higress icon indicating copy to clipboard operation
higress copied to clipboard

feat: add ssl ciphers and protocol version on gateway api

Open alexzzh opened this issue 10 months ago • 0 comments

Ⅰ. Describe what this PR did

  • 在 feat/istio-1.19.0 分支上 ,使得 gateway api支持配置ssl cipher suites 以及 ssl protocol version

Ⅱ. Does this pull request fix one issue?

Ⅲ. Why don't you add test cases (unit test/integration test)?

Ⅳ. Describe how to verify it

  • apply下方gateway api资源
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
 name: higress-gateways
spec:
 controllerName: "higress.io/gateway-controller"
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
 name: higress-gateway
 namespace: higress-system
spec:
 gatewayClassName: higress
 listeners:
 - name: fazheng
   port: 4006
   protocol: HTTPS
   allowedRoutes:
     namespaces:
       from: All
   tls:
     options:
       gateway.higress.io/tls-terminate-mode: "MUTUAL"
       gateway.higress.io/ssl-cipher: "ECDHE-ECDSA-AES128-GCM-SHA256:AES256-SHA"  ==》 1
       gateway.higress.io/tls_min_protocol_version: "TLSV1_1"  ==》 2
       gateway.higress.io/tls_max_protocol_version: "TLSV1_2"  ==》 2
     certificateRefs:
     - kind: Secret
       name: wildcard-foobar-com
 - name: yewu
   port: 4005
   protocol: HTTPS
   allowedRoutes:
     namespaces:
       from: All
   tls:
     certificateRefs:
     - kind: Secret
       name: wildcard-foobar-com
  • 查看数据平面envoy配置是否调整

5351713422355_ pic

Ⅴ. Special notes for reviews

alexzzh avatar Apr 18 '24 06:04 alexzzh