gatewayapi: adding support for TCPRoute and TLSRoute

Co-authored-by: Jean-Baptiste Doumenjou <925513+jbdoumenjou@users.noreply.github.com>
2021-05-20 11:50:12 +02:00 · 2021-05-20 11:50:12 +02:00 · 56f845c71a
commit 56f845c71a
parent e1e1fd640c
72 changed files with 6241 additions and 208 deletions
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/gatewayclass_with_unknown_controller.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/gatewayclass_with_unknown_controller.yml
@ -22,7 +22,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: HTTPRoute
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/one_rule_two_targets.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/one_rule_two_targets.yml
@ -22,7 +22,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: HTTPRoute
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/simple.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/simple.yml
@ -22,7 +22,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: HTTPRoute
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/simple_cross_provider.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/simple_cross_provider.yml
@ -22,7 +22,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: HTTPRoute
@ -49,4 +50,4 @@ spec:
          port: 80
        - serviceName: whoami
          port: 80
-          weight: 1
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/simple_to_api_internal.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/simple_to_api_internal.yml
@ -22,7 +22,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: HTTPRoute
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/simple_with_bad_rule.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/simple_with_bad_rule.yml
@ -0,0 +1,47 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: HTTP
+      port: 80
+      routes:
+        kind: HTTPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: foo
+
+---
+kind: HTTPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: http-app-1
+  namespace: default
+  labels:
+    app: foo
+spec:
+  hostnames:
+    - "foo.com"
+  rules:
+    - matches:
+        - path:
+            type: ImplementationSpecific
+            value: /bar
+      forwardTo:
+        - serviceName: whoami
+          port: 80
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/simple_with_tls_entrypoint.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/simple_with_tls_entrypoint.yml
@ -0,0 +1,47 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: HTTP
+      port: 443
+      routes:
+        kind: HTTPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: foo
+
+---
+kind: HTTPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: http-app-1
+  namespace: default
+  labels:
+    app: foo
+spec:
+  hostnames:
+    - "foo.com"
+  rules:
+    - matches:
+        - path:
+            type: Exact
+            value: /bar
+      forwardTo:
+        - serviceName: whoami
+          port: 80
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/two_rules.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/two_rules.yml
@ -22,7 +22,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: HTTPRoute
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_multiple_host.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_multiple_host.yml
@ -22,7 +22,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: HTTPRoute
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_https.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_https.yml
@ -38,7 +38,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: HTTPRoute
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_https_with_tls_passthrough.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_https_with_tls_passthrough.yml
@ -0,0 +1,64 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: HTTPS
+      port: 443
+      tls:
+        mode: Passthrough
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: HTTPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: foo
+
+---
+kind: HTTPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: http-app-1
+  namespace: default
+  labels:
+    app: foo
+spec:
+  hostnames:
+    - "foo.com"
+  rules:
+    - matches:
+        - path:
+            type: Exact
+            value: /bar
+      forwardTo:
+        - serviceName: whoami
+          port: 80
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_https_without_tls.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_https_without_tls.yml
@ -22,7 +22,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: HTTPRoute
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_tcp.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_tcp.yml
@ -0,0 +1,47 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TCP
+      port: 443
+      routes:
+        kind: HTTPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: foo
+
+---
+kind: HTTPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: http-app-1
+  namespace: default
+  labels:
+    app: foo
+spec:
+  hostnames:
+    - "foo.com"
+  rules:
+    - matches:
+        - path:
+            type: Exact
+            value: /bar
+      forwardTo:
+        - serviceName: whoami
+          port: 80
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_tls.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_protocol_tls.yml
@ -0,0 +1,64 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      port: 443
+      tls:
+        mode: Terminate
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: HTTPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: foo
+
+---
+kind: HTTPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: http-app-1
+  namespace: default
+  labels:
+    app: foo
+spec:
+  hostnames:
+    - "foo.com"
+  rules:
+    - matches:
+        - path:
+            type: Exact
+            value: /bar
+      forwardTo:
+        - serviceName: whoami
+          port: 80
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_several_rules.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_several_rules.yml
@ -22,7 +22,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: HTTPRoute
