tls minversion not being respected in ClientTrafficPolicy #3060
Comments
|
@jhouston1604 could you check the status of the If it was accepted, could you share the Envoy Proxy listener configuration? You can find it with the |
|
hi @liorokman Screenshot attached of the policy being accepted, however getting this error running this command Note: i ran command with those options since it wasnt in the default envoy namespace. Thanks again for looking into this |
|
@jhouston1604 I'm not able to reproduce the issue in my test environment. Could you provide some more information?
|
This seems to be related to CORS configuration in Envoy Proxy. Do you have any CORS related configuration? |
@jhouston1604 this is tied to a mismatch b/w client and server version, if you install the latest |
|
@liorokman can you help ? should be easy to repro with the config provided |
|
@arkodg like I wrote - I could not reproduce the issue with the provided information. I need more details. |
|
Hi @liorokman here are the items you requested, thanks again!
ClientTrafficPolicy: SeucirtyPolicy for the HTTP route posted:
|
|
@jhouston1604 thanks for all the additional information. Two things jump out to me:
There's a PR making the rounds right now ( #2694 ) that makes it safe to use more than one replica for Envoy Gateway, but it hasn't merged yet. Could you see if the issue reproduces for you when you're running Envoy Gateway with a replica size of 1 ? |
|
@liorokman interesting, I will upgrade my client and and scale down my replica size to one right now, sec |
|
@liorokman I did as requested, and i also recreated all the pods just incase. no change. I did however see two errors in the gateway logs. not sure if related |
|
@jhouston1604 I don't think the errors you saw in the log are relevant - they seem to be from the infrastructure controller. For the first issue, does the |
|
@liorokman no errors, let me redact some information in here and i'll post shortly! |
|
@liorokman config attached! |
|
Looking at the listener configuration, none of those listeners are configured to use TLS. Your gateway is defined like this: apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: envoy-public
namespace: envoy-public
spec:
gatewayClassName: envoy-public
listeners:
- name: http
protocol: HTTP
port: 80
allowedRoutes:
namespaces:
from: All
- name: https
protocol: HTTP
port: 443
allowedRoutes:
namespaces:
from: AllSimply using port 443 doesn't transform the listener to a TLS enabled listener. You need to add a TLS section at the very least: apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: envoy-public
namespace: envoy-public
spec:
gatewayClassName: envoy-public
listeners:
- name: http
protocol: HTTP
port: 80
allowedRoutes:
namespaces:
from: All
- name: https
protocol: HTTPS # The protocol needs to be HTTPS and not HTTP
port: 443
allowedRoutes:
namespaces:
from: All
tls: # This section is missing in the configuration files you listed above
certificateRefs: # The place where the server X.509 certificate can be found
- group: ""
kind: Secret
name: example-cert
mode: Terminate Since TLS is not configured for any of the listeners, limiting the supported TLS version to 1.3 in a |
|
oh my goodness @liorokman your so right. I"m so used to using cert manager completely spaced that our certs are in cloudflare. Thanks for all your time and help with this! |
Description:
Repro steps:
Environment:
Tested in 1.0 release
The text was updated successfully, but these errors were encountered: