higress-group/higress

使用gateway api ， 支持mtls

Open

#900 opened on Apr 1, 2024

View on GitHub
 (5 comments) (0 reactions) (0 assignees)Go (1,249 forks)github user discovery
good-issuehelp wantedlevel/challengepriority/highsig/controller

Repository metrics

Stars
 (9,177 stars)
PR merge metrics
 (Avg merge 7d 9h) (18 merged PRs in 30d)

Description

Why do you need it?

项目中需要使用gateway api，同时网关需要完成和客户端之间的tls卸载以及验证客户端证书(mtls)

How could it be?

what we want

使用 gateway api时，可以为不同的监听端口指定验证客户端的证书，形如：

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: higress-gateway
  namespace: higress-system
spec:
  gatewayClassName: higress-gateway
  listeners:
  - name: 业务1
    port: 4006
    protocol: HTTPS
    allowedRoutes:
      namespaces:
        from: All
    tls:
      certificateRefs:
      - kind: Secret
        name: 站点证书1
  ca:   ===》 需求
     ca证书链1
  - name: 业务2
    port: 4005
    protocol: HTTPS
    allowedRoutes:
      namespaces:
        from: All
    tls:
      certificateRefs:
      - kind: Secret
        name: 站点证书2
  ca: ===》 需求
     ca证书链2
     
 对应 envoy 配置
 resources:
  - "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
    validation_context:
      trusted_ca:
        ca证书链2

Contributor guide

Research direction
Analyze the Higress Gateway controller code to understand how TLS configuration is currently handled and propose a method to add CA certificate validation per listener using the Gateway API TLS configuration.
Tech stack
go
Domain
backendapisecurity
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
KubernetesGoEnvoy
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30