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_two_gateways_one_httproute.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_two_gateways_one_httproute.yml
@ -38,7 +38,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: Gateway
@ -56,7 +57,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: HTTPRoute
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_two_listeners_one_httproute.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_two_listeners_one_httproute.yml
@ -38,7 +38,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo
    - protocol: HTTP
      port: 80
      routes:
@ -46,7 +47,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: HTTPRoute
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/with_wrong_service_port.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/with_wrong_service_port.yml
@ -22,7 +22,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: HTTPRoute
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/without_gatewayclass.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/without_gatewayclass.yml
@ -14,7 +14,8 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo

 ---
 kind: HTTPRoute
--- a/pkg/provider/kubernetes/gateway/fixtures/httproute/without_httproute.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/httproute/without_httproute.yml
@ -22,4 +22,5 @@ spec:
        namespaces:
          from: Same
        selector:
-          app: foo
+          matchLabels:
+            app: foo
--- a/pkg/provider/kubernetes/gateway/fixtures/mixed/simple.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/mixed/simple.yml
@ -0,0 +1,131 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: HTTP
+      port: 9080
+      routes:
+        kind: HTTPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: http-app
+    - protocol: HTTPS
+      port: 9443
+      tls:
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: HTTPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: http-app
+    - protocol: TCP
+      port: 9000
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tcp-app
+    - protocol: TLS
+      port: 10000
+      hostname: tls.foo.example.com
+      tls:
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tcp-app
+    - protocol: TLS
+      port: 11000
+      hostname: pass.tls.foo.example.com
+      tls:
+        mode: Passthrough
+      routes:
+        kind: TLSRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tls-app
+
+---
+kind: HTTPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: http-app-1
+  namespace: default
+  labels:
+    app: http-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoami
+          port: 80
+          weight: 1
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-1
+  namespace: default
+  labels:
+    app: tcp-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: tls-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_bad_listener_protocol.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_bad_listener_protocol.yml
@ -0,0 +1,41 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:
+    - protocol: UNKNOWN
+      port: 9080
+      routes:
+        kind: HTTPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: http-app
+
+---
+kind: HTTPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: http-app-1
+  namespace: default
+  labels:
+    app: http-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoami
+          port: 80
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_bad_listener_route_kind.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_bad_listener_route_kind.yml
@ -0,0 +1,41 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:
+    - protocol: HTTP
+      port: 9080
+      routes:
+        kind: UnknownRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: http-app
+
+---
+kind: HTTPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: http-app-1
+  namespace: default
+  labels:
+    app: http-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoami
+          port: 80
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_incompatible_protocol_and_route_kind.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_incompatible_protocol_and_route_kind.yml
@ -0,0 +1,41 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:
+    - protocol: TLS
+      port: 9080
+      routes:
+        kind: HTTPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: http-app
+
+---
+kind: HTTPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: http-app-1
+  namespace: default
+  labels:
+    app: http-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoami
+          port: 80
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_multiple_protocol_using_same_port.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_multiple_protocol_using_same_port.yml
@ -0,0 +1,139 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: HTTP
+      port: 9080
+      routes:
+        kind: HTTPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: http-app-1
+    - protocol: HTTP
+      port: 9080
+      routes:
+        kind: HTTPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: http-app-2
+    - protocol: TCP
+      port: 9000
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tcp-app
+    - protocol: TLS
+      port: 9000
+      tls:
+        mode: Passthrough
+      routes:
+        kind: TLSRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tls-app
+    - protocol: TLS
+      port: 9000
+      tls:
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tcp-app
+
+---
+kind: HTTPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: http-app-1
+  namespace: default
+  labels:
+    app: http-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoami
+          port: 80
+          weight: 1
+---
+kind: HTTPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: http-app-2
+  namespace: default
+  labels:
+    app: http-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoami
+          port: 80
+          weight: 1
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-1
+  namespace: default
+  labels:
+    app: tcp-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: tls-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/mixed/with_wrong_routes_selector.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/mixed/with_wrong_routes_selector.yml
@ -0,0 +1,75 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+  namespace: default
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-mixed-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: HTTP
+      port: 80
+      routes:
+        kind: HTTPRoute
+        selector:
+          matchLabels:
+            app: label-tls-app-1
+    - protocol: TCP
+      port: 9000
+      routes:
+        kind: TCPRoute
+        selector:
+          matchLabels:
+            app: label-tls-app-1
+    - protocol: TLS
+      port: 9443
+      tls:
+        mode: Passthrough
+      routes:
+        kind: TLSRoute
+        selector:
+          matchLabels:
+            app: label-http-app-1
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: label-tls-app-1
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
+
+---
+kind: HTTPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: http-app-1
+  namespace: default
+  labels:
+    app: label-http-app-1
+spec:
+  rules:
+    - matches:
+        - path:
+            type: Exact
+            value: /bar
+      forwardTo:
+        - serviceName: whoamitcp
+          port: 80
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/services.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/services.yml
@ -107,7 +107,6 @@ spec:
    - name: websecure2
      port: 8443
      targetPort: websecure2
-      scheme: https
  selector:
    app: containous
    task: whoami3
@ -164,3 +163,39 @@ spec:
    - name: https
      protocol: TCP
      port: 443
+
+
+---
+kind: Endpoints
+apiVersion: v1
+metadata:
+  name: whoamitcp
+  namespace: default
+
+subsets:
+  - addresses:
+      - ip: 10.10.0.9
+      - ip: 10.10.0.10
+    ports:
+      - name: tcp-1
+        protocol: TCP
+        port: 9000
+      - name: tcp-2
+        protocol: TCP
+        port: 10000
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: whoamitcp
+  namespace: default
+
+spec:
+  ports:
+    - protocol: TCP
+      port: 9000
+      name: tcp-1
+    - protocol: TCP
+      port: 10000
+      name: tcp-2
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/gatewayclass_with_unknown_controller.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/gatewayclass_with_unknown_controller.yml
@ -0,0 +1,41 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: unkown.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TCP
+      port: 8080
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: foo
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: TCP-app-1
+  namespace: default
+  labels:
+    app: foo
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoami
+          port: 80
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/simple.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/simple.yml
@ -0,0 +1,40 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+  namespace: default
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-tcp-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TCP
+      port: 9000
+      routes:
+        kind: TCPRoute
+        selector:
+          matchLabels:
+            app: whoamitcp
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-1
+  namespace: default
+  labels:
+    app: whoamitcp
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/simple_cross_provider.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/simple_cross_provider.yml
@ -0,0 +1,47 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TCP
+      port: 9000
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tcp-app
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-1
+  namespace: default
+  labels:
+    app: tcp-app
+spec:
+  rules:
+    - forwardTo:
+        - weight: 1
+          backendRef:
+            group: traefik.containo.us
+            kind: TraefikService
+            name: service@file
+          port: 9000
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_multiple_routes.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_multiple_routes.yml
@ -0,0 +1,62 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+  namespace: default
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-tcp-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TCP
+      port: 9000
+      routes:
+        kind: TCPRoute
+        selector:
+          matchLabels:
+            app: label-tcp-app-1
+    - protocol: TCP
+      port: 10000
+      routes:
+        kind: TCPRoute
+        selector:
+          matchLabels:
+            app: label-tcp-app-2
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-1
+  namespace: default
+  labels:
+    app: label-tcp-app-1
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-2
+  namespace: default
+  labels:
+    app: label-tcp-app-2
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 10000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_multiple_rules.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_multiple_rules.yml
@ -0,0 +1,44 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+  namespace: default
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-tcp-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TCP
+      port: 9000
+      routes:
+        kind: TCPRoute
+        selector:
+          matchLabels:
+            app: label-tcp-app
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app
+  namespace: default
+  labels:
+    app: label-tcp-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 10000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_protocol_http.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_protocol_http.yml
@ -0,0 +1,42 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: HTTP
+      port: 9000
+      hostname: foo.example.com
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tcp-app
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-1
+  namespace: default
+  labels:
+    app: tcp-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_protocol_https.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_protocol_https.yml
@ -0,0 +1,59 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: HTTPS
+      port: 9000
+      hostname: foo.example.com
