Kong/kubernetes-ingress-controller

Support multiple Gateway Listener certificateRefs

Open

#2,604 opened on Jun 23, 2022

View on GitHubContributor guide
 (2 comments) (1 reaction) (0 assignees)Go (619 forks)auto 404
area/featurearea/gateway-apigood first issuenice-to-havesize/S

Repository metrics

Stars
 (2,404 stars)
PR merge metrics
 (PR metrics pending)

Description

Per https://gateway-api.sigs.k8s.io/v1alpha2/references/spec/#gateway.networking.k8s.io/v1alpha2.GatewayTLSConfig

A single CertificateRef to a Kubernetes Secret has “Core” support. Implementations MAY choose to support attaching multiple certificates to a Listener, but this behavior is implementation-specific.

#2580 only implements the core requirement, and rejects configurations with multiple certificates.

Kong certificate entities can hold two certificates, and will select the served certificate based on client algorithm support (ECDSA or RSA): https://docs.konghq.com/gateway/latest/admin-api/#add-certificate

Acceptance criteria

To support this for Gateway APIs, we would need to:

  • Increase the certificateRef limit to 2.
  • If two certificates are present, verify that they use different signature algorithms (Kong will reject them if they do not).
  • Verify that all certificates use the same CN and SAN sets. Kong does not require this (it probably should) but the Gateway spec requires that implementations serve the cert with the longest SNI-SAN match (e.g. you would serve the cert with foo.example.com instead of *.example.com for foo.example.com) across all certificates. Since we must instead choose the certificate based on algorithm first, we can't meet that part of the spec and need to instead ensure it's irrelevant.
  • For Listeners with 2 certificateRefs, create a Kong certificate with one certificate and key in cert and key and the other in cert_alt and key_alt.

Contributor guide

Research direction
Study the current certificate handling in the Kong ingress controller, specifically the code that processes certificateRefs in Gateway resources. Identify where the limit of 1 is enforced and how to extend it to 2. Understand Kong's certificate entity structure with cert and cert alt fields. Review the Gateway API spec for multiple certificate requirements (different algorithms, same CN/SAN). Implement validation for these requirements and create the Kong certificate with proper cert/cert alt assignment.
Tech stack
go
Domain
backendinfrastructure
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
GoKubernetesGateway API
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60