Skip to content

Add new BackendTLSPolicy configuration options to documentation #3563

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

08volt
Copy link
Contributor

@08volt 08volt commented Jan 22, 2025

/kind documentation

What this PR does / why we need it:
Updated documentation page regarding BackendTLSPolicy with the following fields:

  • Gateway backendTLS field
  • subjectAltNames field
  • options field

The documentation includes descriptions of each new field along with their purpose, usage constraints and reference links.

Fixes #
Does this PR introduce a user-facing change?:

NONE

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. kind/documentation Categorizes issue or PR as related to documentation. labels Jan 22, 2025
@08volt 08volt changed the title Add new BackendTLSPolicy configuration options to documentation: Add new BackendTLSPolicy configuration options to documentation Jan 22, 2025
@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jan 22, 2025
@k8s-ci-robot
Copy link
Contributor

Welcome @08volt!

It looks like this is your first PR to kubernetes-sigs/gateway-api 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/gateway-api has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 22, 2025
@k8s-ci-robot
Copy link
Contributor

Hi @08volt. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Copy link
Member

@robscott robscott left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @08volt! This mostly LGTM. Added some suggestions for version indicators, not quite sure the formatting will be quite right, but should be close.

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: 08volt, robscott

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 22, 2025
@robscott
Copy link
Member

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 22, 2025
Copy link
Contributor

@kflynn kflynn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good from here too, with @robscott's changes. 🙂 Thanks!

@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 12, 2025
@08volt 08volt force-pushed the doc-combine branch 2 times, most recently from be9a8dc to f1b863d Compare March 17, 2025 15:52
@k8s-ci-robot k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 17, 2025
@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

  • Mark this PR as fresh with /remove-lifecycle stale
  • Close this PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

@k8s-ci-robot k8s-ci-robot added lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Jun 15, 2025
@shaneutt
Copy link
Member

shaneutt commented Jul 3, 2025

cc @candita

Could you take a look here please and let us know your thoughts?

@shaneutt shaneutt self-assigned this Jul 3, 2025
@shaneutt shaneutt added this to the v1.4.0 milestone Jul 3, 2025
@shaneutt shaneutt moved this to Review in Release v1.4.0 Jul 3, 2025
@shaneutt shaneutt added the v1.4-release/subtask This indicates a subtask of a feature, bug, or smaller issue for the v1.4 release. label Jul 3, 2025
@k8s-ci-robot k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 10, 2025
@candita
Copy link
Contributor

candita commented Jul 21, 2025

@08volt @shaneutt I have a few suggestions here.

@robscott
Copy link
Member

/remove-lifecycle stale

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 30, 2025
@robscott
Copy link
Member

@08volt I know it's been a while since you created this PR, not sure if you still have time to spend on this. If not, one of us could open a new PR based on your initial commit to help get this across the line, just let us know what you prefer.

- Gateway backendTLS field
- subjectAltNames field
- options field

The documentation includes descriptions of each new field along with
their purpose, usage constraints and reference links.
@08volt
Copy link
Contributor Author

08volt commented Aug 4, 2025

Enrico Shane Utt I have a few suggestions here.

Thanks for the very insightful suggestions, I corrected the documentation.

@08volt
Copy link
Contributor Author

08volt commented Aug 4, 2025

Enrico I know it's been a while since you created this PR, not sure if you still have time to spend on this. If not, one of us could open a new PR based on your initial commit to help get this across the line, just let us know what you prefer.

No worries, I addressed the comments, let me know if there is anything else left to do. Thank you

@shaneutt shaneutt requested a review from candita August 5, 2025 17:12
@shaneutt
Copy link
Member

shaneutt commented Aug 5, 2025

@candita as a person leading the BackendTLSPolicy push to standard, I would like to get your final review/approval and then I'm happy to review and provide the final LGTM.

Comment on lines +35 to +40
These fields were added to Gateway in `v1.1.0`
The Gateway specification now includes a new backendTLS field that allows configuration of TLS settings when the Gateway connects to backends. This provides a default configuration for all backend Services. It is important to note that if a BackendTLSPolicy is attached to a specific Service, it will override the backendTLS configuration on the Gateway.
This functionality enables the specification of client certificates that the Gateway should use when establishing TLS connections with backends.
The backendTLS configuration consists of a single field:

- [ClientCertificateRef][clientCertificateRef] - References an object containing a Client Certificate and its associated private key
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that this information is changing in #3960, so this should be updated with that design, and this PR should probably merge after that one does.

@candita
Copy link
Contributor

candita commented Aug 8, 2025

@08volt @shaneutt

Some of this belongs under Gateway and not BackendTLSPolicy. https://github.com/kubernetes-sigs/gateway-api/pull/3563/files#r2219923354

I did not add the new fields to API, so I think it's best for @LiorLieberman to validate these changes to the docs. To me, this feels like it came out of nowhere, as there isn't even an issue linked to #3180.

Most frighteningly, there are NO conformance tests for these additions. I don't think they should be added to an API object on its way to Standard without them. Should I raise an issue?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/documentation Categorizes issue or PR as related to documentation. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesn't merit a release note. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. v1.4-release/subtask This indicates a subtask of a feature, bug, or smaller issue for the v1.4 release.
Projects
Status: Review
Development

Successfully merging this pull request may close these issues.

GEP: TLS from Gateway to Backend for ingress (backend TLS termination)
9 participants