+      tls:
+        mode: Terminate # Default mode
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tcp-app
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-1
+  namespace: default
+  labels:
+    app: tcp-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_protocol_tls.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_protocol_tls.yml
@ -0,0 +1,59 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      port: 9000
+      hostname: foo.example.com
+      tls:
+        mode: Terminate # Default mode
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tcp-app
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-1
+  namespace: default
+  labels:
+    app: tcp-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_wrong_service_port.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/with_wrong_service_port.yml
@ -0,0 +1,41 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TCP
+      port: 8080
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: foo
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: TCP-app-1
+  namespace: default
+  labels:
+    app: foo
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoami
+          weight: 1
+          port: 9000
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/without_gatewayclass.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/without_gatewayclass.yml
@ -0,0 +1,33 @@
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TCP
+      port: 8080
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: foo
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: TCP-app-1
+  namespace: default
+  labels:
+    app: foo
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoami
+          port: 80
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/without_tcproute.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/without_tcproute.yml
@ -0,0 +1,26 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TCP
+      port: 8080
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: foo
--- a/pkg/provider/kubernetes/gateway/fixtures/tcproute/without_tcproute_tls_protocol.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tcproute/without_tcproute_tls_protocol.yml
@ -0,0 +1,43 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      port: 8080
+      tls:
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: foo
+
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/gatewayclass_with_unknown_controller.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/gatewayclass_with_unknown_controller.yml
@ -0,0 +1,57 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: unkown.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      tls:
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      port: 8080
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: foo
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: foo
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 80
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_TLS_to_TCPRoute.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_TLS_to_TCPRoute.yml
@ -0,0 +1,57 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+  namespace: default
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-tls-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      hostname: foo.example.com
+      port: 9000
+      tls:
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: TCPRoute
+        selector:
+          matchLabels:
+            app: whoamitcp
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-1
+  namespace: default
+  labels:
+    app: whoamitcp
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_TLS_to_TCPRoute_with_certificateRef.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_TLS_to_TCPRoute_with_certificateRef.yml
@ -0,0 +1,57 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+  namespace: default
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-tls-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      hostname: foo.example.com
+      port: 9000
+      tls:
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: TLSRoute
+        selector:
+          matchLabels:
+            app: whoamitls
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: whoamitls
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_TLS_to_TLSRoute.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_TLS_to_TLSRoute.yml
@ -0,0 +1,54 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+  namespace: default
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-tls-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      hostname: foo.example.com
+      port: 9000
+      tls:
+        mode: Passthrough
+      routes:
+        kind: TLSRoute
+        selector:
+          matchLabels:
+            app: whoamitcp
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: whoamitcp
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_cross_provider.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/simple_cross_provider.yml
@ -0,0 +1,63 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      port: 9000
+      tls:
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tcp-app
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-1
+  namespace: default
+  labels:
+    app: tcp-app
+spec:
+  rules:
+    - forwardTo:
+        - weight: 1
+          backendRef:
+            group: traefik.containo.us
+            kind: TraefikService
+            name: service@file
+          port: 9000
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_SNI_matching.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_SNI_matching.yml
@ -0,0 +1,48 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      port: 9001
+      hostname: foo.example.com
+      tls:
+        mode: Passthrough
+      routes:
+        kind: TLSRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tls-app
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: tls-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
+      matches:
+        - snis:
+          - foo.bar
+
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_invalid_SNI_matching.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_invalid_SNI_matching.yml
