question: ApisixTLS missed the `ssl_protocols` parameter

[juzhiyuan]

Description

The latest version of the APISIX Ingress Controller is 2.0.0 RC3. This version misses the ssl_protocols parameter in the ApisixTLS resource, which prevents open source users from configuring this parameter.

Project Scopes

In APISIX Ingress Controller 2.x, active maintainers prefer to encourage the community toward using more standardized resources (use Gateway API instead of APISIX CRD). Therefore, when implementing the new version (2.x), we only ensure that the CRDs remain the same with version 1.8.

The ApisixTLS resource in the APISIX Ingress Controller 1.8 version doesn't support the ssl_protocols parameter either, and there has been no feedback explicitly requesting this parameter. Therefore, it has not been implemented in the new version either. (Dynamic configuration of ssl_protocols is an advanced case used to switch TLS versions dynamically. This purpose can also be achieved by specifying the version in config.yaml.)

We will continue to encourage users to use Gateway API first in the future. New capabilities will not be added to CRDs unless there is a must reason (Please let us know about your use case and the challenges you encounter, let's discuss case by case).

If you encounter configurations where the Gateway API cannot support certain scenarios, please let us know via GitHub Issues or online meetings, and we will discuss and develop a solution and provide support.

Notes

apache/apisix supports the configuration of SSL protocols in three places:

1. config.yaml:
   1. You can configure TLSv1, TLSv1.1, etc. here, which is not constrained by JSONSchema (my previous description was incorrect).
   2. In most cases, no need to support ssl_protocols in the ApisixTLS resource. Simply enable TLSv1 in the config.yaml file.
2. Admin API
   1. The ssl_protocols field of SSL resources is constrained by JSONSchema and only supports TLS1.1 and above.
   2. If the resource ssl_protocols is empty/unset, then Gateway will follow the configuration in config.yaml.
3. ApisixTLS
   1. Yes, it doesn't support ssl_protocols, but for your case, you don't need to configure it here.

If you have such scenario: two domains, one of which only allows TLSv1 and the other of which only allows TLSv1.1+, then you can use the following pattern:

1. Prepare two sets of apache/apisix gateways (let's say Gateway A and Gateway B)
2. Make sure both Gateway A and Gateway B connect to the same ETCD clusters
   1. In kubernetes with apisix-ingress-controller 2.0.0+, no etcd needed. (docs: Enablind embedded Dashboard apisix#12543 (comment))
   2. This is optional
3. Prepare 2 different config.yaml files to work with Gateway A and Gateway B
   1. In k8s, this means you need 2 different services (which means you need to pay for 2 LB fees)