Skip to content

Commit 8753459

Browse files
sarthypartysarthyparty
authored
Add support for TLS Passthrough using TLSRoutes (#2356)
Problem: As a user of NKG, I want to enable TLS Passthrough for my application's endpoints, so that I can achieve end-to-end encryption for my incoming traffic, and so that I do not have to manage certificates at the Gateway. Solution: Allow users to configure TLS Passthrough for their apps using TLSRoute. Adds basic support for TLSRoute. Cross-namespace routing via ReferenceGrants, traffic splitting, and TLS termination use case will be added in a future release. Note that the stream conf volume are always enabled in the deployment.yaml because our nginx conf reads from it. If the file did not exist then nginx will error.
1 parent 2ed7d4a commit 8753459

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+4678
-406
lines changed

‎.github/workflows/conformance.yml

+2
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ jobs:
7575
run: |
7676
ngf_prefix=ghcr.io/nginxinc/nginx-gateway-fabric
7777
ngf_tag=${{ steps.ngf-meta.outputs.version }}
78+
if [ ${{ inputs.enable-experimental }} == "true" ]; then export ENABLE_EXPERIMENTAL=true; fi
7879
make generate-static-deployment PLUS_ENABLED=${{ inputs.image == 'plus' && 'true' || 'false' }} PREFIX=${ngf_prefix} TAG=${ngf_tag}
7980
working-directory: ./tests
8081

@@ -146,6 +147,7 @@ jobs:
146147

147148
- name: Run conformance tests
148149
run: |
150+
if [ ${{ inputs.enable-experimental }} == "true" ]; then export ENABLE_EXPERIMENTAL=true; fi
149151
make run-conformance-tests CONFORMANCE_TAG=${{ github.sha }} NGF_VERSION=${{ github.ref_name }} CLUSTER_NAME=${{ github.run_id }}
150152
core_result=$(cat conformance-profile.yaml | yq '.profiles[0].core.result')
151153
extended_result=$(cat conformance-profile.yaml | yq '.profiles[0].extended.result')

‎charts/nginx-gateway-fabric/templates/clusterrole.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ rules:
7272
- grpcroutes
7373
{{- if .Values.nginxGateway.gwAPIExperimentalFeatures.enable }}
7474
- backendtlspolicies
75+
- tlsroutes
7576
{{- end }}
7677
verbs:
7778
- list
@@ -85,6 +86,7 @@ rules:
8586
- grpcroutes/status
8687
{{- if .Values.nginxGateway.gwAPIExperimentalFeatures.enable }}
8788
- backendtlspolicies/status
89+
- tlsroutes/status
8890
{{- end }}
8991
verbs:
9092
- update

‎charts/nginx-gateway-fabric/templates/deployment.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,8 @@ spec:
129129
volumeMounts:
130130
- name: nginx-conf
131131
mountPath: /etc/nginx/conf.d
132+
- name: nginx-stream-conf
133+
mountPath: /etc/nginx/stream-conf.d
132134
- name: module-includes
133135
mountPath: /etc/nginx/module-includes
134136
- name: nginx-secrets
@@ -166,6 +168,8 @@ spec:
166168
volumeMounts:
167169
- name: nginx-conf
168170
mountPath: /etc/nginx/conf.d
171+
- name: nginx-stream-conf
172+
mountPath: /etc/nginx/stream-conf.d
169173
- name: module-includes
170174
mountPath: /etc/nginx/module-includes
171175
- name: nginx-secrets
@@ -200,6 +204,8 @@ spec:
200204
volumes:
201205
- name: nginx-conf
202206
emptyDir: {}
207+
- name: nginx-stream-conf
208+
emptyDir: {}
203209
- name: module-includes
204210
emptyDir: {}
205211
- name: nginx-secrets

‎config/tests/static-deployment.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,8 @@ spec:
7272
volumeMounts:
7373
- name: nginx-conf
7474
mountPath: /etc/nginx/conf.d
75+
- name: nginx-stream-conf
76+
mountPath: /etc/nginx/stream-conf.d
7577
- name: module-includes
7678
mountPath: /etc/nginx/module-includes
7779
- name: nginx-secrets
@@ -102,6 +104,8 @@ spec:
102104
volumeMounts:
103105
- name: nginx-conf
104106
mountPath: /etc/nginx/conf.d
107+
- name: nginx-stream-conf
108+
mountPath: /etc/nginx/stream-conf.d
105109
- name: module-includes
106110
mountPath: /etc/nginx/module-includes
107111
- name: nginx-secrets
@@ -121,6 +125,8 @@ spec:
121125
volumes:
122126
- name: nginx-conf
123127
emptyDir: {}
128+
- name: nginx-stream-conf
129+
emptyDir: {}
124130
- name: module-includes
125131
emptyDir: {}
126132
- name: nginx-secrets

