trust store — must win over inline CA. + wellKnownCACertificates: System + hostname: example2.com +configMaps: + - apiVersion: v1 + kind: ConfigMap + metadata: + name: ca-cmap + namespace: envoy-gateway + data: + ca.crt: | + -----BEGIN CERTIFICATE----- + MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL + BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw + MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G + A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc + 1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM + yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b + kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU + Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq + ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR + bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48 + 6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/ + BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz + 2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J + i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE + A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg + d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1 + 3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q== + -----END CERTIFICATE----- + diff --git a/internal/gatewayapi/testdata/backend-system-truststore-btlsp-override-per-resource-secret.out.yaml b/internal/gatewayapi/testdata/backend-system-truststore-btlsp-override-per-resource-secret.out.yaml new file mode 100644 index 00000000000..a8f54e89c90 --- /dev/null +++ b/internal/gatewayapi/testdata/backend-system-truststore-btlsp-override-per-resource-secret.out.yaml @@ -0,0 +1,338 @@ +backendTLSPolicies: +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-inline-override + namespace: envoy-gateway + spec: + targetRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-system-ca + validation: + caCertificateRefs: + - group: "" + kind: ConfigMap + name: ca-cmap + hostname: example.com + status: + ancestors: + - ancestorRef: + name: gateway-btls + namespace: envoy-gateway + sectionName: http + conditions: + - lastTransitionTime: null + message: Resolved all the Object references. + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + - lastTransitionTime: null + message: Policy has been accepted. + reason: Accepted + status: "True" + type: Accepted + controllerName: gateway.envoyproxy.io/gatewayclass-controller +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-system-override + namespace: envoy-gateway + spec: + targetRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-inline-ca + validation: + hostname: example2.com + wellKnownCACertificates: System + status: + ancestors: + - ancestorRef: + name: gateway-btls + namespace: envoy-gateway + sectionName: http + conditions: + - lastTransitionTime: null + message: Resolved all the Object references. + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + - lastTransitionTime: null + message: Policy has been accepted. + reason: Accepted + status: "True" + type: Accepted + controllerName: gateway.envoyproxy.io/gatewayclass-controller +backends: +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: backend-system-ca + namespace: envoy-gateway + spec: + endpoints: + - fqdn: + hostname: example.com + port: 8080 + tls: + wellKnownCACertificates: System + status: + conditions: + - lastTransitionTime: null + message: The Backend was accepted + reason: Accepted + status: "True" + type: Accepted +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: backend-inline-ca + namespace: envoy-gateway + spec: + endpoints: + - fqdn: + hostname: example2.com + port: 8080 + tls: + caCertificateRefs: + - group: "" + kind: ConfigMap + name: ca-cmap + status: + conditions: + - lastTransitionTime: null + message: The Backend was accepted + reason: Accepted + status: "True" + type: Accepted +gateways: +- apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + name: gateway-btls + namespace: envoy-gateway + spec: + gatewayClassName: envoy-gateway-class + listeners: + - allowedRoutes: + namespaces: + from: All + name: http + port: 80 + protocol: HTTP + status: + listeners: + - attachedRoutes: 1 + conditions: + - lastTransitionTime: null + message: Sending translated listener configuration to the data plane + reason: Programmed + status: "True" + type: Programmed + - lastTransitionTime: null + message: Listener has been successfully translated + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Listener references have been resolved + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + name: http + supportedKinds: + - group: gateway.networking.k8s.io + kind: HTTPRoute + - group: gateway.networking.k8s.io + kind: GRPCRoute +httpRoutes: +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-btls + namespace: envoy-gateway + spec: + parentRefs: + - name: gateway-btls + namespace: envoy-gateway + sectionName: http + rules: + - backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-system-ca + namespace: envoy-gateway + port: 8080 + matches: + - path: + type: Exact + value: /exact + - backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-inline-ca + namespace: envoy-gateway + port: 8080 + matches: + - path: + type: Exact + value: /exact2 + status: + parents: + - conditions: + - lastTransitionTime: null + message: Route is accepted + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Resolved all the Object references for the Route + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parentRef: + name: gateway-btls + namespace: envoy-gateway + sectionName: http +infraIR: + envoy-gateway/gateway-btls: + proxy: + listeners: + - name: envoy-gateway/gateway-btls/http + ports: + - containerPort: 10080 + name: http-80 + protocol: HTTP + servicePort: 80 + metadata: + labels: + gateway.envoyproxy.io/owning-gateway-name: gateway-btls + gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway + ownerReference: + kind: GatewayClass + name: envoy-gateway-class + name: envoy-gateway/gateway-btls + namespace: envoy-gateway-system +xdsIR: + envoy-gateway/gateway-btls: + accessLog: + json: + - path: /dev/stdout + globalResources: + proxyServiceCluster: + metadata: + kind: Service + name: envoy-envoy-gateway-gateway-btls-a945b5bb + namespace: envoy-gateway-system + sectionName: "8080" + name: envoy-gateway/gateway-btls + settings: + - addressType: IP + endpoints: + - host: 7.6.5.4 + port: 8080 + zone: zone1 + metadata: + kind: Service + name: envoy-envoy-gateway-gateway-btls-a945b5bb + namespace: envoy-gateway-system + sectionName: "8080" + name: envoy-gateway/gateway-btls + protocol: TCP + http: + - address: 0.0.0.0 + externalPort: 80 + hostnames: + - '*' + metadata: + kind: Gateway + name: gateway-btls + namespace: envoy-gateway + sectionName: http + name: envoy-gateway/gateway-btls/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + routes: + - destination: + metadata: + kind: HTTPRoute + name: httproute-btls + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/1 + settings: + - addressType: FQDN + endpoints: + - host: example2.com + port: 8080 + metadata: + kind: Backend + name: backend-inline-ca + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/1/backend/0 + protocol: HTTP + tls: + alpnProtocols: null + caCertificate: + name: policy-btls-system-override/envoy-gateway-ca + maxVersion: "1.3" + minVersion: "1.2" + sni: example2.com + useSystemTrustStore: true + weight: 1 + hostname: '*' + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-btls + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/1/match/0/* + pathMatch: + distinct: false + exact: /exact2 + name: "" + - destination: + metadata: + kind: HTTPRoute + name: httproute-btls + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/0 + settings: + - addressType: FQDN + endpoints: + - host: example.com + port: 8080 + metadata: + kind: Backend + name: backend-system-ca + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/0/backend/0 + protocol: HTTP + tls: + alpnProtocols: null + caCertificate: + certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + name: policy-btls-inline-override/envoy-gateway-ca + maxVersion: "1.3" + minVersion: "1.2" + sni: example.com + weight: 1 + hostname: '*' + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-btls + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/* + pathMatch: + distinct: false + exact: /exact + name: "" + readyListener: + address: 0.0.0.0 + ipFamily: IPv4 + path: /ready + port: 19003 diff --git a/internal/gatewayapi/testdata/backend-system-truststore-btlsp-override-shared-secret.in.yaml b/internal/gatewayapi/testdata/backend-system-truststore-btlsp-override-shared-secret.in.yaml new file mode 100644 index 00000000000..5fe302cfcb3 --- /dev/null +++ b/internal/gatewayapi/testdata/backend-system-truststore-btlsp-override-shared-secret.in.yaml @@ -0,0 +1,142 @@ +# Two scenarios tested together: +# 1. Backend with wellKnownCACertificates: System overridden by a BackendTLSPolicy +# with an explicit caCertificateRefs — BTLSP's CA cert must win, UseSystemTrustStore cleared. +# 2. Backend with explicit caCertificateRefs overridden by a BackendTLSPolicy +# with wellKnownCACertificates: System — system trust store must win. +gateways: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + name: gateway-btls + namespace: envoy-gateway + spec: + gatewayClassName: envoy-gateway-class + listeners: + - name: http + protocol: HTTP + port: 80 + allowedRoutes: + namespaces: + from: All +httpRoutes: + - apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-btls + namespace: envoy-gateway + spec: + parentRefs: + - namespace: envoy-gateway + name: gateway-btls + sectionName: http + rules: + - matches: + - path: + type: Exact + value: /exact + backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-system-ca + namespace: envoy-gateway + port: 8080 + - matches: + - path: + type: Exact + value: /exact2 + backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-inline-ca + namespace: envoy-gateway + port: 8080 +backends: + - apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: backend-system-ca + namespace: envoy-gateway + spec: + endpoints: + - fqdn: + hostname: example.com + port: 8080 + tls: + # Scenario 1: Backend uses system trust store, BTLSP overrides with inline CA. + wellKnownCACertificates: System + - apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: backend-inline-ca + namespace: envoy-gateway + spec: + endpoints: + - fqdn: + hostname: example2.com + port: 8080 + tls: + # Scenario 2: Backend uses inline CA, BTLSP overrides with system trust store. + caCertificateRefs: + - name: ca-cmap + group: "" + kind: ConfigMap +backendTLSPolicies: + - apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-inline-override + namespace: envoy-gateway + spec: + targetRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-system-ca + validation: + # Scenario 1: BTLSP overrides with explicit CA cert — must win over system trust store. + caCertificateRefs: + - name: ca-cmap + group: "" + kind: ConfigMap + hostname: example.com + - apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-system-override + namespace: envoy-gateway + spec: + targetRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-inline-ca + validation: + # Scenario 2: BTLSP overrides with system trust store — must win over inline CA. + wellKnownCACertificates: System + hostname: example2.com +configMaps: + - apiVersion: v1 + kind: ConfigMap + metadata: + name: ca-cmap + namespace: envoy-gateway + data: + ca.crt: | + -----BEGIN CERTIFICATE----- + MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL + BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw + MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G + A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc + 1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM + yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b + kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU + Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq + ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR + bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48 + 6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/ + BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz + 2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J + i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE + A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg + d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1 + 3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q== + -----END CERTIFICATE----- + diff --git a/internal/gatewayapi/testdata/backend-system-truststore-btlsp-override-shared-secret.out.yaml b/internal/gatewayapi/testdata/backend-system-truststore-btlsp-override-shared-secret.out.yaml new file mode 100644 index 00000000000..c81a68c547f --- /dev/null +++ b/internal/gatewayapi/testdata/backend-system-truststore-btlsp-override-shared-secret.out.yaml @@ -0,0 +1,338 @@ +backendTLSPolicies: +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-inline-override + namespace: envoy-gateway + spec: + targetRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-system-ca + validation: + caCertificateRefs: + - group: "" + kind: ConfigMap + name: ca-cmap + hostname: example.com + status: + ancestors: + - ancestorRef: + name: gateway-btls + namespace: envoy-gateway + sectionName: http + conditions: + - lastTransitionTime: null + message: Resolved all the Object references. + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + - lastTransitionTime: null + message: Policy has been accepted. + reason: Accepted + status: "True" + type: Accepted + controllerName: gateway.envoyproxy.io/gatewayclass-controller +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-system-override + namespace: envoy-gateway + spec: + targetRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-inline-ca + validation: + hostname: example2.com + wellKnownCACertificates: System + status: + ancestors: + - ancestorRef: + name: gateway-btls + namespace: envoy-gateway + sectionName: http + conditions: + - lastTransitionTime: null + message: Resolved all the Object references. + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + - lastTransitionTime: null + message: Policy has been accepted. + reason: Accepted + status: "True" + type: Accepted + controllerName: gateway.envoyproxy.io/gatewayclass-controller +backends: +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: backend-system-ca + namespace: envoy-gateway + spec: + endpoints: + - fqdn: + hostname: example.com + port: 8080 + tls: + wellKnownCACertificates: System + status: + conditions: + - lastTransitionTime: null + message: The Backend was accepted + reason: Accepted + status: "True" + type: Accepted +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: backend-inline-ca + namespace: envoy-gateway + spec: + endpoints: + - fqdn: + hostname: example2.com + port: 8080 + tls: + caCertificateRefs: + - group: "" + kind: ConfigMap + name: ca-cmap + status: + conditions: + - lastTransitionTime: null + message: The Backend was accepted + reason: Accepted + status: "True" + type: Accepted +gateways: +- apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + name: gateway-btls + namespace: envoy-gateway + spec: + gatewayClassName: envoy-gateway-class + listeners: + - allowedRoutes: + namespaces: + from: All + name: http + port: 80 + protocol: HTTP + status: + listeners: + - attachedRoutes: 1 + conditions: + - lastTransitionTime: null + message: Sending translated listener configuration to the data plane + reason: Programmed + status: "True" + type: Programmed + - lastTransitionTime: null + message: Listener has been successfully translated + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Listener references have been resolved + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + name: http + supportedKinds: + - group: gateway.networking.k8s.io + kind: HTTPRoute + - group: gateway.networking.k8s.io + kind: GRPCRoute +httpRoutes: +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-btls + namespace: envoy-gateway + spec: + parentRefs: + - name: gateway-btls + namespace: envoy-gateway + sectionName: http + rules: + - backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-system-ca + namespace: envoy-gateway + port: 8080 + matches: + - path: + type: Exact + value: /exact + - backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-inline-ca + namespace: envoy-gateway + port: 8080 + matches: + - path: + type: Exact + value: /exact2 + status: + parents: + - conditions: + - lastTransitionTime: null + message: Route is accepted + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Resolved all the Object references for the Route + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parentRef: + name: gateway-btls + namespace: envoy-gateway + sectionName: http +infraIR: + envoy-gateway/gateway-btls: + proxy: + listeners: + - name: envoy-gateway/gateway-btls/http + ports: + - containerPort: 10080 + name: http-80 + protocol: HTTP + servicePort: 80 + metadata: + labels: + gateway.envoyproxy.io/owning-gateway-name: gateway-btls + gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway + ownerReference: + kind: GatewayClass + name: envoy-gateway-class + name: envoy-gateway/gateway-btls + namespace: envoy-gateway-system +xdsIR: + envoy-gateway/gateway-btls: + accessLog: + json: + - path: /dev/stdout + globalResources: + proxyServiceCluster: + metadata: + kind: Service + name: envoy-envoy-gateway-gateway-btls-a945b5bb + namespace: envoy-gateway-system + sectionName: "8080" + name: envoy-gateway/gateway-btls + settings: + - addressType: IP + endpoints: + - host: 7.6.5.4 + port: 8080 + zone: zone1 + metadata: + kind: Service + name: envoy-envoy-gateway-gateway-btls-a945b5bb + namespace: envoy-gateway-system + sectionName: "8080" + name: envoy-gateway/gateway-btls + protocol: TCP + http: + - address: 0.0.0.0 + externalPort: 80 + hostnames: + - '*' + metadata: + kind: Gateway + name: gateway-btls + namespace: envoy-gateway + sectionName: http + name: envoy-gateway/gateway-btls/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + routes: + - destination: + metadata: + kind: HTTPRoute + name: httproute-btls + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/1 + settings: + - addressType: FQDN + endpoints: + - host: example2.com + port: 8080 + metadata: + kind: Backend + name: backend-inline-ca + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/1/backend/0 + protocol: HTTP + tls: + alpnProtocols: null + caCertificate: + name: system_ca_certificates + maxVersion: "1.3" + minVersion: "1.2" + sni: example2.com + useSystemTrustStore: true + weight: 1 + hostname: '*' + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-btls + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/1/match/0/* + pathMatch: + distinct: false + exact: /exact2 + name: "" + - destination: + metadata: + kind: HTTPRoute + name: httproute-btls + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/0 + settings: + - addressType: FQDN + endpoints: + - host: example.com + port: 8080 + metadata: + kind: Backend + name: backend-system-ca + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/0/backend/0 + protocol: HTTP + tls: + alpnProtocols: null + caCertificate: + certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + name: policy-btls-inline-override/envoy-gateway-ca + maxVersion: "1.3" + minVersion: "1.2" + sni: example.com + weight: 1 + hostname: '*' + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-btls + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/* + pathMatch: + distinct: false + exact: /exact + name: "" + readyListener: + address: 0.0.0.0 + ipFamily: IPv4 + path: /ready + port: 19003 diff --git