Enabling backend mTLS requires changes to the GatewayClass?

[aukevanleeuwen]

Hello,

I'm trying to enable mTLS on the backend configuration by reading https://gateway.envoyproxy.io/docs/tasks/security/backend-mtls/. It states that I should do have this config on the GatewayClass:

---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: eg
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
  parametersRef:
    group: gateway.envoyproxy.io
    kind: EnvoyProxy
    name: custom-proxy-config
    namespace: envoy-gateway-system

I already have this setup on the Gateway though, does that achieve the same thing? I'm a bit confused about that. I would guess that Gateway points to the GatewayClass and therefore I can declare it on either one of those?

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: eg
spec:
  gatewayClassName: eg
  infrastructure:
    parametersRef:
      group: gateway.envoyproxy.io
      kind: EnvoyProxy
      name: envoy-config
  # ...

[arkodg]

yeah you can attach it to the Gateway or GatewayClass, and the Gateway attachment takes precedence

[aukevanleeuwen]

Thanks!