Service Mesh mTLS: DelegatedIdentity SPIFFE API #23968
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
maintainer-s-little-helper
bot
added
the
dont-merge/needs-release-note-label
meyskens
force-pushed
the
meyskens/spiffe-delegate
branch
from
d7a12e1
to
9e7b516
Compare
meyskens
added
the
release-note/minor
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
meyskens
added
area/servicemesh
meyskens
force-pushed
the
meyskens/spiffe-delegate
branch
4 times, most recently
from
4066f28
to
54b31e1
Compare
|
Commit 7d01bce2ac646eb44599d1b3e1d7200b7b39d00b does not contain "Signed-off-by". Please follow instructions provided in https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#developer-s-certificate-of-origin |
maintainer-s-little-helper
bot
added
the
dont-merge/needs-sign-off
meyskens
force-pushed
the
meyskens/spiffe-delegate
branch
from
54b31e1
to
7ed5fdc
Compare
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-sign-off
meyskens
force-pushed
the
meyskens/spiffe-delegate
branch
from
7ed5fdc
to
cb81118
Compare
meyskens
changed the title
mhofstetter
reviewed
Mar 2, 2023
mhofstetter
reviewed
Mar 2, 2023
meyskens
force-pushed
the
meyskens/spiffe-delegate
branch
from
cb81118
to
25f057c
Compare
youngnick
approved these changes
Mar 3, 2023
meyskens
force-pushed
the
meyskens/spiffe-delegate
branch
from
25f057c
to
19e51d8
Compare
mhofstetter
requested changes
Mar 6, 2023
This adds an interface for a hive cell to use that provides the auth package with a way to receive and verify validity of certificates involved. Signed-off-by: Maartje Eyskens <maartje.eyskens@isovalent.com>
This adds a dependency on the SPIFFE/SPIRE SDK to be used in the mTLS handling code. Signed-off-by: Maartje Eyskens <maartje.eyskens@isovalent.com>
This adds an implementation of the Delegate API of a SPIRE server as a source for certificates to be used in an mTLS handhake. It will connect to the admin socket of a SPIRE agent where it will be able to get the certificates and keys in name of all Cilium workloads which are receiving an SVID from the controller. This is then cached in memory for the auth handler to request. Signed-off-by: Maartje Eyskens <maartje.eyskens@isovalent.com>
meyskens
force-pushed
the
meyskens/spiffe-delegate
branch
from
19e51d8
to
d25041f
Compare
|
/test |
mhofstetter
approved these changes
Mar 7, 2023
|
One CI fail in Travis but does not seem related to this PR (the code path is not yet active so would be weird) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds an implementation of the Delegate API of a SPIRE server
as a source for certificates to be used in an mTLS handhake.
It will connect to the admin socket of a SPIRE agent where it will
be able to get the certificates and keys in name of all Cilium
workloads which are receiving an SVID from the controller.
This is then cached in memory for the auth handler to request.
Fixes: #23804