a/internal/gatewayapi/testdata/backend-system-truststore-per-resource-secret.in.yaml b/internal/gatewayapi/testdata/backend-system-truststore-per-resource-secret.in.yaml new file mode 100644 index 00000000000..bdf6e7cb250 --- /dev/null +++ b/internal/gatewayapi/testdata/backend-system-truststore-per-resource-secret.in.yaml @@ -0,0 +1,50 @@ +gateways: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + name: gateway-btls + namespace: envoy-gateway + spec: + gatewayClassName: envoy-gateway-class + listeners: + - name: http + protocol: HTTP + port: 80 + allowedRoutes: + namespaces: + from: All +httpRoutes: + - apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-btls + namespace: envoy-gateway + spec: + parentRefs: + - namespace: envoy-gateway + name: gateway-btls + sectionName: http + rules: + - matches: + - path: + type: Exact + value: /exact + backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-fqdn + namespace: envoy-gateway + port: 8080 +backends: + - apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: backend-fqdn + namespace: envoy-gateway + spec: + endpoints: + - fqdn: + hostname: example.com + port: 8080 + tls: + wellKnownCACertificates: System diff --git a/internal/gatewayapi/testdata/backend-system-truststore-per-resource-secret.out.yaml b/internal/gatewayapi/testdata/backend-system-truststore-per-resource-secret.out.yaml new file mode 100644 index 00000000000..ae291ac7b1b --- /dev/null +++ b/internal/gatewayapi/testdata/backend-system-truststore-per-resource-secret.out.yaml @@ -0,0 +1,202 @@ +backends: +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: backend-fqdn + namespace: envoy-gateway + spec: + endpoints: + - fqdn: + hostname: example.com + port: 8080 + tls: + wellKnownCACertificates: System + status: + conditions: + - lastTransitionTime: null + message: The Backend was accepted + reason: Accepted + status: "True" + type: Accepted +gateways: +- apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + name: gateway-btls + namespace: envoy-gateway + spec: + gatewayClassName: envoy-gateway-class + listeners: + - allowedRoutes: + namespaces: + from: All + name: http + port: 80 + protocol: HTTP + status: + listeners: + - attachedRoutes: 1 + conditions: + - lastTransitionTime: null + message: Sending translated listener configuration to the data plane + reason: Programmed + status: "True" + type: Programmed + - lastTransitionTime: null + message: Listener has been successfully translated + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Listener references have been resolved + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + name: http + supportedKinds: + - group: gateway.networking.k8s.io + kind: HTTPRoute + - group: gateway.networking.k8s.io + kind: GRPCRoute +httpRoutes: +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-btls + namespace: envoy-gateway + spec: + parentRefs: + - name: gateway-btls + namespace: envoy-gateway + sectionName: http + rules: + - backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-fqdn + namespace: envoy-gateway + port: 8080 + matches: + - path: + type: Exact + value: /exact + status: + parents: + - conditions: + - lastTransitionTime: null + message: Route is accepted + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Resolved all the Object references for the Route + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parentRef: + name: gateway-btls + namespace: envoy-gateway + sectionName: http +infraIR: + envoy-gateway/gateway-btls: + proxy: + listeners: + - name: envoy-gateway/gateway-btls/http + ports: + - containerPort: 10080 + name: http-80 + protocol: HTTP + servicePort: 80 + metadata: + labels: + gateway.envoyproxy.io/owning-gateway-name: gateway-btls + gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway + ownerReference: + kind: GatewayClass + name: envoy-gateway-class + name: envoy-gateway/gateway-btls + namespace: envoy-gateway-system +xdsIR: + envoy-gateway/gateway-btls: + accessLog: + json: + - path: /dev/stdout + globalResources: + proxyServiceCluster: + metadata: + kind: Service + name: envoy-envoy-gateway-gateway-btls-a945b5bb + namespace: envoy-gateway-system + sectionName: "8080" + name: envoy-gateway/gateway-btls + settings: + - addressType: IP + endpoints: + - host: 7.6.5.4 + port: 8080 + zone: zone1 + metadata: + kind: Service + name: envoy-envoy-gateway-gateway-btls-a945b5bb + namespace: envoy-gateway-system + sectionName: "8080" + name: envoy-gateway/gateway-btls + protocol: TCP + http: + - address: 0.0.0.0 + externalPort: 80 + hostnames: + - '*' + metadata: + kind: Gateway + name: gateway-btls + namespace: envoy-gateway + sectionName: http + name: envoy-gateway/gateway-btls/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + routes: + - destination: + metadata: + kind: HTTPRoute + name: httproute-btls + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/0 + settings: + - addressType: FQDN + endpoints: + - host: example.com + port: 8080 + metadata: + kind: Backend + name: backend-fqdn + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/0/backend/0 + protocol: HTTP + tls: + alpnProtocols: null + caCertificate: + name: backend-fqdn/envoy-gateway-ca + maxVersion: "1.3" + minVersion: "1.2" + useSystemTrustStore: true + weight: 1 + hostname: '*' + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-btls + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/* + pathMatch: + distinct: false + exact: /exact + name: "" + readyListener: + address: 0.0.0.0 + ipFamily: IPv4 + path: /ready + port: 19003 diff --git a/internal/gatewayapi/testdata/backend-system-truststore-shared-secret.in.yaml b/internal/gatewayapi/testdata/backend-system-truststore-shared-secret.in.yaml new file mode 100644 index 00000000000..bdf6e7cb250 --- /dev/null +++ b/internal/gatewayapi/testdata/backend-system-truststore-shared-secret.in.yaml @@ -0,0 +1,50 @@ +gateways: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + name: gateway-btls + namespace: envoy-gateway + spec: + gatewayClassName: envoy-gateway-class + listeners: + - name: http + protocol: HTTP + port: 80 + allowedRoutes: + namespaces: + from: All +httpRoutes: + - apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-btls + namespace: envoy-gateway + spec: + parentRefs: + - namespace: envoy-gateway + name: gateway-btls + sectionName: http + rules: + - matches: + - path: + type: Exact + value: /exact + backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-fqdn + namespace: envoy-gateway + port: 8080 +backends: + - apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: backend-fqdn + namespace: envoy-gateway + spec: + endpoints: + - fqdn: + hostname: example.com + port: 8080 + tls: + wellKnownCACertificates: System diff --git a/internal/gatewayapi/testdata/backend-system-truststore-shared-secret.out.yaml b/internal/gatewayapi/testdata/backend-system-truststore-shared-secret.out.yaml new file mode 100644 index 00000000000..a99769ce018 --- /dev/null +++ b/internal/gatewayapi/testdata/backend-system-truststore-shared-secret.out.yaml @@ -0,0 +1,202 @@ +backends: +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: backend-fqdn + namespace: envoy-gateway + spec: + endpoints: + - fqdn: + hostname: example.com + port: 8080 + tls: + wellKnownCACertificates: System + status: + conditions: + - lastTransitionTime: null + message: The Backend was accepted + reason: Accepted + status: "True" + type: Accepted +gateways: +- apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + name: gateway-btls + namespace: envoy-gateway + spec: + gatewayClassName: envoy-gateway-class + listeners: + - allowedRoutes: + namespaces: + from: All + name: http + port: 80 + protocol: HTTP + status: + listeners: + - attachedRoutes: 1 + conditions: + - lastTransitionTime: null + message: Sending translated listener configuration to the data plane + reason: Programmed + status: "True" + type: Programmed + - lastTransitionTime: null + message: Listener has been successfully translated + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Listener references have been resolved + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + name: http + supportedKinds: + - group: gateway.networking.k8s.io + kind: HTTPRoute + - group: gateway.networking.k8s.io + kind: GRPCRoute +httpRoutes: +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-btls + namespace: envoy-gateway + spec: + parentRefs: + - name: gateway-btls + namespace: envoy-gateway + sectionName: http + rules: + - backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: backend-fqdn + namespace: envoy-gateway + port: 8080 + matches: + - path: + type: Exact + value: /exact + status: + parents: + - conditions: + - lastTransitionTime: null + message: Route is accepted + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Resolved all the Object references for the Route + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parentRef: + name: gateway-btls + namespace: envoy-gateway + sectionName: http +infraIR: + envoy-gateway/gateway-btls: + proxy: + listeners: + - name: envoy-gateway/gateway-btls/http + ports: + - containerPort: 10080 + name: http-80 + protocol: HTTP + servicePort: 80 + metadata: + labels: + gateway.envoyproxy.io/owning-gateway-name: gateway-btls + gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway + ownerReference: + kind: GatewayClass + name: envoy-gateway-class + name: envoy-gateway/gateway-btls + namespace: envoy-gateway-system +xdsIR: + envoy-gateway/gateway-btls: + accessLog: + json: + - path: /dev/stdout + globalResources: + proxyServiceCluster: + metadata: + kind: Service + name: envoy-envoy-gateway-gateway-btls-a945b5bb + namespace: envoy-gateway-system + sectionName: "8080" + name: envoy-gateway/gateway-btls + settings: + - addressType: IP + endpoints: + - host: 7.6.5.4 + port: 8080 + zone: zone1 + metadata: + kind: Service + name: envoy-envoy-gateway-gateway-btls-a945b5bb + namespace: envoy-gateway-system + sectionName: "8080" + name: envoy-gateway/gateway-btls + protocol: TCP + http: + - address: 0.0.0.0 + externalPort: 80 + hostnames: + - '*' + metadata: + kind: Gateway + name: gateway-btls + namespace: envoy-gateway + sectionName: http + name: envoy-gateway/gateway-btls/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + routes: + - destination: + metadata: + kind: HTTPRoute + name: httproute-btls + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/0 + settings: + - addressType: FQDN + endpoints: + - host: example.com + port: 8080 + metadata: + kind: Backend + name: backend-fqdn + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/0/backend/0 + protocol: HTTP + tls: + alpnProtocols: null + caCertificate: + name: system_ca_certificates + maxVersion: "1.3" + minVersion: "1.2" + useSystemTrustStore: true + weight: 1 + hostname: '*' + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-btls + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/* + pathMatch: + distinct: false + exact: /exact + name: "" + readyListener: + address: 0.0.0.0 + ipFamily: IPv4 + path: /ready + port: 19003 diff --git a/internal/gatewayapi/testdata/backend-tls-settings.out.yaml b/internal/gatewayapi/testdata/backend-tls-settings.out.yaml index 880fda0a114..40f47582166 100644 --- a/internal/gatewayapi/testdata/backend-tls-settings.out.yaml +++ b/internal/gatewayapi/testdata/backend-tls-settings.out.yaml @@ -1055,7 +1055,7 @@ xdsIR: - HTTP/1.1 - HTTP/2 caCertificate: - name: policy-btls-for-backend-1/default-ca + name: system_ca_certificates ciphers: - ECDHE-RSA-AES128-GCM-SHA256 - ECDHE-ECDSA-AES256-GCM-SHA384 @@ -1161,7 +1161,7 @@ xdsIR: - HTTP/1.1 - HTTP/2 caCertificate: - name: policy-btls-for-backend-3/default-ca + name: system_ca_certificates ciphers: - ECDHE-RSA-AES128-GCM-SHA256 - ECDHE-ECDSA-AES256-GCM-SHA384 @@ -1213,7 +1213,7 @@ xdsIR: - HTTP/1.1 - HTTP/2 caCertificate: - name: policy-btls-for-backend-4/default-ca + name: system_ca_certificates ciphers: - ECDHE-RSA-AES128-GCM-SHA256 - ECDHE-ECDSA-AES256-GCM-SHA384 @@ -1290,7 +1290,7 @@ xdsIR: alpnProtocols: - HTTP/2 caCertificate: - name: backend-7/envoy-gateway-ca + name: system_ca_certificates ciphers: - ECDHE-RSA-AES128-GCM-SHA256 - ECDHE-ECDSA-AES256-GCM-SHA384 @@ -1339,7 +1339,7 @@ xdsIR: tls: alpnProtocols: [] caCertificate: - name: backend-9/envoy-gateway-ca + name: system_ca_certificates ciphers: - ECDHE-RSA-AES128-GCM-SHA256 - ECDHE-ECDSA-AES256-GCM-SHA384 @@ -1434,7 +1434,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: policy-btls-for-backend-8/envoy-gateway-ca + name: system_ca_certificates clientCertificates: - certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKRENDQWd5Z0F3SUJBZ0lVU3JTYktMZjBiTEVHb2dXeC9nQ3cyR0N0dnhFd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0V6RVJNQThHQTFVRUF3d0lWR1Z6ZENCSmJtTXdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVRNUkV3RHdZRFZRUUREQWhVWlhOMElFbHVZekNDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFECmdnRVBBRENDQVFvQ2dnRUJBSzFKempQSWlXZzNxb0hTckFkZGtlSmphTVA5aXlNVGkvQlBvOWNKUG9SRThaaTcKV2FwVXJYTC85QTlyK2pITXlHSVpOWk5kY1o1Y1kyWHYwTFA4WnhWeTJsazArM3d0WXpIbnBHWUdWdHlxMnRldApEaEZzaVBsODJZUmpDMG16V2E0UU16NFNYekZITmdJRHBSZGhmcm92bXNldVdHUUU4cFY0VWQ5VUsvU0tpbE1PCnF0QjVKaXJMUDJWczVUMW9XaWNXTFF2ZmJHd3Y3c0ZEZHI5YkcwWHRTUXAxN0hTZ281MFNERTUrQmpTbXB0RncKMVZjS0xscWFoTVhCRERpb3Jnd2hJaEdHS3BFU2VNMFA3YkZoVm1rTTNhc2gyeFNUQnVGVUJEbEU0Sk9haHp3cwpEWHJ1cFVoRGRTMWhkYzJmUHJqaEZBbEpmV0VZWjZCbFpqeXNpVlVDQXdFQUFhTndNRzR3SFFZRFZSME9CQllFCkZCUXVmSzFMaWJ1Vm05VHMvVmpCeDhMM3VpTmVNQjhHQTFVZEl3UVlNQmFBRkJRdWZLMUxpYnVWbTlUcy9WakIKeDhMM3VpTmVNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdHd1lEVlIwUkJCUXdFb0lCS29JTktpNWxlR0Z0Y0d4bApMbU52YlRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQWZQUzQxYWdldldNVjNaWHQwQ09GRzN1WWZQRlhuVnc2ClA0MXA5TzZHa2RZc3VxRnZQZVR5eUgyL2RBSUtLd1N6TS9wdGhnOEtuOExabG1KeUZObkExc3RKeG41WGRiVjEKcFBxajhVdllDQnp5ak1JcW1SeW9peUxpUWxib2hNYTBVZEVCS2NIL1BkTEU5SzhUR0pyWmdvR1hxcTFXbWl0RAozdmNQalNlUEtFaVVKVlM5bENoeVNzMEtZNUIraFVRRDBKajZucEZENFprMHhxZHhoMHJXdWVDcXE3dmpxRVl6CnBqNFB3cnVmbjFQQlRtZnhNdVYvVUpWNWViaWtldVpQMzVrV3pMUjdaV0FMN3d1RGRXcC82bzR5azNRTGFuRFEKQ3dnQ0ZjWCtzcyswVnl1TTNZZXJUT1VVOFFWSkp4NFVaQU5aeDYrNDNwZEpaT2NudFBaNENBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= name: envoy-gateway/gateway-client-auth @@ -1524,7 +1524,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: backend-10/envoy-gateway-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" useSystemTrustStore: true diff --git a/internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml index 870c63ea16e..62fa2268612 100644 --- a/internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml +++ b/internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml @@ -202,7 +202,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: policy-btls/default-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" sni: example.com @@ -222,7 +222,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: policy-btls/default-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" sni: example.com diff --git a/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml index dabd182c1db..475936f2f59 100644 --- a/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml +++ b/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml @@ -191,7 +191,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: policy-btls/default-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" sni: example.com diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy-per-resource-secret.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy-per-resource-secret.in.yaml new file mode 100644 index 00000000000..1433290e4b5 --- /dev/null +++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy-per-resource-secret.in.yaml @@ -0,0 +1,285 @@ +gateways: +- apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + namespace: default + name: gateway-1 + spec: + gatewayClassName: envoy-gateway-class + listeners: + - name: http + protocol: HTTP + port: 80 + allowedRoutes: + namespaces: + from: All +httpRoutes: +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + namespace: default + name: httproute-1 + spec: + hostnames: + - www.foo.com + parentRefs: + - namespace: default + name: gateway-1 + sectionName: http + rules: + - matches: + - path: + value: /foo + backendRefs: + - name: service-1 + port: 8080 +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + namespace: default + name: httproute-2 + spec: + hostnames: + - www.bar.com + parentRefs: + - namespace: default + name: gateway-1 + sectionName: http + rules: + - matches: + - path: + value: /bar + backendRefs: + - name: service-1 + port: 8080 +services: +- apiVersion: v1 + kind: Service + metadata: + namespace: envoy-gateway + name: grpc-backend + spec: + ports: + - port: 8000 + name: grpc + protocol: TCP +- apiVersion: v1 + kind: Service + metadata: + namespace: default + name: grpc-backend-2 + spec: + ports: + - port: 9000 + name: grpc + protocol: TCP +- apiVersion: v1 + kind: Service + metadata: + namespace: default + name: grpc-backend-system-ca + spec: + ports: + - port: 9001 + name: grpc + protocol: TCP +endpointSlices: +- apiVersion: discovery.k8s.io/v1 + kind: EndpointSlice + metadata: + name: endpointslice-grpc-backend + namespace: envoy-gateway + labels: + kubernetes.io/service-name: grpc-backend + addressType: IPv4 + ports: + - name: grpc + protocol: TCP + port: 8000 + endpoints: + - addresses: + - 7.7.7.7 + conditions: + ready: true +- apiVersion: discovery.k8s.io/v1 + kind: EndpointSlice + metadata: + name: endpointslice-grpc-backend-2 + namespace: default + labels: + kubernetes.io/service-name: grpc-backend-2 + addressType: IPv4 + ports: + - name: grpc + protocol: TCP + port: 9000 + endpoints: + - addresses: + - 8.8.8.8 + conditions: + ready: true +- apiVersion: discovery.k8s.io/v1 + kind: EndpointSlice + metadata: + name: endpointslice-grpc-backend-system-ca + namespace: default + labels: + kubernetes.io/service-name: grpc-backend-system-ca + addressType: IPv4 + ports: + - name: grpc + protocol: TCP + port: 9001 + endpoints: + - addresses: + - 9.9.9.9 + conditions: + ready: true +referenceGrants: +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: ReferenceGrant + metadata: + namespace: envoy-gateway + name: referencegrant-1 + spec: + from: + - group: gateway.envoyproxy.io + kind: EnvoyExtensionPolicy + namespace: default + to: + - group: '' + kind: Service +configMaps: +- apiVersion: v1 + kind: ConfigMap + metadata: + name: ca-cmap + namespace: envoy-gateway + data: + ca.crt: | + -----BEGIN CERTIFICATE----- + MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL + BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw + MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G + A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc + 1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM + yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b + kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU + Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq + ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR + bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48 + 6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/ + BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz + 2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J + i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE + A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg + d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1 + 3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q== + -----END CERTIFICATE----- +backendTLSPolicies: +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-grpc + namespace: envoy-gateway + spec: + targetRefs: + - group: '' + kind: Service + name: grpc-backend + sectionName: grpc + validation: + caCertificateRefs: + - name: ca-cmap + group: '' + kind: ConfigMap + hostname: grpc-backend +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-grpc-2 + namespace: default + spec: + targetRefs: + - group: '' + kind: Service + name: grpc-backend-2 + sectionName: grpc + validation: + caCertificateRefs: + - name: ca-cmap + group: '' + kind: ConfigMap + hostname: grpc-backend-2 +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-grpc-system-ca + namespace: default + spec: + targetRefs: + - group: '' + kind: Service + name: grpc-backend-system-ca + sectionName: grpc + validation: + wellKnownCACertificates: System + hostname: grpc-backend-system-ca +envoyExtensionPolicies: +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyExtensionPolicy + metadata: + namespace: default + name: policy-for-gateway + spec: + targetRef: + group: gateway.networking.k8s.io + kind: Gateway + name: gateway-1 + extProc: + - backendRefs: + - Name: grpc-backend + Namespace: envoy-gateway + Port: 8000 + processingMode: + allowModeOverride: true + request: + body: Buffered + attributes: + - request.path + response: + body: Streamed + attributes: + - xds.route_metadata + - connection.requested_server_name + metadata: + accessibleNamespaces: + - envoy.filters.http.ext_authz + writableNamespaces: + - envoy.filters.http.my_custom + messageTimeout: 5s + failOpen: true + - backendRefs: + - Name: grpc-backend-system-ca + Namespace: default + Port: 9001 + processingMode: + request: {} + response: {} +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyExtensionPolicy + metadata: + namespace: default + name: policy-for-http-route + spec: + targetRef: + group: gateway.networking.k8s.io + kind: HTTPRoute + name: httproute-1 + extProc: + - backendRefs: + - Name: grpc-backend-2 + Port: 9000 + processingMode: + request: {} + response: {} diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy-per-resource-secret.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy-per-resource-secret.out.yaml new file mode 100644 index 00000000000..8f5c6ead3a9 --- /dev/null +++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy-per-resource-secret.out.yaml @@ -0,0 +1,608 @@ +backendTLSPolicies: +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-grpc + namespace: envoy-gateway + spec: + targetRefs: + - group: "" + kind: Service + name: grpc-backend + sectionName: grpc + validation: + caCertificateRefs: + - group: "" + kind: ConfigMap + name: ca-cmap + hostname: grpc-backend + status: + ancestors: + - ancestorRef: + group: gateway.envoyproxy.io + kind: EnvoyExtensionPolicy + name: policy-for-gateway + namespace: default + conditions: + - lastTransitionTime: null + message: Resolved all the Object references. + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + - lastTransitionTime: null + message: Policy has been accepted. + reason: Accepted + status: "True" + type: Accepted + controllerName: gateway.envoyproxy.io/gatewayclass-controller +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-grpc-2 + namespace: default + spec: + targetRefs: + - group: "" + kind: Service + name: grpc-backend-2 + sectionName: grpc + validation: + caCertificateRefs: + - group: "" + kind: ConfigMap + name: ca-cmap + hostname: grpc-backend-2 + status: + ancestors: + - ancestorRef: + group: gateway.envoyproxy.io + kind: EnvoyExtensionPolicy + name: policy-for-http-route + namespace: default + conditions: + - lastTransitionTime: null + message: Configmap ca-cmap not found in namespace default. + reason: NoValidCACertificate + status: "False" + type: Accepted + - lastTransitionTime: null + message: Configmap ca-cmap not found in namespace default. + reason: InvalidCACertificateRef + status: "False" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-grpc-system-ca + namespace: default + spec: + targetRefs: + - group: "" + kind: Service + name: grpc-backend-system-ca + sectionName: grpc + validation: + hostname: grpc-backend-system-ca + wellKnownCACertificates: System + status: + ancestors: + - ancestorRef: + group: gateway.envoyproxy.io + kind: EnvoyExtensionPolicy + name: policy-for-gateway + namespace: default + conditions: + - lastTransitionTime: null + message: Resolved all the Object references. + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + - lastTransitionTime: null + message: Policy has been accepted. + reason: Accepted + status: "True" + type: Accepted + controllerName: gateway.envoyproxy.io/gatewayclass-controller +envoyExtensionPolicies: +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyExtensionPolicy + metadata: + name: policy-for-http-route + namespace: default + spec: + extProc: + - backendRefs: + - name: grpc-backend-2 + port: 9000 + processingMode: + request: {} + response: {} + targetRef: + group: gateway.networking.k8s.io + kind: HTTPRoute + name: httproute-1 + status: + ancestors: + - ancestorRef: + group: gateway.networking.k8s.io + kind: Gateway + name: gateway-1 + namespace: default + sectionName: http + conditions: + - lastTransitionTime: null + message: 'ExtProc: configmap ca-cmap not found in namespace default.' + reason: Invalid + status: "False" + type: Accepted + - lastTransitionTime: null + message: spec.targetRef is deprecated, use spec.targetRefs instead + reason: DeprecatedField + status: "True" + type: Warning + controllerName: gateway.envoyproxy.io/gatewayclass-controller +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyExtensionPolicy + metadata: + name: policy-for-gateway + namespace: default + spec: + extProc: + - backendRefs: + - name: grpc-backend + namespace: envoy-gateway + port: 8000 + failOpen: true + messageTimeout: 5s + metadata: + accessibleNamespaces: + - envoy.filters.http.ext_authz + writableNamespaces: + - envoy.filters.http.my_custom + processingMode: + allowModeOverride: true + request: + attributes: + - request.path + body: Buffered + response: + attributes: + - xds.route_metadata + - connection.requested_server_name + body: Streamed + - backendRefs: + - name: grpc-backend-system-ca + namespace: default + port: 9001 + processingMode: + request: {} + response: {} + targetRef: + group: gateway.networking.k8s.io + kind: Gateway + name: gateway-1 + status: + ancestors: + - ancestorRef: + group: gateway.networking.k8s.io + kind: Gateway + name: gateway-1 + namespace: default + conditions: + - lastTransitionTime: null + message: Policy has been accepted. + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: spec.targetRef is deprecated, use spec.targetRefs instead + reason: DeprecatedField + status: "True" + type: Warning + - lastTransitionTime: null + message: 'This policy is being overridden by other envoyExtensionPolicies + for these routes: [default/httproute-1]' + reason: Overridden + status: "True" + type: Overridden + controllerName: gateway.envoyproxy.io/gatewayclass-controller +gateways: +- apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + name: gateway-1 + namespace: default + spec: + gatewayClassName: envoy-gateway-class + listeners: + - allowedRoutes: + namespaces: + from: All + name: http + port: 80 + protocol: HTTP + status: + listeners: + - attachedRoutes: 2 + conditions: + - lastTransitionTime: null + message: Sending translated listener configuration to the data plane + reason: Programmed + status: "True" + type: Programmed + - lastTransitionTime: null + message: Listener has been successfully translated + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Listener references have been resolved + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + name: http + supportedKinds: + - group: gateway.networking.k8s.io + kind: HTTPRoute + - group: gateway.networking.k8s.io + kind: GRPCRoute +httpRoutes: +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-1 + namespace: default + spec: + hostnames: + - www.foo.com + parentRefs: + - name: gateway-1 + namespace: default + sectionName: http + rules: + - backendRefs: + - name: service-1 + port: 8080 + matches: + - path: + value: /foo + status: + parents: + - conditions: + - lastTransitionTime: null + message: Route is accepted + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Resolved all the Object references for the Route + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parentRef: + name: gateway-1 + namespace: default + sectionName: http +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-2 + namespace: default + spec: + hostnames: + - www.bar.com + parentRefs: + - name: gateway-1 + namespace: default + sectionName: http + rules: + - backendRefs: + - name: service-1 + port: 8080 + matches: + - path: + value: /bar + status: + parents: + - conditions: + - lastTransitionTime: null + message: Route is accepted + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Resolved all the Object references for the Route + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parentRef: + name: gateway-1 + namespace: default + sectionName: http +infraIR: + default/gateway-1: + proxy: + listeners: + - name: default/gateway-1/http + ports: + - containerPort: 10080 + name: http-80 + protocol: HTTP + servicePort: 80 + metadata: + labels: + gateway.envoyproxy.io/owning-gateway-name: gateway-1 + gateway.envoyproxy.io/owning-gateway-namespace: default + ownerReference: + kind: GatewayClass + name: envoy-gateway-class + name: default/gateway-1 + namespace: envoy-gateway-system +xdsIR: + default/gateway-1: + accessLog: + json: + - path: /dev/stdout + globalResources: + proxyServiceCluster: + metadata: + kind: Service + name: envoy-default-gateway-1-bfd08ef4 + namespace: envoy-gateway-system + sectionName: "8080" + name: default/gateway-1 + settings: + - addressType: IP + endpoints: + - host: 7.6.5.4 + port: 8080 + zone: zone1 + metadata: + kind: Service + name: envoy-default-gateway-1-bfd08ef4 + namespace: envoy-gateway-system + sectionName: "8080" + name: default/gateway-1 + protocol: TCP + http: + - address: 0.0.0.0 + externalPort: 80 + hostnames: + - '*' + metadata: + kind: Gateway + name: gateway-1 + namespace: default + sectionName: http + name: default/gateway-1/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + routes: + - destination: + metadata: + kind: HTTPRoute + name: httproute-1 + namespace: default + name: httproute/default/httproute-1/rule/0 + settings: + - addressType: IP + endpoints: + - host: 7.7.7.7 + port: 8080 + metadata: + kind: Service + name: service-1 + namespace: default + sectionName: "8080" + name: httproute/default/httproute-1/rule/0/backend/0 + protocol: HTTP + weight: 1 + directResponse: + statusCode: 500 + envoyExtensions: + extProcs: + - allowModeOverride: true + authority: grpc-backend.envoy-gateway:8000 + destination: + metadata: + kind: EnvoyExtensionPolicy + name: policy-for-gateway + namespace: default + name: envoyextensionpolicy/default/policy-for-gateway/extproc/0 + settings: + - addressType: IP + endpoints: + - host: 7.7.7.7 + port: 8000 + metadata: + kind: Service + name: grpc-backend + namespace: envoy-gateway + sectionName: "8000" + name: envoyextensionpolicy/default/policy-for-gateway/extproc/0/backend/0 + protocol: GRPC + tls: + alpnProtocols: null + caCertificate: + certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + name: policy-btls-grpc/envoy-gateway-ca + maxVersion: "1.3" + minVersion: "1.2" + sni: grpc-backend + weight: 1 + failOpen: true + forwardingMetadataNamespaces: + - envoy.filters.http.ext_authz + messageTimeout: 5s + name: envoyextensionpolicy/default/policy-for-gateway/extproc/0 + receivingMetadataNamespaces: + - envoy.filters.http.my_custom + requestAttributes: + - request.path + requestBodyProcessingMode: Buffered + requestHeaderProcessing: true + responseAttributes: + - xds.route_metadata + - connection.requested_server_name + responseBodyProcessingMode: Streamed + responseHeaderProcessing: true + - authority: grpc-backend-system-ca.default:9001 + destination: + metadata: + kind: EnvoyExtensionPolicy + name: policy-for-gateway + namespace: default + name: envoyextensionpolicy/default/policy-for-gateway/extproc/1 + settings: + - addressType: IP + endpoints: + - host: 9.9.9.9 + port: 9001 + metadata: + kind: Service + name: grpc-backend-system-ca + namespace: default + sectionName: "9001" + name: envoyextensionpolicy/default/policy-for-gateway/extproc/1/backend/0 + protocol: GRPC + tls: + alpnProtocols: null + caCertificate: + name: policy-btls-grpc-system-ca/default-ca + maxVersion: "1.3" + minVersion: "1.2" + sni: grpc-backend-system-ca + useSystemTrustStore: true + weight: 1 + name: envoyextensionpolicy/default/policy-for-gateway/extproc/1 + requestHeaderProcessing: true + responseHeaderProcessing: true + hostname: www.foo.com + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-1 + namespace: default + name: httproute/default/httproute-1/rule/0/match/0/www_foo_com + pathMatch: + distinct: false + name: "" + prefix: /foo + - destination: + metadata: + kind: HTTPRoute + name: httproute-2 + namespace: default + name: httproute/default/httproute-2/rule/0 + settings: + - addressType: IP + endpoints: + - host: 7.7.7.7 + port: 8080 + metadata: + kind: Service + name: service-1 + namespace: default + sectionName: "8080" + name: httproute/default/httproute-2/rule/0/backend/0 + protocol: HTTP + weight: 1 + envoyExtensions: + extProcs: + - allowModeOverride: true + authority: grpc-backend.envoy-gateway:8000 + destination: + metadata: + kind: EnvoyExtensionPolicy + name: policy-for-gateway + namespace: default + name: envoyextensionpolicy/default/policy-for-gateway/extproc/0 + settings: + - addressType: IP + endpoints: + - host: 7.7.7.7 + port: 8000 + metadata: + kind: Service + name: grpc-backend + namespace: envoy-gateway + sectionName: "8000" + name: envoyextensionpolicy/default/policy-for-gateway/extproc/0/backend/0 + protocol: GRPC + tls: + alpnProtocols: null + caCertificate: + certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + name: policy-btls-grpc/envoy-gateway-ca + maxVersion: "1.3" + minVersion: "1.2" + sni: grpc-backend + weight: 1 + failOpen: true + forwardingMetadataNamespaces: + - envoy.filters.http.ext_authz + messageTimeout: 5s + name: envoyextensionpolicy/default/policy-for-gateway/extproc/0 + receivingMetadataNamespaces: + - envoy.filters.http.my_custom + requestAttributes: + - request.path + requestBodyProcessingMode: Buffered + requestHeaderProcessing: true + responseAttributes: + - xds.route_metadata + - connection.requested_server_name + responseBodyProcessingMode: Streamed + responseHeaderProcessing: true + - authority: grpc-backend-system-ca.default:9001 + destination: + metadata: + kind: EnvoyExtensionPolicy + name: policy-for-gateway + namespace: default + name: envoyextensionpolicy/default/policy-for-gateway/extproc/1 + settings: + - addressType: IP + endpoints: + - host: 9.9.9.9 + port: 9001 + metadata: + kind: Service + name: grpc-backend-system-ca + namespace: default + sectionName: "9001" + name: envoyextensionpolicy/default/policy-for-gateway/extproc/1/backend/0 + protocol: GRPC + tls: + alpnProtocols: null + caCertificate: + name: policy-btls-grpc-system-ca/default-ca + maxVersion: "1.3" + minVersion: "1.2" + sni: grpc-backend-system-ca + useSystemTrustStore: true + weight: 1 + name: envoyextensionpolicy/default/policy-for-gateway/extproc/1 + requestHeaderProcessing: true + responseHeaderProcessing: true + hostname: www.bar.com + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-2 + namespace: default + name: httproute/default/httproute-2/rule/0/match/0/www_bar_com + pathMatch: + distinct: false + name: "" + prefix: /bar + readyListener: + address: 0.0.0.0 + ipFamily: IPv4 + path: /ready + port: 19003 diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy-shared-secret.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy-shared-secret.in.yaml new file mode 100644 index 00000000000..1433290e4b5 --- /dev/null +++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy-shared-secret.in.yaml @@ -0,0 +1,285 @@ +gateways: +- apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + namespace: default + name: gateway-1 + spec: + gatewayClassName: envoy-gateway-class + listeners: + - name: http + protocol: HTTP + port: 80 + allowedRoutes: + namespaces: + from: All +httpRoutes: +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + namespace: default + name: httproute-1 + spec: + hostnames: + - www.foo.com + parentRefs: + - namespace: default + name: gateway-1 + sectionName: http + rules: + - matches: + - path: + value: /foo + backendRefs: + - name: service-1 + port: 8080 +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + namespace: default + name: httproute-2 + spec: + hostnames: + - www.bar.com + parentRefs: + - namespace: default + name: gateway-1 + sectionName: http + rules: + - matches: + - path: + value: /bar + backendRefs: + - name: service-1 + port: 8080 +services: +- apiVersion: v1 + kind: Service + metadata: + namespace: envoy-gateway + name: grpc-backend + spec: + ports: + - port: 8000 + name: grpc + protocol: TCP +- apiVersion: v1 + kind: Service + metadata: + namespace: default + name: grpc-backend-2 + spec: + ports: + - port: 9000 + name: grpc + protocol: TCP +- apiVersion: v1 + kind: Service + metadata: + namespace: default + name: grpc-backend-system-ca + spec: + ports: + - port: 9001 + name: grpc + protocol: TCP +endpointSlices: +- apiVersion: discovery.k8s.io/v1 + kind: EndpointSlice + metadata: + name: endpointslice-grpc-backend + namespace: envoy-gateway + labels: + kubernetes.io/service-name: grpc-backend + addressType: IPv4 + ports: + - name: grpc + protocol: TCP + port: 8000 + endpoints: + - addresses: + - 7.7.7.7 + conditions: + ready: true +- apiVersion: discovery.k8s.io/v1 + kind: EndpointSlice + metadata: + name: endpointslice-grpc-backend-2 + namespace: default + labels: + kubernetes.io/service-name: grpc-backend-2 + addressType: IPv4 + ports: + - name: grpc + protocol: TCP + port: 9000 + endpoints: + - addresses: + - 8.8.8.8 + conditions: + ready: true +- apiVersion: discovery.k8s.io/v1 + kind: EndpointSlice + metadata: + name: endpointslice-grpc-backend-system-ca + namespace: default + labels: + kubernetes.io/service-name: grpc-backend-system-ca + addressType: IPv4 + ports: + - name: grpc + protocol: TCP + port: 9001 + endpoints: + - addresses: + - 9.9.9.9 + conditions: + ready: true +referenceGrants: +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: ReferenceGrant + metadata: + namespace: envoy-gateway + name: referencegrant-1 + spec: + from: + - group: gateway.envoyproxy.io + kind: EnvoyExtensionPolicy + namespace: default + to: + - group: '' + kind: Service +configMaps: +- apiVersion: v1 + kind: ConfigMap + metadata: + name: ca-cmap + namespace: envoy-gateway + data: + ca.crt: | + -----BEGIN CERTIFICATE----- + MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL + BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw + MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G + A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc + 1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM + yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b + kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU + Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq + ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR + bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48 + 6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/ + BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz + 2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J + i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE + A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg + d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1 + 3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q== + -----END CERTIFICATE----- +backendTLSPolicies: +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-grpc + namespace: envoy-gateway + spec: + targetRefs: + - group: '' + kind: Service + name: grpc-backend + sectionName: grpc + validation: + caCertificateRefs: + - name: ca-cmap + group: '' + kind: ConfigMap + hostname: grpc-backend +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-grpc-2 + namespace: default + spec: + targetRefs: + - group: '' + kind: Service + name: grpc-backend-2 + sectionName: grpc + validation: + caCertificateRefs: + - name: ca-cmap + group: '' + kind: ConfigMap + hostname: grpc-backend-2 +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-grpc-system-ca + namespace: default + spec: + targetRefs: + - group: '' + kind: Service + name: grpc-backend-system-ca + sectionName: grpc + validation: + wellKnownCACertificates: System + hostname: grpc-backend-system-ca +envoyExtensionPolicies: +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyExtensionPolicy + metadata: + namespace: default + name: policy-for-gateway + spec: + targetRef: + group: gateway.networking.k8s.io + kind: Gateway + name: gateway-1 + extProc: + - backendRefs: + - Name: grpc-backend + Namespace: envoy-gateway + Port: 8000 + processingMode: + allowModeOverride: true + request: + body: Buffered + attributes: + - request.path + response: + body: Streamed + attributes: + - xds.route_metadata + - connection.requested_server_name + metadata: + accessibleNamespaces: + - envoy.filters.http.ext_authz + writableNamespaces: + - envoy.filters.http.my_custom + messageTimeout: 5s + failOpen: true + - backendRefs: + - Name: grpc-backend-system-ca + Namespace: default + Port: 9001 + processingMode: + request: {} + response: {} +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyExtensionPolicy + metadata: + namespace: default + name: policy-for-http-route + spec: + targetRef: + group: gateway.networking.k8s.io + kind: HTTPRoute + name: httproute-1 + extProc: + - backendRefs: + - Name: grpc-backend-2 + Port: 9000 + processingMode: + request: {} + response: {} diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy-shared-secret.