Skip to content

Commit 19c3711

Browse files
ivanmatmatiivanmatmati
committed
MINOR: add TLS route example
1 parent f687af0 commit 19c3711

File tree

6 files changed

+192
-0
lines changed

6 files changed

+192
-0
lines changed

‎example/README.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,47 @@
11
## HUG
22

3+
## HTTP Echo docker image
4+
5+
### Building the `http-echo` Docker Image
6+
7+
This example requires the **http-echo** Docker image, which is used as a simple backend application for testing TLS passthrough and HTTP routing.
8+
9+
The source code for the image is located in the HAProxy Unified Gateway repository:
10+
11+
[https://github.com/haproxytech/haproxy-unified-gateway](https://github.com/haproxytech/haproxy-unified-gateway)
12+
13+
#### Steps to build the image
14+
15+
1. Clone the repository (or navigate to the folder if you already have it):
16+
17+
```bash
18+
git clone --depth 1 https://github.com/haproxytech/haproxy-unified-gateway
19+
cd haproxy-unified-gateway/ci/http-echo
20+
```
21+
22+
2. Build the Docker image
23+
24+
```sh
25+
docker build -t http-echo:latest .
26+
```
27+
28+
3. Make the image available to your Kubernetes cluster
29+
30+
* Option 1: Push to a Docker registry accessible from the cluster:
31+
32+
```bash
33+
docker tag http-echo:latest <your-registry>/http-echo:latest
34+
docker push <your-registry>/http-echo:latest
35+
```
36+
37+
* Option 2: Load the image into a Kind cluster (if you are using Kind)
38+
39+
```sh
40+
kind load docker-image http-echo:latest --name <kind-cluster-name>
41+
```
42+
43+
After the image is available in your cluster, you can apply the example manifests, and the TLSRoute/HTTPRoute examples will use this image as the backend.
44+
345
### Gateway API
446

547
* [Gateway API](./deploy/gateway-api/README.md): Gateway API resource.

‎example/tlsroute/sslpassthrough/README.md‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# TLSRoute SSL Passthrough Example
2+
3+
This example demonstrates how to expose a backend application using **TLS passthrough** with a `TLSRoute` and the **HAProxy Kubernetes Gateway**.
4+
5+
When using passthrough mode, the Gateway forwards the encrypted TLS stream directly to the backend service **without terminating TLS**. This allows the backend to present its own certificate.
6+
7+
---
8+
9+
## What is deployed
10+
11+
This example installs the following resources:
12+
13+
- **GatewayClass**:
14+
`haproxy` — defines a class of Gateways managed by the HAProxy Kubernetes Gateway controller.
15+
16+
- **Gateway**:
17+
`tls-gateway` — exposes a listener on port **31443** configured for **TLS passthrough** and accepting routes for the hostname `example.local`.
18+
19+
- **TLSRoute**:
20+
- `tlsroute` — matches:
21+
- SNI: `example.local`
22+
- Any path
23+
and forwards traffic to the backend service `http-echo`, which terminates TLS.
24+
25+
---
26+
27+
## Deploying the example
28+
29+
```bash
30+
kubectl apply -n <your example namespace> -f .
31+
```
32+
33+
## Validating passthrough functionality
34+
35+
To test traffic flow, open a shell inside the Gateway controller pod (or anywhere with network access to the Gateway listener).
36+
37+
## Using curl
38+
39+
Because the Gateway is in passthrough mode, the backend’s certificate should be presented directly to the client.
40+
41+
Run:
42+
43+
```sh
44+
curl -v -k \
45+
-H "Host: example.local" \
46+
--resolve "example.local:31443:127.0.0.1" \
47+
https://example.local:31443/
48+
```
49+
You should observe:
50+
* The TLS handshake showing the backend’s certificate, not the Gateway’s.
51+
* A successful HTTP 200 response from the echo application.
52+
53+
Example excerpt from the curl -v output:
54+
55+
```
56+
* Server certificate:
57+
* subject: C=FR; L=PARIS; O=Echo HTTP; CN=http-echo-5fbc86ccc-db9hh
58+
* start date: Dec 2 09:22:28 2025 GMT
59+
* expire date: Dec 2 09:22:28 2026 GMT
60+
* issuer: C=FR; L=PARIS; O=Echo HTTP; CN=http-echo-5fbc86ccc-db9hh
61+
* SSL certificate verify result: self-signed certificate (18), continuing anyway.
62+
* Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
63+
```
64+
65+
This confirms that:
66+
67+
1. The request reached the Gateway.
68+
69+
2. The Gateway routed the encrypted TLS stream through to the backend.
70+
71+
3. TLS termination occurred on the backend, proving that passthrough mode is functioning correctly.

‎example/tlsroute/sslpassthrough/gateway.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: gateway.networking.k8s.io/v1
2+
kind: Gateway
3+
metadata:
4+
name: tls-gateway
5+
spec:
6+
gatewayClassName: haproxy
7+
listeners:
8+
- allowedRoutes:
9+
kinds:
10+
- group: gateway.networking.k8s.io
11+
kind: TLSRoute
12+
hostname: example.local
13+
name: tls
14+
port: 31443
15+
protocol: TLS
16+
tls:
17+
mode: Passthrough

‎example/tlsroute/sslpassthrough/gatewayclass.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: gateway.networking.k8s.io/v1
2+
kind: GatewayClass
3+
metadata:
4+
name: haproxy
5+
spec:
6+
controllerName: gate.haproxy.org/hug

‎example/tlsroute/sslpassthrough/http-echo.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
kind: Deployment
2+
apiVersion: apps/v1
3+
metadata:
4+
name: http-echo
5+
spec:
6+
replicas: 1
7+
selector:
8+
matchLabels:
9+
app: http-echo
10+
template:
11+
metadata:
12+
labels:
13+
app: http-echo
14+
spec:
15+
containers:
16+
- name: http-echo
17+
image: "haproxytech/http-echo:latest"
18+
imagePullPolicy: Never
19+
ports:
20+
- name: http
21+
containerPort: 8888
22+
protocol: TCP
23+
- name: https
24+
containerPort: 8443
25+
protocol: TCP
26+
---
27+
kind: Service
28+
apiVersion: v1
29+
metadata:
30+
name: http-echo
31+
spec:
32+
ports:
33+
- name: http
34+
protocol: TCP
35+
port: 80
36+
targetPort: http
37+
- name: https
38+
protocol: TCP
39+
port: 443
40+
targetPort: https
41+
selector:
42+
app: http-echo

‎example/tlsroute/sslpassthrough/tlsroute.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: gateway.networking.k8s.io/v1alpha2
2+
kind: TLSRoute
3+
metadata:
4+
name: tlsroute
5+
spec:
6+
parentRefs:
7+
- name: tls-gateway
8+
sectionName: tls
9+
hostnames:
10+
- "example.local"
11+
rules:
12+
- backendRefs:
13+
- name: http-echo
14+
port: 443

0 commit comments

Comments
 (0)