From f5c8c09f961da3de5ca63c5775a9c50825c94752 Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Fri, 25 Sep 2026 21:12:10 +0000
Subject: [PATCH] =?UTF-8?q?=E5=85=81=E8=AE=B8=20Envoy=20=E5=90=8E=E7=AB=AF?=
 =?UTF-8?q?=E5=8D=8F=E5=95=86=20TLS=201.3=20=E4=BB=A5=E6=8E=A5=E5=85=A5=20?=
 =?UTF-8?q?Incus?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: panxiao81 <pan-xiao@live.cn>
---
 platform/envoy-gateway/README.md          |  8 ++++++++
 platform/envoy-gateway/envoyproxy.yaml    | 10 ++++++++++
 platform/envoy-gateway/gateway.yaml       |  5 +++++
 platform/envoy-gateway/kustomization.yaml |  1 +
 4 files changed, 24 insertions(+)
 create mode 100644 platform/envoy-gateway/envoyproxy.yaml

diff --git a/platform/envoy-gateway/README.md b/platform/envoy-gateway/README.md
index fa88114..e170588 100644
--- a/platform/envoy-gateway/README.md
+++ b/platform/envoy-gateway/README.md
@@ -131,3 +131,11 @@ iptables/NodePort rather than binding. Test with `curl`, not `ss`.
 Contour source manifests were removed from the clean baseline. Live leftovers may
 still exist and must be inventoried before deletion; do not infer live state from
 the archive cleanup. The legacy Git history retains the retired manifests.
+
+## 后端 TLS 版本
+
+`EnvoyProxy/eg` 显式允许后端 TLS 1.2–1.3，由 `Gateway/eg` 的
+`infrastructure.parametersRef` 引用。Incus 7.5.1 只接受 TLS 1.3；
+仅创建 BackendTLSPolicy 时，现有 Envoy 上游默认最高 TLS 1.2，会返回
+`TLSV1_ALERT_PROTOCOL_VERSION` 并导致入口 503。此设置保留 TLS 1.2 后端兼容性，
+不改变前端 TLS listener、证书和路由；各后端仍需各自的 BackendTLSPolicy。
diff --git a/platform/envoy-gateway/envoyproxy.yaml b/platform/envoy-gateway/envoyproxy.yaml
new file mode 100644
index 0000000..7fdc4ca
--- /dev/null
+++ b/platform/envoy-gateway/envoyproxy.yaml
@@ -0,0 +1,10 @@
+# Incus 只接受 TLS 1.3；显式允许后端协商 1.2–1.3，保留其他后端兼容性。
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: eg
+  namespace: envoy-gateway-system
+spec:
+  backendTLS:
+    minVersion: '1.2'
+    maxVersion: '1.3'
diff --git a/platform/envoy-gateway/gateway.yaml b/platform/envoy-gateway/gateway.yaml
index 640d4da..80e5edb 100644
--- a/platform/envoy-gateway/gateway.yaml
+++ b/platform/envoy-gateway/gateway.yaml
@@ -24,6 +24,11 @@ metadata:
   namespace: envoy-gateway-system
 spec:
   gatewayClassName: eg
+  infrastructure:
+    parametersRef:
+      group: gateway.envoyproxy.io
+      kind: EnvoyProxy
+      name: eg
   listeners:
     # Plaintext :80 — ACME http-01 (the bao-acme ClusterIssuer solves through here)
     # and HTTP->HTTPS redirects. Never serve anything sensitive on it.
diff --git a/platform/envoy-gateway/kustomization.yaml b/platform/envoy-gateway/kustomization.yaml
index a2c534d..b4c2004 100644
--- a/platform/envoy-gateway/kustomization.yaml
+++ b/platform/envoy-gateway/kustomization.yaml
@@ -4,3 +4,4 @@ resources:
   - helmrepository.yaml
   - helmrelease.yaml
   - gateway.yaml
+  - envoyproxy.yaml