AlinsRan commented on issue #2254:
URL:
https://github.com/apache/apisix-ingress-controller/issues/2254#issuecomment-5472369304
This should be possible as of 2.2.0.
Both `ApisixUpstream.spec.scheme` and `BackendTrafficPolicy.spec.scheme`
used to be restricted to the L7 set (`http`, `https`, `grpc`, `grpcs`), so
there was no way to express a TLS upstream on a stream route even though APISIX
itself accepts `tls`. #2830 relaxed that validation, and `tcp`, `tls` and `udp`
are now accepted.
For an `ApisixRoute` stream rule the scheme comes from an `ApisixUpstream`
named after the backend Service:
```yaml
apiVersion: apisix.apache.org/v2
kind: ApisixUpstream
metadata:
name: nginx # must match the Service name below
spec:
ingressClassName: apisix
scheme: tls
---
apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
name: nginx-tcp-route
spec:
ingressClassName: apisix
stream:
- name: rule1
protocol: TCP
match:
ingressPort: 9100
backend:
serviceName: nginx
servicePort: 443
```
The client speaks plain TCP to the gateway on 9100, and APISIX does the TLS
handshake with the Service on 443. The `ApisixUpstream` has to carry the same
name as the Service, since that is how the stream backend finds it.
The port also needs to be open for stream traffic on the data plane:
```yaml
apisix:
proxy_mode: http&stream
stream_proxy:
tcp:
- 9100
```
One thing worth knowing: when the client connects over plain TCP there is no
SNI to pass along, so APISIX sends `apisix_backend` as a dummy SNI to the
upstream. If your upstream picks a certificate by SNI, or you are verifying the
hostname, that is the value it will see.
On the Gateway API side the equivalent is a `TCPRoute` with a
`BackendTrafficPolicy` carrying `scheme: tls`.
Would you be able to try this on 2.2.0? If it covers your case we can close
this one out.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
