Skip to content

gep: refine ClientCertificateRef description for backend TLS #4123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

gep: refine ClientCertificateRef description for backend TLS #4123

wants to merge 2 commits into from

Conversation

snorwin
Copy link
Member

@snorwin snorwin commented Sep 25, 2025 •
edited
Loading

What type of PR is this?

/kind gep

What this PR does / why we need it:
In the current version of the GEP-3155, the semantics of an invalid ClientCertificateRef are not fully specified.
Additionally, the GEP states that an invalid ClientCertificateRef affects the ResolvedRefs condition on the Listeners, which I think is incorrect.

This PR clarifies the behavior by introducing a ResolvedRefs condition on the Gateway instead. That condition will be set whenever a ClientCertificateRef is invalid or not permitted.

Which issue(s) this PR fixes:

N/A

Does this PR introduce a user-facing change?:

NONE

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. kind/gep PRs related to Gateway Enhancement Proposal(GEP) cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Sep 25, 2025
@k8s-ci-robot k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 25, 2025
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: snorwin
Once this PR has been reviewed and has the lgtm label, please assign shaneutt for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Sep 25, 2025
@snorwin
Copy link
Member Author

snorwin commented Sep 25, 2025

/cc @robscott @kl52752 @rikatz

kl52752
kl52752 reviewed Sep 25, 2025
View reviewed changes
geps/gep-3155/index.md Outdated
// to be attached. If a ReferenceGrant does not allow this reference, the
// "ResolvedRefs" condition MUST be set to False for this listener with the
// "RefNotPermitted" reason.
// This setting can be overridden on the service level by use of BackendTLSPolicy.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This statement is no longer true. gateway client certificate is part of gateway identity and should be the same for all connections from gateway to backend, this setting cannot be overridden on service level

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was thinking the same, but I didn’t want to remove it without discussing it first. If everyone agrees, I’ll go ahead and remove it.

@rikatz
Copy link
Member

rikatz commented Sep 26, 2025

/assign

@rikatz
Copy link
Member

rikatz commented Sep 26, 2025

overall lgtm.

Will leave final word for approvers :)

@snorwin
Copy link
Member Author

snorwin commented Sep 29, 2025

@robscott @youngnick what do you think about adding a ResolvedRefs condition to the Gateway? Would that make sense to you, or should we instead extend the Accepted condition with another reason? In general, how would an invalid client certificate affect acceptance?

I’m interested to hear your thoughts so we can improve the description further.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@LiorLieberman LiorLieberman Awaiting requested review from LiorLieberman

@youngnick youngnick Awaiting requested review from youngnick

@rikatz rikatz Awaiting requested review from rikatz

@robscott robscott Awaiting requested review from robscott

1 more reviewer

@kl52752 kl52752 kl52752 left review comments

Reviewers whose approvals may not affect merge requirements
Assignees

@rikatz rikatz

Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. kind/gep PRs related to Gateway Enhancement Proposal(GEP) release-note-none Denotes a PR that doesn't merit a release note. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@snorwin @k8s-ci-robot @rikatz @kl52752