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy-shared-secret.out.yaml new file mode 100644 index 00000000000..e7507cf3d90 --- /dev/null +++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy-shared-secret.out.yaml @@ -0,0 +1,608 @@ +backendTLSPolicies: +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-grpc + namespace: envoy-gateway + spec: + targetRefs: + - group: "" + kind: Service + name: grpc-backend + sectionName: grpc + validation: + caCertificateRefs: + - group: "" + kind: ConfigMap + name: ca-cmap + hostname: grpc-backend + status: + ancestors: + - ancestorRef: + group: gateway.envoyproxy.io + kind: EnvoyExtensionPolicy + name: policy-for-gateway + namespace: default + conditions: + - lastTransitionTime: null + message: Resolved all the Object references. + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + - lastTransitionTime: null + message: Policy has been accepted. + reason: Accepted + status: "True" + type: Accepted + controllerName: gateway.envoyproxy.io/gatewayclass-controller +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-grpc-2 + namespace: default + spec: + targetRefs: + - group: "" + kind: Service + name: grpc-backend-2 + sectionName: grpc + validation: + caCertificateRefs: + - group: "" + kind: ConfigMap + name: ca-cmap + hostname: grpc-backend-2 + status: + ancestors: + - ancestorRef: + group: gateway.envoyproxy.io + kind: EnvoyExtensionPolicy + name: policy-for-http-route + namespace: default + conditions: + - lastTransitionTime: null + message: Configmap ca-cmap not found in namespace default. + reason: NoValidCACertificate + status: "False" + type: Accepted + - lastTransitionTime: null + message: Configmap ca-cmap not found in namespace default. + reason: InvalidCACertificateRef + status: "False" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller +- apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: BackendTLSPolicy + metadata: + name: policy-btls-grpc-system-ca + namespace: default + spec: + targetRefs: + - group: "" + kind: Service + name: grpc-backend-system-ca + sectionName: grpc + validation: + hostname: grpc-backend-system-ca + wellKnownCACertificates: System + status: + ancestors: + - ancestorRef: + group: gateway.envoyproxy.io + kind: EnvoyExtensionPolicy + name: policy-for-gateway + namespace: default + conditions: + - lastTransitionTime: null + message: Resolved all the Object references. + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + - lastTransitionTime: null + message: Policy has been accepted. + reason: Accepted + status: "True" + type: Accepted + controllerName: gateway.envoyproxy.io/gatewayclass-controller +envoyExtensionPolicies: +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyExtensionPolicy + metadata: + name: policy-for-http-route + namespace: default + spec: + extProc: + - backendRefs: + - name: grpc-backend-2 + port: 9000 + processingMode: + request: {} + response: {} + targetRef: + group: gateway.networking.k8s.io + kind: HTTPRoute + name: httproute-1 + status: + ancestors: + - ancestorRef: + group: gateway.networking.k8s.io + kind: Gateway + name: gateway-1 + namespace: default + sectionName: http + conditions: + - lastTransitionTime: null + message: 'ExtProc: configmap ca-cmap not found in namespace default.' + reason: Invalid + status: "False" + type: Accepted + - lastTransitionTime: null + message: spec.targetRef is deprecated, use spec.targetRefs instead + reason: DeprecatedField + status: "True" + type: Warning + controllerName: gateway.envoyproxy.io/gatewayclass-controller +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyExtensionPolicy + metadata: + name: policy-for-gateway + namespace: default + spec: + extProc: + - backendRefs: + - name: grpc-backend + namespace: envoy-gateway + port: 8000 + failOpen: true + messageTimeout: 5s + metadata: + accessibleNamespaces: + - envoy.filters.http.ext_authz + writableNamespaces: + - envoy.filters.http.my_custom + processingMode: + allowModeOverride: true + request: + attributes: + - request.path + body: Buffered + response: + attributes: + - xds.route_metadata + - connection.requested_server_name + body: Streamed + - backendRefs: + - name: grpc-backend-system-ca + namespace: default + port: 9001 + processingMode: + request: {} + response: {} + targetRef: + group: gateway.networking.k8s.io + kind: Gateway + name: gateway-1 + status: + ancestors: + - ancestorRef: + group: gateway.networking.k8s.io + kind: Gateway + name: gateway-1 + namespace: default + conditions: + - lastTransitionTime: null + message: Policy has been accepted. + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: spec.targetRef is deprecated, use spec.targetRefs instead + reason: DeprecatedField + status: "True" + type: Warning + - lastTransitionTime: null + message: 'This policy is being overridden by other envoyExtensionPolicies + for these routes: [default/httproute-1]' + reason: Overridden + status: "True" + type: Overridden + controllerName: gateway.envoyproxy.io/gatewayclass-controller +gateways: +- apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + name: gateway-1 + namespace: default + spec: + gatewayClassName: envoy-gateway-class + listeners: + - allowedRoutes: + namespaces: + from: All + name: http + port: 80 + protocol: HTTP + status: + listeners: + - attachedRoutes: 2 + conditions: + - lastTransitionTime: null + message: Sending translated listener configuration to the data plane + reason: Programmed + status: "True" + type: Programmed + - lastTransitionTime: null + message: Listener has been successfully translated + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Listener references have been resolved + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + name: http + supportedKinds: + - group: gateway.networking.k8s.io + kind: HTTPRoute + - group: gateway.networking.k8s.io + kind: GRPCRoute +httpRoutes: +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-1 + namespace: default + spec: + hostnames: + - www.foo.com + parentRefs: + - name: gateway-1 + namespace: default + sectionName: http + rules: + - backendRefs: + - name: service-1 + port: 8080 + matches: + - path: + value: /foo + status: + parents: + - conditions: + - lastTransitionTime: null + message: Route is accepted + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Resolved all the Object references for the Route + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parentRef: + name: gateway-1 + namespace: default + sectionName: http +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-2 + namespace: default + spec: + hostnames: + - www.bar.com + parentRefs: + - name: gateway-1 + namespace: default + sectionName: http + rules: + - backendRefs: + - name: service-1 + port: 8080 + matches: + - path: + value: /bar + status: + parents: + - conditions: + - lastTransitionTime: null + message: Route is accepted + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Resolved all the Object references for the Route + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parentRef: + name: gateway-1 + namespace: default + sectionName: http +infraIR: + default/gateway-1: + proxy: + listeners: + - name: default/gateway-1/http + ports: + - containerPort: 10080 + name: http-80 + protocol: HTTP + servicePort: 80 + metadata: + labels: + gateway.envoyproxy.io/owning-gateway-name: gateway-1 + gateway.envoyproxy.io/owning-gateway-namespace: default + ownerReference: + kind: GatewayClass + name: envoy-gateway-class + name: default/gateway-1 + namespace: envoy-gateway-system +xdsIR: + default/gateway-1: + accessLog: + json: + - path: /dev/stdout + globalResources: + proxyServiceCluster: + metadata: + kind: Service + name: envoy-default-gateway-1-bfd08ef4 + namespace: envoy-gateway-system + sectionName: "8080" + name: default/gateway-1 + settings: + - addressType: IP + endpoints: + - host: 7.6.5.4 + port: 8080 + zone: zone1 + metadata: + kind: Service + name: envoy-default-gateway-1-bfd08ef4 + namespace: envoy-gateway-system + sectionName: "8080" + name: default/gateway-1 + protocol: TCP + http: + - address: 0.0.0.0 + externalPort: 80 + hostnames: + - '*' + metadata: + kind: Gateway + name: gateway-1 + namespace: default + sectionName: http + name: default/gateway-1/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + routes: + - destination: + metadata: + kind: HTTPRoute + name: httproute-1 + namespace: default + name: httproute/default/httproute-1/rule/0 + settings: + - addressType: IP + endpoints: + - host: 7.7.7.7 + port: 8080 + metadata: + kind: Service + name: service-1 + namespace: default + sectionName: "8080" + name: httproute/default/httproute-1/rule/0/backend/0 + protocol: HTTP + weight: 1 + directResponse: + statusCode: 500 + envoyExtensions: + extProcs: + - allowModeOverride: true + authority: grpc-backend.envoy-gateway:8000 + destination: + metadata: + kind: EnvoyExtensionPolicy + name: policy-for-gateway + namespace: default + name: envoyextensionpolicy/default/policy-for-gateway/extproc/0 + settings: + - addressType: IP + endpoints: + - host: 7.7.7.7 + port: 8000 + metadata: + kind: Service + name: grpc-backend + namespace: envoy-gateway + sectionName: "8000" + name: envoyextensionpolicy/default/policy-for-gateway/extproc/0/backend/0 + protocol: GRPC + tls: + alpnProtocols: null + caCertificate: + certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + name: policy-btls-grpc/envoy-gateway-ca + maxVersion: "1.3" + minVersion: "1.2" + sni: grpc-backend + weight: 1 + failOpen: true + forwardingMetadataNamespaces: + - envoy.filters.http.ext_authz + messageTimeout: 5s + name: envoyextensionpolicy/default/policy-for-gateway/extproc/0 + receivingMetadataNamespaces: + - envoy.filters.http.my_custom + requestAttributes: + - request.path + requestBodyProcessingMode: Buffered + requestHeaderProcessing: true + responseAttributes: + - xds.route_metadata + - connection.requested_server_name + responseBodyProcessingMode: Streamed + responseHeaderProcessing: true + - authority: grpc-backend-system-ca.default:9001 + destination: + metadata: + kind: EnvoyExtensionPolicy + name: policy-for-gateway + namespace: default + name: envoyextensionpolicy/default/policy-for-gateway/extproc/1 + settings: + - addressType: IP + endpoints: + - host: 9.9.9.9 + port: 9001 + metadata: + kind: Service + name: grpc-backend-system-ca + namespace: default + sectionName: "9001" + name: envoyextensionpolicy/default/policy-for-gateway/extproc/1/backend/0 + protocol: GRPC + tls: + alpnProtocols: null + caCertificate: + name: system_ca_certificates + maxVersion: "1.3" + minVersion: "1.2" + sni: grpc-backend-system-ca + useSystemTrustStore: true + weight: 1 + name: envoyextensionpolicy/default/policy-for-gateway/extproc/1 + requestHeaderProcessing: true + responseHeaderProcessing: true + hostname: www.foo.com + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-1 + namespace: default + name: httproute/default/httproute-1/rule/0/match/0/www_foo_com + pathMatch: + distinct: false + name: "" + prefix: /foo + - destination: + metadata: + kind: HTTPRoute + name: httproute-2 + namespace: default + name: httproute/default/httproute-2/rule/0 + settings: + - addressType: IP + endpoints: + - host: 7.7.7.7 + port: 8080 + metadata: + kind: Service + name: service-1 + namespace: default + sectionName: "8080" + name: httproute/default/httproute-2/rule/0/backend/0 + protocol: HTTP + weight: 1 + envoyExtensions: + extProcs: + - allowModeOverride: true + authority: grpc-backend.envoy-gateway:8000 + destination: + metadata: + kind: EnvoyExtensionPolicy + name: policy-for-gateway + namespace: default + name: envoyextensionpolicy/default/policy-for-gateway/extproc/0 + settings: + - addressType: IP + endpoints: + - host: 7.7.7.7 + port: 8000 + metadata: + kind: Service + name: grpc-backend + namespace: envoy-gateway + sectionName: "8000" + name: envoyextensionpolicy/default/policy-for-gateway/extproc/0/backend/0 + protocol: GRPC + tls: + alpnProtocols: null + caCertificate: + certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + name: policy-btls-grpc/envoy-gateway-ca + maxVersion: "1.3" + minVersion: "1.2" + sni: grpc-backend + weight: 1 + failOpen: true + forwardingMetadataNamespaces: + - envoy.filters.http.ext_authz + messageTimeout: 5s + name: envoyextensionpolicy/default/policy-for-gateway/extproc/0 + receivingMetadataNamespaces: + - envoy.filters.http.my_custom + requestAttributes: + - request.path + requestBodyProcessingMode: Buffered + requestHeaderProcessing: true + responseAttributes: + - xds.route_metadata + - connection.requested_server_name + responseBodyProcessingMode: Streamed + responseHeaderProcessing: true + - authority: grpc-backend-system-ca.default:9001 + destination: + metadata: + kind: EnvoyExtensionPolicy + name: policy-for-gateway + namespace: default + name: envoyextensionpolicy/default/policy-for-gateway/extproc/1 + settings: + - addressType: IP + endpoints: + - host: 9.9.9.9 + port: 9001 + metadata: + kind: Service + name: grpc-backend-system-ca + namespace: default + sectionName: "9001" + name: envoyextensionpolicy/default/policy-for-gateway/extproc/1/backend/0 + protocol: GRPC + tls: + alpnProtocols: null + caCertificate: + name: system_ca_certificates + maxVersion: "1.3" + minVersion: "1.2" + sni: grpc-backend-system-ca + useSystemTrustStore: true + weight: 1 + name: envoyextensionpolicy/default/policy-for-gateway/extproc/1 + requestHeaderProcessing: true + responseHeaderProcessing: true + hostname: www.bar.com + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-2 + namespace: default + name: httproute/default/httproute-2/rule/0/match/0/www_bar_com + pathMatch: + distinct: false + name: "" + prefix: /bar + readyListener: + address: 0.0.0.0 + ipFamily: IPv4 + path: /ready + port: 19003 diff --git a/internal/gatewayapi/testdata/envoyproxy-otel-backend-tls-per-resource-secret.in.yaml b/internal/gatewayapi/testdata/envoyproxy-otel-backend-tls-per-resource-secret.in.yaml new file mode 100644 index 00000000000..cd211316e32 --- /dev/null +++ b/internal/gatewayapi/testdata/envoyproxy-otel-backend-tls-per-resource-secret.in.yaml @@ -0,0 +1,70 @@ +envoyProxyForGatewayClass: + apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyProxy + metadata: + namespace: envoy-gateway-system + name: telemetry-tls + spec: + telemetry: + accessLog: + settings: + - format: + type: Text + text: | + [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% + sinks: + - type: OpenTelemetry + openTelemetry: + backendRefs: + - name: otel-collector + namespace: envoy-gateway + kind: Backend + group: gateway.envoyproxy.io + resourceAttributes: + k8s.cluster.name: "cluster-1" + tracing: + provider: + type: OpenTelemetry + backendRefs: + - name: otel-collector + namespace: envoy-gateway + kind: Backend + group: gateway.envoyproxy.io + samplingRate: 100 + metrics: + sinks: + - type: OpenTelemetry + openTelemetry: + backendRefs: + - name: otel-collector + namespace: envoy-gateway + kind: Backend + group: gateway.envoyproxy.io +gateways: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + namespace: envoy-gateway + name: gateway-1 + spec: + gatewayClassName: envoy-gateway-class + listeners: + - name: http + protocol: HTTP + port: 80 + allowedRoutes: + namespaces: + from: Same +backends: + - apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: otel-collector + namespace: envoy-gateway + spec: + endpoints: + - fqdn: + hostname: otel-collector.example.com + port: 443 + tls: + wellKnownCACertificates: System diff --git a/internal/gatewayapi/testdata/envoyproxy-otel-backend-tls-per-resource-secret.out.yaml b/internal/gatewayapi/testdata/envoyproxy-otel-backend-tls-per-resource-secret.out.yaml new file mode 100644 index 00000000000..6527350a901 --- /dev/null +++ b/internal/gatewayapi/testdata/envoyproxy-otel-backend-tls-per-resource-secret.out.yaml @@ -0,0 +1,266 @@ +backends: +- apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: Backend + metadata: + name: otel-collector + namespace: envoy-gateway + spec: + endpoints: + - fqdn: + hostname: otel-collector.example.com + port: 443 + tls: + wellKnownCACertificates: System + status: + conditions: + - lastTransitionTime: null + message: The Backend was accepted + reason: Accepted + status: "True" + type: Accepted +gateways: +- apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + name: gateway-1 + namespace: envoy-gateway + spec: + gatewayClassName: envoy-gateway-class + listeners: + - allowedRoutes: + namespaces: + from: Same + name: http + port: 80 + protocol: HTTP + status: + listeners: + - attachedRoutes: 0 + conditions: + - lastTransitionTime: null + message: Sending translated listener configuration to the data plane + reason: Programmed + status: "True" + type: Programmed + - lastTransitionTime: null + message: Listener has been successfully translated + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Listener references have been resolved + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + name: http + supportedKinds: + - group: gateway.networking.k8s.io + kind: HTTPRoute + - group: gateway.networking.k8s.io + kind: GRPCRoute +infraIR: + envoy-gateway/gateway-1: + proxy: + config: + apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyProxy + metadata: + name: telemetry-tls + namespace: envoy-gateway-system + spec: + logging: {} + telemetry: + accessLog: + settings: + - format: + text: | + [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% + type: Text + sinks: + - openTelemetry: + backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: otel-collector + namespace: envoy-gateway + resourceAttributes: + k8s.cluster.name: cluster-1 + type: OpenTelemetry + metrics: + sinks: + - openTelemetry: + backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: otel-collector + namespace: envoy-gateway + type: OpenTelemetry + tracing: + provider: + backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: otel-collector + namespace: envoy-gateway + type: OpenTelemetry + samplingRate: 100 + status: {} + listeners: + - name: envoy-gateway/gateway-1/http + ports: + - containerPort: 10080 + name: http-80 + protocol: HTTP + servicePort: 80 + metadata: + labels: + gateway.envoyproxy.io/owning-gateway-name: gateway-1 + gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway + ownerReference: + kind: GatewayClass + name: envoy-gateway-class + name: envoy-gateway/gateway-1 + namespace: envoy-gateway-system + resolvedMetricSinks: + - authority: otel-collector.example.com + destination: + metadata: + kind: EnvoyProxy + name: telemetry-tls + namespace: envoy-gateway-system + name: metrics_otel_0 + settings: + - addressType: FQDN + endpoints: + - host: otel-collector.example.com + port: 443 + metadata: + kind: Backend + name: otel-collector + namespace: envoy-gateway + name: metrics_otel_0/backend/-1 + protocol: GRPC + tls: + alpnProtocols: null + caCertificate: + name: otel-collector/envoy-gateway-ca + maxVersion: "1.3" + minVersion: "1.2" + sni: otel-collector.example.com + useSystemTrustStore: true +xdsIR: + envoy-gateway/gateway-1: + accessLog: + openTelemetry: + - authority: otel-collector.example.com + destination: + metadata: + kind: EnvoyProxy + name: telemetry-tls + namespace: envoy-gateway-system + name: accesslog_otel_0_0 + settings: + - addressType: FQDN + endpoints: + - host: otel-collector.example.com + port: 443 + metadata: + kind: Backend + name: otel-collector + namespace: envoy-gateway + name: accesslog_otel_0_0/backend/-1 + protocol: GRPC + tls: + alpnProtocols: null + caCertificate: + name: otel-collector/envoy-gateway-ca + maxVersion: "1.3" + minVersion: "1.2" + sni: otel-collector.example.com + useSystemTrustStore: true + resourceAttributes: + - key: k8s.cluster.name + value: cluster-1 + text: | + [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% + globalResources: + proxyServiceCluster: + metadata: + kind: Service + name: envoy-envoy-gateway-gateway-1-196ae069 + namespace: envoy-gateway-system + sectionName: "8080" + name: envoy-gateway/gateway-1 + settings: + - addressType: IP + endpoints: + - host: 7.6.5.4 + port: 8080 + zone: zone1 + metadata: + kind: Service + name: envoy-envoy-gateway-gateway-1-196ae069 + namespace: envoy-gateway-system + sectionName: "8080" + name: envoy-gateway/gateway-1 + protocol: TCP + http: + - address: 0.0.0.0 + externalPort: 80 + hostnames: + - '*' + metadata: + kind: Gateway + name: gateway-1 + namespace: envoy-gateway + sectionName: http + name: envoy-gateway/gateway-1/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + metrics: + enablePerEndpointStats: false + enableRequestResponseSizesStats: false + enableVirtualHostStats: false + readyListener: + address: 0.0.0.0 + ipFamily: IPv4 + path: /ready + port: 19003 + tracing: + authority: otel-collector.example.com + destination: + metadata: + kind: EnvoyProxy + name: telemetry-tls + namespace: envoy-gateway-system + name: tracing + settings: + - addressType: FQDN + endpoints: + - host: otel-collector.example.com + port: 443 + metadata: + kind: Backend + name: otel-collector + namespace: envoy-gateway + name: tracing/backend/-1 + protocol: GRPC + tls: + alpnProtocols: null + caCertificate: + name: otel-collector/envoy-gateway-ca + maxVersion: "1.3" + minVersion: "1.2" + sni: otel-collector.example.com + useSystemTrustStore: true + provider: + backendRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: otel-collector + namespace: envoy-gateway + type: OpenTelemetry + samplingRate: 100 + serviceName: gateway-1.envoy-gateway diff --git a/internal/gatewayapi/testdata/envoyproxy-otel-backend-tls.out.yaml b/internal/gatewayapi/testdata/envoyproxy-otel-backend-tls.out.yaml index 6527350a901..9c95ca2bf3d 100644 --- a/internal/gatewayapi/testdata/envoyproxy-otel-backend-tls.out.yaml +++ b/internal/gatewayapi/testdata/envoyproxy-otel-backend-tls.out.yaml @@ -143,7 +143,7 @@ infraIR: tls: alpnProtocols: null caCertificate: - name: otel-collector/envoy-gateway-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" sni: otel-collector.example.com @@ -173,7 +173,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: otel-collector/envoy-gateway-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" sni: otel-collector.example.com @@ -250,7 +250,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: otel-collector/envoy-gateway-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" sni: otel-collector.example.com diff --git a/internal/gatewayapi/testdata/envoyproxy-otel-backendtlspolicy.out.yaml b/internal/gatewayapi/testdata/envoyproxy-otel-backendtlspolicy.out.yaml index 1e997337a6e..e15df74b14e 100644 --- a/internal/gatewayapi/testdata/envoyproxy-otel-backendtlspolicy.out.yaml +++ b/internal/gatewayapi/testdata/envoyproxy-otel-backendtlspolicy.out.yaml @@ -174,7 +174,7 @@ infraIR: tls: alpnProtocols: null caCertificate: - name: otel-tls/envoy-gateway-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" sni: otel-collector.example.com @@ -204,7 +204,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: otel-tls/envoy-gateway-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" sni: otel-collector.example.com @@ -281,7 +281,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: otel-tls/envoy-gateway-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" sni: otel-collector.example.com diff --git a/internal/gatewayapi/testdata/envoyproxy-tls-settings.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tls-settings.out.yaml index 98fd6f0911a..0880c6f2d26 100644 --- a/internal/gatewayapi/testdata/envoyproxy-tls-settings.out.yaml +++ b/internal/gatewayapi/testdata/envoyproxy-tls-settings.out.yaml @@ -288,7 +288,7 @@ xdsIR: - HTTP/1.1 - HTTP/2 caCertificate: - name: policy-tls/default-ca + name: system_ca_certificates ciphers: - ECDHE-RSA-AES128-GCM-SHA256 - ECDHE-ECDSA-AES256-GCM-SHA384 @@ -358,7 +358,7 @@ xdsIR: - HTTP/1.1 - HTTP/2 caCertificate: - name: policy-tls/default-ca + name: system_ca_certificates ciphers: - ECDHE-RSA-AES128-GCM-SHA256 - ECDHE-ECDSA-AES256-GCM-SHA384 diff --git a/internal/gatewayapi/testdata/gateway-tls-frontend-backend.out.yaml b/internal/gatewayapi/testdata/gateway-tls-frontend-backend.out.yaml index 7600a186820..c796dc9f13b 100644 --- a/internal/gatewayapi/testdata/gateway-tls-frontend-backend.out.yaml +++ b/internal/gatewayapi/testdata/gateway-tls-frontend-backend.out.yaml @@ -1847,7 +1847,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: tls-backend-policy/default-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" sni: backend.example.org diff --git a/internal/gatewayapi/testdata/httproute-dynamic-resolver-host-rewriting.out.yaml b/internal/gatewayapi/testdata/httproute-dynamic-resolver-host-rewriting.out.yaml index ff076041555..9333f29bb78 100644 --- a/internal/gatewayapi/testdata/httproute-dynamic-resolver-host-rewriting.out.yaml +++ b/internal/gatewayapi/testdata/httproute-dynamic-resolver-host-rewriting.out.yaml @@ -351,7 +351,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: backend-with-system-ca/default-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" useSystemTrustStore: true diff --git a/internal/gatewayapi/testdata/httproute-dynamic-resolver.out.yaml b/internal/gatewayapi/testdata/httproute-dynamic-resolver.out.yaml index 7ed3f712243..5b8edec9ad5 100644 --- a/internal/gatewayapi/testdata/httproute-dynamic-resolver.out.yaml +++ b/internal/gatewayapi/testdata/httproute-dynamic-resolver.out.yaml @@ -246,7 +246,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: backend-with-system-ca/default-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" useSystemTrustStore: true diff --git a/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-websocket-app-protocols.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-websocket-app-protocols.out.yaml index 7a7704398f9..a1394e4e75f 100644 --- a/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-websocket-app-protocols.out.yaml +++ b/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-websocket-app-protocols.out.yaml @@ -284,7 +284,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: backend-wss/default-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" sni: websocket.example.com diff --git a/internal/gatewayapi/testdata/httproute-with-tls-and-http.out.yaml b/internal/gatewayapi/testdata/httproute-with-tls-and-http.out.yaml index 4b0b26970e3..acf07db014b 100644 --- a/internal/gatewayapi/testdata/httproute-with-tls-and-http.out.yaml +++ b/internal/gatewayapi/testdata/httproute-with-tls-and-http.out.yaml @@ -215,7 +215,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: policy-btls-for-backend-1/default-ca + name: system_ca_certificates maxVersion: "1.3" minVersion: "1.2" sni: example.com diff --git a/internal/gatewayapi/testdata/tcproute-with-backendtlspolicy.out.yaml b/internal/gatewayapi/testdata/tcproute-with-backendtlspolicy.out.yaml index fd00f97b020..36aa11edf3a 100644 --- a/internal/gatewayapi/testdata/tcproute-with-backendtlspolicy.out.yaml +++ b/internal/gatewayapi/testdata/tcproute-with-backendtlspolicy.out.yaml @@ -201,7 +201,7 @@ xdsIR: tls: alpnProtocols: null caCertificate: - name: policy-btls-for-service-1/default-ca + name: system_ca_certificates clientCertificates: - certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKRENDQWd5Z0F3SUJBZ0lVU3JTYktMZjBiTEVHb2dXeC9nQ3cyR0N0dnhFd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0V6RVJNQThHQTFVRUF3d0lWR1Z6ZENCSmJtTXdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVRNUkV3RHdZRFZRUUREQWhVWlhOMElFbHVZekNDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFECmdnRVBBRENDQVFvQ2dnRUJBSzFKempQSWlXZzNxb0hTckFkZGtlSmphTVA5aXlNVGkvQlBvOWNKUG9SRThaaTcKV2FwVXJYTC85QTlyK2pITXlHSVpOWk5kY1o1Y1kyWHYwTFA4WnhWeTJsazArM3d0WXpIbnBHWUdWdHlxMnRldApEaEZzaVBsODJZUmpDMG16V2E0UU16NFNYekZITmdJRHBSZGhmcm92bXNldVdHUUU4cFY0VWQ5VUsvU0tpbE1PCnF0QjVKaXJMUDJWczVUMW9XaWNXTFF2ZmJHd3Y3c0ZEZHI5YkcwWHRTUXAxN0hTZ281MFNERTUrQmpTbXB0RncKMVZjS0xscWFoTVhCRERpb3Jnd2hJaEdHS3BFU2VNMFA3YkZoVm1rTTNhc2gyeFNUQnVGVUJEbEU0Sk9haHp3cwpEWHJ1cFVoRGRTMWhkYzJmUHJqaEZBbEpmV0VZWjZCbFpqeXNpVlVDQXdFQUFhTndNRzR3SFFZRFZSME9CQllFCkZCUXVmSzFMaWJ1Vm05VHMvVmpCeDhMM3VpTmVNQjhHQTFVZEl3UVlNQmFBRkJRdWZLMUxpYnVWbTlUcy9WakIKeDhMM3VpTmVNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdHd1lEVlIwUkJCUXdFb0lCS29JTktpNWxlR0Z0Y0d4bApMbU52YlRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQWZQUzQxYWdldldNVjNaWHQwQ09GRzN1WWZQRlhuVnc2ClA0MXA5TzZHa2RZc3VxRnZQZVR5eUgyL2RBSUtLd1N6TS9wdGhnOEtuOExabG1KeUZObkExc3RKeG41WGRiVjEKcFBxajhVdllDQnp5ak1JcW1SeW9peUxpUWxib2hNYTBVZEVCS2NIL1BkTEU5SzhUR0pyWmdvR1hxcTFXbWl0RAozdmNQalNlUEtFaVVKVlM5bENoeVNzMEtZNUIraFVRRDBKajZucEZENFprMHhxZHhoMHJXdWVDcXE3dmpxRVl6CnBqNFB3cnVmbjFQQlRtZnhNdVYvVUpWNWViaWtldVpQMzVrV3pMUjdaV0FMN3d1RGRXcC82bzR5azNRTGFuRFEKQ3dnQ0ZjWCtzcyswVnl1TTNZZXJUT1VVOFFWSkp4NFVaQU5aeDYrNDNwZEpaT2NudFBaNENBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= name: envoy-gateway-system/client-auth diff --git a/internal/gatewayapi/translator.go b/internal/gatewayapi/translator.go index bc44d584bb7..7be58c16ef4 100644 --- a/internal/gatewayapi/translator.go +++ b/internal/gatewayapi/translator.go @@ -88,6 +88,11 @@ type Translator struct { // should be merged under the parent GatewayClass. MergeGateways bool + // PerResourceSystemCASecret restores the old behavior of emitting one SDS secret per + // BackendTLSPolicy or Backend resource using WellKnownCACertificates: System, instead of + // sharing a single system_ca_certificates secret. Disabled by default (shared secret used). + PerResourceSystemCASecret bool + // GatewayNamespaceMode is true if controller uses gateway namespace mode for infra deployments. GatewayNamespaceMode bool diff --git a/internal/gatewayapi/translator_test.go b/internal/gatewayapi/translator_test.go index 4e56d762a8f..42e5a1222d2 100644 --- a/internal/gatewayapi/translator_test.go +++ b/internal/gatewayapi/translator_test.go @@ -56,6 +56,7 @@ func TestTranslate(t *testing.T) { RunningOnHost bool LuaEnvoyExtensionPolicyDisabled bool SDSEnabled bool + PerResourceSystemCASecret bool }{ { name: "envoypatchpolicy-invalid-feature-disabled", @@ -93,6 +94,36 @@ func TestTranslate(t *testing.T) { BackendEnabled: true, SDSEnabled: true, }, + { + name: "envoyextensionpolicy-with-extproc-with-backendtlspolicy-shared-secret", + }, + { + name: "envoyproxy-otel-backend-tls-per-resource-secret", + BackendEnabled: true, + PerResourceSystemCASecret: true, + }, + { + name: "envoyextensionpolicy-with-extproc-with-backendtlspolicy-per-resource-secret", + PerResourceSystemCASecret: true, + }, + { + name: "backend-system-truststore-shared-secret", + BackendEnabled: true, + }, + { + name: "backend-system-truststore-per-resource-secret", + BackendEnabled: true, + PerResourceSystemCASecret: true, + }, + { + name: "backend-system-truststore-btlsp-override-shared-secret", + BackendEnabled: true, + }, + { + name: "backend-system-truststore-btlsp-override-per-resource-secret", + BackendEnabled: true, + PerResourceSystemCASecret: true, + }, } inputFiles, err := filepath.Glob(filepath.Join("testdata", "*.in.yaml")) @@ -118,6 +149,7 @@ func TestTranslate(t *testing.T) { runningOnHost := false luaEnvoyExtensionPolicyDisabled := false sdsEnabled := false + perResourceSystemCASecret := false for _, config := range testCasesConfig { if config.name == strings.Split(filepath.Base(inputFile), ".")[0] { @@ -127,6 +159,7 @@ func TestTranslate(t *testing.T) { runningOnHost = config.RunningOnHost luaEnvoyExtensionPolicyDisabled = config.LuaEnvoyExtensionPolicyDisabled sdsEnabled = config.SDSEnabled + perResourceSystemCASecret = config.PerResourceSystemCASecret } } @@ -137,6 +170,7 @@ func TestTranslate(t *testing.T) { EnvoyPatchPolicyEnabled: envoyPatchPolicyEnabled, BackendEnabled: backendEnabled, SDSSecretRefEnabled: sdsEnabled, + PerResourceSystemCASecret: perResourceSystemCASecret, ControllerNamespace: "envoy-gateway-system", MergeGateways: IsMergeGatewaysEnabled(resources), GatewayNamespaceMode: gatewayNamespaceMode, diff --git a/internal/ir/xds.go b/internal/ir/xds.go index db6d2f09350..7837b300cdc 100644 --- a/internal/ir/xds.go +++ b/internal/ir/xds.go @@ -33,6 +33,10 @@ import ( const ( EmptyPath = "" + + // SystemTrustStoreSecretName is the shared SDS secret name used by all clusters that reference + // the system CA trust store when backend cluster deduplication is enabled. + SystemTrustStoreSecretName = "system_ca_certificates" //nolint:gosec // not a credential ) var ( diff --git a/internal/xds/translator/globalresources.go b/internal/xds/translator/globalresources.go index 32a67d52035..2fa12a4fb34 100644 --- a/internal/xds/translator/globalresources.go +++ b/internal/xds/translator/globalresources.go @@ -13,9 +13,11 @@ import ( tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3" resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3" "github.com/envoyproxy/go-control-plane/pkg/wellknown" + proto "google.golang.org/protobuf/proto" "google.golang.org/protobuf/types/known/anypb" "github.com/envoyproxy/gateway/internal/ir" + "github.com/envoyproxy/gateway/internal/utils/cert" "github.com/envoyproxy/gateway/internal/xds/types" ) @@ -27,13 +29,15 @@ const ( wasmHTTPServicePort = 18002 ) -// patchGlobalResources builds and appends the global resources that are shared across listeners and routes. -// for example, the envoy client certificate and the OIDC HMAC secret. +// SystemTrustStoreSecretName is re-exported from ir for use within the xDS translator package. +const SystemTrustStoreSecretName = ir.SystemTrustStoreSecretName + +// patchGlobalResources builds and appends global resources shared across listeners and routes. func (t *Translator) patchGlobalResources(tCtx *types.ResourceVersionTable, irXds *ir.Xds) error { var errs error if irXds.GlobalResources != nil && irXds.GlobalResources.EnvoyClientCertificate != nil { - // Create the envoy client TLS secret. It is used for envoy to establish a TLS connection with control plane components. + // Create the envoy client TLS secret for control plane connections (rate limit, wasm). if err := createEnvoyClientTLSCertSecret(tCtx, irXds.GlobalResources); err != nil { errs = errors.Join(errs, err) } @@ -66,6 +70,83 @@ func containsGlobalRateLimit(httpListeners []*ir.HTTPListener) bool { return false } +// emitSystemTrustStoreSecret ensures a system CA trust store SDS secret with the given name +// is present, creating it if not. When dedup is enabled, name is SystemTrustStoreSecretName and +// a single shared secret is used; when dedup is disabled, name is a per-policy name and each +// cluster gets its own idempotently-created copy pointing at the same system CA file path. +func emitSystemTrustStoreSecret(tCtx *types.ResourceVersionTable, name string) error { + // Fast path for the shared secret: the SystemTrustStore flag is set on first emission, + // so subsequent calls can skip the O(secrets) findXdsSecret scan. + if name == SystemTrustStoreSecretName && tCtx.SystemTrustStore { + return nil + } + if findXdsSecret(tCtx, name) != nil { + return nil + } + secret := &tlsv3.Secret{ + Name: name, + Type: &tlsv3.Secret_ValidationContext{ + ValidationContext: systemTrustStoreValidationContext(), + }, + } + if err := tCtx.AddXdsResource(resourcev3.SecretType, secret); err != nil { + return err + } + if name == SystemTrustStoreSecretName { + tCtx.SystemTrustStore = true + } + return nil +} + +// systemTrustStoreValidationContext returns the canonical ValidationContext for the system CA trust store. +// Used both when emitting the secret and when validating it hasn't been tampered with. +func systemTrustStoreValidationContext() *tlsv3.CertificateValidationContext { + return &tlsv3.CertificateValidationContext{ + TrustedCa: &corev3.DataSource{ + Specifier: &corev3.DataSource_Filename{Filename: cert.SystemCertPath}, + }, + } +} + +// validateSystemTrustStoreSecret checks whether system_ca_certificates is present and +// unmodified. Returns an error if it was tampered with (wrong content, duplicate, or removed). +// A no-op if the secret was never emitted. The full proto is compared against the canonical +// form so any field mutation (trust chain verification flags, SAN matchers, CRL config, etc.) +// is detected, not just filename changes. +func validateSystemTrustStoreSecret(tCtx *types.ResourceVersionTable) error { + if !tCtx.SystemTrustStore { + return nil + } + var matches []*tlsv3.Secret + for _, r := range tCtx.XdsResources[resourcev3.SecretType] { + if s, ok := r.