How do I set alpnProtos for DownstreamTLSContext for envoy instances using Gateway Envoy Provisioner?

[hbobenicio]

I'd like to configure alpnProtos for DownstreamTLSContext for my Gateway API listeners using Gateway Envoy Provisioner.

How do I do that?
In my case I'm trying to configure Envoy to return a specific string on ALPN negotiation of my listeners, "postgresql", the postgres 17 alpn protocol string for direct negotiations.

[hbobenicio]

I've found this comment:

contour/internal/xdscache/v3/listener.go

Line 500 in 9947760

// Do not offer ALPN for TCP proxying, since

which states

// Do not offer ALPN for TCP proxying, since
// the protocols will be provided by the TCP
// backend in its ServerHello.

does it make sense? TLSRoutes do support TLS Termination at gateway level so this is not true in this case, right?
Does it make sense to set alpnProtos here for something provided from listerners.tls configurations?

[hbobenicio]

Well, I think this is just not possible by now with contour. This answers this discussion, so I'm closing this. But I still think this should be supported for Gateway API's TLSRoutes with TLS Termination, just because TLS's ServerHello Message needs to provide this alpnProto in the response for the TLS termination, and a static setting makes lots of sense for many use cases I guess. Better to create an issue for that...