feat: Add BackendTLS Policy support #1487

ciarams87 · 2024-01-18T19:41:35Z

Proposed changes

Problem: As a user of NGF
I want NGF to implement the BackendTLSPolicy
So that NGF can securely connect to my pods using TLS.

Solution:

Add support for BackendTLSPolicy as outlined in the spec.
Add a new experimental features flag, so that the experimental APIs are not required by default.
Extend conformance tests to support installing and running against the experimental APIs

Testing: Manual testing, unit testing, conformance testing with and without experimental features enabled (NOTE: no conformance test for Backend TLS policy currently exists - that work is tracked here)

Note: When running the conformance tests with the experimental APIs installed, an unrelated test failed (HTTPRouteInvalidParentRefNotMatchingSectionName). Looks like we have been missing this failure because of a bug in the Gateway API - see https://github.com/nginxinc/nginx-gateway-fabric/actions/runs/7574208095/job/20628086048#step:17:672 for the example output. The fix is to move the check for the existence of a listener for a HTTPRoute above where we check for a port in the ParentRef.

Closes #1262

Checklist

Before creating a PR, run through this checklist and mark each as complete.

I have read the CONTRIBUTING doc
I have added tests that prove my fix is effective or that my feature works
I have checked that all unit tests pass after adding my changes
I have updated necessary documentation
I have rebased my branch onto main
I will ensure my PR is targeting the main branch and pulling from my branch from my own fork

pleshakov

Please see my comments, requests and suggestions. I haven't reviewed some unit tests code because of the anticipation they might changed because of the changes to the code they test.

cmd/gateway/commands.go

deploy/helm-chart/templates/rbac.yaml

examples/backend-tls/README.md

examples/backend-tls/gateway.yaml

examples/backend-tls/policy.yaml

internal/mode/static/state/dataplane/configuration.go

site/content/includes/installation/install-gateway-api-resources.md

site/content/overview/gateway-api-compatibility.md

site/content/includes/installation/install-gateway-api-resources.md

ADubhlaoich

LGTM: specific issues I would have mentioned were already flagged by @pleshakov, so I will avoid redundancy.

Is there a desire for the example to become a documentation how-to use case?

conformance/scripts/install-gateway.sh

conformance/scripts/uninstall-gateway.sh

examples/backend-tls/README.md

internal/mode/static/build_statuses.go

internal/framework/status/backend_tls.go

internal/mode/static/state/graph/backend_refs.go

internal/mode/static/state/graph/backend_tls_policy.go

internal/mode/static/state/graph/config_maps.go

site/content/how-to/traffic-management/backend-tls-termination.md

sjberman · 2024-02-02T16:53:24Z

@ADubhlaoich will probably want to re-review the new guide that was added.

cmd/gateway/commands.go

docs/developer/quickstart.md

internal/mode/static/manager.go

internal/mode/static/nginx/config/servers.go

internal/mode/static/nginx/config/generator.go

internal/framework/status/setters_test.go

internal/mode/static/build_statuses.go

internal/framework/status/statuses.go

pleshakov

Hi @ciarams87

I added a few suggestions and requests in places where readability could be improved.
I also noticed a bug (panic)
otherwise, this looks good to me

internal/mode/static/build_statuses_test.go

internal/mode/static/nginx/config/servers_test.go

internal/mode/static/state/change_processor.go

internal/mode/static/state/change_processor_test.go

internal/mode/static/state/conditions/conditions.go

internal/mode/static/state/graph/backend_tls_policy.go

internal/mode/static/state/graph/backend_tls_policy_test.go

internal/mode/static/state/graph/graph_test.go

deploy/helm-chart/templates/rbac.yaml

cmd/gateway/commands.go

kate-osborn

🚀

* Add BackendTLS Policy support

alex-ivascu · 2025-10-16T10:48:31Z

Any idea when this functionality will be supported officially and not through experimental features?

bjee19 · 2025-10-16T18:46:32Z

Hey @alex-ivascu, as you may know, BackendTLSPolicy support was promoted to the standard release channel in Gateway api v1.4.0. We have an issue tracking our upgrade to Gateway api v1.4.0, which will go out in our 2.3 release sometime early januaray.

ciarams87 requested review from a team as code owners January 18, 2024 19:41

github-actions bot added documentation Improvements or additions to documentation enhancement New feature or request helm-chart Relates to helm chart labels Jan 18, 2024

pleshakov reviewed Jan 19, 2024

View reviewed changes

ciarams87 marked this pull request as draft January 19, 2024 17:49

ciarams87 force-pushed the feat/backend-tls-policy branch from c0f4672 to ca31db4 Compare January 19, 2024 19:43

ADubhlaoich approved these changes Jan 22, 2024

View reviewed changes

ciarams87 force-pushed the feat/backend-tls-policy branch 3 times, most recently from 64cae3f to 077a917 Compare January 31, 2024 16:55

ciarams87 marked this pull request as ready for review January 31, 2024 17:04

ciarams87 requested review from a team and pleshakov January 31, 2024 17:04

sjberman reviewed Jan 31, 2024

View reviewed changes

ciarams87 force-pushed the feat/backend-tls-policy branch from 907b0f1 to a3dcd42 Compare February 1, 2024 16:31

sjberman reviewed Feb 1, 2024

View reviewed changes

ciarams87 force-pushed the feat/backend-tls-policy branch from 65fc3cf to 1bb09fb Compare February 2, 2024 12:11

sjberman reviewed Feb 2, 2024

View reviewed changes

site/content/how-to/traffic-management/backend-tls-termination.md Outdated Show resolved Hide resolved

site/content/how-to/traffic-management/backend-tls-termination.md Outdated Show resolved Hide resolved

pleshakov reviewed Feb 3, 2024

View reviewed changes

bjee19 reviewed Feb 5, 2024

View reviewed changes

internal/framework/status/statuses.go Outdated Show resolved Hide resolved

ciarams87 force-pushed the feat/backend-tls-policy branch 2 times, most recently from b331dc4 to e7dc901 Compare February 7, 2024 22:22

ciarams87 requested review from ADubhlaoich, bjee19, pleshakov and sjberman February 7, 2024 22:23

ciarams87 force-pushed the feat/backend-tls-policy branch from e7dc901 to 2b8cbf6 Compare February 8, 2024 10:52

ciarams87 force-pushed the feat/backend-tls-policy branch from c7a9fdd to fb1ac8c Compare February 13, 2024 08:50

pleshakov reviewed Feb 13, 2024

View reviewed changes

kate-osborn reviewed Feb 13, 2024

View reviewed changes

deploy/helm-chart/templates/rbac.yaml Outdated Show resolved Hide resolved

cmd/gateway/commands.go Outdated Show resolved Hide resolved

cmd/gateway/commands.go Outdated Show resolved Hide resolved

ciarams87 force-pushed the feat/backend-tls-policy branch from bf86b9c to facbe81 Compare February 14, 2024 12:10

ciarams87 requested review from kate-osborn and pleshakov February 14, 2024 12:12

ciarams87 mentioned this pull request Feb 14, 2024

NGF is reloading NGINX for BackendTLSPolicy with no accepted Gateway #1577

Open

pleshakov approved these changes Feb 14, 2024

View reviewed changes

kate-osborn approved these changes Feb 14, 2024

View reviewed changes

pleshakov mentioned this pull request Feb 14, 2024

Support NGINX Plus usage reporting #1544

Merged

6 tasks

bjee19 approved these changes Feb 14, 2024

View reviewed changes

ciarams87 added 13 commits February 15, 2024 09:01

Add BackendTLS Policy support

871ffc1

Add status updater for backendtlspolicy, move logic

955feeb

Review feedback 1

a2ae465

Add more validation; handle conflicts

e726354

Add status updater unit tests

46d2bbf

Move example to docs

498c43a

Improve how-to guide

105c349

Review feedback

549cb1d

Add change processor test cases

df21907

Fix linter

96269ae

Tidy code, fix panic, update for plus manifest

42af02a

Add additional test case

949c08e

Add conditional to RBAC and generate new manifests

244391d

ciarams87 force-pushed the feat/backend-tls-policy branch from c3df833 to 244391d Compare February 15, 2024 09:01

ciarams87 merged commit 7596bf7 into nginx:main Feb 15, 2024

ciarams87 deleted the feat/backend-tls-policy branch February 15, 2024 11:38

miledxz added a commit to miledxz/nginx-gateway-fabric that referenced this pull request Jan 14, 2025

feat: Add BackendTLS Policy support (nginx#1487)

b5315a9

* Add BackendTLS Policy support

feat: Add BackendTLS Policy support #1487

feat: Add BackendTLS Policy support #1487

Uh oh!

Conversation

ciarams87 commented Jan 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes

Checklist

Uh oh!

pleshakov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ADubhlaoich left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sjberman commented Feb 2, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pleshakov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kate-osborn left a comment

Choose a reason for hiding this comment

Uh oh!

alex-ivascu commented Oct 16, 2025

Uh oh!

bjee19 commented Oct 16, 2025

Uh oh!

ciarams87 commented Jan 18, 2024 •

edited

Loading