knative-extensions / net-gateway-api

Integration between Knative and service-apis (ingress v2) for Knative Ingress migration.
Apache License 2.0
28 stars 29 forks source link

Generate HTTPRoute sectionName to select listener #610

Closed acelinkio closed 5 months ago

acelinkio commented 9 months ago

Please provide a method to setup routes created via Knative to configure route parentref listener section. Gateways allow for restricting access to listeners. This is especially useful when wanting to ensure that no traffic is sent in plain text.

Example where the listener on 80 is limited to HTTPRoute that is a 301 redirect:

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: internal
  namespace: cilium-gateway
spec:
  gatewayClassName: cilium
  listeners:
  - protocol: HTTP
    port: 80
    name: http
    allowedRoutes:
      namespaces:
        from: Same
  - protocol: HTTPS
    port: 443
    name: https
    tls:
      certificateRefs:
      - kind: Secret
        name: wildcard-production
        namespace: cilium-secrets
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: httpsredirect-internalgw
  namespace: cilium-gateway
spec:
  parentRefs:
    - name: internal
      namespace: cilium-gateway
      sectionName: http
  rules:
    - filters:
        - requestRedirect:
            scheme: https
            statusCode: 301
          type: RequestRedirect
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: grafana
  namespace: monitoring
spec:
  parentRefs:
  - name: internal
    namespace: cilium-gateway
    sectionName: https
  hostnames:
  - "grafana.mydomain.tld"
  rules:
  - backendRefs:
    - name: grafana
      port: 80
github-actions[bot] commented 6 months ago

This issue is stale because it has been open for 90 days with no activity. It will automatically close after 30 more days of inactivity. Reopen the issue with /reopen. Mark the issue as fresh by adding the comment /remove-lifecycle stale.

dprotaso commented 4 months ago

FWIW I think we'll have to do this in order to accomplish HTTP=>HTTPS redirects

We're tracking that here https://github.com/knative-extensions/net-gateway-api/issues/130