@ -0,0 +1,49 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      port: 9001
+      hostname: foo.example.com
+      tls:
+        mode: Passthrough
+      routes:
+        kind: TLSRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tls-app
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: tls-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
+      matches:
+        - snis:
+          - foo.bar
+          - "*"
+
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_multiple_SNI_matching.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_multiple_SNI_matching.yml
@ -0,0 +1,49 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      port: 9001
+      hostname: foo.example.com
+      tls:
+        mode: Passthrough
+      routes:
+        kind: TLSRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tls-app
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: tls-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
+      matches:
+        - snis:
+          - foo.bar
+          - fiz.baz
+
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_multiple_routes_kind.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_multiple_routes_kind.yml
@ -0,0 +1,82 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+  namespace: default
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-tls-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      hostname: foo.example.com
+      port: 9000
+      tls:
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: TCPRoute
+        selector:
+          matchLabels:
+            app: label-tcp-app-1
+    - protocol: TLS
+      port: 10000
+      tls:
+        mode: Passthrough
+      routes:
+        kind: TLSRoute
+        selector:
+          matchLabels:
+            app: label-tls-app-1
+
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-1
+  namespace: default
+  labels:
+    app: label-tcp-app-1
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: label-tls-app-1
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 10000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_passthrough.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_passthrough.yml
@ -0,0 +1,44 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      port: 9001
+      hostname: foo.example.com
+      tls:
+        mode: Passthrough
+      routes:
+        kind: TLSRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tls-app
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: tls-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_passthrough_tls.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_passthrough_tls.yml
@ -0,0 +1,60 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      port: 9001
+      hostname: foo.example.com
+      tls:
+        mode: Passthrough
+        # certificateRef is ignored with mode "Passthrough"
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: TLSRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tls-app
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: tls-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_protocol_http.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_protocol_http.yml
@ -0,0 +1,42 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: HTTP
+      port: 9001
+      hostname: foo.example.com
+      routes:
+        kind: TLSRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tls-app
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: tls-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_protocol_https.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_protocol_https.yml
@ -0,0 +1,59 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: HTTPS
+      port: 9001
+      hostname: foo.example.com
+      tls:
+        mode: Terminate # Default mode
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: TLSRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tls-app
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: tls-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_protocol_tcp.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_protocol_tcp.yml
@ -0,0 +1,42 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TCP
+      port: 9001
+      hostname: foo.example.com
+      routes:
+        kind: TLSRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: tls-app
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: tls-app
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_wrong_service_port.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/with_wrong_service_port.yml
@ -0,0 +1,57 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      port: 8080
+      tls:
+        certificateRef:
+          kind: Secret
+          name: supersecret
+          group: core
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: foo
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-1
+  namespace: default
+  labels:
+    app: foo
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          weight: 1
+          port: 9001
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/without_gatewayclass.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/without_gatewayclass.yml
@ -0,0 +1,33 @@
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      port: 8080
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: foo
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-1
+  namespace: default
+  labels:
+    app: foo
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 8080
+          weight: 1
--- a/pkg/provider/kubernetes/gateway/fixtures/tlsroute/without_tlsroute.yml
+++ b/pkg/provider/kubernetes/gateway/fixtures/tlsroute/without_tlsroute.yml
@ -0,0 +1,28 @@
+---
+kind: GatewayClass
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway-class
+spec:
+  controller: traefik.io/gateway-controller
+
+---
+kind: Gateway
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: my-gateway
+  namespace: default
+spec:
+  gatewayClassName: my-gateway-class
+  listeners:  # Use GatewayClass defaults for listener definition.
+    - protocol: TLS
+      port: 8080
+      tls:
+        mode: Passthrough
+      routes:
+        kind: TLSRoutes
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: foo