‎deploy/aws-nlb/deploy.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,8 @@ spec:
246246
volumeMounts:
247247
- mountPath: /etc/nginx/conf.d
248248
name: nginx-conf
249+
- mountPath: /etc/nginx/stream-conf.d
250+
name: nginx-stream-conf
249251
- mountPath: /etc/nginx/module-includes
250252
name: module-includes
251253
- mountPath: /etc/nginx/secrets
@@ -276,6 +278,8 @@ spec:
276278
volumeMounts:
277279
- mountPath: /etc/nginx/conf.d
278280
name: nginx-conf
281+
- mountPath: /etc/nginx/stream-conf.d
282+
name: nginx-stream-conf
279283
- mountPath: /etc/nginx/module-includes
280284
name: module-includes
281285
- mountPath: /etc/nginx/secrets
@@ -295,6 +299,8 @@ spec:
295299
volumes:
296300
- emptyDir: {}
297301
name: nginx-conf
302+
- emptyDir: {}
303+
name: nginx-stream-conf
298304
- emptyDir: {}
299305
name: module-includes
300306
- emptyDir: {}

‎deploy/azure/deploy.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,8 @@ spec:
243243
volumeMounts:
244244
- mountPath: /etc/nginx/conf.d
245245
name: nginx-conf
246+
- mountPath: /etc/nginx/stream-conf.d
247+
name: nginx-stream-conf
246248
- mountPath: /etc/nginx/module-includes
247249
name: module-includes
248250
- mountPath: /etc/nginx/secrets
@@ -273,6 +275,8 @@ spec:
273275
volumeMounts:
274276
- mountPath: /etc/nginx/conf.d
275277
name: nginx-conf
278+
- mountPath: /etc/nginx/stream-conf.d
279+
name: nginx-stream-conf
276280
- mountPath: /etc/nginx/module-includes
277281
name: module-includes
278282
- mountPath: /etc/nginx/secrets
@@ -294,6 +298,8 @@ spec:
294298
volumes:
295299
- emptyDir: {}
296300
name: nginx-conf
301+
- emptyDir: {}
302+
name: nginx-stream-conf
297303
- emptyDir: {}
298304
name: module-includes
299305
- emptyDir: {}

‎deploy/default/deploy.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,8 @@ spec:
243243
volumeMounts:
244244
- mountPath: /etc/nginx/conf.d
245245
name: nginx-conf
246+
- mountPath: /etc/nginx/stream-conf.d
247+
name: nginx-stream-conf
246248
- mountPath: /etc/nginx/module-includes
247249
name: module-includes
248250
- mountPath: /etc/nginx/secrets
@@ -273,6 +275,8 @@ spec:
273275
volumeMounts:
274276
- mountPath: /etc/nginx/conf.d
275277
name: nginx-conf
278+
- mountPath: /etc/nginx/stream-conf.d
279+
name: nginx-stream-conf
276280
- mountPath: /etc/nginx/module-includes
277281
name: module-includes
278282
- mountPath: /etc/nginx/secrets
@@ -292,6 +296,8 @@ spec:
292296
volumes:
293297
- emptyDir: {}
294298
name: nginx-conf
299+
- emptyDir: {}
300+
name: nginx-stream-conf
295301
- emptyDir: {}
296302
name: module-includes
297303
- emptyDir: {}

‎deploy/experimental-nginx-plus/deploy.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ rules:
8282
- referencegrants
8383
- grpcroutes
8484
- backendtlspolicies
85+
- tlsroutes
8586
verbs:
8687
- list
8788
- watch
@@ -93,6 +94,7 @@ rules:
9394
- gatewayclasses/status
9495
- grpcroutes/status
9596
- backendtlspolicies/status
97+
- tlsroutes/status
9698
verbs:
9799
- update
98100
- apiGroups:
@@ -256,6 +258,8 @@ spec:
256258
volumeMounts:
257259
- mountPath: /etc/nginx/conf.d
258260
name: nginx-conf
261+
- mountPath: /etc/nginx/stream-conf.d
262+
name: nginx-stream-conf
259263
- mountPath: /etc/nginx/module-includes
260264
name: module-includes
261265
- mountPath: /etc/nginx/secrets
@@ -286,6 +290,8 @@ spec:
286290
volumeMounts:
287291
- mountPath: /etc/nginx/conf.d
288292
name: nginx-conf
293+
- mountPath: /etc/nginx/stream-conf.d
294+
name: nginx-stream-conf
289295
- mountPath: /etc/nginx/module-includes
290296
name: module-includes
291297
- mountPath: /etc/nginx/secrets
@@ -305,6 +311,8 @@ spec:
305311
volumes:
306312
- emptyDir: {}
307313
name: nginx-conf
314+
- emptyDir: {}
315+
name: nginx-stream-conf
308316
- emptyDir: {}
309317
name: module-includes
310318
- emptyDir: {}

‎deploy/experimental/deploy.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ rules:
7474
- referencegrants
7575
- grpcroutes
7676
- backendtlspolicies
77+
- tlsroutes
7778
verbs:
7879
- list
7980
- watch
@@ -85,6 +86,7 @@ rules:
8586
- gatewayclasses/status
8687
- grpcroutes/status
8788
- backendtlspolicies/status
89+
- tlsroutes/status
8890
verbs:
8991
- update
9092
- apiGroups:
@@ -247,6 +249,8 @@ spec:
247249
volumeMounts:
248250
- mountPath: /etc/nginx/conf.d
249251
name: nginx-conf
252+
- mountPath: /etc/nginx/stream-conf.d
253+
name: nginx-stream-conf
250254
- mountPath: /etc/nginx/module-includes
251255
name: module-includes
252256
- mountPath: /etc/nginx/secrets
@@ -277,6 +281,8 @@ spec:
277281
volumeMounts:
278282
- mountPath: /etc/nginx/conf.d
279283
name: nginx-conf
284+
- mountPath: /etc/nginx/stream-conf.d
285+
name: nginx-stream-conf
280286
- mountPath: /etc/nginx/module-includes
281287
name: module-includes
282288
- mountPath: /etc/nginx/secrets
@@ -296,6 +302,8 @@ spec:
296302
volumes:
297303
- emptyDir: {}
298304
name: nginx-conf
305+
- emptyDir: {}
306+
name: nginx-stream-conf
299307
- emptyDir: {}
300308
name: module-includes
301309
- emptyDir: {}

‎deploy/nginx-plus/deploy.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,8 @@ spec:
254254
volumeMounts:
255255
- mountPath: /etc/nginx/conf.d
256256
name: nginx-conf
257+
- mountPath: /etc/nginx/stream-conf.d
258+
name: nginx-stream-conf
257259
- mountPath: /etc/nginx/module-includes
258260
name: module-includes
259261
- mountPath: /etc/nginx/secrets
@@ -284,6 +286,8 @@ spec:
284286
volumeMounts:
285287
- mountPath: /etc/nginx/conf.d
286288
name: nginx-conf
289+
- mountPath: /etc/nginx/stream-conf.d
290+
name: nginx-stream-conf
287291
- mountPath: /etc/nginx/module-includes
288292
name: module-includes
289293
- mountPath: /etc/nginx/secrets
@@ -303,6 +307,8 @@ spec:
303307
volumes:
304308
- emptyDir: {}
305309
name: nginx-conf
310+
- emptyDir: {}
311+
name: nginx-stream-conf
306312
- emptyDir: {}
307313
name: module-includes
308314
- emptyDir: {}

‎deploy/nodeport/deploy.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,8 @@ spec:
243243
volumeMounts:
244244
- mountPath: /etc/nginx/conf.d
245245
name: nginx-conf
246+
- mountPath: /etc/nginx/stream-conf.d
247+
name: nginx-stream-conf
246248
- mountPath: /etc/nginx/module-includes
247249
name: module-includes
248250
- mountPath: /etc/nginx/secrets
@@ -273,6 +275,8 @@ spec:
273275
volumeMounts:
274276
- mountPath: /etc/nginx/conf.d
275277
name: nginx-conf
278+
- mountPath: /etc/nginx/stream-conf.d
279+
name: nginx-stream-conf
276280
- mountPath: /etc/nginx/module-includes
277281
name: module-includes
278282
- mountPath: /etc/nginx/secrets
@@ -292,6 +296,8 @@ spec:
292296
volumes:
293297
- emptyDir: {}
294298
name: nginx-conf
299+
- emptyDir: {}
300+
name: nginx-stream-conf
295301
- emptyDir: {}
296302
name: module-includes
297303
- emptyDir: {}

