-
Notifications
You must be signed in to change notification settings - Fork 584
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[FEATURE] mTLS authentication for manager <-> instance-manager communication #3839
Comments
Pre Ready-For-Testing Checklist
|
This image includes MTLS support for the GRPC server and im client refactorings to enable persistent connection support. Longhorn longhorn#3839 Signed-off-by: Joshua Moody <joshua.moody@suse.com>
The MTLS secret is currently hardcoded to longhorn-grpc-tls we can improve this further in the future when necessary to also enable auto cert generation Longhorn longhorn#3839 Signed-off-by: Joshua Moody <joshua.moody@suse.com>
This image includes MTLS support for the GRPC server and im client refactorings to enable persistent connection support. Longhorn #3839 Signed-off-by: Joshua Moody <joshua.moody@suse.com>
The MTLS secret is currently hardcoded to longhorn-grpc-tls we can improve this further in the future when necessary to also enable auto cert generation Longhorn #3839 Signed-off-by: Joshua Moody <joshua.moody@suse.com>
The below is a test secret that can be used to enable MTLS auth on a cluster. absent TLS secret (default setup):
Test im deployed without TLS secret (non tls server)
Old instance-mangers pre TLS should just continue to work, since they should use the same client fallback as in the above test case
Expected Case that will not work, due to one time setup on the IM (tls server)
|
Verified on v1.3.0-preview1 Follow test steps for this feature 1 . absent TLS secret (default setup):
2 . Test im deployed without TLS secret (non tls server)
3 . Old instance-mangers pre TLS should just continue to work, since they should use the same client fallback as in the above test case
4 . Expected Case that will not work, due to one time setup on the IM (tls server)
|
Verified on master-head 20220513(73f1914b988daa121599f7ff2c4c9bbf59a40967) 1 . absent TLS secret (default setup):
2 . Test im deployed without TLS secret (non tls server)
|
cc @c3y1huang |
@cchien816 just added an automation label, could you help create a ticket to track the e2e test implementation later? Thanks. |
Is your feature request related to a problem? Please describe
We want to add authentication to the grpc control communication, this can be done at the manager <-> im level.
Since we are switching the engine binary invocation to a proxy client that also talks directly via the im.
Previously the MTLS auth was tracked and discussed at #1983 but it isn't really the best place for that, since the actual feature request is concerned with the authentication from the users perspective (UI).
Describe the solution you'd like
Additional context
The text was updated successfully, but these errors were encountered: