Skip to content

Commit de816a6

Browse files
zhaohuabingzhaohuabing
authored
Keep ALPN configuration for listeners with overlapping certificates when ALPN is explicitly set via ClientTrafficPolicy (envoyproxy#6217)
Keep ALPN configuration for listeners with overlapping certificates when ALPN is explicitly set in ClientTrafficPolicy Signed-off-by: Huabing (Robin) Zhao <[email protected]>
1 parent 0f6f363 commit de816a6

13 files changed

+180
-40
lines changed

‎internal/gatewayapi/listener.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -270,14 +270,14 @@ func checkOverlappingHostnames(httpsListeners []*ListenerContext) {
270270
if gateway1.Name == gateway2.Name &&
271271
gateway1.Namespace == gateway2.Namespace {
272272
message = fmt.Sprintf(
273-
"The hostname %s overlaps with the hostname %s in listener %s. ALPN is set to HTTP/1.1 to prevent HTTP/2 connection coalescing",
273+
"The hostname %s overlaps with the hostname %s in listener %s. ALPN will default to HTTP/1.1 to prevent HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy",
274274
overlappingListeners[i].hostname1,
275275
overlappingListeners[i].hostname2,
276276
overlappingListeners[i].listener2,
277277
)
278278
} else {
279279
message = fmt.Sprintf(
280-
"The hostname %s overlaps with the hostname %s in listener %s of gateway %s. ALPN is set to HTTP/1.1 to prevent HTTP/2 connection coalescing",
280+
"The hostname %s overlaps with the hostname %s in listener %s of gateway %s. ALPN will default to HTTP/1.1 to prevent HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy",
281281
overlappingListeners[i].hostname1,
282282
overlappingListeners[i].hostname2,
283283
overlappingListeners[i].listener2,
@@ -355,14 +355,14 @@ func checkOverlappingCertificates(httpsListeners []*ListenerContext) {
355355
if gateway1.Name == gateway2.Name &&
356356
gateway1.Namespace == gateway2.Namespace {
357357
message = fmt.Sprintf(
358-
"The certificate san %s overlaps with the certificate san %s in listener %s. ALPN is set to HTTP/1.1 to prevent HTTP/2 connection coalescing",
358+
"The certificate SAN %s overlaps with the certificate SAN %s in listener %s. ALPN will default to HTTP/1.1 to prevent HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy",
359359
overlappingListeners[i].san1,
360360
overlappingListeners[i].san2,
361361
overlappingListeners[i].listener2,
362362
)
363363
} else {
364364
message = fmt.Sprintf(
365-
"The certificate san %s overlaps with the certificate san %s in listener %s of gateway %s. ALPN is set to HTTP/1.1 to prevent HTTP/2 connection coalescing",
365+
"The certificate SAN %s overlaps with the certificate SAN %s in listener %s of gateway %s. ALPN will default to HTTP/1.1 to prevent HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy",
366366
overlappingListeners[i].san1,
367367
overlappingListeners[i].san2,
368368
overlappingListeners[i].listener2,

