feat(gateway-api): support TLSRoute #2594
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR implements TLSRoute support for the Gateway API in APISIX Ingress Controller. The implementation adds full TLSRoute resource handling including controller reconciliation, translation to APISIX configuration, and test infrastructure, but does not support TLS passthrough mode due to APISIX limitations.
Key changes:
- Added TLSRouteReconciler controller with complete lifecycle management
- Implemented TLSRoute to APISIX stream route translation logic
- Extended test infrastructure with TLS proxy support and conformance testing
Reviewed Changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| test/e2e/scaffold/scaffold.go | Added TLS tunnel support for E2E testing |
| test/e2e/gatewayapi/tlsroute.go | Added comprehensive TLSRoute E2E test cases |
| test/e2e/framework/manifests/ingress.yaml | Updated RBAC permissions for TLSRoute resources |
| test/e2e/framework/manifests/apisix.yaml | Added TLS port configuration to APISIX deployment |
| test/e2e/framework/manifests/apisix-standalone.yaml | Added TLS port configuration to standalone APISIX |
| test/conformance/conformance_test.go | Added TLS conformance testing with passthrough limitation |
| internal/types/k8s.go | Added TLSRoute type definitions and mappings |
| internal/provider/apisix/provider.go | Integrated TLSRoute translation into provider |
| internal/manager/controllers.go | Registered TLSRouteReconciler controller |
| internal/controller/utils.go | Added TLSRoute hostname and protocol matching logic |
| internal/controller/tlsroute_controller..go | Implemented complete TLSRoute controller |
| internal/controller/indexer/tlsroute.go | Added TLSRoute indexing for efficient queries |
| internal/controller/indexer/indexer.go | Registered TLSRoute indexer setup |
| internal/adc/translator/tlsroute.go | Implemented TLSRoute to APISIX stream route translation |
| docs/en/latest/concepts/gateway-api.md | Updated documentation to reflect TLSRoute support |
| config/rbac/role.yaml | Added TLSRoute RBAC permissions |
| api/v2/shared_types.go | Added TLS scheme constant |
| Makefile | Added TLS conformance profile to testing |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
ronething
reviewed
Oct 11, 2025
ronething
reviewed
Oct 11, 2025
nic-6443
approved these changes
Oct 11, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Type of change:
What this PR does / why we need it:
Implement TLSRoute.
According to the Gateway API specification,
tls.mode: Passthroughmeans the gateway does not participate in the TLS handshake or decryption, simply forwarding encrypted traffic to the backend.However, in APISIX, SNI-based routing depends on
sslobjects (which require certificate loading).Once an SSL object is involved, APISIX must terminate or participate in the TLS handshake.
Therefore, in the current implementation, APISIX rejects configurations with
tls.mode: Passthrough.Pre-submission checklist: