Skip to content

Commit 9098973

Browse files
authored
clarify terminology for gateway TLS (#4036)
1 parent 8ec8a83 commit 9098973

File tree

1 file changed

+57
-99
lines changed

1 file changed

+57
-99
lines changed

geps/gep-2907/index.md

Lines changed: 57 additions & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,14 @@ This GEP aims to define high level TLS terminology and structure within Gateway
88
API to ensure that all our independent proposals related to TLS result in a
99
coherent set of APIs. This will result in some adjustments to provisional and
1010
experimental TLS-related GEPs, specifically [BackendTLSPolicy](../gep-1897/index.md)
11-
and [Client Certificate Verification](../gep-91/index.md).
1211

1312
## Goals
14-
* Define high-level terminology for how we refer to TLS in Gateway API.
15-
* Define top level fields where TLS configuration can live.
13+
1. Define high-level terminology for how we refer to TLS in Gateway API.
14+
2. Define top level fields where TLS configuration can live for all below cases:
15+
* Client to Gateway (Frontend) TLS configuration.
16+
* Gateway to Client TLS configuration (Client Certificate Validation)
17+
* Gateway to backend (Gateway Client Certificate)
18+
3. Document how to use `BackendTLSPolicy` to support Gateway to Backend TLS configuration.
1619

1720
## Non-Goals
1821
* Add or change fields directly. (This may inspire changes in other GEPs
@@ -30,29 +33,15 @@ in scope for this GEP. In the future, this GEP may be expanded to include:
3033

3134
## Introduction
3235

33-
### Where TLS could be configured
34-
We have three different places where we might want to configure TLS:
35-
36-
#### A. Gateways
37-
Config attached at this layer will apply to everything behind a single address
38-
such as a virtual IP.
36+
### TLS mode
3937

40-
#### B. Gateway Listeners
41-
Each Gateway contains multiple “Listeners”. Each HTTPS Listener in a Gateway
42-
must have a unique combination of protocol, port, and SNI (Server Name
43-
Indication). TLS configuration attached at this layer should be [isolated via
44-
SNI](../../guides/implementers.md#listener-isolation).
38+
TLS can be configured with two distinct modes:
39+
* **Passthrough**: The Gateway forwards encrypted traffic directly to the backend from the entity originating the connection (called later a client). The TLS connection is established between the client and the backend; the Gateway does not participate in the TLS handshake.
4540

46-
#### C. BackendTLSPolicy
47-
This policy allows us to attach unique TLS configuration per Backend. Depending
48-
on the organization, this policy may be owned by the application owner or the
49-
cluster operator. Note that this configuration will be used by all Gateways
50-
(potentially from different implementations) that are connecting to the backend.
41+
* **Terminate**: The Gateway acts as a man-in-the-middle, terminating the client's TLS connection and originating a separate connection to the backend when routing the traffic. Both connections can independently support TLS and mutual TLS due to their distinct TLS configurations. The Gateway's dual role as a client or server affects the placement of TLS settings needed for given connection.
5142

5243
### "Frontend" and "Backend"
53-
A guiding principle in this naming is to use consistent naming for “Downstream”
54-
(1+2) and “Upstream” (3+4), similar to Envoy. To avoid the confusion with what
55-
is upstream and downstream, Gateway API will use “Frontend” (1+2) and “Backend”
44+
A guiding principle in this naming is to use consistent naming for both TLS connections “Downstream” (1+2) and “Upstream” (3+4) handled by the Gateway (similar to Envoy). To avoid the confusion with what is upstream and downstream, Gateway API will use “Frontend” (1+2) and “Backend”
5645
(3+4).
5746

5847
* **Frontend:** The entity connecting to a Gateway, typically a client
@@ -73,43 +62,34 @@ flowchart LR
7362

7463
The above diagram depicts these four segments as edges in a graph.
7564

76-
### TLS mode
65+
#### Frontend configuration
7766

78-
TLS can be configured with two distinct modes:
67+
In the Frontend TLS connection Gateway acts as a server and presents Server certificate during TLS handshake. Client connects to the Gateway on domain basis and this is desired to configure Server certificates on the Listener.
68+
In the mutual frontend TLS Gateway needs to verify client certificates with configured CA. It was expected that CA configuration would be also defined on Listener but due to connection coalescing this solution was not secure. We decided to move client certificate validation configuration on the Gateway level and allow for per port overrides.
69+
70+
#### Backend configuration
71+
72+
In the Backend connection Gateway acts as a client. The nature of the connection (HTTP or HTTPS) is configured on the Service using BackendTLSPolicy. If BackendTLSPolicy is defined for a Service, the Gateway must establish an HTTPS connection with the backend. During the TLS handshake, the backend presents a Server certificate. The Gateway validates this certificate against a CA certificate (and optionally SANs) configured by BackendTLSPolicy.
73+
For mutual backend TLS, the Gateway's identity must be configured. This identity, a client certificate set on the Gateway object, will be presented by the Gateway. The Gateway uses the same client certificate for all backend connections originating mutual TLS.
7974

80-
* **Terminate**: the TLS connection is instantiated between the frontend and the
81-
Gateway. The connection between the Gateway and the backend is left unencrypted
82-
unless a new TLS connection between the two entities is configured via BackendTLSPolicy.
83-
* **Passthrough**: the TLS connection is instantiated between the frontend and the
84-
backend. The traffic flows through the Gateway encrypted, and the Gateway is not
85-
able to decrypt or inspect the encrypted portions of the TLS stream.
8675

8776
## Proposed Segments
88-
Note that this does not represent any form of commitment that any of these
89-
fields or concepts will exist within Gateway API. If or when they do, we propose
90-
the following naming structure:
9177

92-
### 1. Validate Client Certificate provided by Frontend
78+
79+
### 1. Gateway level configuration
80+
81+
Gateway-level configurations are required for both Frontend and Backend connections. We propose a top-level GatewayTLSConfig that is divided into independent Backend and Frontend configurations.
9382

9483
| Proposed Placement | Name | Status |
9584
|-|-|-|
96-
| Gateway Listener | `Listener.TLS.FrontendValidation` | Proposed |
85+
| Gateway | `Gateway.TLS.Frontend` | Proposed |
86+
| Gateway | `Gateway.TLS.Backend` | Proposed |
9787

9888
#### Rationale
99-
Use FrontendValidation to leave room for concepts like trust anchors and trust
100-
domains. Anything not strictly tied to validation would belong to Listener.TLS
101-
which is now reserved exclusively for “Frontend” TLS configuration (1+2).
102-
103-
#### Why Not Frontend.Validation?
104-
Part of the idea behind this GEP is that Listener.TLS is really entirely focused
105-
on 1+2 - the bits of TLS between frontend and Gateway. That means that if we
106-
were to add any additional TLS configuration in the Listener.TLS struct, it
107-
would tied to that limited scope, and thus we don't really need a separate
108-
Frontend struct.
89+
From the security point of view both TLS configurations require a Gateway level field. The configurations are independent and can coexist.
10990

110-
One could make an argument that Listener.TLS.Validation should be the field name
111-
here to avoid any ambiguity, but in this specific context, we think that it's
112-
probably helpful to specifically spell out frontend.
91+
#### Why Not Listener.Frontend?
92+
Due to connection coalescing, the client certificate validation for the frontend was moved to a Gateway level field to address security concerns. [GEP-91 Update PR](https://github.com/kubernetes-sigs/gateway-api/pull/3942)
11393

11494
#### Why Not FrontendTLSPolicy?
11595
It could be reasonable to try to mirror BackendTLSPolicy for Frontend TLS. As we
@@ -129,7 +109,7 @@ We don't think either of those reasons really apply to frontend TLS. Instead,
129109
frontend TLS could theoretically be configured either for an entire Gateway, or
130110
a specific Gateway listener. Given that many implementations already support
131111
distinguishing this config per SNI, it seems to make sense to start with
132-
listener level attachment. We think that the persona that would be responsible
112+
Listener level attachment. We think that the persona that would be responsible
133113
for a Gateway is not sufficiently different than the persona that would be
134114
responsible for frontend TLS, so the current proposal is likely the best option
135115
available to us.
@@ -145,17 +125,30 @@ This is already finalized in the API and so we're stuck with this name. In
145125
hindsight a name that was more clearly tied to frontend TLS would have been
146126
ideal here.
147127

148-
### 3. Configure Client Certificate that Gateway should use to connect to Backend
128+
### 3. Configure Client Certificate Validation for Frontend
129+
130+
Client certificate validation will reside at the Gateway level. This configuration will be
131+
either applied globally to all Listeners in the Gateway or can be overridden on a per-port basis.
149132

150133
| Proposed Placement | Name | Status |
151134
|-|-|-|
152-
| Gateway | `Gateway.Spec.BackendTLS.ClientCertificateRef` | Not Proposed |
153-
| BackendTLSPolicy | `BackendTLSPolicy.Spec.ClientCertificateRef` | Not Proposed |
135+
| Gateway | `Gateway.TLS.Frontend.Default.Validation` | Proposed |
136+
| Gateway | `Gateway.TLS.Frontend.PerPort` | Proposed |
154137

155138
#### Rationale
156-
It's not yet obvious which of the above options are preferable, but a case could
157-
be made for either or both. If we add a `BackendTLS` struct to Gateway it would
158-
leave room for concepts like TLS version, ALPN, cipher suites, etc.
139+
Gateway level configuration for client certificate validation was chosen due to security issue.
140+
141+
#### Why per port override
142+
HTTPS connection can be reused between multiple Listeners sharing the same port. This might lead to bypassing client certificate validation configuration for a given Listener becasue new TLS handshake will not be triggered for different hostname.
143+
144+
### 4. Configure Client Certificate that Gateway should use to connect to Backend
145+
146+
| Proposed Placement | Name | Status |
147+
|-|-|-|
148+
| Gateway | `Gateway.Spec.TLS.Backend.ClientCertificateRef` | Proposed |
149+
150+
#### Rationale
151+
Client certificate is part of Gateway identity and should not be overriden per backend.
159152

160153
#### Why Not Listener level to match FrontendValidation?
161154
In general, we'd expect this identity to represent a Gateway as a whole, and
@@ -167,7 +160,7 @@ use when connecting to a backend, it should likely either be tied directly to
167160
the Gateway or Backend, but the Listener is not particularly relevant in this
168161
context.
169162

170-
### 4. Validate Server Certificate that is provided by Backend
163+
### 5. Validate Server Certificate that is provided by Backend
171164
| Proposed Placement | Name | Status |
172165
|-|-|-|
173166
| Gateway | `Gateway.Spec.BackendTLS.Validation` | Not Proposed |
@@ -179,42 +172,7 @@ already clearly backend-focused, config like TLS Version, ALPN, and cipher
179172
suites, could live at the same level without confusion. It's also plausible that
180173
some Gateways may want to express Gateway-wide CAs that are trusted.
181174

182-
#### Why BackendTLS on Gateways?
183-
Although this GEP is intentionally not committing to adding new fields or
184-
features, it's possible that at some point in the future we may want to have
185-
some kind of Backend TLS config at the Gateway level. For example, it may be
186-
useful to configure a set of CAs that a Gateway trusts or a client cert that a
187-
Gateway should use to connect to all backends. If this existed, there would
188-
likely be some overlap in config with BackendTLSPolicy, and if a future GEP
189-
proposed this, it would need to include how overlapping config should be
190-
handled.
191-
192-
#### Why the inconsistency between Frontend and Backend TLS config on Gateways?
193-
If we were to populate all the possible fields described in this GEP, we'd end
194-
up with the following config on Gateways:
195-
196-
```
197-
Gateway.Spec.Listeners.TLS.FrontendValidation
198-
Gateway.Spec.Listeners.TLS
199-
Gateway.Spec.BackendTLS.ClientCertificateRef
200-
Gateway.Spec.BackendTLS.Validation
201-
```
202-
203-
This is all tied to the need to provide backwards compatibility with the TLS
204-
config that is already GA on Listeners (`Listener.TLS`). If we were naming that
205-
field today with the broader vision of TLS configuration throughout Gateway API
206-
we would almost certainly choose a more descriptive name that was more clearly
207-
tied to Frontend TLS. Unfortunately we're too late to change that name, but we
208-
can try to make the rest of the terminology clearly tied to frontend or backend
209-
TLS.
210-
211-
One [suggestion by @candita](https://github.com/kubernetes-sigs/gateway-api/pull/2910#discussion_r1552534017)
212-
would be to introduce a Listener like resource for BackendTLS, resulting in a
213-
more consistent naming scheme within Gateway TLS configuration. Although it's
214-
not yet clear if we need this additional layer, we should reconsider it as we're
215-
further developing Backend TLS.
216-
217-
### 5. Configure TLS mode
175+
### 6. Configure TLS mode
218176

219177
| Proposed Placement | Name | Status |
220178
|-|-|-|
@@ -236,8 +194,8 @@ does not need to be provided, as the TLS termination is handled by the backend.
236194

237195
## Routes and TLS
238196

239-
Multiple routes can be attached to listeners specifying TLS configuration. This section
240-
intends to clearly state how and when Routes can attach to listeners with TLS configuration.
197+
Multiple routes can be attached to Listeners specifying TLS configuration. This section
198+
intends to clearly state how and when Routes can attach to Listeners with TLS configuration.
241199

242200
### Context
243201

@@ -265,12 +223,12 @@ with the compatible protocol.
265223
|-----------|---------|---------------|----------------|
266224
| HTTP | `HTTPRoute`/`GRPCRoute` | no | no |
267225
| HTTPS | `HTTPRoute`/`GRPCRoute` | yes | no |
268-
| TLS | `TLSRoute` | yes | yes |
226+
| TLS | `TLSRoute` | yes | yes |
269227
| TCP | `TCPRoute` | yes | no |
270228
| UDP | `UDPRoute` | no | no |
271229

272230
> [!NOTE]
273-
> When the traffic is routed to the backend via a listener configured with TLS `Passthrough`
274-
> and a compatible route, the packets are left untouched by the gateway. In order to
275-
> terminate the TLS connection to the gateway and forward the traffic unencrypted to the backend,
276-
> a listener configured with TLS `Terminate` and a compatible route must be used.
231+
> When the traffic is routed to the backend via a Listener configured with TLS `Passthrough`
232+
> and a compatible route, the packets are left untouched by the Gateway. In order to
233+
> terminate the TLS connection to the Gateway and forward the traffic unencrypted to the backend,
234+
> a Listener configured with TLS `Terminate` and a compatible route must be used.

0 commit comments

Comments
 (0)