‎internal/gatewayapi/listener_test.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -453,14 +453,14 @@ func TestCheckOverlappingCertificates(t *testing.T) {
453453
condition: gwapiv1.ListenerConditionOverlappingTLSConfig,
454454
status: metav1.ConditionTrue,
455455
reason: gwapiv1.ListenerReasonOverlappingCertificates,
456-
message: "The certificate san foo.example.com overlaps with the certificate san foo.example.com in listener listener-2. ALPN is set to HTTP/1.1 to prevent HTTP/2 connection coalescing",
456+
message: "The certificate SAN foo.example.com overlaps with the certificate SAN foo.example.com in listener listener-2. ALPN will default to HTTP/1.1 to prevent HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy",
457457
},
458458
{
459459
listenerName: "listener-2",
460460
condition: gwapiv1.ListenerConditionOverlappingTLSConfig,
461461
status: metav1.ConditionTrue,
462462
reason: gwapiv1.ListenerReasonOverlappingCertificates,
463-
message: "The certificate san foo.example.com overlaps with the certificate san foo.example.com in listener listener-1. ALPN is set to HTTP/1.1 to prevent HTTP/2 connection coalescing",
463+
message: "The certificate SAN foo.example.com overlaps with the certificate SAN foo.example.com in listener listener-1. ALPN will default to HTTP/1.1 to prevent HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy",
464464
},
465465
},
466466
},
@@ -516,14 +516,14 @@ func TestCheckOverlappingCertificates(t *testing.T) {
516516
condition: gwapiv1.ListenerConditionOverlappingTLSConfig,
517517
status: metav1.ConditionTrue,
518518
reason: gwapiv1.ListenerReasonOverlappingCertificates,
519-
message: "The certificate san *.example.com overlaps with the certificate san foo.example.com in listener listener-2. ALPN is set to HTTP/1.1 to prevent HTTP/2 connection coalescing",
519+
message: "The certificate SAN *.example.com overlaps with the certificate SAN foo.example.com in listener listener-2. ALPN will default to HTTP/1.1 to prevent HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy",
520520
},
521521
{
522522
listenerName: "listener-2",
523523
condition: gwapiv1.ListenerConditionOverlappingTLSConfig,
524524
status: metav1.ConditionTrue,
525525
reason: gwapiv1.ListenerReasonOverlappingCertificates,
526-
message: "The certificate san foo.example.com overlaps with the certificate san *.example.com in listener listener-1. ALPN is set to HTTP/1.1 to prevent HTTP/2 connection coalescing",
526+
message: "The certificate SAN foo.example.com overlaps with the certificate SAN *.example.com in listener listener-1. ALPN will default to HTTP/1.1 to prevent HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy",
527527
},
528528
},
529529
},
@@ -555,14 +555,14 @@ func TestCheckOverlappingCertificates(t *testing.T) {
555555
condition: gwapiv1.ListenerConditionOverlappingTLSConfig,
556556
status: metav1.ConditionTrue,
557557
reason: gwapiv1.ListenerReasonOverlappingCertificates,
558-
message: "The certificate san bar.example.org overlaps with the certificate san *.example.org in listener listener-2. ALPN is set to HTTP/1.1 to prevent HTTP/2 connection coalescing",
558+
message: "The certificate SAN bar.example.org overlaps with the certificate SAN *.example.org in listener listener-2. ALPN will default to HTTP/1.1 to prevent HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy",
559559
},
560560
{
561561
listenerName: "listener-2",
562562
condition: gwapiv1.ListenerConditionOverlappingTLSConfig,
563563
status: metav1.ConditionTrue,
564564
reason: gwapiv1.ListenerReasonOverlappingCertificates,
565-
message: "The certificate san *.example.org overlaps with the certificate san bar.example.org in listener listener-1. ALPN is set to HTTP/1.1 to prevent HTTP/2 connection coalescing",
565+
message: "The certificate SAN *.example.org overlaps with the certificate SAN bar.example.org in listener listener-1. ALPN will default to HTTP/1.1 to prevent HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy",
566566
},
567567
},
568568
},

‎internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-certs.out.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,9 @@ gateways:
6767
status: "True"
6868
type: ResolvedRefs
6969
- lastTransitionTime: null
70-
message: The certificate san *.example.com overlaps with the certificate san
71-
bar.example.com in listener https-2. ALPN is set to HTTP/1.1 to prevent
72-
HTTP/2 connection coalescing
70+
message: The certificate SAN *.example.com overlaps with the certificate SAN
71+
bar.example.com in listener https-2. ALPN will default to HTTP/1.1 to prevent
72+
HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy
7373
reason: OverlappingCertificates
7474
status: "True"
7575
type: OverlappingTLSConfig
@@ -97,9 +97,9 @@ gateways:
9797
status: "True"
9898
type: ResolvedRefs
9999
- lastTransitionTime: null
100-
message: The certificate san bar.example.com overlaps with the certificate
101-
san *.example.com in listener https-1. ALPN is set to HTTP/1.1 to prevent
102-
HTTP/2 connection coalescing
100+
message: The certificate SAN bar.example.com overlaps with the certificate
101+
SAN *.example.com in listener https-1. ALPN will default to HTTP/1.1 to
102+
prevent HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy
103103
reason: OverlappingCertificates
104104
status: "True"
105105
type: OverlappingTLSConfig