(*tlsv3.Secret); ok && s.Name == SystemTrustStoreSecretName { + matches = append(matches, s) + } + } + switch len(matches) { + case 0: + return fmt.Errorf("secret %q was removed by a patch or extension but is still referenced by clusters", SystemTrustStoreSecretName) + case 1: + if !proto.Equal(matches[0], canonicalSystemTrustStoreSecret()) { + return fmt.Errorf("secret %q was modified by a patch or extension", SystemTrustStoreSecretName) + } + return nil + default: + return fmt.Errorf("secret %q appears %d times; at most one is allowed", SystemTrustStoreSecretName, len(matches)) + } +} + +// canonicalSystemTrustStoreSecret returns the exact proto that validateSystemTrustStoreSecret +// expects to find for system_ca_certificates. Any deviation is rejected. +func canonicalSystemTrustStoreSecret() *tlsv3.Secret { + return &tlsv3.Secret{ + Name: SystemTrustStoreSecretName, + Type: &tlsv3.Secret_ValidationContext{ + ValidationContext: systemTrustStoreValidationContext(), + }, + } +} + func createEnvoyClientTLSCertSecret(tCtx *types.ResourceVersionTable, globalResources *ir.GlobalResources) error { if err := tCtx.AddXdsResource( resourcev3.SecretType, diff --git a/internal/xds/translator/globalresources_test.go b/internal/xds/translator/globalresources_test.go new file mode 100644 index 00000000000..84b3ecd9e31 --- /dev/null +++ b/internal/xds/translator/globalresources_test.go @@ -0,0 +1,92 @@ +// Copyright Envoy Gateway Authors +// SPDX-License-Identifier: Apache-2.0 +// The full text of the Apache license is available in the LICENSE file at +// the root of the repo. + +package translator + +import ( + "os" + "testing" + + corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3" + tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3" + resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3" + "github.com/stretchr/testify/require" + + egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1" + "github.com/envoyproxy/gateway/internal/logging" + xtypes "github.com/envoyproxy/gateway/internal/xds/types" +) + +func newTestTranslator() *Translator { + return &Translator{ + Logger: logging.DefaultLogger(os.Stdout, egv1a1.LogLevelInfo), + } +} + +func newTCtxWithSystemTrustStore(t *testing.T) *xtypes.ResourceVersionTable { + t.Helper() + tCtx := new(xtypes.ResourceVersionTable) + require.NoError(t, emitSystemTrustStoreSecret(tCtx, SystemTrustStoreSecretName)) + require.True(t, tCtx.SystemTrustStore) + return tCtx +} + +func TestEnsureSystemTrustStoreSecret_NoOp(t *testing.T) { + tCtx := newTCtxWithSystemTrustStore(t) + tr := newTestTranslator() + require.NoError(t, tr.ensureSystemTrustStoreSecret(tCtx)) + // Secret should still be present and unchanged. + require.NoError(t, validateSystemTrustStoreSecret(tCtx)) +} + +func TestEnsureSystemTrustStoreSecret_Removed(t *testing.T) { + tCtx := newTCtxWithSystemTrustStore(t) + // Simulate extension hook removing the secret. + tCtx.XdsResources[resourcev3.SecretType] = nil + tr := newTestTranslator() + require.NoError(t, tr.ensureSystemTrustStoreSecret(tCtx)) + // Secret should be restored. + require.NoError(t, validateSystemTrustStoreSecret(tCtx)) +} + +func TestEnsureSystemTrustStoreSecret_Modified(t *testing.T) { + tCtx := newTCtxWithSystemTrustStore(t) + // Simulate extension hook modifying the secret filename. + for _, r := range tCtx.XdsResources[resourcev3.SecretType] { + if s, ok := r.(*tlsv3.Secret); ok && s.Name == SystemTrustStoreSecretName { + s.Type = &tlsv3.Secret_ValidationContext{ + ValidationContext: &tlsv3.CertificateValidationContext{ + TrustedCa: &corev3.DataSource{ + Specifier: &corev3.DataSource_Filename{Filename: "/tmp/evil-ca.crt"}, + }, + }, + } + } + } + tr := newTestTranslator() + require.NoError(t, tr.ensureSystemTrustStoreSecret(tCtx)) + // Secret should be restored to canonical form. + require.NoError(t, validateSystemTrustStoreSecret(tCtx)) +} + +func TestEnsureSystemTrustStoreSecret_Duplicated(t *testing.T) { + tCtx := newTCtxWithSystemTrustStore(t) + // Simulate extension hook injecting a duplicate. + duplicate := canonicalSystemTrustStoreSecret() + _ = tCtx.AddXdsResource(resourcev3.SecretType, duplicate) + require.Error(t, validateSystemTrustStoreSecret(tCtx)) // two copies → error + tr := newTestTranslator() + require.NoError(t, tr.ensureSystemTrustStoreSecret(tCtx)) + // Exactly one canonical copy should remain. + require.NoError(t, validateSystemTrustStoreSecret(tCtx)) +} + +func TestEnsureSystemTrustStoreSecret_NotEmitted(t *testing.T) { + // If the secret was never emitted (no system trust store in use), ensure is a no-op. + tCtx := new(xtypes.ResourceVersionTable) + tr := newTestTranslator() + require.NoError(t, tr.ensureSystemTrustStoreSecret(tCtx)) + require.Nil(t, tCtx.XdsResources) +} diff --git a/internal/xds/translator/jsonpatch.go b/internal/xds/translator/jsonpatch.go index 9848c1e012a..2ef1ad84565 100644 --- a/internal/xds/translator/jsonpatch.go +++ b/internal/xds/translator/jsonpatch.go @@ -86,6 +86,16 @@ func processJSONPatches(tCtx *types.ResourceVersionTable, envoyPatchPolicies []* continue } + // Reject patches that inject a resource named system_ca_certificates — + // the name is reserved for the system trust store. + if p.Type == resourcev3.SecretType { + if s, ok := temp.(*tlsv3.Secret); ok && s.Name == SystemTrustStoreSecretName { + tErr := fmt.Errorf("secret name %q is reserved for the system trust store and cannot be used by other resources", SystemTrustStoreSecretName) + tErrs = errors.Join(tErrs, tErr) + continue + } + } + if err = tCtx.AddXdsResource(p.Type, temp); err != nil { tErr := fmt.Errorf("validation failed for xds resource %s, err:%s", p.Type, err.Error()) tErrs = errors.Join(tErrs, tErr) @@ -109,6 +119,13 @@ func processJSONPatches(tCtx *types.ResourceVersionTable, envoyPatchPolicies []* continue } + // Reject patches that modify the reserved system_ca_certificates secret. + if p.Type == resourcev3.SecretType && p.Name == SystemTrustStoreSecretName { + tErr := fmt.Errorf("secret name %q is reserved for the system trust store and cannot be modified by patches", SystemTrustStoreSecretName) + tErrs = errors.Join(tErrs, tErr) + continue + } + resourceJSON, err = jsonMarshalOpts.Marshal(dest) if err != nil { tErr := fmt.Errorf("unable to marshal xds resource %s, err: %w", p.Type, err) @@ -137,6 +154,15 @@ func processJSONPatches(tCtx *types.ResourceVersionTable, envoyPatchPolicies []* continue } + // Reject a patch that renames any secret to the reserved system trust store name. + if p.Type == resourcev3.SecretType { + if s, ok := temp.(*tlsv3.Secret); ok && s.Name == SystemTrustStoreSecretName && p.Name != SystemTrustStoreSecretName { + tErr := fmt.Errorf("secret name %q is reserved for the system trust store and cannot be used by other resources", SystemTrustStoreSecretName) + tErrs = errors.Join(tErrs, tErr) + continue + } + } + // Validate the patched resource validator, ok := temp.(interface{ Validate() error }) if ok { diff --git a/internal/xds/translator/testdata/in/xds-ir/backend-tls-settings.yaml b/internal/xds/translator/testdata/in/xds-ir/backend-tls-settings.yaml index 63596d4fa63..721a7e900f7 100644 --- a/internal/xds/translator/testdata/in/xds-ir/backend-tls-settings.yaml +++ b/internal/xds/translator/testdata/in/xds-ir/backend-tls-settings.yaml @@ -53,6 +53,8 @@ http: subjectAltNames: - uri: spiffe://cluster.local/ns/istio-demo/sa/echo-v1 - hostname: subdomain.secondexample.com + CACertificate: + name: system_ca_certificates useSystemTrustStore: true weight: 1 hostname: '*' @@ -153,6 +155,8 @@ http: - RSA-PSS-RSAE-SHA256 - ECDSA-SECP256R1-SHA256 sni: example.com + CACertificate: + name: system_ca_certificates useSystemTrustStore: true weight: 1 hostname: '*' @@ -203,6 +207,8 @@ http: - RSA-PSS-RSAE-SHA256 - ECDSA-SECP256R1-SHA256 sni: example.com + CACertificate: + name: system_ca_certificates useSystemTrustStore: true weight: 1 hostname: '*' diff --git a/internal/xds/translator/testdata/in/xds-ir/http-route-dynamic-resolver-with-host-rewriting.yaml b/internal/xds/translator/testdata/in/xds-ir/http-route-dynamic-resolver-with-host-rewriting.yaml index f0cdb2fa57c..a14a35873c1 100644 --- a/internal/xds/translator/testdata/in/xds-ir/http-route-dynamic-resolver-with-host-rewriting.yaml +++ b/internal/xds/translator/testdata/in/xds-ir/http-route-dynamic-resolver-with-host-rewriting.yaml @@ -54,7 +54,7 @@ http: tls: alpnProtocols: null caCertificate: - name: backend-with-system-ca/default-ca + name: system_ca_certificates useSystemTrustStore: true weight: 1 hostname: gateway.envoyproxy.io diff --git a/internal/xds/translator/testdata/in/xds-ir/http-route-multiple-system-truststore-per-resource-secret.yaml b/internal/xds/translator/testdata/in/xds-ir/http-route-multiple-system-truststore-per-resource-secret.yaml new file mode 100644 index 00000000000..8c00d99aaa0 --- /dev/null +++ b/internal/xds/translator/testdata/in/xds-ir/http-route-multiple-system-truststore-per-resource-secret.yaml @@ -0,0 +1,73 @@ +http: + - address: 0.0.0.0 + hostnames: + - '*' + name: envoy-gateway/gateway-btls/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + routes: + - destination: + name: httproute/envoy-gateway/httproute-btls-1/rule/0 + settings: + - addressType: IP + endpoints: + - host: 10.244.0.11 + port: 8080 + protocol: HTTP + tls: + CACertificate: + name: policy-btls-1/policies-ca + sni: backend-1.example.com + useSystemTrustStore: true + weight: 1 + name: httproute/envoy-gateway/httproute-btls-1/rule/0/backend/0 + hostname: '*' + name: httproute/envoy-gateway/httproute-btls-1/rule/0/match/0/* + pathMatch: + distinct: false + exact: /backend-1 + name: "" + - destination: + name: httproute/envoy-gateway/httproute-btls-2/rule/0 + settings: + - addressType: IP + endpoints: + - host: 10.244.0.12 + port: 8080 + protocol: HTTP + tls: + CACertificate: + name: policy-btls-2/policies-ca + sni: backend-2.example.com + useSystemTrustStore: true + weight: 1 + name: httproute/envoy-gateway/httproute-btls-2/rule/0/backend/0 + hostname: '*' + name: httproute/envoy-gateway/httproute-btls-2/rule/0/match/0/* + pathMatch: + distinct: false + exact: /backend-2 + name: "" + - destination: + name: httproute/envoy-gateway/httproute-btls-3/rule/0 + settings: + - addressType: IP + endpoints: + - host: 10.244.0.13 + port: 8080 + protocol: HTTP + tls: + CACertificate: + name: policy-btls-3/policies-ca + sni: backend-3.example.com + useSystemTrustStore: true + weight: 1 + name: httproute/envoy-gateway/httproute-btls-3/rule/0/backend/0 + hostname: '*' + name: httproute/envoy-gateway/httproute-btls-3/rule/0/match/0/* + pathMatch: + distinct: false + exact: /backend-3 + name: "" diff --git a/internal/xds/translator/testdata/in/xds-ir/http-route-multiple-system-truststore.yaml b/internal/xds/translator/testdata/in/xds-ir/http-route-multiple-system-truststore.yaml new file mode 100644 index 00000000000..66395662c05 --- /dev/null +++ b/internal/xds/translator/testdata/in/xds-ir/http-route-multiple-system-truststore.yaml @@ -0,0 +1,73 @@ +http: + - address: 0.0.0.0 + hostnames: + - '*' + name: envoy-gateway/gateway-btls/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + routes: + - destination: + name: httproute/envoy-gateway/httproute-btls-1/rule/0 + settings: + - addressType: IP + endpoints: + - host: 10.244.0.11 + port: 8080 + protocol: HTTP + tls: + CACertificate: + name: system_ca_certificates + sni: backend-1.example.com + useSystemTrustStore: true + weight: 1 + name: httproute/envoy-gateway/httproute-btls-1/rule/0/backend/0 + hostname: '*' + name: httproute/envoy-gateway/httproute-btls-1/rule/0/match/0/* + pathMatch: + distinct: false + exact: /backend-1 + name: "" + - destination: + name: httproute/envoy-gateway/httproute-btls-2/rule/0 + settings: + - addressType: IP + endpoints: + - host: 10.244.0.12 + port: 8080 + protocol: HTTP + tls: + CACertificate: + name: system_ca_certificates + sni: backend-2.example.com + useSystemTrustStore: true + weight: 1 + name: httproute/envoy-gateway/httproute-btls-2/rule/0/backend/0 + hostname: '*' + name: httproute/envoy-gateway/httproute-btls-2/rule/0/match/0/* + pathMatch: + distinct: false + exact: /backend-2 + name: "" + - destination: + name: httproute/envoy-gateway/httproute-btls-3/rule/0 + settings: + - addressType: IP + endpoints: + - host: 10.244.0.13 + port: 8080 + protocol: HTTP + tls: + CACertificate: + name: system_ca_certificates + sni: backend-3.example.com + useSystemTrustStore: true + weight: 1 + name: httproute/envoy-gateway/httproute-btls-3/rule/0/backend/0 + hostname: '*' + name: httproute/envoy-gateway/httproute-btls-3/rule/0/match/0/* + pathMatch: + distinct: false + exact: /backend-3 + name: "" diff --git a/internal/xds/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.yaml b/internal/xds/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.yaml new file mode 100644 index 00000000000..9c749afbd1e --- /dev/null +++ b/internal/xds/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.yaml @@ -0,0 +1,31 @@ +http: + - address: 0.0.0.0 + hostnames: + - '*' + name: envoy-gateway/gateway-btls/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + routes: + - destination: + name: httproute/envoy-gateway/httproute-btls/rule/0 + settings: + - addressType: IP + endpoints: + - host: 10.244.0.11 + port: 8080 + protocol: HTTP + tls: + CACertificate: + name: policy-btls/policies-ca + sni: example.com + useSystemTrustStore: true + weight: 1 + name: httproute/envoy-gateway/httproute-btls/rule/0/backend/0 + hostname: '*' + name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/* + pathMatch: + distinct: false + exact: /exact + name: "" diff --git a/internal/xds/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore.yaml b/internal/xds/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore.yaml index 9c749afbd1e..de82d6a8f2a 100644 --- a/internal/xds/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore.yaml +++ b/internal/xds/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore.yaml @@ -18,7 +18,7 @@ http: protocol: HTTP tls: CACertificate: - name: policy-btls/policies-ca + name: system_ca_certificates sni: example.com useSystemTrustStore: true weight: 1 diff --git a/internal/xds/translator/testdata/in/xds-ir/httproute-with-tls-and-http.yaml b/internal/xds/translator/testdata/in/xds-ir/httproute-with-tls-and-http.yaml index 1f48455ed98..895d265e866 100644 --- a/internal/xds/translator/testdata/in/xds-ir/httproute-with-tls-and-http.yaml +++ b/internal/xds/translator/testdata/in/xds-ir/httproute-with-tls-and-http.yaml @@ -34,7 +34,7 @@ http: tls: alpnProtocols: null caCertificate: - name: policy-btls-for-backend-1/default-ca + name: system_ca_certificates sni: example.com subjectAltNames: - uri: spiffe://cluster.local/ns/istio-demo/sa/echo-v1 diff --git a/internal/xds/translator/testdata/in/xds-ir/jsonpatch-system-truststore-enforcement.yaml b/internal/xds/translator/testdata/in/xds-ir/jsonpatch-system-truststore-enforcement.yaml new file mode 100644 index 00000000000..736888a8aab --- /dev/null +++ b/internal/xds/translator/testdata/in/xds-ir/jsonpatch-system-truststore-enforcement.yaml @@ -0,0 +1,100 @@ +envoyPatchPolicies: +# Policy 1: inject a duplicate secret named system_ca_certificates via add-op +- status: + ancestors: + - ancestorRef: + group: "gateway.networking.k8s.io" + kind: "Gateway" + namespace: "envoy-gateway" + name: "gateway-btls" + name: "inject-duplicate-system-ca-policy" + namespace: "default" + generation: 1 + jsonPatches: + - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret" + name: "system_ca_certificates_injected" + operation: + op: "add" + path: "" + value: + name: system_ca_certificates + validation_context: + trusted_ca: + filename: "/tmp/evil-ca.crt" +# Policy 2: modify the existing secret (replace filename) +- status: + ancestors: + - ancestorRef: + group: "gateway.networking.k8s.io" + kind: "Gateway" + namespace: "envoy-gateway" + name: "gateway-btls" + name: "replace-system-ca-policy" + namespace: "default" + generation: 1 + jsonPatches: + - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret" + name: "system_ca_certificates" + operation: + op: "replace" + path: "/validation_context/trusted_ca/filename" + value: "/tmp/evil-ca.crt" +# Policy 3: rename another secret to system_ca_certificates +- status: + ancestors: + - ancestorRef: + group: "gateway.networking.k8s.io" + kind: "Gateway" + namespace: "envoy-gateway" + name: "gateway-btls" + name: "rename-to-system-ca-policy" + namespace: "default" + generation: 1 + jsonPatches: + - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret" + name: "other-secret" + operation: + op: "add" + path: "" + value: + name: other-secret + validation_context: + trusted_ca: + filename: "/etc/ssl/certs/ca-certificates.crt" + - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret" + name: "other-secret" + operation: + op: "replace" + path: "/name" + value: "system_ca_certificates" +http: +- address: 0.0.0.0 + hostnames: + - '*' + name: envoy-gateway/gateway-btls/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + routes: + - destination: + name: httproute/envoy-gateway/httproute-btls/rule/0 + settings: + - addressType: IP + endpoints: + - host: 10.244.0.11 + port: 8080 + protocol: HTTP + tls: + CACertificate: + name: system_ca_certificates + sni: example.com + useSystemTrustStore: true + weight: 1 + name: httproute/envoy-gateway/httproute-btls/rule/0/backend/0 + hostname: '*' + name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/* + pathMatch: + distinct: false + exact: /exact + name: "" diff --git a/internal/xds/translator/testdata/in/xds-ir/tcproute-mtls.yaml b/internal/xds/translator/testdata/in/xds-ir/tcproute-mtls.yaml index f5a266f49f3..1f75ea3bff1 100644 --- a/internal/xds/translator/testdata/in/xds-ir/tcproute-mtls.yaml +++ b/internal/xds/translator/testdata/in/xds-ir/tcproute-mtls.yaml @@ -40,6 +40,8 @@ tcp: subjectAltNames: - uri: spiffe://cluster.local/ns/istio-demo/sa/echo-v1 - hostname: subdomain.secondexample.com + CACertificate: + name: system_ca_certificates useSystemTrustStore: true weight: 1 metadata: diff --git a/internal/xds/translator/testdata/in/xds-ir/websocket-backend-force-http1-upstream.yaml b/internal/xds/translator/testdata/in/xds-ir/websocket-backend-force-http1-upstream.yaml index b86e8bfdbba..0b3159046d4 100644 --- a/internal/xds/translator/testdata/in/xds-ir/websocket-backend-force-http1-upstream.yaml +++ b/internal/xds/translator/testdata/in/xds-ir/websocket-backend-force-http1-upstream.yaml @@ -22,7 +22,7 @@ http: tls: alpnProtocols: null caCertificate: - name: websocket-wss-route/ca + name: system_ca_certificates sni: "websocket.example.com" useSystemTrustStore: true - name: "ordinary-tls-http-route" @@ -38,6 +38,6 @@ http: tls: alpnProtocols: null caCertificate: - name: ordinary-tls-http-route/ca + name: system_ca_certificates sni: "ordinary.example.com" useSystemTrustStore: true diff --git a/internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-translate-error.secrets.yaml b/internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-translate-error.secrets.yaml new file mode 100644 index 00000000000..b522884fef6 --- /dev/null +++ b/internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-translate-error.secrets.yaml @@ -0,0 +1,4 @@ +- name: system_ca_certificates + validationContext: + trustedCa: + filename: /etc/ssl/certs/ca-certificates.crt diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-dynamic-resolver-with-host-rewriting.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-dynamic-resolver-with-host-rewriting.clusters.yaml index e0a6ae10d24..23d13f6467a 100644 --- a/internal/xds/translator/testdata/out/xds-ir/http-route-dynamic-resolver-with-host-rewriting.clusters.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-dynamic-resolver-with-host-rewriting.clusters.yaml @@ -66,7 +66,7 @@ combinedValidationContext: defaultValidationContext: {} validationContextSdsSecretConfig: - name: backend-with-system-ca/default-ca + name: system_ca_certificates sdsConfig: ads: {} resourceApiVersion: V3 diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-dynamic-resolver-with-host-rewriting.secrets.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-dynamic-resolver-with-host-rewriting.secrets.yaml index 78ae34806b0..b522884fef6 100644 --- a/internal/xds/translator/testdata/out/xds-ir/http-route-dynamic-resolver-with-host-rewriting.secrets.