‎deploy/openshift/deploy.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,8 @@ spec:
251251
volumeMounts:
252252
- mountPath: /etc/nginx/conf.d
253253
name: nginx-conf
254+
- mountPath: /etc/nginx/stream-conf.d
255+
name: nginx-stream-conf
254256
- mountPath: /etc/nginx/module-includes
255257
name: module-includes
256258
- mountPath: /etc/nginx/secrets
@@ -281,6 +283,8 @@ spec:
281283
volumeMounts:
282284
- mountPath: /etc/nginx/conf.d
283285
name: nginx-conf
286+
- mountPath: /etc/nginx/stream-conf.d
287+
name: nginx-stream-conf
284288
- mountPath: /etc/nginx/module-includes
285289
name: module-includes
286290
- mountPath: /etc/nginx/secrets
@@ -300,6 +304,8 @@ spec:
300304
volumes:
301305
- emptyDir: {}
302306
name: nginx-conf
307+
- emptyDir: {}
308+
name: nginx-stream-conf
303309
- emptyDir: {}
304310
name: module-includes
305311
- emptyDir: {}

‎internal/framework/gatewayclass/validate.go

+1
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ var gatewayCRDs = map[string]apiVersion{
2323
"referencegrants.gateway.networking.k8s.io": {},
2424
"backendtlspolicies.gateway.networking.k8s.io": {},
2525
"grpcroutes.gateway.networking.k8s.io": {},
26+
"tlsroutes.gateway.networking.k8s.io": {},
2627
}
2728

2829
type apiVersion struct {

‎internal/framework/kinds/kinds.go

+2
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ const (
1919
HTTPRoute = "HTTPRoute"
2020
// GRPCRoute is the GRPCRoute kind.
2121
GRPCRoute = "GRPCRoute"
22+
// TLSRoute is the TLSRoute kind.
23+
TLSRoute = "TLSRoute"
2224
)
2325

2426
// NGINX Gateway Fabric kinds.

‎internal/mode/static/handler.go

+1
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,7 @@ func (h *eventHandlerImpl) updateStatuses(ctx context.Context, logger logr.Logge
246246
gcReqs = status.PrepareGatewayClassRequests(graph.GatewayClass, graph.IgnoredGatewayClasses, transitionTime)
247247
}
248248
routeReqs := status.PrepareRouteRequests(
249+
graph.L4Routes,
249250
graph.Routes,
250251
transitionTime,
251252
h.latestReloadResult,

‎internal/mode/static/manager.go

+9
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ import (
3131
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
3232
k8spredicate "sigs.k8s.io/controller-runtime/pkg/predicate"
3333
gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
34+
gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
3435
gatewayv1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
3536
gatewayv1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
3637

@@ -73,6 +74,7 @@ func init() {
7374
utilruntime.Must(gatewayv1beta1.Install(scheme))
7475
utilruntime.Must(gatewayv1.Install(scheme))
7576
utilruntime.Must(gatewayv1alpha3.Install(scheme))
77+
utilruntime.Must(gatewayv1alpha2.Install(scheme))
7678
utilruntime.Must(apiv1.AddToScheme(scheme))
7779
utilruntime.Must(discoveryV1.AddToScheme(scheme))
7880
utilruntime.Must(ngfAPI.AddToScheme(scheme))
@@ -489,6 +491,12 @@ func registerControllers(
489491
// https://github.com/nginxinc/nginx-gateway-fabric/issues/1545
490492
objectType: &apiv1.ConfigMap{},
491493
},
494+
{
495+
objectType: &gatewayv1alpha2.TLSRoute{},
496+
options: []controller.Option{
497+
controller.WithK8sPredicate(k8spredicate.GenerationChangedPredicate{}),
498+
},
499+
},
492500
}
493501
controllerRegCfgs = append(controllerRegCfgs, gwExpFeatures...)
494502
}
@@ -663,6 +671,7 @@ func prepareFirstEventBatchPreparerArgs(
663671
objectLists,
664672
&gatewayv1alpha3.BackendTLSPolicyList{},
665673
&apiv1.ConfigMapList{},
674+
&gatewayv1alpha2.TLSRouteList{},
666675
)
667676
}
668677

0 commit comments

Comments
 (0)