[Bug]: TransportServer does not accept host for SNI

[saedx1]

Version

edge

What Kubernetes platforms are you running on?

EKS Amazon

Steps to reproduce

1. Deploy Nginx Ingress Controller with Custom Ports (TCP 7000)
2. Deploy this example following the instructions in there.
3. Check the events for the cafe using kubectl events --for TransportServer/cafe-ts
4. You'll find this message:

LAST SEEN           TYPE      REASON     OBJECT                    MESSAGE
58m (x2 over 58m)   Warning   Rejected   TransportServer/cafe-ts   TransportServer default/cafe-ts was rejected with error: spec.host: Forbidden: host field is allowed only for TLS Passthrough TransportServers
58m (x2 over 58m)   Warning   Rejected   TransportServer/cafe-ts   TransportServer default/cafe-ts was rejected with error: spec.host: Forbidden: host field is allowed only for TLS Passthrough TransportServers
58m (x2 over 58m)   Warning   Rejected   TransportServer/cafe-ts   TransportServer default/cafe-ts was rejected with error: spec.host: Forbidden: host field is allowed only for TLS Passthrough TransportServers
23m                 Warning   Rejected   TransportServer/cafe-ts   TransportServer default/cafe-ts was rejected with error: spec.host: Forbidden: host field is allowed only for TLS Passthrough TransportServers
23m                 Warning   Rejected   TransportServer/cafe-ts   TransportServer default/cafe-ts was rejected with error: spec.host: Forbidden: host field is allowed only for TLS Passthrough TransportServers
23m                 Warning   Rejected   TransportServer/cafe-ts   TransportServer default/cafe-ts was rejected with error: spec.host: Forbidden: host field is allowed only for TLS Passthrough TransportServers

[github-actions]

Hi @saedx1 thanks for reporting!

Be sure to check out the docs and the Contributing Guidelines while you wait for a human to take a look at this 🙂

Cheers!

[vepatel]

Hey @saedx1 this feature is only present in main at this moment and will be available in next major release. You can try edge version of NIC if you'd like to try this out.

Thanks!

[j1m-ryan]

Yeah as Venktesh said, we sometimes have examples in main, that are not yet released. To see the examples that will work for a particular version you can check out that tag. Just tested on main and I get

Name:         cafe-ts
Namespace:    default
Labels:       <none>
Annotations:  <none>
API Version:  k8s.nginx.org/v1
Kind:         TransportServer
Metadata:
  Creation Timestamp:  2024-11-19T15:44:15Z
  Generation:          1
  Resource Version:    36662
  UID:                 6792c14f-bdc2-4633-aafc-8fe753ef49f4
Spec:
  Action:
    Pass:  tcp-echo
  Host:    cafe.example.com
  Listener:
    Name:      tcp-listener
    Protocol:  TCP
  Tls:
    Secret:  cafe-secret
  Upstreams:
    Name:     tcp-echo
    Port:     7000
    Service:  tcp-echo-service
Status:
  Message:  Configuration for default/cafe-ts was added or updated 
  Reason:   AddedOrUpdated
  State:    Valid
Events:
  Type    Reason          Age   From                      Message
  ----    ------          ----  ----                      -------
  Normal  AddedOrUpdated  8s    nginx-ingress-controller  Configuration for default/cafe-ts was added or updated

[vepatel]

@saedx1 did you get a chance to deploy this with edge build?

[jjngx]

This issue is addressed in NIC v4.0.0