chore(*) ExternalServices add CA and Client certificate support #1094
Conversation
Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
nickolaev
force-pushed
the
chore/tls_origination
branch
from
4fc74de to
34b6fe1
Compare
# Conflicts: # pkg/xds/topology/outbound.go Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
pkg/xds/topology/outbound.go
Outdated
| tlsEnabled = externalService.Spec.Networking.Tls.Enabled | ||
| externalServiceEndpoint, err := buildExternalServiceEndpoint(externalService, mesh.Meta.GetMesh(), loader) | ||
| if err != nil { | ||
| log.Info("Unable to create ExternalService endpoint", err) |
There was a problem hiding this comment.
If err happened, maybe log also should be log.Error regardless it doesn't affect the execution?
There was a problem hiding this comment.
I also think log.Error is better. How about this
log.Error(err, "unable to create ExternalService endpoint. Endpoint won't be included in the XDS.", "name", externalService.Meta.GetName(), "mesh", externalService.Meta.GetMesh())
Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
pkg/xds/envoy/tls.go
Outdated
| @@ -183,8 +183,35 @@ func ServiceSpiffeIDMatcher(mesh string, service string) *envoy_type_matcher.Str | |||
| } | |||
| } | |||
|
|
|||
| func CreateUpstreamTlsContextNoMetadata(sni string) (*envoy_auth.UpstreamTlsContext, error) { | |||
| func CreateUpstreamTlsContextNoMetadata(ca, cert, key *envoy_core.DataSource, sni string) (*envoy_auth.UpstreamTlsContext, error) { | |||
There was a problem hiding this comment.
How about UpstreamTlsContextOutsideMesh() or UpstreamTLSContextManuallMTLS instead of CreateUpstreamTlsContextNoMetadata()
?
Can you also put this function in existing tls subpackage if possible? I want to throw there all the things tls related eventually
There was a problem hiding this comment.
Renaming is fine, but am not sure why to move only this function and not the whole tls.go?
There was a problem hiding this comment.
feel free to move whole tls.go
pkg/xds/topology/outbound.go
Outdated
| tlsEnabled = externalService.Spec.Networking.Tls.Enabled | ||
| externalServiceEndpoint, err := buildExternalServiceEndpoint(externalService, mesh.Meta.GetMesh(), loader) | ||
| if err != nil { | ||
| log.Info("Unable to create ExternalService endpoint", err) |
There was a problem hiding this comment.
I also think log.Error is better. How about this
log.Error(err, "unable to create ExternalService endpoint. Endpoint won't be included in the XDS.", "name", externalService.Meta.GetName(), "mesh", externalService.Meta.GetMesh())
Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
nickolaev
force-pushed
the
chore/tls_origination
branch
from
f7dcd17 to
e685596
Compare
Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
nickolaev
force-pushed
the
chore/tls_origination
branch
from
5c27e51 to
53a65d4
Compare
Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
| @@ -76,3 +76,7 @@ func (k *k8SDeployment) Delete(cluster framework.Cluster) error { | |||
| func (k *k8SDeployment) GetExternalAppAddress() string { | |||
| return k.ip | |||
| } | |||
|
|
|||
| func (k *k8SDeployment) GetCert() string { | |||
| return "" | |||
There was a problem hiding this comment.
why is it empty on K8S?
There was a problem hiding this comment.
It is actually not implemented there. Will just panic.
There was a problem hiding this comment.
Ok, but why? Is it because we don't have this test on Kubernetes? If so, please add a comment why we don't have a test on Kubernetes
Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
Signed-off-by: Nikolay Nikolaev <nikolay.nikolaev@konghq.com>
Summary
Add CA and Client certificate support