Service Mesh mTLS: introduce auth map #24218
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
maintainer-s-little-helper
bot
added
the
dont-merge/needs-release-note-label
mhofstetter
added
release-note/misc
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
mhofstetter
force-pushed
the
pr/mhofstetter/auth-map
branch
2 times, most recently
from
e41e82b
to
54a387c
Compare
|
New map types need to be added to the alignchecker like for example in commit 16e132e, both in |
mhofstetter
force-pushed
the
pr/mhofstetter/auth-map
branch
4 times, most recently
from
7216939
to
d333ebe
Compare
|
/test |
mhofstetter
force-pushed
the
pr/mhofstetter/auth-map
branch
from
d333ebe
to
60a7b87
Compare
|
E2E Tests failed with added |
|
/test |
qmonnet
requested changes
Mar 10, 2023
mhofstetter
force-pushed
the
pr/mhofstetter/auth-map
branch
from
60a7b87
to
6915649
Compare
mhofstetter
force-pushed
the
pr/mhofstetter/auth-map
branch
from
6915649
to
90339aa
Compare
|
rebased to master and resolved conflicts in generated documentation files (without any other changes) |
Prior to this commit, auth information were kept as additional property in the ct map which required authentication on a per connection basis. This commit introduces the bpf map auth which keeps track of authentication state between security identities in combination with the remote node id, auth type and an expiration. Signed-off-by: Marco Hofstetter <marco.hofstetter@isovalent.com>
Introduce cilium CLI command "cilium bpf auth list" to inspect the entries of the bpf auth map. Signed-off-by: Marco Hofstetter <marco.hofstetter@isovalent.com>
mhofstetter
force-pushed
the
pr/mhofstetter/auth-map
branch
from
90339aa
to
d8b7420
Compare
|
/test |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently, authentication state (if required by a policy) is tracked as property in the conntrack map which requires authentication in the userspace on a per connection basis.
These changes introduce the bpf map
authwhich enables keeping track of authentication state between security identities in combination with the remote node id, auth type and an expiration.