feat: Support SNI based TLS Route

[tokers]

Now Apache APISIX supports to match the stream route with TLS SNI (apache/apisix#4433), we can implement it in ApisixRoute.

[tao12345666333]

LGTM

[svendberg]

Any ETA for this? At the moment we have to manually call the API and set SNI for stream routes to support TLS. It would be nice to use the ApisixRoute CRD without having to manually update the streamroute with SNI afterwards.

[tao12345666333]

It will be added in the next version v1.5 at the earliest, and v1.6 at the latest.

[tao12345666333]

@svendberg Is this feature of APISIX currently used in your production environment?

[svendberg]

We use it in production to expose MQTT endpoints ( TCP ) with TLS for a multi-tenant solution. Right now, we use an ApisixRoute to create the upstream and a "dummy" stream_route in Apisix. Then we use the Apisix API to create a new stream_route with an SNI defined, reusing the upstream created by ApisixRoute.

[mangoGoForward]

WeOpen Star

I'd like to work on this issue.

[tao12345666333]

thanks @mangoGoForward
Assigned

[mangoGoForward]

Hi @tao12345666333 . On the implementation, I want to confirm a few things:

1. We should add sni in types.

   apisix-ingress-controller/pkg/types/apisix/v1/types.go

   Lines 331 to 339 in 3cccd56

   	type StreamRoute struct {
   	// TODO metadata should use Metadata type
   	ID string `json:"id,omitempty" yaml:"id,omitempty"`
   	Desc string `json:"desc,omitempty" yaml:"desc,omitempty"`
   	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
   	ServerPort int32 `json:"server_port,omitempty" yaml:"server_port,omitempty"`
   	UpstreamId string `json:"upstream_id,omitempty" yaml:"upstream_id,omitempty"`
   	Upstream *Upstream `json:"upstream,omitempty" yaml:"upstream,omitempty"`
   	}

2. When ApisixRoute translate to StreamRoute, we should add sni to StreamRoute instance?
   

   apisix-ingress-controller/pkg/kube/translation/apisix_route.go

   Line 732 in 3cccd56

   sr.ServerPort = part.Match.IngressPort

   
   then create or update it.
   But I am confused about that which field in ApisixRoute we can use.

[tokers]

@mangoGoForward What about just using Host or SNI?

[tao12345666333]

I prefer Host

[mangoGoForward]

I prefer Host

But seems ApisixRouteSpec.Stream doesn't have this property? If I'm missed the meaning, please correct me, thanks.

[tao12345666333]

@mangoGoForward sorry for delay.

But seems ApisixRouteSpec.Stream doesn't have this property?

yes, since it's a new feature, we can add it

[tokers]

I prefer Host

But seems ApisixRouteSpec.Stream doesn't have this property? If I'm missed the meaning, please correct me, thanks.

Yeah, that's the point that we need to implement it :).

[mangoGoForward]

I have been commit a PR #1051, if you have free time, please have a review~

[tao12345666333]

Thanks

[tao12345666333]

@svendberg #1051 has been merged. Thanks @mangoGoForward

This feature will be released in v1.6