feat: gateway tls extensions #12917

puertomontt · 2025-11-18T23:21:14Z

Description

Allow users to configure TLS parameters for TLS listeners on Gateway using the options field.

API changes:

This PR adds the following tls options:

kgateway.dev/cipher-suites: comma separated list of cipher suites
kgateway.dev/ecdh-curves: comma separated list of ecdh curves
kgateway.dev/min-tls-version: minimum TLS version string, e.g. "1.2"
kgateway.dev/max-tls-version: maximum TLS version string, e.g. "1.3"
kgateway.dev/verify-subject-alt-names: comma separated list of SANs [placeholder, to be implemented]

Change Type

/kind feature

Changelog

Allow configuring cipher suites, ecdh curves, minimum TLS version, maximum TLS version using tls options map.

Additional Notes

largely referenced from solo-io#10553
resolves #12933
resolves #11232

Copilot

Pull Request Overview

This PR adds support for additional TLS extension options in Gateway listeners, allowing users to configure advanced TLS parameters such as cipher suites, ECDH curves, and TLS version constraints through Gateway API annotations.

Key changes:

Added new TLS-related annotations (cipher suites, ECDH curves, min/max TLS versions, verify subject alt names)
Refactored TLS option processing into a unified ApplyTLSExtensionOptions function
Extended the IR TlsBundle struct with new TLS configuration fields

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
api/annotations/gateway.go	Added new annotation constants for TLS extensions (cipher suites, ECDH curves, TLS versions, subject alt names)
pkg/pluginsdk/ir/gw2.go	Extended `TlsBundle` struct with new fields for TLS parameters
internal/kgateway/translator/sslutils/ssl_utils.go	Implemented TLS extension option processing functions and validation logic
internal/kgateway/translator/sslutils/ssl_utils_test.go	Added comprehensive unit tests for TLS extension option handling
internal/kgateway/translator/listener/gateway_listener_translator.go	Refactored to use new unified TLS option processing function
internal/kgateway/translator/irtranslator/fc.go	Applied TLS parameters to Envoy configuration
internal/kgateway/krtcollections/policy.go	Fixed type conversion for annotation key access
internal/kgateway/translator/gateway/gateway_translator_test.go	Updated test name to reflect broader TLS options support
internal/kgateway/translator/gateway/testutils/outputs/gateway-only/tls.yaml	Updated expected output to include TLS parameters

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

api/annotations/gateway.go

internal/kgateway/translator/sslutils/ssl_utils_test.go

api/annotations/gateway.go

internal/kgateway/translator/sslutils/ssl_utils.go

Copilot · 2025-11-18T23:31:51Z

internal/kgateway/translator/sslutils/ssl_utils.go

+func ApplyCipherSuites(in string, out *ir.TlsBundle) error {
+	cipherSuites := strings.Split(in, ",")
+	out.CipherSuites = cipherSuites
+	return nil
+}


The cipher suites are accepted without any validation. Consider adding validation to ensure only secure and supported cipher suites are configured. Accepting arbitrary cipher suite values could allow users to configure weak or insecure ciphers, or non-existent cipher suites that would cause Envoy configuration errors.

Signed-off-by: omar <[email protected]>

sheidkamp

A few comments, and the copilot comments are worth looking at.

Would like to see e2e tests, but can be done in a followup.

sheidkamp · 2025-11-20T16:57:51Z

api/annotations/gateway.go

+	// VerifySubjectAltNames is the annotation key used to set the verify subject alt names for a TLS listener.
+	// The value is a comma separated list of subject alt names, e.g "example.com,www.example.com".
+	// Use in the TLS options field of a TLS listener.
+	VerifySubjectAltNames gwv1.AnnotationKey = "kgateway.dev/verify-subject-alt-names"


These are the annotations we are using for GW API with GG1:

GatewaySslCipherSuites = GatewaySslOptionsPrefix + "/cipher-suites" GatewaySslEcdhCurves = GatewaySslOptionsPrefix + "/ecdh-curves" GatewaySslMinimumTlsVersion = GatewaySslOptionsPrefix + "/minimum-tls-version" GatewaySslMaximumTlsVersion = GatewaySslOptionsPrefix + "/maximum-tls-version" GatewaySslOneWayTls = GatewaySslOptionsPrefix + "/one-way-tls" GatewaySslVerifySubjectAltName = GatewaySslOptionsPrefix + "/verify-subject-alt-name"

The differences are (GG1/new GG2):

minimum-tls-version/min-tls-version

maximum-tls-version/max-tls-version

verify-subject-alt-name/verify-subject-alt-names

The prefix will be changing from "gateway.gloo.solo.io/ssl" to "kgateway.dev", but do we want to keep the leaf names consistent? (although verify-subject-alt-names is a better annotation than verify-subject-alt-name

sheidkamp · 2025-11-20T16:59:39Z

internal/kgateway/translator/irtranslator/fc.go

+	if len(ssl.EcdhCurves) > 0 {
+		common.TlsParams.EcdhCurves = ssl.EcdhCurves
+	}
+	// TODO: add verify subject alt names (validation context)


Are we going to do this as part of this PR?

