Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NGF: Secret support for BackendTLSPolicy #315

Merged
merged 1 commit into from
Mar 28, 2025
+5 −3
Merged

NGF: Secret support for BackendTLSPolicy #315

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion content/ngf/how-to/traffic-security/securing-backend-traffic.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -216,7 +216,9 @@ We can see we a status 400 Bad Request message from NGINX.

## Create the backend TLS configuration

To configure the backend TLS terminationm, first we will create the ConfigMap that holds the `ca.crt` entry for verifying our self-signed certificates:
{{< note >}} This example uses a `ConfigMap` to store the CA certificate, but you can also use a `Secret`. This could be a better option if integrating with [cert-manager](https://cert-manager.io/). The `Secret` should have a `ca.crt` key that holds the contents of the CA certificate. {{< /note >}}

To configure the backend TLS termination, first we will create the ConfigMap that holds the `ca.crt` entry for verifying our self-signed certificates:

```yaml
kubectl apply -f - <<EOF
Expand Down
4 changes: 2 additions & 2 deletions content/ngf/overview/gateway-api-compatibility.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -355,10 +355,10 @@ Fields:
- `kind`: Supports `Service`.
- `name`: Supported.
- `validation`
- `caCertificateRefs`: Supports single reference to a `ConfigMap`, with the CA certificate in a key named `ca.crt`.
- `caCertificateRefs`: Supports single reference to a `ConfigMap` or `Secret`, with the CA certificate in a key named `ca.crt`.
- `name`: Supported.
- `group`: Supported.
- `kind`: Supports `ConfigMap`.
- `kind`: Supports `ConfigMap` and `Secret`.
- `hostname`: Supported.
- `wellKnownCertificates`: Supports `System`. This will set the CA certificate to the Alpine system root CA path `/etc/ssl/cert.pem`. NB: This option will only work if the NGINX image used is Alpine based. The NGF NGINX images are Alpine based by default.
- `subjectAltNames`: Not supported.
Expand Down
Loading