Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature Request: Automatically trigger envoy reload when certificates change on filesystem #483

Open
mhamann opened this issue Nov 17, 2023 · 0 comments

Comments

@mhamann
Copy link

mhamann commented Nov 17, 2023

If you want to see App Mesh implement this idea, please upvote with a 👍.

Tell us about your request
In EKS, certificates are stored in secrets which are mounted to a container's filesystem. If the contents of the secret changes (e.g., automatic certificate renewal), Kubernetes automatically updates the data mounted within the container's filesystem.

AppMesh/Envoy should detect this change and automatically reload the certificates in the running container, otherwise the system will become inoperable once the existing certificates expire.

Which integration(s) is this request for?
EKS / Kubernetes

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
Currently, we need to manually detect cert/secret updates and take some action within the cluster, such as manually restarting the pods on which the certs were mounted.

Are you currently working around this issue?
We are currently managing this manually; however, we are considering some in-house automation to detect these changes and trigger pod restarts. This seems like work we shouldn't have to do.

Additional context
N/A

Attachments
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant