docs(kic): add upstream TLS verification guide

[czeslavo]

Description

Adds a guide covering upstream TLS verification configuration features added in KIC 3.4.

Part of #8133 (this guide will have to be extended with Gateway API instructions once Kong/kubernetes-ingress-controller#6631 is implemented).

Testing instructions

KIC nightly image has to be used for testing:

helm upgrade --install kong kong/ingress -n kong --create-namespace --set controller.ingressController.image.repository=kong/nightly-ingress-controller --set controller.ingressController.image.tag=2024-11-28 --set controller.ingressController.image.effectiveSemver=3.4.0

Preview link: https://deploy-preview-8201--kongdocs.netlify.app/kubernetes-ingress-controller/unreleased/guides/security/verify-upstream-tls/

Checklist

• Review label added
• Conditional version tags added, if applicable.

[netlify]

✅ Deploy Preview for kongdocs ready!

Name	Link
🔨 Latest commit	5d8a855
🔍 Latest deploy log	https://app.netlify.com/sites/kongdocs/deploys/67617d8bc86acf0008f547df
😎 Deploy Preview	https://deploy-preview-8201--kongdocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	9 paths audited Performance: 93 (🟢 up 3 from production) Accessibility: 92 (no change from production) Best Practices: 98 (🟢 up 8 from production) SEO: 99 (no change from production) PWA: - View the detailed breakdown and full score reports

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[lahabana]

Probably more related to the CRD move than this but I was missing a bunch of RBAC to some CRDs (.e.g: kongupstreampolicies, konglicences, kongcustomentities, kongvaults, kongconsumergroups) once fixing clusterrole/kong-controller I got unblocked.

[lahabana]

One thing I'm unsure here is how we articulate this guide for BackendTLS. Should we just add a last section to this guide: "Configure Kong Gateway to verify the upstream TLS certificate using GatewayAPI BackendTLS"?

[pmalek]

Probably more related to the CRD move than this but I was missing a bunch of RBAC to some CRDs (.e.g: kongupstreampolicies, konglicences, kongcustomentities, kongvaults, kongconsumergroups) once fixing clusterrole/kong-controller I got unblocked.

Those should all be in place, weird 🤔 .

ℹ️ BackendTLSPolicy and ConfigMap (not yet used in this guide) rules were fixed in https://github.com/Kong/charts/releases/tag/ingress-0.15.2 and https://github.com/Kong/charts/releases/tag/kong-2.44.1.

[lahabana]

This is clear and works well.

My only point of confusion is around the likely connection reuse that would confuse anyone doing things quickly.
However, I'm not sure how we can fix this.

[lahabana]

Nit: but I was blindly copy pasting and applying. So when I saw this I had to look back and check that I didn't miss a step because the last copy/paste only updates the service.

Might be worth doing either both patches in one block or have the output for each block (I prefer this second option).

[czeslavo]

True, it will be cleaner to have the expected outputs separately: 5d8a855

[pmalek]

ac0800f added the BackendTLSPolicy parts for this guide.

ℹ️ I've created Kong/kubernetes-ingress-controller#6834 to cover the implementation gap between using annotations and BackendTLSPolicy (the latter only allows CA certs in ConfigMaps, as per the Gateway API spec: https://github.com/kubernetes-sigs/gateway-api/blob/26051f587ccaf54823ccfd7eca5cbf2013aa8177/apis/v1alpha3/backendtlspolicy_types.go#L115-L119).

[czeslavo]

Thank you, @pmalek, for taking care of updating the PR! 🙇 I reviewed it and found a couple of nits, fixed them in 98035d0 and 697f576. PTAL

[pmalek]

Thank you, @pmalek, for taking care of updating the PR! 🙇 I reviewed it and found a couple of nits, fixed them in 98035d0 and 697f576. PTAL

Looks good to me 👍

[czeslavo]

Changed annotations to use plural form (following Kong/kubernetes-ingress-controller#6845) in b8e6034 and added navtabs for CA certificates sourced from Secrets for BackendTLSPolicy (as we've decided it will be implemented before releasing KIC 3.4 in Kong/kubernetes-ingress-controller#6834) in 523dacf.

[mlavacca]

Thanks @czeslavo, the PR looks good to me apart from a detail: in the prerequisite section of the guide we are installing Gateway API from the standard channel, while BackendTLSPolicies are in the experimental one. We should update the Gateway API installation section with the proper channel.

[czeslavo]

in the prerequisite section of the guide we are installing Gateway API from the standard channel, while BackendTLSPolicies are in the experimental one. We should update the Gateway API installation section with the proper channel.

Good catch, fixed in 0d93270.

[mlavacca]

👍