Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Service mesh: add mTLS auth method #24263

Merged
merged 3 commits into from
Mar 20, 2023
Merged

Service mesh: add mTLS auth method #24263

merged 3 commits into from
Mar 20, 2023

Commits on Mar 16, 2023

  1. Add mTLS auth controller 

    This adds an mTLS auth handler to the Serice Mesh auth package.
It will listen on a given port and does a mutual TLS handshake with
SPIFFE IDs it received. This will assure the both sides got the needed
certificates.

In order to integrate with the datapath tables it also improves the SPIFFE
interface to use the Cilium Numeric Identities. And convert them from and
to valid SNI fields. As well as implement code to validate the URI SANS
inside the certificates.

Signed-off-by: Maartje Eyskens <maartje.eyskens@isovalent.com>
    @meyskens
    meyskens committed Mar 16, 2023
    Configuration menu
    Copy the full SHA
    08c7000 View commit details
    Browse the repository at this point in the history

  2. Remove the debug statement for processing SVIDs 

    Removing the debuig line that tells which SVID it received.
The delegate API will send the state of the world on every sync.
In very large deployments this will make a lot of debug logs.

Signed-off-by: Maartje Eyskens <maartje.eyskens@isovalent.com>
    @meyskens
    meyskens committed Mar 16, 2023
    Configuration menu
    Copy the full SHA
    b21dac4 View commit details
    Browse the repository at this point in the history

  3. Add mTLS auth to the Helm chart 

    This adds the ability to enable mtls-spiffe support in the Helm chart,
It will set the required config flags to the defaults as wel
as mount the spire socket to the agent pods.

Signed-off-by: Maartje Eyskens <maartje.eyskens@isovalent.com>
    @meyskens
    meyskens committed Mar 16, 2023
    Configuration menu
    Copy the full SHA
    d699086 View commit details
    Browse the repository at this point in the history