liveBook · Manning

TLSRoute

As explained in Kubernetes in Action, Second Edition

A TLSRoute is a Kubernetes Gateway API resource that routes TLS traffic to backend services using information available from the encrypted connection, primarily the recipient hostname.

A TLSRoute is a Kubernetes Gateway API resource for routing encrypted TLS traffic to backend services. With pass-through TLS, the gateway cannot inspect HTTP details; it primarily uses the recipient hostname. section 13.4.2

Use a TLSRoute when TLS remains encrypted from the client to the backend. Configure the Gateway listener with protocol TLS and tls.mode Passthrough; unlike HTTPS termination, the gateway does not know the underlying application protocol. section 13.4.2

Route a hostname to a TLS backend

A TLSRoute can attach to the kiada Gateway, match kiada.example.com, and forward traffic to the kiada-stable Service on port 443. Its essential fields are parentRefs, hostnames, and backendRefs. section 13.4.2

Listing 13.16 Configuring a gateway for TLS pass-through
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: kiada
spec:
  gatewayClassName: istio
  listeners:
  - name: http
    port: 80
    protocol: HTTP
  - name: tls             #1
    port: 443               #2
    protocol: TLS              #3
    tls:                     #4
      mode: Passthrough      #4

Inspect the Gateway listener required before applying a TLSRoute: port 443 uses protocol TLS and Passthrough mode. section 13.4.2

Listing 13.17 Creating a TLSRoute
apiVersion: gateway.networking.k8s.io/v1alpha2     #1
kind: TLSRoute      #1                              
metadata:
  name: kiada
spec:
  parentRefs:       #2
  - name: kiada     #2
  hostnames:             #3
  - kiada.example.com    #3
  rules:            #4
  - backendRefs:              #5
    - name: kiada-stable      #5
      port: 443               #5

Inspect a complete TLSRoute manifest showing the v1alpha2 API, parent Gateway, hostname match, and backend reference. section 13.4.2

How Kubernetes in Action, Second Edition covers it

How deep it goes
Explains listener configuration, resource fields, backend routing, and the failure caused by omitting the TLSRoute.
Examples
Uses a kiada.example.com hostname, a kiada Gateway, the kiada-stable Service, and a curl connection test.
What it assumes
Assumes a Gateway and backend Service, while teaching the required TLS listener and TLSRoute configuration.
What you can do after
Operate/configure pass-through TLS routing from a Gateway listener to a backend Service.
How it connects
Connects TLSRoute with Gateway, TLS pass-through, HTTPRoute, backend services, and TLS termination.
Cover of Kubernetes in Action, Second Edition
liveBookmanning.com
Read Kubernetes in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Kubernetes in Action, Second Edition. The section links point to the parts of the book it draws on.