Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Service Mesh mTLS: DelegatedIdentity SPIFFE API #23968

Merged
merged 3 commits into from
Mar 8, 2023
Merged

Service Mesh mTLS: DelegatedIdentity SPIFFE API #23968

merged 3 commits into from
Mar 8, 2023

Commits on Mar 7, 2023

  1. Define a CertificateProvider interface 

    This adds an interface for a hive cell to use that provides the
auth package with a way to receive and verify validity of certificates involved.

Signed-off-by: Maartje Eyskens <maartje.eyskens@isovalent.com>
    @meyskens
    meyskens committed Mar 7, 2023
    Configuration menu
    Copy the full SHA
    d1e05d7 View commit details
    Browse the repository at this point in the history

  2. Vendor in SPIFFE/SPIRE SDK 

    This adds a dependency on the SPIFFE/SPIRE SDK to be used in the
mTLS handling code.

Signed-off-by: Maartje Eyskens <maartje.eyskens@isovalent.com>
    @meyskens
    meyskens committed Mar 7, 2023
    Configuration menu
    Copy the full SHA
    e462fe7 View commit details
    Browse the repository at this point in the history

  3. Add Spire delegate API as CertificateProvider 

    This adds an implementation of the Delegate API of a SPIRE server
as a source for certificates to be used in an mTLS handhake.

It will connect to the admin socket of a SPIRE agent where it will
be able to get the certificates and keys in name of all Cilium
workloads which are receiving an SVID from the controller.
This is then cached in memory for the auth handler to request.

Signed-off-by: Maartje Eyskens <maartje.eyskens@isovalent.com>
    @meyskens
    meyskens committed Mar 7, 2023
    Configuration menu
    Copy the full SHA
    d25041f View commit details
    Browse the repository at this point in the history