envoy: use SDS to get jrock.us certs

jrockway · Apr 26, 2020 · 3d986f6 · 3d986f6
1 parent 97a7add
commit 3d986f6
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 6 deletions.
diff --git a/ingress/public/envoy.yaml b/ingress/public/envoy.yaml
@@ -84,11 +84,9 @@ static_resources:
                         "@type": type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
                         common_tls_context:
                             alpn_protocols: ["h2", "http/1.1"]
-                            tls_certificates:
-                                - certificate_chain:
-                                      filename: "/jrock.us/tls.crt"
-                                  private_key:
-                                      filename: "/jrock.us/tls.key"
+                            tls_certificate_sds_secret_configs:
+                                sds_config:
+                                    path: /etc/envoy/sds.yaml
                 filters:
                     - name: envoy.http_connection_manager
                       typed_config:

diff --git a/ingress/public/kustomization.yaml b/ingress/public/kustomization.yaml
@@ -9,7 +9,7 @@ resources:
     - client-cert.yaml
 configMapGenerator:
     - name: envoy-config
-      files: ["envoy.yaml"]
+      files: ["envoy.yaml", "sds.yaml"]
     - name: envoy-policy
       files: ["policy.rego=access/policy.rego"]
 secretGenerator:

diff --git a/ingress/public/sds.yaml b/ingress/public/sds.yaml
@@ -0,0 +1,7 @@
+resources:
+    - "@type": "type.googleapis.com/envoy.api.v2.auth.Secret"
+      tls_certificate:
+          certificate_chain:
+              filename: "/jrock.us/tls.crt"
+          private_key:
+              filename: "/jrock.us/tls.key"