higress
higress copied to clipboard
feat: add ssl ciphers and protocol version on gateway api
Ⅰ. Describe what this PR did
- 在 feat/istio-1.19.0 分支上 ,使得 gateway api支持配置
ssl cipher suites
以及ssl protocol version
Ⅱ. Does this pull request fix one issue?
Ⅲ. Why don't you add test cases (unit test/integration test)?
Ⅳ. Describe how to verify it
- apply下方gateway api资源
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
name: higress-gateways
spec:
controllerName: "higress.io/gateway-controller"
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: higress-gateway
namespace: higress-system
spec:
gatewayClassName: higress
listeners:
- name: fazheng
port: 4006
protocol: HTTPS
allowedRoutes:
namespaces:
from: All
tls:
options:
gateway.higress.io/tls-terminate-mode: "MUTUAL"
gateway.higress.io/ssl-cipher: "ECDHE-ECDSA-AES128-GCM-SHA256:AES256-SHA" ==》 1
gateway.higress.io/tls_min_protocol_version: "TLSV1_1" ==》 2
gateway.higress.io/tls_max_protocol_version: "TLSV1_2" ==》 2
certificateRefs:
- kind: Secret
name: wildcard-foobar-com
- name: yewu
port: 4005
protocol: HTTPS
allowedRoutes:
namespaces:
from: All
tls:
certificateRefs:
- kind: Secret
name: wildcard-foobar-com
- 查看数据平面envoy配置是否调整