Skip to content

Docs: tcp security policy #7247

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
+8 −4
Open

Docs: tcp security policy #7247

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
eb82156
updated release notes
davem-git Oct 15, 2025
6d9431d
updated docs
davem-git Oct 15, 2025
00bdc39
Merge branch 'main' of github.com:envoyproxy/gateway into feat-tcp-se…
davem-git Oct 22, 2025
28774bd
Merge branch 'main' of github.com:envoyproxy/gateway into feat-tcp-se…
davem-git Oct 23, 2025
23b66bf
Merge branch 'main' of github.com:envoyproxy/gateway into feat-tcp-se…
davem-git Oct 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions release-notes/current.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ security updates: |

# New features or capabilities added in this release.
new features: |
Added support for applying SecurityPolicy Authorization to TCPRoute (client IP / allow-deny list for TCP traffic).
Added support for mTLS configuration for ExtensionServer.
Added support for RetryPolicy in gRPC ExtAuth callouts via SecurityPolicy backend settings fields.
Added support for late response headers in ClientTrafficPolicy.
Expand Down
8 changes: 5 additions & 3 deletions site/content/en/latest/concepts/gateway_api_extensions/security-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,16 +36,18 @@ SecurityPolicy can be attached to Gateway API resources using two targeting mech
1. **Direct Reference (`targetRefs`)**: Explicitly reference specific resources by name and kind.
2. **Label Selection (`targetSelectors`)**: Match resources based on their labels (see [targetSelectors API reference](../../api/extension_types#targetselectors))

The policy applies to all resources that match either targeting method. You can target various Gateway API resource types including `Gateway`, `HTTPRoute`, and `GRPCRoute`.
The policy applies to all resources that match either targeting method. You can target various Gateway API resource types including `Gateway`, `HTTPRoute`, `GRPCRoute`, and `TCPRoute`.

Note: TCPRoute support is limited to authorization using client IP allow/deny lists (IP-based authorization). Other SecurityPolicy features such as JWT, API Key, Basic Auth, or OIDC are not applicable to TCPRoute targets.

**Important**: A SecurityPolicy can only target resources in the same namespace as the policy itself.

### Precedence

When multiple SecurityPolicies apply to the same resource, Envoy Gateway resolves conflicts using a precedence hierarchy based on the target resource type and section-level specificity:

1. **Route rule-level policies** (HTTPRoute/GRPCRoute with `sectionName` targeting specific rules) - Highest precedence
2. **Route-level policies** (HTTPRoute, GRPCRoute without `sectionName`) - High precedence
1. **Route rule-level policies** (HTTPRoute, GRPCRoute, or TCPRoute with `sectionName` targeting specific rules) - Highest precedence
2. **Route-level policies** (HTTPRoute, GRPCRoute, or TCPRoute without `sectionName`) - High precedence
3. **Listener-level policies** (Gateway with `sectionName` targeting specific listeners) - Medium precedence
4. **Gateway-level policies** (Gateway without `sectionName`) - Lowest precedence

Expand Down
3 changes: 2 additions & 1 deletion site/content/en/latest/tasks/security/restrict-ip-access.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ This task provides instructions for configuring IP allowlist/denylist on Envoy G
checks if an incoming request is from an allowed IP address before routing the request to a backend service.

Envoy Gateway introduces a new CRD called [SecurityPolicy][SecurityPolicy] that allows the user to configure IP allowlist/denylist.
This instantiated resource can be linked to a [Gateway][Gateway], [HTTPRoute][HTTPRoute] or [GRPCRoute][GRPCRoute] resource.
This instantiated resource can be linked to a [Gateway][Gateway], [HTTPRoute][HTTPRoute], [GRPCRoute][GRPCRoute] or [TCPRoute][TCPRoute] resource.

## Prerequisites

Expand Down Expand Up @@ -194,3 +194,4 @@ Checkout the [Developer Guide](../../../contributions/develop) to get involved i
[Gateway]: https://gateway-api.sigs.k8s.io/api-types/gateway
[HTTPRoute]: https://gateway-api.sigs.k8s.io/api-types/httproute
[GRPCRoute]: https://gateway-api.sigs.k8s.io/api-types/grpcroute
[TCPRoute]: https://gateway-api.sigs.k8s.io/guides/tcp/
Loading