Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[issue] Cli supports http only #60

Closed
bigangryrobot opened this issue Jun 22, 2021 · 1 comment · Fixed by #875
Closed

[issue] Cli supports http only #60

bigangryrobot opened this issue Jun 22, 2021 · 1 comment · Fixed by #875

Comments

@bigangryrobot
Copy link
Contributor

This line in the cli limits the tool to only work with http endpoints

https://github.com/megaease/easegress/blob/main/cmd/client/command/common.go#L108

Suggest that we do one of the following:

  • Flag to enable or disable tls support as that would flip this and potentially other things as well
  • Allow the end user to describe the connectivity method themselves
@qdongxu
Copy link
Contributor

qdongxu commented Jun 25, 2021

Move the requirement&feasibility discussion from PR to issues, to avoid polluting the code review discussion. Discuss in this thread, please.

@xxx7xxxx :

Here are my opinions:
For now plain HTTP is acceptable for admin interfaces.
If we decide to support HTTPS or gRPC(like etcd3.x), it got more work. e.g. certificates stuff for HTTPS, protobuf definition for gRPC and so on.

@zhao-kun:

I think HTTP should be deprecated
HTTPS might bring complicated in the operation, but it's an enterprise feature for providing more security and worth our while to try it. So @benja-wu can schedule this to the Easegress' roadmap.

@benja-wu:

I think we can keep the HTTP way for Admin APIs as default behavior, but support HTTPS as a new feature for enterprise's security purpose. Cause I believe that Easegress's admin API will be mostly invoked inside the company's local area network.
Also I totally agree to support HTTPS in Admin APIs as an enterprise feature.
How about that?

@qdongxu:

It's necessary to clarify that we provide value-adding packages/features in the enterprise releases. but we don't disable the capability of the open-source releases. As in this case, It's good to let the cli tool supports https access. for the server-side, we can configure the admin port with SSL/TLS certificates out of the box(or provide a clear method, this can be planned in the roadmap). while the open-source users can configure by themselves (eg. put the API portal behind a gateway which enables https )

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants