Skip to content

Commit dadf621

Browse files
fraenkelfraenkel
authored
Gateway supports custom cipher suites (#58381)
1 parent b2f713a commit dadf621

File tree

5 files changed

+296
-2
lines changed

5 files changed

+296
-2
lines changed

‎pilot/pkg/config/kube/gateway/conversion.go‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ import (
5555
"istio.io/istio/pkg/config/schema/gvk"
5656
"istio.io/istio/pkg/config/schema/kind"
5757
schematypes "istio.io/istio/pkg/config/schema/kubetypes"
58+
"istio.io/istio/pkg/config/security"
5859
"istio.io/istio/pkg/kube/controllers"
5960
"istio.io/istio/pkg/kube/krt"
6061
"istio.io/istio/pkg/ptr"
@@ -66,6 +67,7 @@ const (
6667
gatewayTLSTerminateModeKey = "gateway.istio.io/tls-terminate-mode"
6768
addressTypeOverride = "networking.istio.io/address-type"
6869
gatewayClassDefaults = "gateway.istio.io/defaults-for-class"
70+
gatewayTLSCipherSuites = "gateway.istio.io/tls-cipher-suites"
6971
)
7072

7173
func sortConfigByCreationTime(configs []config.Config) {
@@ -2114,7 +2116,7 @@ func buildTLS(
21142116
return nil, nil
21152117
}
21162118
// Explicitly not supported: file mounted
2117-
// Not yet implemented: TLS mode, https redirect, max protocol version, SANs, CipherSuites, VerifyCertificate
2119+
// Not yet implemented: TLS mode, https redirect, max protocol version, SANs, VerifyCertificate
21182120
out := &istio.ServerTLSSettings{
21192121
HttpsRedirect: false,
21202122
}
@@ -2215,6 +2217,12 @@ func buildTLS(
22152217
out.Mode = istio.ServerTLSSettings_AUTO_PASSTHROUGH
22162218
}
22172219
}
2220+
if opts := tls.Options[gatewayTLSCipherSuites]; opts != "" {
2221+
ciphers := security.FilterCipherSuites(slices.Map(strings.Split(string(opts), ","), strings.TrimSpace))
2222+
if len(ciphers) > 0 {
2223+
out.CipherSuites = ciphers
2224+
}
2225+
}
22182226
return out, nil
22192227
}
22202228

‎pilot/pkg/config/kube/gateway/testdata/tls.status.yaml.golden‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -258,6 +258,153 @@ status:
258258
---
259259
apiVersion: gateway.networking.k8s.io/v1beta1
260260
kind: Gateway
261+
metadata:
262+
name: gateway-invalid-ciphers
263+
namespace: istio-system
264+
spec: null
265+
status:
266+
addresses:
267+
- type: IPAddress
268+
value: 1.2.3.4
269+
conditions:
270+
- lastTransitionTime: fake
271+
message: Resource accepted
272+
reason: Accepted
273+
status: "True"
274+
type: Accepted
275+
- lastTransitionTime: fake
276+
message: Resource programmed, assigned to service(s) istio-ingressgateway.istio-system.svc.domain.suffix:34000
277+
reason: Programmed
278+
status: "True"
279+
type: Programmed
280+
listeners:
281+
- attachedRoutes: 0
282+
conditions:
283+
- lastTransitionTime: fake
284+
message: No errors found
285+
reason: Accepted
286+
status: "True"
287+
type: Accepted
288+
- lastTransitionTime: fake
289+
message: No errors found
290+
reason: NoConflicts
291+
status: "False"
292+
type: Conflicted
293+
- lastTransitionTime: fake
294+
message: No errors found
295+
reason: Programmed
296+
status: "True"
297+
type: Programmed
298+
- lastTransitionTime: fake
299+
message: No errors found
300+
reason: ResolvedRefs
301+
status: "True"
302+
type: ResolvedRefs
303+
name: passthrough
304+
supportedKinds:
305+
- group: gateway.networking.k8s.io
306+
kind: TLSRoute
307+
---
308+
apiVersion: gateway.networking.k8s.io/v1beta1
309+
kind: Gateway
310+
metadata:
311+
name: gateway-mixed-ciphers
312+
namespace: istio-system
313+
spec: null
314+
status:
315+
addresses:
316+
- type: IPAddress
317+
value: 1.2.3.4
318+
conditions:
319+
- lastTransitionTime: fake
320+
message: Resource accepted
321+
reason: Accepted
322+
status: "True"
323+
type: Accepted
324+
- lastTransitionTime: fake
325+
message: Resource programmed, assigned to service(s) istio-ingressgateway.istio-system.svc.domain.suffix:34000
326+
reason: Programmed
327+
status: "True"
328+
type: Programmed
329+
listeners:
330+
- attachedRoutes: 0
331+
conditions:
332+
- lastTransitionTime: fake
333+
message: No errors found
334+
reason: Accepted
335+
status: "True"
336+
type: Accepted
337+
- lastTransitionTime: fake
338+
message: No errors found
339+
reason: NoConflicts
340+
status: "False"
341+
type: Conflicted
342+
- lastTransitionTime: fake
343+
message: No errors found
344+
reason: Programmed
345+
status: "True"
346+
type: Programmed
347+
- lastTransitionTime: fake
348+
message: No errors found
349+
reason: ResolvedRefs
350+
status: "True"
351+
type: ResolvedRefs
352+
name: passthrough
353+
supportedKinds:
354+
- group: gateway.networking.k8s.io
355+
kind: TLSRoute
356+
---
357+
apiVersion: gateway.networking.k8s.io/v1beta1
358+
kind: Gateway
359+
metadata:
360+
name: gateway-valid-ciphers
361+
namespace: istio-system
362+
spec: null
363+
status:
364+
addresses:
365+
- type: IPAddress
366+
value: 1.2.3.4
367+
conditions:
368+
- lastTransitionTime: fake
369+
message: Resource accepted
370+
reason: Accepted
371+
status: "True"
372+
type: Accepted
373+
- lastTransitionTime: fake
374+
message: Resource programmed, assigned to service(s) istio-ingressgateway.istio-system.svc.domain.suffix:34000
375+
reason: Programmed
376+
status: "True"
377+
type: Programmed
378+
listeners:
379+
- attachedRoutes: 0
380+
conditions:
381+
- lastTransitionTime: fake
382+
message: No errors found
383+
reason: Accepted
384+
status: "True"
385+
type: Accepted
386+
- lastTransitionTime: fake
387+
message: No errors found
388+
reason: NoConflicts
389+
status: "False"
390+
type: Conflicted
391+
- lastTransitionTime: fake
392+
message: No errors found
393+
reason: Programmed
394+
status: "True"
395+
type: Programmed
396+
- lastTransitionTime: fake
397+
message: No errors found
398+
reason: ResolvedRefs
399+
status: "True"
400+
type: ResolvedRefs
401+
name: passthrough
402+
supportedKinds:
403+
- group: gateway.networking.k8s.io
404+
kind: TLSRoute
405+
---
406+
apiVersion: gateway.networking.k8s.io/v1beta1
407+
kind: Gateway
261408
metadata:
262409
name: gateway2
263410
namespace: istio-system

‎pilot/pkg/config/kube/gateway/testdata/tls.yaml‎

Lines changed: 67 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,72 @@ spec:
134134
tls:
135135
mode: Passthrough
136136
---
137+
apiVersion: gateway.networking.k8s.io/v1beta1
138+
kind: Gateway
139+
metadata:
140+
name: gateway-valid-ciphers
141+
namespace: istio-system
142+
spec:
143+
addresses:
144+
- value: istio-ingressgateway
145+
type: Hostname
146+
gatewayClassName: istio
147+
listeners:
148+
- name: passthrough
149+
port: 34000
150+
protocol: TLS
151+
allowedRoutes:
152+
namespaces:
153+
from: All
154+
tls:
155+
mode: Passthrough
156+
options:
157+
gateway.istio.io/tls-cipher-suites: "ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-RSA-AES128-GCM-SHA256"
158+
---
159+
apiVersion: gateway.networking.k8s.io/v1beta1
160+
kind: Gateway
161+
metadata:
162+
name: gateway-invalid-ciphers
163+
namespace: istio-system
164+
spec:
165+
addresses:
166+
- value: istio-ingressgateway
167+
type: Hostname
168+
gatewayClassName: istio
169+
listeners:
170+
- name: passthrough
171+
port: 34000
172+
protocol: TLS
173+
allowedRoutes:
174+
namespaces:
175+
from: All
176+
tls:
177+
mode: Passthrough
178+
options:
179+
gateway.istio.io/tls-cipher-suites: "bogus,bad"
180+
---
181+
apiVersion: gateway.networking.k8s.io/v1beta1
182+
kind: Gateway
183+
metadata:
184+
name: gateway-mixed-ciphers
185+
namespace: istio-system
186+
spec:
187+
addresses:
188+
- value: istio-ingressgateway
189+
type: Hostname
190+
gatewayClassName: istio
191+
listeners:
192+
- name: passthrough
193+
port: 34000
194+
protocol: TLS
195+
allowedRoutes:
196+
namespaces:
197+
from: All
198+
tls:
199+
mode: Passthrough
200+
options:
201+
gateway.istio.io/tls-cipher-suites: "bad, ECDHE-RSA-AES128-GCM-SHA256"
202+
---
137203
apiVersion: gateway.networking.k8s.io/v1alpha2
138204
kind: TLSRoute
139205
metadata:
@@ -179,4 +245,4 @@ spec:
179245
rules:
180246
- backendRefs:
181247
- name: httpbin
182-
port: 80
248+
port: 80

‎pilot/pkg/config/kube/gateway/testdata/tls.yaml.golden‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,70 @@
11
apiVersion: networking.istio.io/v1
22
kind: Gateway
3+
metadata:
4+
annotations:
5+
internal.istio.io/gateway-semantics: gateway
6+
internal.istio.io/gateway-service: istio-ingressgateway.istio-system.svc.domain.suffix
7+
internal.istio.io/parents: Gateway/gateway-invalid-ciphers/passthrough.istio-system
8+
internal.istio.io/service-account-name: ""
9+
name: gateway-invalid-ciphers~istio-autogenerated-k8s-gateway~passthrough
10+
namespace: istio-system
11+
spec:
12+
servers:
13+
- hosts:
14+
- '*/*'
15+
port:
16+
name: default
17+
number: 34000
18+
protocol: TLS
19+
tls: {}
20+
---
21+
apiVersion: networking.istio.io/v1
22+
kind: Gateway
23+
metadata:
24+
annotations:
25+
internal.istio.io/gateway-semantics: gateway
26+
internal.istio.io/gateway-service: istio-ingressgateway.istio-system.svc.domain.suffix
27+
internal.istio.io/parents: Gateway/gateway-mixed-ciphers/passthrough.istio-system
28+
internal.istio.io/service-account-name: ""
29+
name: gateway-mixed-ciphers~istio-autogenerated-k8s-gateway~passthrough
30+
namespace: istio-system
31+
spec:
32+
servers:
33+
- hosts:
34+
- '*/*'
35+
port:
36+
name: default
37+
number: 34000
38+
protocol: TLS
39+
tls:
40+
cipherSuites:
41+
- ECDHE-RSA-AES128-GCM-SHA256
42+
---
43+
apiVersion: networking.istio.io/v1
44+
kind: Gateway
45+
metadata:
46+
annotations:
47+
internal.istio.io/gateway-semantics: gateway
48+
internal.istio.io/gateway-service: istio-ingressgateway.istio-system.svc.domain.suffix
49+
internal.istio.io/parents: Gateway/gateway-valid-ciphers/passthrough.istio-system
50+
internal.istio.io/service-account-name: ""
51+
name: gateway-valid-ciphers~istio-autogenerated-k8s-gateway~passthrough
52+
namespace: istio-system
53+
spec:
54+
servers:
55+
- hosts:
56+
- '*/*'
57+
port:
58+
name: default
59+
number: 34000
60+
protocol: TLS
61+
tls:
62+
cipherSuites:
63+
- ECDHE-ECDSA-AES128-GCM-SHA256
64+
- ECDHE-RSA-AES128-GCM-SHA256
65+
---
66+
apiVersion: networking.istio.io/v1
67+
kind: Gateway
368
metadata:
469
annotations:
570
internal.istio.io/gateway-semantics: gateway

‎releasenotes/notes/58366.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: release-notes/v2
2+
kind: bug-fix
3+
area: traffic-management
4+
issue:
5+
- 58366
6+
releaseNotes:
7+
- |
8+
**Added** an option, `gateway.istio.io/tls-cipher-suites`, to specify the custom cipher suites on a Gateway. The value is a comma separated list of cipher suites.

0 commit comments

Comments
 (0)