AlinsRan commented on code in PR #2882:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2882#discussion_r4244313383
##########
docs/en/latest/concepts/gateway-api.md:
##########
@@ -87,7 +87,7 @@ The fields below are specified in the Gateway API
specification but are either p
| `spec.listeners[].port` | Partially supported | Controls
`server_port` route-var injection; off by default and enabled via
[`listener_port_match_mode`](../reference/configuration-file.md) (`auto` /
`explicit`). The controller cannot dynamically open data plane ports, so APISIX
must already listen on the specified port. |
| `spec.listeners[].tls.certificateRefs[].group` | Partially supported | Only
`""` is supported; other group values cause validation failure. |
| `spec.listeners[].tls.certificateRefs[].kind` | Partially supported
| Only `Secret` is supported.
|
-| `spec.listeners[].tls.mode` | Partially supported
| `Terminate` is implemented; `Passthrough` is effectively unsupported for
Gateway listeners. |
+| `spec.listeners[].tls.mode` | Partially supported
| `Terminate` and `Passthrough` are both implemented. A `Passthrough` listener
needs APISIX to be listening on that port with
[`tls_passthrough`](https://apisix.apache.org/docs/apisix/stream-proxy/); the
controller cannot open data plane ports itself. A single port cannot mix the
two modes: listeners that disagree on `tls.mode` for one port are reported
`Accepted=False` with `ProtocolConflict`. |
Review Comment:
Fixed in 284fa5da. The row now draws the line:
```markdown
<!-- docs/en/latest/concepts/gateway-api.md -->
A single port cannot mix the two modes. Within one Gateway, listeners that
disagree on `tls.mode`
for one port are reported `Accepted=False` with `ProtocolConflict` and carry
no routes. Two Gateways
that disagree about the same port are each valid on their own, so no
conflict is reported there; the
routes on that port fall back to `Terminate`, because a physical stream
listen has a single mode.
```
That matches what the translator does — `portsWithConflictingTLSMode` is
built from one Gateway's listeners, and `tlsPassthroughOnPort` returns false
the moment a matched listener on the port is not `Passthrough`, so the port is
served as `Terminate`.
##########
test/conformance/conformance_test.go:
##########
@@ -62,6 +51,18 @@ var skippedTestsForKnownGaps = []string{
// A single HTTPRoute attached to several Gateways is not served from
each
// parent independently.
tests.HTTPRouteMultipleGateways.ShortName,
+
+ // The same limitation for TLSRoute, and not something the translator
can
+ // fix. The test stands four Gateways up on port 443 with different
listener
+ // hostnames; every Gateway resolves to the one data plane address and
the one
+ // physical stream listen, so their SNI namespaces are shared. The
Gateway
+ // whose listener carries no hostname keeps its route's "*.com"
verbatim -
+ // correctly, and its own subtest depends on it - which then also
answers
+ // "non.matching.com" on the address of the Gateway that should have
rejected
+ // it. Which Gateway a connection was addressed to is not on the wire,
so
+ // there is nothing left to discriminate on. Every other assertion in
this
+ // test passes, including the hostname intersections themselves.
+ tests.TLSRouteHostnameIntersection.ShortName,
Review Comment:
The description was wrong, not the skip list. Corrected: it now lists the
three Passthrough tests that do run — `TLSRouteSimpleSameNamespace`,
`TLSRouteInvalidBackendRefNonexistent`, `TLSRouteInvalidBackendRefUnknownKind`
— and states the two that stay skipped with their reasons.
`TLSRouteHostnameIntersection` stays skipped because it is an architectural
limit rather than a translator gap, the same one `HTTPRouteMultipleGateways` is
already skipped for. The reason is recorded where the skip is:
```go
// test/conformance/conformance_test.go
// The same limitation for TLSRoute, and not something the translator can
// fix. The test stands four Gateways up on port 443 with different listener
// hostnames; every Gateway resolves to the one data plane address and the
one
// physical stream listen, so their SNI namespaces are shared. The Gateway
// whose listener carries no hostname keeps its route's "*.com" verbatim -
// correctly, and its own subtest depends on it - which then also answers
// "non.matching.com" on the address of the Gateway that should have rejected
// it. Which Gateway a connection was addressed to is not on the wire, so
// there is nothing left to discriminate on. Every other assertion in this
// test passes, including the hostname intersections themselves.
tests.TLSRouteHostnameIntersection.ShortName,
```
This was checked by dumping the resulting stream routes, not inferred: the
hostname intersections the test asserts on all come out right, and only the
negative case on a shared address fails. Making it pass needs one address per
Gateway, which is a deployment property.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
