feat: tls.peer manifest field for service-to-service mtls posture - #440
Merged
Conversation
per-service knob in [service.<name>.tls]: peer = "off" # default — no peer authentication peer = "warn" # request + verify, but accept on failure peer = "require" # reject any peer without a valid cluster-CA leaf a service that only wants mtls (no public-facing acme cert) can now declare just tls.peer with no tls.domain. acme still requires a domain — the loader keeps that constraint. four new loader tests cover defaults, all three modes, the domain- optional case, and the invalid-value rejection. no behavior change yet — this PR just lands the config surface so the listener (server-side accept) and the upstream dial (client-side originate) can read it in the next chunk.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
summary
first PR-5 chunk. adds the manifest
tls.peer = "off" | "warn" | "require"field so the next chunks can wire the proxy listener (server-side accept
with mTLS) and the upstream dial (client-side originate) based on it.
config-surface only — nothing reads
tls.peerin this PR yet.what's in here
spec.TlsConfig.PeerModeenum (off / warn / require) + label + parserspec.TlsConfig.peerfield defaulting to.offspec.TlsConfig.domainis now optional (defaults to"") — a servicethat only wants mTLS doesn't need a public DNS name. ACME still
requires a domain, and the loader enforces that.
tls.peer; an unknown value is rejected with theexisting
InvalidTlsConfigerrorinvalid-value reject
design notes
peerundertlsmatches the original Phase 8 plan andkeeps related config grouped. one could argue mTLS is orthogonal to
inbound termination, but the user-facing surface is small enough
that grouping wins.
domainoptional is a small breaking-change risk only forusers who were relying on the prior "missing domain ⇒ error" behavior
without
acmeset. that combination was previously invalid (thecert had nowhere to go), so the behavior change is a bug fix more
than a contract break.
next chunk
tls.peerfrom the proxy listener path and callacceptServerHandshake(MtlsOpts)when settls.peerfrom the upstream dial path and callclient_session.doHandshakewith the cluster CAyoq cert service <name>CLIstill no auto-merge — security-sensitive wiring.