Repository: kubernetes-sigs/gateway-api

Issue #763: Document Self Service TLS Certificate Approaches
Created: 2021-08-11T02:39:13Z
What would you like to be added:
As a follow up to the discussion in #749 (comment), it would be good to clarify exactly how the API can be used to allow app owners to provide their own TLS certs.
Why this is needed:
This is a common request, and the existing guidance in GEP #746 is pretty broad and may not scale as much as needed.

Duplicate issue #622: Allow application developer to specify TLS client certificate
Created: 2021-04-22T07:11:34Z
What would you like to be added:
Application developer should be able to define a client certificate that the proxy uses when it connects to developer's backend service with TLS.
Why is this needed:
Background:
This feature has been previously discussed and it was included as BackendPolicy.spec.tls.clientCertificateRef. Later, Gateway level configuration was preferred #395 and feature was removed.  As per discussion in the comments of #400, I would like to propose this capability to be re-introduced as an optional feature,  as an alternative to global (per gateway) configuration.
Use case details:
Assume we have application developer working within Kubernetes namespace. Application developer wants to secure the traffic between proxy and their backend service.
1. Application developer generates their own certificates and configures server certificate to their backend service
2. To get the proxy to validate the server certificate, the application developer configures reference to the CA certificate secret to BackendPolicy.spec.tls.certificateAuthorityRef
Next the developer would like to protect the backend service even further, by allowing incoming TLS connections only from the proxy. Symmetrically, application developer could enable client authentication by themselves, like they did for the server authentication in step 2 above but this would require client certificate to be configurable per backend service, not per Gateway which would be outside of application developers domain.
Implementing this enhancement has following advantages:

Allows "self-service" workflow for the application developer, since they do not need to depend on cluster admin to configure client certificate on gateway level
Cluster admin does not need to manage / coordinate / distribute single CA certificate for the development teams working in the cluster. Each team can configure their own client certificates for the proxy and CA certificates to their backend for validating the client cert

Closing comment (2022-10-05T04:50:50Z): Hi @mikemorris

Noting for posterity and shared context that this appears to be a duplicate of #763

While being closely related,

this current issue #622 was about allowing application developer to manage the client certificate for proxy when it initiates TLS connection towards their upstream/backend service.
The discussion in #763 is about allowing application developer to manage server certificate for proxy when it terminates TLS connection from an external client. That is the same use case as Ingress.spec.tls.secretName targets, where application developer can set certificate for a virtual host(s) that they manage.


After very quick look at #1430 it seems to me like "GEP-1282: Describing Backend Properties" would rather allow addressing this (closed) issue than #763?  Cc @candita.