feat: add support for certificate fetching and rotation via SDS server#8537
feat: add support for certificate fetching and rotation via SDS server#8537zirain wants to merge 6 commits intoenvoyproxy:mainfrom
Conversation
✅ Deploy Preview for cerulean-figolla-1f9435 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
| // such as the SPIRE or others. | ||
| // | ||
| // +optional | ||
| SDS *SDSProvider `json:"sds,omitempty"` |
There was a problem hiding this comment.
do we need to support multiple SDS here?
There was a problem hiding this comment.
In that case, we need to figure out how to reference to specific sds provider in clientCertificateRef:
caCertificateRefs:
- name: ROOTCA
kind: SDSwe probably need something like sds-provider-name://ROOTCA but which make thing more complex, becasue we use BackendObjectReference/BackendCluster to reference the backend, there's no provider name.
There was a problem hiding this comment.
we rely on parentRef like semantics
There was a problem hiding this comment.
AFAIT, CACertificateRefs uses gwapiv1.SecretObjectReference or gwapiv1.LocalObjectReference.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #8537 +/- ##
=======================================
Coverage ? 74.19%
=======================================
Files ? 243
Lines ? 37727
Branches ? 0
=======================================
Hits ? 27991
Misses ? 7782
Partials ? 1954 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Signed-off-by: zirain <[email protected]>
Signed-off-by: zirain <[email protected]>
Signed-off-by: zirain <[email protected]>
Signed-off-by: zirain <[email protected]>
Signed-off-by: zirain <[email protected]>
Signed-off-by: zirain <[email protected]>
| // such as the SPIRE or others. | ||
| type SDSProvider struct { | ||
| // BackendObjectReference references a Kubernetes object that represents the backend. | ||
| gwapiv1.BackendObjectReference `json:",inline"` |
There was a problem hiding this comment.
shouldnt this be
gateway/api/v1alpha1/shared_types.go
Line 600 in ffceb4f
| // Name of the Secret object. | ||
| Name string `json:"name" yaml:"name"` | ||
| Name string `json:"name" yaml:"name"` | ||
| FromSDS *bool `json:"fromSDS,omitempty" yaml:"fromSDS,omitempty"` |
There was a problem hiding this comment.
does this need to be a named sds string ?
There was a problem hiding this comment.
I have no strong option about use a SDSName instead of the combination of FromSDS+Name.
| // such as the SPIRE or others. | ||
| // | ||
| // +optional | ||
| SDS *SDSProvider `json:"sds,omitempty"` |
There was a problem hiding this comment.
also needs smething like https://gateway-api.sigs.k8s.io/reference/1.5/spec/#allowedroutes to allow which namespaces and BTLSP can reference it
There was a problem hiding this comment.
Under what conditions, we need to limit a BTLSP reference to SDS provider.
There was a problem hiding this comment.
we dont want an unknown app to reference an sds secret unless allowed by the platform team
There was a problem hiding this comment.
this could be done in the next iterater or later.
Let's focus on #8537 (comment) first, do we really need mutiple SDS providers, and how will the API looks like.
| // such as the SPIRE or others. | ||
| type SDSProvider struct { | ||
| // BackendObjectReference references a Kubernetes object that represents the backend. | ||
| gwapiv1.BackendObjectReference `json:",inline"` |
There was a problem hiding this comment.
should we validate if it is a Service or Backend?
There was a problem hiding this comment.
we should, let's make an agreement about should this be multiple or not first.
4 participants
fixes: #6366
The idea is introduce a new API
SDSinEnvoyProxyto define an external SDS server.ServiceorBackendkind: SDSincaCertificateRefsorclientCertificateRef,namewill be used to fetch certificate from (external) SDS server.