Set OverlappingTLSConfig condition on Listeners #3696
Description
Is your enhancement request related to a problem? Please describe.
Currently, our controller does not set the OverlappingTLSConfig condition on Listeners when overlapping TLS configuration is detected (e.g., overlapping hostnames or certificates on the same port). This means users are not warned about potentially conflicting TLS configurations, which can lead to confusing runtime behavior, especially with HTTP connection coalescing.
What would you like to be added:
Implement logic to detect overlapping TLS configuration (hostnames and, optionally, certificates) between Listeners on the same port, and set the OverlappingTLSConfig condition (with the appropriate reason: OverlappingHostnames or OverlappingCertificates) on all affected Listeners, as required by the Gateway API spec.
Why this is needed:
This is required for Gateway API conformance and ensures users are made aware of configuration risks that can cause unexpected or insecure behavior. Even if runtime mitigations (such as toggles to disable SNI host validation) are present, the condition must still be set to surface the underlying configuration issue.
Additional context
See Gateway API documentation for ListenerConditionOverlappingTLSConfig and associated reasons.
This work is distinct from the toggle implemented here and should always be performed when overlap is detected, regardless of other settings.
Reference:
Metadata
Metadata
Assignees
Type
Projects
Status