feat: support forward client cert config XFCC header

api/v1alpha1/clienttrafficpolicy_types.go

@@ -104,6 +104,11 @@ type HeaderSettings struct {
 	// +optional
 	EnableEnvoyHeaders *bool `json:"enableEnvoyHeaders,omitempty"`
 
+	// Configure Envoy proxy how to handle the x-forwarded-client-cert (XFCC) HTTP header.
+	// When enabled, Hash and By is always set
+	// +optional
+	XForwardedClientCert *XForwardedClientCert `json:"xForwardedClientCert,omitempty"`
+
 	// WithUnderscoresAction configures the action to take when an HTTP header with underscores
 	// is encountered. The default action is to reject the request.
 	// +optional
@@ -134,6 +139,59 @@ const (
 	WithUnderscoresActionDropHeader WithUnderscoresAction = "DropHeader"
 )
 
+// Configure Envoy proxy how to handle the x-forwarded-client-cert (XFCC) HTTP header.
+type XForwardedClientCert struct {
+	// Envoy Proxy mode how to handle the x-forwarded-client-cert (XFCC) HTTP header.
+	// +optional
+	Mode *ForwardMode `json:"mode,omitempty"`
+
+	// Specifies the fields in the client certificate to be forwarded on the x-forwarded-client-cert (XFCC) HTTP header
+	// +kubebuilder:validation:MaxItems=5
+	// +optional
+	CertDetailsToAdd []ClientCertData `json:"certDetailsToAdd,omitempty"`
+}
+
+// Envoy Proxy mode how to handle the x-forwarded-client-cert (XFCC) HTTP header.
+// +kubebuilder:validation:Enum=Sanitize;ForwardOnly;AppendForward;SanitizeSet;AlwaysForwardOnly
+type ForwardMode string
+
+const (
+	// Do not send the XFCC header to the next hop. This is the default value.
+	ForwardModeSanitize ForwardMode = "Sanitize"
+	// When the client connection is mTLS (Mutual TLS), forward the XFCC header
+	// in the request.
+	ForwardModeForwardOnly ForwardMode = "ForwardOnly"
+	// When the client connection is mTLS, append the client certificate
+	// information to the request’s XFCC header and forward it.
+	ForwardModeAppendForward ForwardMode = "AppendForward"
+	// When the client connection is mTLS, reset the XFCC header with the client
+	// certificate information and send it to the next hop.
+	ForwardModeSanitizeSet ForwardMode = "SanitizeSet"
+	// Always forward the XFCC header in the request, regardless of whether the
+	// client connection is mTLS.
+	ForwardModeAlwaysForwardOnly ForwardMode = "AlwaysForwardOnly"
+)
+
+// Specifies the fields in the client certificate to be forwarded on the x-forwarded-client-cert (XFCC) HTTP header
+// By default, x-forwarded-client-cert (XFCC) will always include By and Hash data
+// +kubebuilder:validation:Enum=Subject;Cert;Chain;Dns;Uri
+type ClientCertData string
+
+const (
+	// Whether to forward the subject of the client cert.
+	ClientCertDataSubject ClientCertData = "Subject"
+	// Whether to forward the entire client cert in URL encoded PEM format.
+	// This will appear in the XFCC header comma separated from other values with the value Cert=”PEM”.
+	ClientCertDataCert ClientCertData = "Cert"
+	// Whether to forward the entire client cert chain (including the leaf cert) in URL encoded PEM format.
+	// This will appear in the XFCC header comma separated from other values with the value Chain=”PEM”.
+	ClientCertDataChain ClientCertData = "Chain"
+	// Whether to forward the DNS type Subject Alternative Names of the client cert.
+	ClientCertDataDNS ClientCertData = "Dns"
+	// Whether to forward the URI type Subject Alternative Name of the client cert.
+	ClientCertDataURI ClientCertData = "Uri"
+)
+
 // ClientIPDetectionSettings provides configuration for determining the original client IP address for requests.
 //
 // +kubebuilder:validation:XValidation:rule="!(has(self.xForwardedFor) && has(self.customHeader))",message="customHeader cannot be used in conjunction with xForwardedFor"

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -162,6 +162,39 @@ spec:
                     - RejectRequest
                     - DropHeader
                     type: string
+                  xForwardedClientCert:
+                    description: |-
+                      Configure Envoy proxy how to handle the x-forwarded-client-cert (XFCC) HTTP header.
+                      When enabled, Hash and By is always set
+                    properties:
+                      certDetailsToAdd:
+                        description: Specifies the fields in the client certificate
+                          to be forwarded on the x-forwarded-client-cert (XFCC) HTTP
+                          header
+                        items:
+                          description: |-
+                            Specifies the fields in the client certificate to be forwarded on the x-forwarded-client-cert (XFCC) HTTP header
+                            By default, x-forwarded-client-cert (XFCC) will always include By and Hash data
+                          enum:
+                          - Subject
+                          - Cert
+                          - Chain
+                          - Dns
+                          - Uri
+                          type: string
+                        maxItems: 5
+                        type: array
+                      mode:
+                        description: Envoy Proxy mode how to handle the x-forwarded-client-cert
+                          (XFCC) HTTP header.
+                        enum:
+                        - Sanitize
+                        - ForwardOnly
+                        - AppendForward
+                        - SanitizeSet
+                        - AlwaysForwardOnly
+                        type: string
+                    type: object
                 type: object
               http1:
                 description: HTTP1 provides HTTP/1 configuration on the listener.

internal/gatewayapi/clienttrafficpolicy.go

@@ -549,6 +549,21 @@ func translateListenerHeaderSettings(headerSettings *egv1a1.HeaderSettings, http
 		WithUnderscoresAction: ir.WithUnderscoresAction(ptr.Deref(headerSettings.WithUnderscoresAction, egv1a1.WithUnderscoresActionRejectRequest)),
 		PreserveXRequestID:    ptr.Deref(headerSettings.PreserveXRequestID, false),
 	}
+
+	if headerSettings.XForwardedClientCert != nil {
+		httpIR.Headers.XForwardedClientCert = &ir.XForwardedClientCert{
+			Mode: ir.ForwardMode(ptr.Deref(headerSettings.XForwardedClientCert.Mode, egv1a1.ForwardModeSanitize)),
+		}
+
+		var certDetailsToAdd []ir.ClientCertData
+		if httpIR.Headers.XForwardedClientCert.Mode == ir.ForwardModeAppendForward || httpIR.Headers.XForwardedClientCert.Mode == ir.ForwardModeSanitizeSet {
+			for _, data := range headerSettings.XForwardedClientCert.CertDetailsToAdd {
+				certDetailsToAdd = append(certDetailsToAdd, ir.ClientCertData(data))
+			}
+
+			httpIR.Headers.XForwardedClientCert.CertDetailsToAdd = certDetailsToAdd
+		}
+	}
 }
 
 func translateHTTP1Settings(http1Settings *egv1a1.HTTP1Settings, httpIR *ir.HTTPListener) error {