‎internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs-merged-gateways.out.yaml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,10 @@ gateways:
4141
status: "True"
4242
type: ResolvedRefs
4343
- lastTransitionTime: null
44-
message: The certificate san *.example.com overlaps with the certificate san
45-
bar.example.com in listener https-1 of gateway gateway-2. ALPN is set to
46-
HTTP/1.1 to prevent HTTP/2 connection coalescing
44+
message: The certificate SAN *.example.com overlaps with the certificate SAN
45+
bar.example.com in listener https-1 of gateway gateway-2. ALPN will default
46+
to HTTP/1.1 to prevent HTTP/2 connection coalescing, unless explicitly configured
47+
via ClientTrafficPolicy
4748
reason: OverlappingCertificates
4849
status: "True"
4950
type: OverlappingTLSConfig
@@ -95,9 +96,10 @@ gateways:
9596
status: "True"
9697
type: ResolvedRefs
9798
- lastTransitionTime: null
98-
message: The certificate san bar.example.com overlaps with the certificate
99-
san *.example.com in listener https-1 of gateway gateway-1. ALPN is set
100-
to HTTP/1.1 to prevent HTTP/2 connection coalescing
99+
message: The certificate SAN bar.example.com overlaps with the certificate
100+
SAN *.example.com in listener https-1 of gateway gateway-1. ALPN will default
101+
to HTTP/1.1 to prevent HTTP/2 connection coalescing, unless explicitly configured
102+
via ClientTrafficPolicy
101103
reason: OverlappingCertificates
102104
status: "True"
103105
type: OverlappingTLSConfig

‎internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs.out.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,9 @@ gateways:
5454
status: "True"
5555
type: ResolvedRefs
5656
- lastTransitionTime: null
57-
message: The certificate san *.example.com overlaps with the certificate san
58-
bar.example.com in listener https-2. ALPN is set to HTTP/1.1 to prevent
59-
HTTP/2 connection coalescing
57+
message: The certificate SAN *.example.com overlaps with the certificate SAN
58+
bar.example.com in listener https-2. ALPN will default to HTTP/1.1 to prevent
59+
HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy
6060
reason: OverlappingCertificates
6161
status: "True"
6262
type: OverlappingTLSConfig
@@ -84,9 +84,9 @@ gateways:
8484
status: "True"
8585
type: ResolvedRefs
8686
- lastTransitionTime: null
87-
message: The certificate san bar.example.com overlaps with the certificate
88-
san *.example.com in listener https-1. ALPN is set to HTTP/1.1 to prevent
89-
HTTP/2 connection coalescing
87+
message: The certificate SAN bar.example.com overlaps with the certificate
88+
SAN *.example.com in listener https-1. ALPN will default to HTTP/1.1 to
89+
prevent HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy
9090
reason: OverlappingCertificates
9191
status: "True"
9292
type: OverlappingTLSConfig

‎internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-merged-gateways.out.yaml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,9 @@ gateways:
4242
type: ResolvedRefs
4343
- lastTransitionTime: null
4444
message: The hostname foo.example.com overlaps with the hostname *.example.com
45-
in listener https-1 of gateway gateway-2. ALPN is set to HTTP/1.1 to prevent
46-
HTTP/2 connection coalescing
45+
in listener https-1 of gateway gateway-2. ALPN will default to HTTP/1.1
46+
to prevent HTTP/2 connection coalescing, unless explicitly configured via
47+
ClientTrafficPolicy
4748
reason: OverlappingHostnames
4849
status: "True"
4950
type: OverlappingTLSConfig
@@ -109,8 +110,9 @@ gateways:
109110
type: ResolvedRefs
110111
- lastTransitionTime: null
111112
message: The hostname *.example.com overlaps with the hostname foo.example.com
112-
in listener https-1 of gateway gateway-1. ALPN is set to HTTP/1.1 to prevent
113-
HTTP/2 connection coalescing
113+
in listener https-1 of gateway gateway-1. ALPN will default to HTTP/1.1
114+
to prevent HTTP/2 connection coalescing, unless explicitly configured via
115+
ClientTrafficPolicy
114116
reason: OverlappingHostnames
115117
status: "True"
116118
type: OverlappingTLSConfig

‎internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames.out.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,8 @@ gateways:
6868
type: ResolvedRefs
6969
- lastTransitionTime: null
7070
message: The hostname foo.example.com overlaps with the hostname *.example.com
71-
in listener https-2. ALPN is set to HTTP/1.1 to prevent HTTP/2 connection
72-
coalescing
71+
in listener https-2. ALPN will default to HTTP/1.1 to prevent HTTP/2 connection
72+
coalescing, unless explicitly configured via ClientTrafficPolicy
7373
reason: OverlappingHostnames
7474
status: "True"
7575
type: OverlappingTLSConfig
@@ -98,8 +98,8 @@ gateways:
9898
type: ResolvedRefs
9999
- lastTransitionTime: null
100100
message: The hostname *.example.com overlaps with the hostname foo.example.com
101-
in listener https-1. ALPN is set to HTTP/1.1 to prevent HTTP/2 connection
102-
coalescing
101+
in listener https-1. ALPN will default to HTTP/1.1 to prevent HTTP/2 connection
102+
coalescing, unless explicitly configured via ClientTrafficPolicy
103103
reason: OverlappingHostnames
104104
status: "True"
105105
type: OverlappingTLSConfig

‎internal/xds/translator/listener.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -423,7 +423,8 @@ func (t *Translator) addHCMToXDSListener(xdsListener *listenerv3.Listener, irLis
423423
config := irListener.TLS.DeepCopy()
424424
// If the listener has overlapping TLS config with other listeners, we need to disable HTTP/2
425425
// to avoid the HTTP/2 Connection Coalescing issue (see https://gateway-api.sigs.k8s.io/geps/gep-3567/)
426-
if irListener.TLSOverlaps {
426+
// Note: if ALPN is explicitly set by the user using ClientTrafficPolicy, we keep it as is
427+
if irListener.TLSOverlaps && config.ALPNProtocols == nil {
427428
config.ALPNProtocols = []string{"http/1.1"}
428429
}
429430
tSocket, err = buildXdsDownstreamTLSSocket(config)

‎internal/xds/translator/testdata/in/xds-ir/listener-overlapping-tls-config.yaml‎

Lines changed: 45 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ http:
3838
tls:
3939
alpnProtocols: null
4040
certificates:
41-
- name: envoy-gateway/tls-secret-example-com
41+
- name: envoy-gateway/tls-secret-foo-example-com
4242
privateKey: '[redacted]'
4343
certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMyRENDQWNBQ0FRQXdEUVlKS29aSWh2Y05BUUVMQlFBd0xURVZNQk1HQTFVRUNnd01aWGhoYlhCc1pTQkoKYm1NdU1SUXdFZ1lEVlFRRERBdGxlR0Z0Y0d4bExtTnZiVEFlRncweU5UQTBNakV3T1RFd05ETmFGdzB6TlRBMApNVGt3T1RFd05ETmFNRGN4RmpBVUJnTlZCQU1NRFNvdVpYaGhiWEJzWlM1amIyMHhIVEFiQmdOVkJBb01GR1Y0CllXMXdiR1VnYjNKbllXNXBlbUYwYVc5dU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0MKQVFFQXY0anl4TUh1YzQzMHdvWkk4M1JSMXVxU2gvbm9MVWVPdDZnMkNKaFVFYXNaeUNOMzN3bFRRRDE0SEhkSwpOb1k4SThWd1pOZFZCNGpjRzlnb3dDVmVQY3lqRzZPaGl1aUZNWnU2NzV6dWZEWnRlRTNEY3lTbFgrY2lSbVZZCkNuSmk3QkV3NlJMUUJ0bVV6WGxtYmRpVXE5djJwalVBL2R3ZnRLRHRZTHFrVytvTSt5MWg3cjRJV0JVK2RVcU0KcGtTem5VSCtKN1JoRkFsdytmRWlVSFRLemlCMkVtdjc3Mi91bS96NHdMWnJIeWNGbmc4L1FCM0JIUktXVTV4eQp3bWNTQ2xrVlMvWWNpMFVXcnR2eGhwck9wTUhQUGR2QkZ2M2NaWGNpUUJjb0ZNcGxsQzV0UURvdWJ0dEV1d3JpCi8rVktKWkUrSVl4ei9YeUd3Y3dJRnIzWG13SURBUUFCTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBU3VLaE8KcGtwL1VSclphbEU0OUlnc0xkN3hSTlBhREVkQ1RWZ3Qvc3praUhnSDB1NDBVaVV6KzVzaDRpdlJOazRqTm1zRwprb3FwQlBVS3pvVmtrSTcxUWQ4bHh1VzF2dkxZMXVvM0RIS2svdDFpUWVZWWpERlk3YzUxVG1BT015WUdKTlhxCi9EbW84UWgzaFB1RnI3a29kUjBLSkJyc0RsMEhoWVBjUnpWOW1sQ2lrU1B4THJGTUNwZGx0QUw2UEprSVpucUgKc1g5dEtVZk1uYW5jMkpHZTZVTDE1ODBEV2xQTUcrMU1qRElCVXdxWWYzaWNKb0NYclAwbzNmckRKcTE2VnpidApkalRtVGswakx1bGkvQ2JCZzh4dWp4emo4bmRPcVNkd05kd091OWoxSmZ2Q0I1RjZ4S0VTenowOVo5TzlOZUM5CjMrd1pLTlRSOXVEdDRKNksKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
4444
tlsOverlaps: true
@@ -85,3 +85,47 @@ http:
8585
privateKey: '[redacted]'
8686
certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMyRENDQWNBQ0FRQXdEUVlKS29aSWh2Y05BUUVMQlFBd0xURVZNQk1HQTFVRUNnd01aWGhoYlhCc1pTQkoKYm1NdU1SUXdFZ1lEVlFRRERBdGxlR0Z0Y0d4bExtTnZiVEFlRncweU5UQTBNakV3T1RFd05ETmFGdzB6TlRBMApNVGt3T1RFd05ETmFNRGN4RmpBVUJnTlZCQU1NRFNvdVpYaGhiWEJzWlM1amIyMHhIVEFiQmdOVkJBb01GR1Y0CllXMXdiR1VnYjNKbllXNXBlbUYwYVc5dU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0MKQVFFQXY0anl4TUh1YzQzMHdvWkk4M1JSMXVxU2gvbm9MVWVPdDZnMkNKaFVFYXNaeUNOMzN3bFRRRDE0SEhkSwpOb1k4SThWd1pOZFZCNGpjRzlnb3dDVmVQY3lqRzZPaGl1aUZNWnU2NzV6dWZEWnRlRTNEY3lTbFgrY2lSbVZZCkNuSmk3QkV3NlJMUUJ0bVV6WGxtYmRpVXE5djJwalVBL2R3ZnRLRHRZTHFrVytvTSt5MWg3cjRJV0JVK2RVcU0KcGtTem5VSCtKN1JoRkFsdytmRWlVSFRLemlCMkVtdjc3Mi91bS96NHdMWnJIeWNGbmc4L1FCM0JIUktXVTV4eQp3bWNTQ2xrVlMvWWNpMFVXcnR2eGhwck9wTUhQUGR2QkZ2M2NaWGNpUUJjb0ZNcGxsQzV0UURvdWJ0dEV1d3JpCi8rVktKWkUrSVl4ei9YeUd3Y3dJRnIzWG13SURBUUFCTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBU3VLaE8KcGtwL1VSclphbEU0OUlnc0xkN3hSTlBhREVkQ1RWZ3Qvc3praUhnSDB1NDBVaVV6KzVzaDRpdlJOazRqTm1zRwprb3FwQlBVS3pvVmtrSTcxUWQ4bHh1VzF2dkxZMXVvM0RIS2svdDFpUWVZWWpERlk3YzUxVG1BT015WUdKTlhxCi9EbW84UWgzaFB1RnI3a29kUjBLSkJyc0RsMEhoWVBjUnpWOW1sQ2lrU1B4THJGTUNwZGx0QUw2UEprSVpucUgKc1g5dEtVZk1uYW5jMkpHZTZVTDE1ODBEV2xQTUcrMU1qRElCVXdxWWYzaWNKb0NYclAwbzNmckRKcTE2VnpidApkalRtVGswakx1bGkvQ2JCZzh4dWp4emo4bmRPcVNkd05kd091OWoxSmZ2Q0I1RjZ4S0VTenowOVo5TzlOZUM5CjMrd1pLTlRSOXVEdDRKNksKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
8787
tlsOverlaps: true
88+
- address: 0.0.0.0 # this listener should keep the ALPN because it's explictily set
89+
hostnames:
90+
- bar.example.com
91+
isHTTP2: false
92+
metadata:
93+
kind: Gateway
94+
name: gateway-1
95+
namespace: envoy-gateway
96+
sectionName: https-1
97+
name: envoy-gateway/gateway-1/https-1
98+
path:
99+
escapedSlashesAction: UnescapeAndRedirect
100+
mergeSlashes: true
101+
port: 8443
102+
routes:
103+
- destination:
104+
name: httproute/envoy-gateway/httproute-1/rule/0
105+
settings:
106+
- addressType: IP
107+
endpoints:
108+
- host: 7.7.7.7
109+
port: 8080
110+
name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
111+
protocol: HTTP
112+
weight: 1
113+
hostname: foo.example.com
114+
isHTTP2: false
115+
metadata:
116+
kind: HTTPRoute
117+
name: httproute-1
118+
namespace: envoy-gateway
119+
name: httproute/envoy-gateway/httproute-1/rule/0/match/0/foo_example_com
120+
pathMatch:
121+
distinct: false
122+
name: ""
123+
prefix: /
124+
tls:
125+
alpnProtocols:
126+
- h2
127+
certificates:
128+
- name: envoy-gateway/tls-secret-bar-example-com
129+
privateKey: '[redacted]'
130+
certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMyRENDQWNBQ0FRQXdEUVlKS29aSWh2Y05BUUVMQlFBd0xURVZNQk1HQTFVRUNnd01aWGhoYlhCc1pTQkoKYm1NdU1SUXdFZ1lEVlFRRERBdGxlR0Z0Y0d4bExtTnZiVEFlRncweU5UQTBNakV3T1RFd05ETmFGdzB6TlRBMApNVGt3T1RFd05ETmFNRGN4RmpBVUJnTlZCQU1NRFNvdVpYaGhiWEJzWlM1amIyMHhIVEFiQmdOVkJBb01GR1Y0CllXMXdiR1VnYjNKbllXNXBlbUYwYVc5dU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0MKQVFFQXY0anl4TUh1YzQzMHdvWkk4M1JSMXVxU2gvbm9MVWVPdDZnMkNKaFVFYXNaeUNOMzN3bFRRRDE0SEhkSwpOb1k4SThWd1pOZFZCNGpjRzlnb3dDVmVQY3lqRzZPaGl1aUZNWnU2NzV6dWZEWnRlRTNEY3lTbFgrY2lSbVZZCkNuSmk3QkV3NlJMUUJ0bVV6WGxtYmRpVXE5djJwalVBL2R3ZnRLRHRZTHFrVytvTSt5MWg3cjRJV0JVK2RVcU0KcGtTem5VSCtKN1JoRkFsdytmRWlVSFRLemlCMkVtdjc3Mi91bS96NHdMWnJIeWNGbmc4L1FCM0JIUktXVTV4eQp3bWNTQ2xrVlMvWWNpMFVXcnR2eGhwck9wTUhQUGR2QkZ2M2NaWGNpUUJjb0ZNcGxsQzV0UURvdWJ0dEV1d3JpCi8rVktKWkUrSVl4ei9YeUd3Y3dJRnIzWG13SURBUUFCTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBU3VLaE8KcGtwL1VSclphbEU0OUlnc0xkN3hSTlBhREVkQ1RWZ3Qvc3praUhnSDB1NDBVaVV6KzVzaDRpdlJOazRqTm1zRwprb3FwQlBVS3pvVmtrSTcxUWQ4bHh1VzF2dkxZMXVvM0RIS2svdDFpUWVZWWpERlk3YzUxVG1BT015WUdKTlhxCi9EbW84UWgzaFB1RnI3a29kUjBLSkJyc0RsMEhoWVBjUnpWOW1sQ2lrU1B4THJGTUNwZGx0QUw2UEprSVpucUgKc1g5dEtVZk1uYW5jMkpHZTZVTDE1ODBEV2xQTUcrMU1qRElCVXdxWWYzaWNKb0NYclAwbzNmckRKcTE2VnpidApkalRtVGswakx1bGkvQ2JCZzh4dWp4emo4bmRPcVNkd05kd091OWoxSmZ2Q0I1RjZ4S0VTenowOVo5TzlOZUM5CjMrd1pLTlRSOXVEdDRKNksKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
131+
tlsOverlaps: true

0 commit comments

Comments
 (0)