feat(infra): add configurable CA path for xDS mTLS#8633
Closed
rajatvig wants to merge 3 commits into
Closed
Conversation
✅ Deploy Preview for cerulean-figolla-1f9435 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
rajatvig
changed the title
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #8633 +/- ##
==========================================
- Coverage 74.52% 74.50% -0.02%
==========================================
Files 243 243
Lines 38670 38677 +7
==========================================
Hits 28817 28817
- Misses 7862 7867 +5
- Partials 1991 1993 +2 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Add --xds-tls-ca-path CLI flag for the controller and xdsTLSCAPath field on the EnvoyProxy CRD to override the default CA certificate path (/certs/ca.crt) used for xDS mTLS. This enables non-disruptive CA rotation when using cert-manager with trust-manager. The default CA path is baked into leaf cert secrets, which become stale when the CA rotates. By pointing both sides at a separately managed CA bundle (e.g. a trust-manager ConfigMap), the existing reload mechanisms (GetConfigForClient and SDS file watch) pick up the new CA without pod restarts. Relates to envoyproxy#4891 Signed-off-by: Rajat Vig <[email protected]>
zirain
force-pushed
the
feat/configurable-xds-tls-ca-path
branch
from
bdefb9f to
40f4d0b
Compare
Contributor
|
This pull request has been automatically marked as stale because it has not had activity in the last 30 days. Please feel free to give a status update now, ping for review, when it's ready. Thank you for your contributions! |
Contributor
|
This pull request has been automatically marked as stale because it has not had activity in the last 30 days. Please feel free to give a status update now, ping for review, when it's ready. Thank you for your contributions! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a configurable CA certificate path for xDS mTLS on both the controller and proxy sides. By default, the CA comes from the
ca.crtfield in the leaf cert secrets. This change allows pointing both sides at a separately managed CA file instead.Changes
Controller side:
--xds-tls-ca-pathCLI flag overrides the default/certs/ca.crtxdsTLSCAPathandxdsTLSCABundleto configure the flag and mount a CA ConfigMapProxy side:
xdsTLSCAPathfield on theEnvoyProxyCRD overrides the CA path in the SDS trusted CA configBoth sides default to the existing behavior when not set.
The controller re-reads the CA file on each TLS handshake via
GetConfigForClient.The proxy picks up CA changes via SDS file watch. No pod restarts required when the CA file is updated.
Testing
Relates to: #4891