From 225048a47a67b5eb3270240ea451d69564493cd1 Mon Sep 17 00:00:00 2001 From: Teju Nareddy Date: Sun, 9 Mar 2025 22:10:08 -0500 Subject: [PATCH] docs: clarify `ExtensionTLS` type Signed-off-by: Teju Nareddy --- api/v1alpha1/envoygateway_types.go | 9 ++++----- site/content/en/latest/api/extension_types.md | 4 ++-- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/api/v1alpha1/envoygateway_types.go b/api/v1alpha1/envoygateway_types.go index 33893c8569..ead5759695 100644 --- a/api/v1alpha1/envoygateway_types.go +++ b/api/v1alpha1/envoygateway_types.go @@ -560,13 +560,12 @@ type ExtensionService struct { TLS *ExtensionTLS `json:"tls,omitempty"` } -// ExtensionTLS defines the TLS configuration when connecting to an extension service +// ExtensionTLS defines the TLS configuration when connecting to an extension service. type ExtensionTLS struct { - // CertificateRef contains a references to objects (Kubernetes objects or otherwise) that - // contains a TLS certificate and private keys. These certificates are used to - // establish a TLS handshake to the extension server. + // CertificateRef is a reference to a Kubernetes Secret with a CA certificate in a key named "tls.crt". // - // CertificateRef can only reference a Kubernetes Secret at this time. + // The CA certificate is used by Envoy Gateway the verify the server certificate presented by the extension server. + // At this time, Envoy Gateway does not support Client Certificate authentication of Envoy Gateway towards the extension server (mTLS). // // +kubebuilder:validation:Required CertificateRef gwapiv1.SecretObjectReference `json:"certificateRef"` diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 3483a8e013..17fb45b1da 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -1721,14 +1721,14 @@ _Appears in:_ -ExtensionTLS defines the TLS configuration when connecting to an extension service +ExtensionTLS defines the TLS configuration when connecting to an extension service. _Appears in:_ - [ExtensionService](#extensionservice) | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | -| `certificateRef` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)_ | true | | CertificateRef contains a references to objects (Kubernetes objects or otherwise) that
contains a TLS certificate and private keys. These certificates are used to
establish a TLS handshake to the extension server.
CertificateRef can only reference a Kubernetes Secret at this time. | +| `certificateRef` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)_ | true | | CertificateRef is a reference to a Kubernetes Secret with a CA certificate in a key named "tls.crt".
The CA certificate is used by Envoy Gateway the verify the server certificate presented by the extension server.
At this time, Envoy Gateway does not support Client Certificate authentication of Envoy Gateway towards the extension server (mTLS). | #### ExtractFrom