Repository navigation
feat: opt-in SPIFFE mTLS for https backends - #535
Merged
Merged
Conversation
- New flags --spiffe-backend-mtls and --spiffe-backend-ids. With --spiffe-backend-mtls, /api/echo calls the https backends over SPIFFE mTLS, presenting podinfo's SVID and authorizing the backend by ID, or by podinfo's trust domain when no IDs are given. SVID rotation applies to backend calls too. http backends are unchanged. - Off by default, so https backends with WebPKI certs keep working when SPIFFE is enabled for the server. - --spiffe-backend-mtls without --spiffe-endpoint-socket, or --spiffe-backend-ids without --spiffe-backend-mtls, fail at startup. - Backend calls fail with a clear error before the SVID is issued and after shutdown closes the Workload API source. - The backend transport no longer assumes http.DefaultTransport is an *http.Transport. - Chart: new spiffe.backendMTLS and spiffe.backendIDs values, with template errors for invalid combinations. - Tests chain two SPIFFE podinfo instances and cover mutual authorization, foreign trust domains and the disabled mode.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds opt-in SPIFFE mTLS for calls from
/api/echotohttpsbackends, so two podinfo instances can be chained over SPIFFE mTLS.Changes
--spiffe-backend-mtls: callhttpsbackends with SPIFFE mTLS, presenting podinfo's SVID. Requires--spiffe-endpoint-socket.--spiffe-backend-ids: server SPIFFE IDs accepted from backends. When empty, any ID in podinfo's trust domain is accepted. Requires--spiffe-backend-mtls.httpsbackends with WebPKI certs keep working. When the flag is on, allhttpsbackends must be SPIFFE workloads.httpbackends are never affected.X509Sourceas the server, so SVID rotation applies to backend calls.spiffe.backendMTLSandspiffe.backendIDsvalues. Rendering fails forbackendMTLSwithoutspiffe.enabledand forbackendIDswithoutbackendMTLS.Testing
go test -race ./pkg/api/http/ -run SPIFFE: chains two SPIFFE podinfo instances and covers mutual authorization, rejection on either side, foreign trust domains, the disabled mode, flag validation and the error before the SVID is issued and after shutdown.helm lintandhelm templatewith valid and invalid value combinations.