No, because that involves a larger change.

Should we either remove VerifySubjectAltNames from gateway.go or at least mark it as not implemented?

marked as TODO

created #12955 to track

internal/kgateway/translator/sslutils/ssl_utils.go

internal/kgateway/translator/gateway/testutils/inputs/gateway-only/tls-alpn.yaml

internal/kgateway/translator/sslutils/ssl_utils_test.go

jenshu · 2025-11-20T19:21:27Z

api/annotations/gateway.go

+	// It is used to set the per connection buffer limit for the gateway.
+	// The value is a string representing the limit, e.g "64Ki".
+	// The limit is applied to all listeners in the gateway.
+	PerConnectionBufferLimit gwv1.AnnotationKey = "kgateway.dev/per-connection-buffer-limit"


maybe it's already been discussed, but why are these all annotations rather than adding them to the trafficpolicy (or other) api?

PerConnectionBufferLimit is existing. Basically we didn't want to add a CRD for this option and it didn't fit anywhere. Likewise for the TLS extensions, but in this case using the gateway API tls options field instead of the actual annotations.

Signed-off-by: omar <[email protected]>

sheidkamp

One question and a small update

internal/kgateway/translator/listener/gateway_listener_translator.go

sheidkamp · 2025-11-24T16:09:47Z

api/annotations/gateway.go

 	// VerifySubjectAltNames is the annotation key used to set the verify subject alt names for a TLS listener.
 	// The value is a comma separated list of subject alt names, e.g "example.com,www.example.com".
 	// Use in the TLS options field of a TLS listener.
+	// TODO: implement.


Can we add #12955 to the comment (and other similar TODOs)?

Signed-off-by: omar <[email protected]>

Copilot AI review requested due to automatic review settings November 18, 2025 23:21

gateway-bot added do-not-merge/description-invalid do-not-merge/kind-invalid Indicates a PR lacks a `kind/foo` label and requires one. do-not-merge/release-note-invalid Indicates that a PR should not merge because it's missing one of the release note labels. labels Nov 18, 2025

Copilot started reviewing on behalf of puertomontt November 18, 2025 23:21 View session

Copilot finished reviewing on behalf of puertomontt November 18, 2025 23:25

puertomontt linked an issue Nov 18, 2025 that may be closed by this pull request

Cipher Suite Config #11232

Closed

Copilot AI reviewed Nov 18, 2025

View reviewed changes

puertomontt force-pushed the tls-opts branch from d8b8a7a to 91836c4 Compare November 18, 2025 23:54

feat: gateway tls extensions

8ba274f

Signed-off-by: omar <[email protected]>

puertomontt force-pushed the tls-opts branch from 91836c4 to 8ba274f Compare November 18, 2025 23:55

puertomontt enabled auto-merge November 19, 2025 20:34

sheidkamp reviewed Nov 20, 2025

View reviewed changes

jenshu reviewed Nov 20, 2025

View reviewed changes

puertomontt added 4 commits November 21, 2025 14:14

trim whitespace

a8b6be4

Signed-off-by: omar <[email protected]>

Merge branch 'main' of github.com:kgateway-dev/kgateway into tls-opts

bfab045

Signed-off-by: omar <[email protected]>

use map

6644f41

Signed-off-by: omar <[email protected]>

add TODO for sans

17757c4

Signed-off-by: omar <[email protected]>

sheidkamp mentioned this pull request Nov 21, 2025

Implement TLS feature - verifySubjectAltNames #12955

Closed

fix test

9217535

Signed-off-by: omar <[email protected]>

sheidkamp reviewed Nov 24, 2025

View reviewed changes

puertomontt added 3 commits November 24, 2025 10:15

Merge branch 'main' of github.com:kgateway-dev/kgateway into tls-opts

817f192

Signed-off-by: omar <[email protected]>

fix merge

dca3bbe

Signed-off-by: omar <[email protected]>

todo

e1e298e

Signed-off-by: omar <[email protected]>

sheidkamp approved these changes Nov 24, 2025

View reviewed changes

puertomontt added this pull request to the merge queue Nov 24, 2025

Merged via the queue into kgateway-dev:main with commit f85f7ed Nov 24, 2025
30 checks passed

puertomontt deleted the tls-opts branch November 24, 2025 17:48

sheidkamp mentioned this pull request Nov 24, 2025

[Epic] kgateway TLS feature gaps #12932

Closed

puertomontt mentioned this pull request Nov 24, 2025

Cipher Suite Config #11232

Closed

feat: gateway tls extensions #12917

feat: gateway tls extensions #12917

Uh oh!

Conversation

puertomontt commented Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

API changes:

Change Type

Changelog

Additional Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

sheidkamp left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sheidkamp left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

puertomontt commented Nov 18, 2025 •

edited

Loading