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-dynamic-resolver-with-host-rewriting.secrets.yaml @@ -1,4 +1,4 @@ -- name: backend-with-system-ca/default-ca +- name: system_ca_certificates validationContext: trustedCa: filename: /etc/ssl/certs/ca-certificates.crt diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.clusters.yaml new file mode 100644 index 00000000000..e783538f33d --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.clusters.yaml @@ -0,0 +1,171 @@ +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: httproute/envoy-gateway/httproute-btls-1/rule/0 + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: httproute/envoy-gateway/httproute-btls-1/rule/0 + perConnectionBufferLimitBytes: 32768 + transportSocket: + name: dummy.transport_socket + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: {} + transportSocketMatches: + - match: + name: httproute/envoy-gateway/httproute-btls-1/rule/0/tls/0 + name: httproute/envoy-gateway/httproute-btls-1/rule/0/tls/0 + transportSocket: + name: envoy.transport_sockets.tls + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: + combinedValidationContext: + defaultValidationContext: + matchTypedSubjectAltNames: + - matcher: + exact: backend-1.example.com + sanType: DNS + validationContextSdsSecretConfig: + name: policy-btls-1/policies-ca + sdsConfig: + ads: {} + resourceApiVersion: V3 + sni: backend-1.example.com + type: EDS + typedExtensionProtocolOptions: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + autoConfig: + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + httpProtocolOptions: {} +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: httproute/envoy-gateway/httproute-btls-2/rule/0 + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: httproute/envoy-gateway/httproute-btls-2/rule/0 + perConnectionBufferLimitBytes: 32768 + transportSocket: + name: dummy.transport_socket + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: {} + transportSocketMatches: + - match: + name: httproute/envoy-gateway/httproute-btls-2/rule/0/tls/0 + name: httproute/envoy-gateway/httproute-btls-2/rule/0/tls/0 + transportSocket: + name: envoy.transport_sockets.tls + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: + combinedValidationContext: + defaultValidationContext: + matchTypedSubjectAltNames: + - matcher: + exact: backend-2.example.com + sanType: DNS + validationContextSdsSecretConfig: + name: policy-btls-2/policies-ca + sdsConfig: + ads: {} + resourceApiVersion: V3 + sni: backend-2.example.com + type: EDS + typedExtensionProtocolOptions: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + autoConfig: + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + httpProtocolOptions: {} +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: httproute/envoy-gateway/httproute-btls-3/rule/0 + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: httproute/envoy-gateway/httproute-btls-3/rule/0 + perConnectionBufferLimitBytes: 32768 + transportSocket: + name: dummy.transport_socket + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: {} + transportSocketMatches: + - match: + name: httproute/envoy-gateway/httproute-btls-3/rule/0/tls/0 + name: httproute/envoy-gateway/httproute-btls-3/rule/0/tls/0 + transportSocket: + name: envoy.transport_sockets.tls + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: + combinedValidationContext: + defaultValidationContext: + matchTypedSubjectAltNames: + - matcher: + exact: backend-3.example.com + sanType: DNS + validationContextSdsSecretConfig: + name: policy-btls-3/policies-ca + sdsConfig: + ads: {} + resourceApiVersion: V3 + sni: backend-3.example.com + type: EDS + typedExtensionProtocolOptions: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + autoConfig: + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + httpProtocolOptions: {} diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.endpoints.yaml new file mode 100644 index 00000000000..47805a81cba --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.endpoints.yaml @@ -0,0 +1,48 @@ +- clusterName: httproute/envoy-gateway/httproute-btls-1/rule/0 + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 10.244.0.11 + portValue: 8080 + loadBalancingWeight: 1 + metadata: + filterMetadata: + envoy.transport_socket_match: + name: httproute/envoy-gateway/httproute-btls-1/rule/0/tls/0 + loadBalancingWeight: 1 + locality: + region: httproute/envoy-gateway/httproute-btls-1/rule/0/backend/0 +- clusterName: httproute/envoy-gateway/httproute-btls-2/rule/0 + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 10.244.0.12 + portValue: 8080 + loadBalancingWeight: 1 + metadata: + filterMetadata: + envoy.transport_socket_match: + name: httproute/envoy-gateway/httproute-btls-2/rule/0/tls/0 + loadBalancingWeight: 1 + locality: + region: httproute/envoy-gateway/httproute-btls-2/rule/0/backend/0 +- clusterName: httproute/envoy-gateway/httproute-btls-3/rule/0 + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 10.244.0.13 + portValue: 8080 + loadBalancingWeight: 1 + metadata: + filterMetadata: + envoy.transport_socket_match: + name: httproute/envoy-gateway/httproute-btls-3/rule/0/tls/0 + loadBalancingWeight: 1 + locality: + region: httproute/envoy-gateway/httproute-btls-3/rule/0/backend/0 diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.listeners.yaml new file mode 100644 index 00000000000..86036a19d51 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.listeners.yaml @@ -0,0 +1,35 @@ +- address: + socketAddress: + address: 0.0.0.0 + portValue: 10080 + defaultFilterChain: + filters: + - name: envoy.filters.network.http_connection_manager + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + commonHttpProtocolOptions: + headersWithUnderscoresAction: REJECT_REQUEST + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + maxConcurrentStreams: 100 + httpFilters: + - name: envoy.filters.http.router + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + suppressEnvoyHeaders: true + mergeSlashes: true + normalizePath: true + pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT + rds: + configSource: + ads: {} + resourceApiVersion: V3 + routeConfigName: envoy-gateway/gateway-btls/http + serverHeaderTransformation: PASS_THROUGH + statPrefix: http-10080 + useRemoteAddress: true + name: envoy-gateway/gateway-btls/http + maxConnectionsToAcceptPerSocketEvent: 1 + name: envoy-gateway/gateway-btls/http + perConnectionBufferLimitBytes: 32768 diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.routes.yaml new file mode 100644 index 00000000000..6c66166d8ef --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.routes.yaml @@ -0,0 +1,28 @@ +- ignorePortInHostMatching: true + name: envoy-gateway/gateway-btls/http + virtualHosts: + - domains: + - '*' + name: envoy-gateway/gateway-btls/http/* + routes: + - match: + path: /backend-1 + name: httproute/envoy-gateway/httproute-btls-1/rule/0/match/0/* + route: + cluster: httproute/envoy-gateway/httproute-btls-1/rule/0 + upgradeConfigs: + - upgradeType: websocket + - match: + path: /backend-2 + name: httproute/envoy-gateway/httproute-btls-2/rule/0/match/0/* + route: + cluster: httproute/envoy-gateway/httproute-btls-2/rule/0 + upgradeConfigs: + - upgradeType: websocket + - match: + path: /backend-3 + name: httproute/envoy-gateway/httproute-btls-3/rule/0/match/0/* + route: + cluster: httproute/envoy-gateway/httproute-btls-3/rule/0 + upgradeConfigs: + - upgradeType: websocket diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.secrets.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.secrets.yaml new file mode 100644 index 00000000000..c0bebaac165 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore-per-resource-secret.secrets.yaml @@ -0,0 +1,12 @@ +- name: policy-btls-1/policies-ca + validationContext: + trustedCa: + filename: /etc/ssl/certs/ca-certificates.crt +- name: policy-btls-2/policies-ca + validationContext: + trustedCa: + filename: /etc/ssl/certs/ca-certificates.crt +- name: policy-btls-3/policies-ca + validationContext: + trustedCa: + filename: /etc/ssl/certs/ca-certificates.crt diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.clusters.yaml new file mode 100644 index 00000000000..6f130d2e018 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.clusters.yaml @@ -0,0 +1,171 @@ +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: httproute/envoy-gateway/httproute-btls-1/rule/0 + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: httproute/envoy-gateway/httproute-btls-1/rule/0 + perConnectionBufferLimitBytes: 32768 + transportSocket: + name: dummy.transport_socket + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: {} + transportSocketMatches: + - match: + name: httproute/envoy-gateway/httproute-btls-1/rule/0/tls/0 + name: httproute/envoy-gateway/httproute-btls-1/rule/0/tls/0 + transportSocket: + name: envoy.transport_sockets.tls + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: + combinedValidationContext: + defaultValidationContext: + matchTypedSubjectAltNames: + - matcher: + exact: backend-1.example.com + sanType: DNS + validationContextSdsSecretConfig: + name: system_ca_certificates + sdsConfig: + ads: {} + resourceApiVersion: V3 + sni: backend-1.example.com + type: EDS + typedExtensionProtocolOptions: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + autoConfig: + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + httpProtocolOptions: {} +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: httproute/envoy-gateway/httproute-btls-2/rule/0 + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: httproute/envoy-gateway/httproute-btls-2/rule/0 + perConnectionBufferLimitBytes: 32768 + transportSocket: + name: dummy.transport_socket + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: {} + transportSocketMatches: + - match: + name: httproute/envoy-gateway/httproute-btls-2/rule/0/tls/0 + name: httproute/envoy-gateway/httproute-btls-2/rule/0/tls/0 + transportSocket: + name: envoy.transport_sockets.tls + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: + combinedValidationContext: + defaultValidationContext: + matchTypedSubjectAltNames: + - matcher: + exact: backend-2.example.com + sanType: DNS + validationContextSdsSecretConfig: + name: system_ca_certificates + sdsConfig: + ads: {} + resourceApiVersion: V3 + sni: backend-2.example.com + type: EDS + typedExtensionProtocolOptions: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + autoConfig: + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + httpProtocolOptions: {} +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: httproute/envoy-gateway/httproute-btls-3/rule/0 + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: httproute/envoy-gateway/httproute-btls-3/rule/0 + perConnectionBufferLimitBytes: 32768 + transportSocket: + name: dummy.transport_socket + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: {} + transportSocketMatches: + - match: + name: httproute/envoy-gateway/httproute-btls-3/rule/0/tls/0 + name: httproute/envoy-gateway/httproute-btls-3/rule/0/tls/0 + transportSocket: + name: envoy.transport_sockets.tls + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: + combinedValidationContext: + defaultValidationContext: + matchTypedSubjectAltNames: + - matcher: + exact: backend-3.example.com + sanType: DNS + validationContextSdsSecretConfig: + name: system_ca_certificates + sdsConfig: + ads: {} + resourceApiVersion: V3 + sni: backend-3.example.com + type: EDS + typedExtensionProtocolOptions: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + autoConfig: + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + httpProtocolOptions: {} diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.endpoints.yaml new file mode 100644 index 00000000000..47805a81cba --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.endpoints.yaml @@ -0,0 +1,48 @@ +- clusterName: httproute/envoy-gateway/httproute-btls-1/rule/0 + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 10.244.0.11 + portValue: 8080 + loadBalancingWeight: 1 + metadata: + filterMetadata: + envoy.transport_socket_match: + name: httproute/envoy-gateway/httproute-btls-1/rule/0/tls/0 + loadBalancingWeight: 1 + locality: + region: httproute/envoy-gateway/httproute-btls-1/rule/0/backend/0 +- clusterName: httproute/envoy-gateway/httproute-btls-2/rule/0 + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 10.244.0.12 + portValue: 8080 + loadBalancingWeight: 1 + metadata: + filterMetadata: + envoy.transport_socket_match: + name: httproute/envoy-gateway/httproute-btls-2/rule/0/tls/0 + loadBalancingWeight: 1 + locality: + region: httproute/envoy-gateway/httproute-btls-2/rule/0/backend/0 +- clusterName: httproute/envoy-gateway/httproute-btls-3/rule/0 + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 10.244.0.13 + portValue: 8080 + loadBalancingWeight: 1 + metadata: + filterMetadata: + envoy.transport_socket_match: + name: httproute/envoy-gateway/httproute-btls-3/rule/0/tls/0 + loadBalancingWeight: 1 + locality: + region: httproute/envoy-gateway/httproute-btls-3/rule/0/backend/0 diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.listeners.yaml new file mode 100644 index 00000000000..86036a19d51 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.listeners.yaml @@ -0,0 +1,35 @@ +- address: + socketAddress: + address: 0.0.0.0 + portValue: 10080 + defaultFilterChain: + filters: + - name: envoy.filters.network.http_connection_manager + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + commonHttpProtocolOptions: + headersWithUnderscoresAction: REJECT_REQUEST + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + maxConcurrentStreams: 100 + httpFilters: + - name: envoy.filters.http.router + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + suppressEnvoyHeaders: true + mergeSlashes: true + normalizePath: true + pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT + rds: + configSource: + ads: {} + resourceApiVersion: V3 + routeConfigName: envoy-gateway/gateway-btls/http + serverHeaderTransformation: PASS_THROUGH + statPrefix: http-10080 + useRemoteAddress: true + name: envoy-gateway/gateway-btls/http + maxConnectionsToAcceptPerSocketEvent: 1 + name: envoy-gateway/gateway-btls/http + perConnectionBufferLimitBytes: 32768 diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.routes.yaml new file mode 100644 index 00000000000..6c66166d8ef --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.routes.yaml @@ -0,0 +1,28 @@ +- ignorePortInHostMatching: true + name: envoy-gateway/gateway-btls/http + virtualHosts: + - domains: + - '*' + name: envoy-gateway/gateway-btls/http/* + routes: + - match: + path: /backend-1 + name: httproute/envoy-gateway/httproute-btls-1/rule/0/match/0/* + route: + cluster: httproute/envoy-gateway/httproute-btls-1/rule/0 + upgradeConfigs: + - upgradeType: websocket + - match: + path: /backend-2 + name: httproute/envoy-gateway/httproute-btls-2/rule/0/match/0/* + route: + cluster: httproute/envoy-gateway/httproute-btls-2/rule/0 + upgradeConfigs: + - upgradeType: websocket + - match: + path: /backend-3 + name: httproute/envoy-gateway/httproute-btls-3/rule/0/match/0/* + route: + cluster: httproute/envoy-gateway/httproute-btls-3/rule/0 + upgradeConfigs: + - upgradeType: websocket diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.secrets.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.secrets.yaml new file mode 100644 index 00000000000..b522884fef6 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-system-truststore.secrets.yaml @@ -0,0 +1,4 @@ +- name: system_ca_certificates + validationContext: + trustedCa: + filename: /etc/ssl/certs/ca-certificates.crt diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.clusters.yaml new file mode 100644 index 00000000000..f08220608dc --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.clusters.yaml @@ -0,0 +1,57 @@ +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: httproute/envoy-gateway/httproute-btls/rule/0 + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: httproute/envoy-gateway/httproute-btls/rule/0 + perConnectionBufferLimitBytes: 32768 + transportSocket: + name: dummy.transport_socket + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: {} + transportSocketMatches: + - match: + name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0 + name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0 + transportSocket: + name: envoy.transport_sockets.tls + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: + combinedValidationContext: + defaultValidationContext: + matchTypedSubjectAltNames: + - matcher: + exact: example.com + sanType: DNS + validationContextSdsSecretConfig: + name: policy-btls/policies-ca + sdsConfig: + ads: {} + resourceApiVersion: V3 + sni: example.com + type: EDS + typedExtensionProtocolOptions: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + autoConfig: + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + httpProtocolOptions: {} diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.endpoints.yaml new file mode 100644 index 00000000000..3d0e8160769 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.endpoints.yaml @@ -0,0 +1,16 @@ +- clusterName: httproute/envoy-gateway/httproute-btls/rule/0 + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 10.244.0.11 + portValue: 8080 + loadBalancingWeight: 1 + metadata: + filterMetadata: + envoy.transport_socket_match: + name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0 + loadBalancingWeight: 1 + locality: + region: httproute/envoy-gateway/httproute-btls/rule/0/backend/0 diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.listeners.yaml new file mode 100644 index 00000000000..86036a19d51 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.listeners.yaml @@ -0,0 +1,35 @@ +- address: + socketAddress: + address: 0.0.0.0 + portValue: 10080 + defaultFilterChain: + filters: + - name: envoy.filters.network.http_connection_manager + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + commonHttpProtocolOptions: + headersWithUnderscoresAction: REJECT_REQUEST + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + maxConcurrentStreams: 100 + httpFilters: + - name: envoy.filters.http.router + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + suppressEnvoyHeaders: true + mergeSlashes: true + normalizePath: true + pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT + rds: + configSource: + ads: {} + resourceApiVersion: V3 + routeConfigName: envoy-gateway/gateway-btls/http + serverHeaderTransformation: PASS_THROUGH + statPrefix: http-10080 + useRemoteAddress: true + name: envoy-gateway/gateway-btls/http + maxConnectionsToAcceptPerSocketEvent: 1 + name: envoy-gateway/gateway-btls/http + perConnectionBufferLimitBytes: 32768 diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.routes.yaml new file mode 100644 index 00000000000..bd4f9cfe7e2 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.routes.yaml @@ -0,0 +1,14 @@ +- ignorePortInHostMatching: true + name: envoy-gateway/gateway-btls/http + virtualHosts: + - domains: + - '*' + name: envoy-gateway/gateway-btls/http/* + routes: + - match: + path: /exact + name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/* + route: + cluster: httproute/envoy-gateway/httproute-btls/rule/0 + upgradeConfigs: + - upgradeType: websocket diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.secrets.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.secrets.yaml new file mode 100644 index 00000000000..313d6f89060 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore-per-resource-secret.secrets.yaml @@ -0,0 +1,4 @@ +- name: policy-btls/policies-ca + validationContext: + trustedCa: + filename: /etc/ssl/certs/ca-certificates.crt diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.clusters.yaml index f08220608dc..cf869388409 100644 --- a/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.clusters.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.clusters.yaml @@ -41,7 +41,7 @@ exact: example.com sanType: DNS validationContextSdsSecretConfig: - name: policy-btls/policies-ca + name: system_ca_certificates sdsConfig: ads: {} resourceApiVersion: V3 diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.secrets.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.secrets.yaml index 313d6f89060..b522884fef6 100644 --- a/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.secrets.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.secrets.yaml @@ -1,4 +1,4 @@ -- name: policy-btls/policies-ca +- name: system_ca_certificates validationContext: trustedCa: filename: /etc/ssl/certs/ca-certificates.crt diff --git a/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-http.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-http.clusters.yaml index 1ae97c4dcec..e97b7f60a9b 100644 --- a/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-http.clusters.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-http.clusters.yaml @@ -46,7 +46,7 @@ exact: subdomain.secondexample.com sanType: DNS validationContextSdsSecretConfig: - name: policy-btls-for-backend-1/default-ca + name: system_ca_certificates sdsConfig: ads: {} resourceApiVersion: V3 diff --git a/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-http.secrets.yaml b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-http.secrets.yaml index a348298f78a..b522884fef6 100644 --- a/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-http.secrets.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-http.secrets.yaml @@ -1,4 +1,4 @@ -- name: policy-btls-for-backend-1/default-ca +- name: system_ca_certificates validationContext: trustedCa: filename: /etc/ssl/certs/ca-certificates.crt diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.clusters.yaml new file mode 100644 index 00000000000..cf869388409 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.clusters.yaml @@ -0,0 +1,57 @@ +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: httproute/envoy-gateway/httproute-btls/rule/0 + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: httproute/envoy-gateway/httproute-btls/rule/0 + perConnectionBufferLimitBytes: 32768 + transportSocket: + name: dummy.transport_socket + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: {} + transportSocketMatches: + - match: + name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0 + name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0 + transportSocket: + name: envoy.transport_sockets.tls + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: + combinedValidationContext: + defaultValidationContext: + matchTypedSubjectAltNames: + - matcher: + exact: example.com + sanType: DNS + validationContextSdsSecretConfig: + name: system_ca_certificates + sdsConfig: + ads: {} + resourceApiVersion: V3 + sni: example.com + type: EDS + typedExtensionProtocolOptions: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + autoConfig: + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + httpProtocolOptions: {} diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.endpoints.yaml new file mode 100644 index 00000000000..3d0e8160769 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.endpoints.yaml @@ -0,0 +1,16 @@ +- clusterName: httproute/envoy-gateway/httproute-btls/rule/0 + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 10.244.0.11 + portValue: 8080 + loadBalancingWeight: 1 + metadata: + filterMetadata: + envoy.transport_socket_match: + name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0 + loadBalancingWeight: 1 + locality: + region: httproute/envoy-gateway/httproute-btls/rule/0/backend/0 diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.envoypatchpolicies.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.envoypatchpolicies.yaml new file mode 100644 index 00000000000..b98a237f4dd --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.envoypatchpolicies.yaml @@ -0,0 +1,57 @@ +- generation: 1 + name: inject-duplicate-system-ca-policy + namespace: default + status: + ancestors: + - ancestorRef: + group: gateway.networking.k8s.io + kind: Gateway + name: gateway-btls + namespace: envoy-gateway + conditions: + - lastTransitionTime: null + message: Secret name "system_ca_certificates" is reserved for the system trust + store and cannot be used by other resources. + observedGeneration: 1 + reason: Invalid + status: "False" + type: Programmed + controllerName: "" +- generation: 1 + name: replace-system-ca-policy + namespace: default + status: + ancestors: + - ancestorRef: + group: gateway.networking.k8s.io + kind: Gateway + name: gateway-btls + namespace: envoy-gateway + conditions: + - lastTransitionTime: null + message: Secret name "system_ca_certificates" is reserved for the system trust + store and cannot be modified by patches. + observedGeneration: 1 + reason: Invalid + status: "False" + type: Programmed + controllerName: "" +- generation: 1 + name: rename-to-system-ca-policy + namespace: default + status: + ancestors: + - ancestorRef: + group: gateway.networking.k8s.io + kind: Gateway + name: gateway-btls + namespace: envoy-gateway + conditions: + - lastTransitionTime: null + message: Secret name "system_ca_certificates" is reserved for the system trust + store and cannot be used by other resources. + observedGeneration: 1 + reason: Invalid + status: "False" + type: Programmed + controllerName: "" diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.listeners.yaml new file mode 100644 index 00000000000..86036a19d51 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.listeners.yaml @@ -0,0 +1,35 @@ +- address: + socketAddress: + address: 0.0.0.0 + portValue: 10080 + defaultFilterChain: + filters: + - name: envoy.filters.network.http_connection_manager + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + commonHttpProtocolOptions: + headersWithUnderscoresAction: REJECT_REQUEST + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + maxConcurrentStreams: 100 + httpFilters: + - name: envoy.filters.http.router + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + suppressEnvoyHeaders: true + mergeSlashes: true + normalizePath: true + pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT + rds: + configSource: + ads: {} + resourceApiVersion: V3 + routeConfigName: envoy-gateway/gateway-btls/http + serverHeaderTransformation: PASS_THROUGH + statPrefix: http-10080 + useRemoteAddress: true + name: envoy-gateway/gateway-btls/http + maxConnectionsToAcceptPerSocketEvent: 1 + name: envoy-gateway/gateway-btls/http + perConnectionBufferLimitBytes: 32768 diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.routes.yaml new file mode 100644 index 00000000000..bd4f9cfe7e2 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.routes.yaml @@ -0,0 +1,14 @@ +- ignorePortInHostMatching: true + name: envoy-gateway/gateway-btls/http + virtualHosts: + - domains: + - '*' + name: envoy-gateway/gateway-btls/http/* + routes: + - match: + path: /exact + name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/* + route: + cluster: httproute/envoy-gateway/httproute-btls/rule/0 + upgradeConfigs: + - upgradeType: websocket diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.secrets.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.secrets.yaml new file mode 100644 index 00000000000..109b6912570 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-system-truststore-enforcement.secrets.yaml @@ -0,0 +1,8 @@ +- name: system_ca_certificates + validationContext: + trustedCa: + filename: /etc/ssl/certs/ca-certificates.crt +- name: other-secret + validationContext: + trustedCa: + filename: /etc/ssl/certs/ca-certificates.crt diff --git a/internal/xds/translator/testdata/out/xds-ir/websocket-backend-force-http1-upstream.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/websocket-backend-force-http1-upstream.clusters.yaml index 09df7715b7b..0c3ffa6803c 100644 --- a/internal/xds/translator/testdata/out/xds-ir/websocket-backend-force-http1-upstream.clusters.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/websocket-backend-force-http1-upstream.clusters.yaml @@ -41,7 +41,7 @@ exact: websocket.example.com sanType: DNS validationContextSdsSecretConfig: - name: websocket-wss-route/ca + name: system_ca_certificates sdsConfig: ads: {} resourceApiVersion: V3 @@ -95,7 +95,7 @@ exact: ordinary.example.com sanType: DNS validationContextSdsSecretConfig: - name: ordinary-tls-http-route/ca + name: system_ca_certificates sdsConfig: ads: {} resourceApiVersion: V3 diff --git a/internal/xds/translator/testdata/out/xds-ir/websocket-backend-force-http1-upstream.secrets.yaml b/internal/xds/translator/testdata/out/xds-ir/websocket-backend-force-http1-upstream.secrets.yaml index 4abecf47fc6..b522884fef6 100644 --- a/internal/xds/translator/testdata/out/xds-ir/websocket-backend-force-http1-upstream.secrets.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/websocket-backend-force-http1-upstream.secrets.yaml @@ -1,8 +1,4 @@ -- name: websocket-wss-route/ca - validationContext: - trustedCa: - filename: /etc/ssl/certs/ca-certificates.crt -- name: ordinary-tls-http-route/ca +- name: system_ca_certificates validationContext: trustedCa: filename: /etc/ssl/certs/ca-certificates.crt diff --git a/internal/xds/translator/translator.go b/internal/xds/translator/translator.go index 5010eb7b05b..a7ab8f0a057 100644 --- a/internal/xds/translator/translator.go +++ b/internal/xds/translator/translator.go @@ -33,7 +33,6 @@ import ( "github.com/envoyproxy/gateway/internal/ir" "github.com/envoyproxy/gateway/internal/logging" "github.com/envoyproxy/gateway/internal/utils" - "github.com/envoyproxy/gateway/internal/utils/cert" "github.com/envoyproxy/gateway/internal/utils/proto" "github.com/envoyproxy/gateway/internal/xds/types" ) @@ -176,6 +175,13 @@ func (t *Translator) Translate(xdsIR *ir.Xds) (*types.ResourceVersionTable, erro } } + // Repair system_ca_certificates before validation so the restored canonical secret + // passes ValidateAll and the snapshot remains publishable. + // EnvoyPatchPolicy tampering is caught earlier per-policy inside processJSONPatches. + if err := t.ensureSystemTrustStoreSecret(tCtx); err != nil { + errs = errors.Join(errs, err) + } + // Validate all the xds resources in the table before returning // This is necessary to catch any misconfigurations that might have been missed during translation if err := tCtx.ValidateAll(); err != nil { @@ -185,6 +191,37 @@ func (t *Translator) Translate(xdsIR *ir.Xds) (*types.ResourceVersionTable, erro return tCtx, errs } +// ensureSystemTrustStoreSecret detects and repairs any tampering with system_ca_certificates +// by a post-translation extension hook. If tampering is detected the secret is restored to +// the canonical form and a warning is logged. Returns an error only if re-emission fails — +// in that case the snapshot would have clusters referencing a missing secret, so the caller +// should propagate the error to block publishing. +func (t *Translator) ensureSystemTrustStoreSecret(tCtx *types.ResourceVersionTable) error { + err := validateSystemTrustStoreSecret(tCtx) + if err == nil { + return nil + } + t.Logger.Info("system trust store secret was tampered with by extension; restoring", "reason", err.Error()) + // Remove all existing copies (handles modified and duplicate cases). + if tCtx.XdsResources != nil { + secrets := tCtx.XdsResources[resourcev3.SecretType] + filtered := secrets[:0] + for _, r := range secrets { + if s, ok := r.(*tlsv3.Secret); ok && s.Name == SystemTrustStoreSecretName { + continue + } + filtered = append(filtered, r) + } + tCtx.XdsResources[resourcev3.SecretType] = filtered + } + // Re-emit the canonical secret. + tCtx.SystemTrustStore = false // reset so emitSystemTrustStoreSecret re-emits + if emitErr := emitSystemTrustStoreSecret(tCtx, SystemTrustStoreSecretName); emitErr != nil { + return fmt.Errorf("failed to restore system trust store secret after tampering: %w", emitErr) + } + return nil +} + func findIRListenersByXDSListener(xdsIR *ir.Xds, listener *listenerv3.Listener) []ir.Listener { ret := []ir.Listener{} @@ -1067,7 +1104,8 @@ func processXdsCluster(tCtx *types.ResourceVersionTable, extras *ExtraArgs, metadata *ir.ResourceMetadata, ) error { - return addXdsCluster(tCtx, route.asClusterArgs(name, settings, extras, metadata)) + args := route.asClusterArgs(name, settings, extras, metadata) + return addXdsCluster(tCtx, args) } // findXdsSecret finds a xds secret with the same name, and returns nil if there is no match. @@ -1121,12 +1159,21 @@ func addXdsCluster(tCtx *types.ResourceVersionTable, args *xdsClusterArgs) error for _, ds := range args.settings { shouldValidateTLS := ds.TLS != nil && !ds.TLS.InsecureSkipVerify if shouldValidateTLS { - // Create an SDS secret for the CA certificate - either with inline bytes or with a filesystem ref - secret := buildXdsUpstreamTLSCASecret(ds.TLS) - if secret != nil { - if err := tCtx.AddXdsResource(resourcev3.SecretType, secret); err != nil { + if ds.TLS.UseSystemTrustStore { + // Ensure the system CA secret exists under the name already set in the IR. + // When dedup is on this is SystemTrustStoreSecretName (shared); when off + // it is a per-policy name and each cluster gets its own idempotent copy. + if err := emitSystemTrustStoreSecret(tCtx, ds.TLS.CACertificate.Name); err != nil { return err } + } else { + // Create an SDS secret for the CA certificate — inline bytes or filesystem ref. + secret := buildXdsUpstreamTLSCASecret(ds.TLS) + if secret != nil { + if err := tCtx.AddXdsResource(resourcev3.SecretType, secret); err != nil { + return err + } + } } } } @@ -1183,19 +1230,6 @@ const ( ) func buildXdsUpstreamTLSCASecret(tlsConfig *ir.TLSUpstreamConfig) *tlsv3.Secret { - if tlsConfig.UseSystemTrustStore { - return &tlsv3.Secret{ - Name: tlsConfig.CACertificate.Name, - Type: &tlsv3.Secret_ValidationContext{ - ValidationContext: &tlsv3.CertificateValidationContext{ - TrustedCa: &corev3.DataSource{ - Specifier: &corev3.DataSource_Filename{Filename: cert.SystemCertPath}, - }, - }, - }, - } - } - // For SDS based CA certificate, the secret will be generated by SDS server, so we can skip adding the secret here if tlsConfig.CACertificate.SDS != nil { return nil @@ -1214,15 +1248,18 @@ func buildXdsUpstreamTLSCASecret(tlsConfig *ir.TLSUpstreamConfig) *tlsv3.Secret } func buildValidationContext(tlsConfig *ir.TLSUpstreamConfig) (*tlsv3.CommonTlsContext_CombinedValidationContext, bool) { + // CACertificate.Name already holds the correct secret name set during gatewayapi→IR translation. + secretName := tlsConfig.CACertificate.Name + validationContext := &tlsv3.CommonTlsContext_CombinedCertificateValidationContext{ ValidationContextSdsSecretConfig: &tlsv3.SdsSecretConfig{ - Name: tlsConfig.CACertificate.Name, + Name: secretName, SdsConfig: makeConfigSource(), }, DefaultValidationContext: &tlsv3.CertificateValidationContext{}, } if tlsConfig.CACertificate.SDS != nil { - // get secret from SDS + // CA certificate is served by an external SDS server; use its config. sds := tlsConfig.CACertificate.SDS clusterName := sdsClusterNameFromURL(sds.GetURL()) validationContext.ValidationContextSdsSecretConfig = sdsSecretConfig(sds.SecretName, clusterName) diff --git a/internal/xds/translator/translator_test.go b/internal/xds/translator/translator_test.go index cbf96c3cdd8..3780a665fac 100644 --- a/internal/xds/translator/translator_test.go +++ b/internal/xds/translator/translator_test.go @@ -120,6 +120,19 @@ func TestTranslateXds(t *testing.T) { Enabled: []egv1a1.RuntimeFlag{egv1a1.XDSNameSchemeV2}, }, }, + "http-route-with-tls-system-truststore-per-resource-secret": { + runtimeFlags: &egv1a1.RuntimeFlags{ + Enabled: []egv1a1.RuntimeFlag{egv1a1.PerResourceSystemCASecret}, + }, + }, + "http-route-multiple-system-truststore-per-resource-secret": { + runtimeFlags: &egv1a1.RuntimeFlags{ + Enabled: []egv1a1.RuntimeFlag{egv1a1.PerResourceSystemCASecret}, + }, + }, + "jsonpatch-system-truststore-enforcement": { + requireEnvoyPatchPolicies: true, + }, } inputFiles, err := filepath.Glob(filepath.Join("testdata", "in", "xds-ir", "*.yaml")) diff --git a/internal/xds/types/resourceversiontable.go b/internal/xds/types/resourceversiontable.go index f6914aa03a5..ad0124914be 100644 --- a/internal/xds/types/resourceversiontable.go +++ b/internal/xds/types/resourceversiontable.go @@ -21,10 +21,17 @@ type XdsResources = map[resourcev3.Type][]types.Resource type EnvoyPatchPolicyStatuses []*ir.EnvoyPatchPolicyStatus +// GlobalResourceStatus tracks which shared global resources were emitted during translation. +type GlobalResourceStatus struct { + // SystemTrustStore indicates the system_ca_certificates secret was emitted. + SystemTrustStore bool +} + // ResourceVersionTable holds all the translated xds resources type ResourceVersionTable struct { XdsResources EnvoyPatchPolicyStatuses + GlobalResourceStatus } // GetXdsResources retrieves the translated xds resources saved in the translator context. diff --git a/release-notes/current/breaking_changes/9357-system-trust-store-single-sds-secret.md b/release-notes/current/breaking_changes/9357-system-trust-store-single-sds-secret.md new file mode 100644 index 00000000000..df033aabccd --- /dev/null +++ b/release-notes/current/breaking_changes/9357-system-trust-store-single-sds-secret.md @@ -0,0 +1,2 @@ +All `BackendTLSPolicy` resources using `WellKnownCACertificates: System` and `Backend` resources using `spec.tls.wellKnownCACertificates: System` now share a single SDS secret named `system_ca_certificates` instead of one per-resource secret named `/-ca`. EnvoyPatchPolicies or extension servers referencing the old per-resource secret names or the cluster's `validationContextSdsSecretConfig` field must be updated accordingly. Patching `system_ca_certificates` is not supported; users requiring a custom CA bundle per backend should use `CACertificateRefs` instead of `WellKnownCACertificates: System`. Disruption to traffic during upgrade is possible, due to warming of new secrets. To opt out and restore the old per-resource secret behavior, enable the `PerResourceSystemCASecret` runtime flag. + diff --git a/release-notes/current/performance_improvements/9357-system-trust-store-single-sds-secret.md b/release-notes/current/performance_improvements/9357-system-trust-store-single-sds-secret.md new file mode 100644 index 00000000000..7d251062004 --- /dev/null +++ b/release-notes/current/performance_improvements/9357-system-trust-store-single-sds-secret.md @@ -0,0 +1 @@ +Reduced inotify watch usage for `BackendTLSPolicy` with `WellKnownCACertificates: System` by sharing a single SDS secret across all policies instead of creating one per policy. diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 4138a7b9934..dda14ee2955 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -5778,6 +5778,7 @@ _Appears in:_ | ----- | ----------- | | `XDSNameSchemeV2` | XDSNameSchemeV2 indicates that the xds name scheme v2 is used.
* The listener name will be generated using the protocol and port of the listener.
| | `EndpointSliceIndex` | EndpointSliceIndex indicates that field indexes are used to look up EndpointSlices by backend.
It is enabled by default to reduce CPU usage for EndpointSlice lookups in large clusters.
If the additional controller memory usage for the indexes becomes a concern,
consider disabling this flag.
| +| `PerResourceSystemCASecret` | PerResourceSystemCASecret restores the pre-1.x behavior of emitting one SDS secret per
BackendTLSPolicy or Backend resource that uses WellKnownCACertificates: System, instead
of sharing a single system_ca_certificates secret across all of them.
Disabled by default (i.e. the shared secret is used). Enable this flag to opt out during
upgrades — Envoy must warm the new system_ca_certificates secret before clusters can use
it, which may cause a brief disruption to new connections on first enable.
| #### RuntimeFlags