set upstream tls for extension and dnsname clusters

Signed-off-by: Clay Kauzlaric <ckauzlaric@vmware.com>
projectcontour · Dec 8, 2023 · 2177ee7 · 2177ee7
1 parent 381f66f
commit 2177ee7
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 0 deletions.
diff --git a/cmd/contour/serve.go b/cmd/contour/serve.go
@@ -1200,6 +1200,7 @@ func (s *Server) getDAGBuilder(dbc dagBuilderConfig) *dag.Builder {
 			FieldLogger:       s.log.WithField("context", "ExtensionServiceProcessor"),
 			ClientCertificate: dbc.clientCert,
 			ConnectTimeout:    dbc.connectTimeout,
+			UpstreamTLS:       dbc.upstreamTLS,
 		},
 		&dag.HTTPProxyProcessor{
 			EnableExternalNameService:     dbc.enableExternalNameService,

diff --git a/internal/dag/extension_processor.go b/internal/dag/extension_processor.go
@@ -39,6 +39,10 @@ type ExtensionServiceProcessor struct {
 
 	// ConnectTimeout defines how long the proxy should wait when establishing connection to upstream service.
 	ConnectTimeout time.Duration
+
+	// UpstreamTLS defines the TLS settings like min/max version
+	// and cipher suites for upstream connections.
+	UpstreamTLS *contour_api_v1alpha1.EnvoyTLS
 }
 
 var _ Processor = &ExtensionServiceProcessor{}
@@ -114,6 +118,7 @@ func (p *ExtensionServiceProcessor) buildExtensionService(
 		ClusterTimeoutPolicy: ctp,
 		SNI:                  "",
 		ClientCertificate:    clientCertSecret,
+		UpstreamTLS:          (*UpstreamTLS)(p.UpstreamTLS),
 	}
 
 	lbPolicy := loadBalancerPolicy(ext.Spec.LoadBalancerPolicy)

diff --git a/internal/dag/httpproxy_processor.go b/internal/dag/httpproxy_processor.go
@@ -493,6 +493,7 @@ func (p *HTTPProxyProcessor) computeHTTPProxy(proxy *contour_api_v1.HTTPProxy) {
 							Port:               port,
 							DNSLookupFamily:    dnsLookupFamily,
 							UpstreamValidation: uv,
+							UpstreamTLS:        (*UpstreamTLS)(p.UpstreamTLS),
 						},
 						CacheDuration: cacheDuration,
 					},