luxolus
/
open-consul
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity
open-consul/agent/xds
History
Freddy 6ef38eaea7
Configure upstream TLS context with peer root certs (#13321) 
For mTLS to work between two proxies in peered clusters with different root CAs,
proxies need to configure their outbound listener to use different root certificates
for validation.

Up until peering was introduced proxies would only ever use one set of root certificates
to validate all mesh traffic, both inbound and outbound. Now an upstream proxy
may have a leaf certificate signed by a CA that's different from the dialing proxy's.

This PR makes changes to proxycfg and xds so that the upstream TLS validation
uses different root certificates depending on which cluster is being dialed.
 		2022-06-01 15:53:52 -06:00
..
proxysupport connect: Add Envoy 1.22 to integration tests, remove Envoy 1.18 (#12805) 2022-04-18 09:36:07 -07:00
serverlessplugin Support making requests to lambda from connect proxies. 2022-05-05 17:42:30 -04:00
testdata Configure upstream TLS context with peer root certs (#13321) 2022-06-01 15:53:52 -06:00
xdscommon Support making requests to lambda from connect proxies. 2022-05-05 17:42:30 -04:00
clusters.go Configure upstream TLS context with peer root certs (#13321) 2022-06-01 15:53:52 -06:00
clusters_test.go Use embedded SpiffeID for peered upstreams 2022-05-31 09:55:37 -06:00
config.go Fix proto lint errors after version bump 2022-05-24 18:44:54 -07:00
config_test.go Support Incremental xDS mode (#9855) 2021-04-29 13:54:05 -05:00
delta.go Enable servers to configure arbitrary proxies from the catalog (#13244) 2022-05-27 12:38:52 +01:00
delta_test.go add general runstep test helper instead of copying it all over the place (#13013) 2022-05-10 15:25:51 -05:00
endpoints.go Configure upstream TLS context with peer root certs (#13321) 2022-06-01 15:53:52 -06:00
endpoints_test.go Make an xdscommon package that will be shared between Consul and Envoy plugins 2022-03-08 14:57:23 -05:00
envoy_versioning.go connect: Add Envoy 1.22 to integration tests, remove Envoy 1.18 (#12805) 2022-04-18 09:36:07 -07:00
envoy_versioning_test.go connect: Add Envoy 1.22 to integration tests, remove Envoy 1.18 (#12805) 2022-04-18 09:36:07 -07:00
failover_math.go xds: default to speaking xDS v3, but allow for v2 to be spoken upon request (#9658) 2021-02-26 16:23:15 -06:00
failover_math_test.go partition dicovery chains (#10983) 2021-09-07 16:29:32 -04:00
golden_test.go connect: Add Envoy 1.21.1 to support matrix, remove 1.17.4 (#12777) 2022-04-14 10:44:42 -07:00
listeners.go Configure upstream TLS context with peer root certs (#13321) 2022-06-01 15:53:52 -06:00
listeners_ingress.go Configure upstream TLS context with peer root certs (#13321) 2022-06-01 15:53:52 -06:00
listeners_test.go fix: multiple grpc/http2 services for ingress listeners 2022-05-26 10:43:58 -04:00
naming.go connect: generate the full SNI names for discovery targets in the compiler rather than in the xds package (#6340) 2019-08-19 13:03:03 -05:00
net_fallback.go re-run gofmt on 1.17 (#11579) 2021-11-16 12:04:01 -06:00
net_linux.go re-run gofmt on 1.17 (#11579) 2021-11-16 12:04:01 -06:00
protocol_trace.go Support Incremental xDS mode (#9855) 2021-04-29 13:54:05 -05:00
rbac.go Update spiffe ID patterns used for RBAC 2021-09-14 11:00:03 -06:00
rbac_test.go connect: Remove support for Envoy 1.16 (#11354) 2021-10-27 18:51:35 -07:00
resources.go Make an xdscommon package that will be shared between Consul and Envoy plugins 2022-03-08 14:57:23 -05:00
response.go Continue working through proxy and agent 2021-05-04 12:41:43 -07:00
routes.go Fix proto lint errors after version bump 2022-05-24 18:44:54 -07:00
routes_test.go fix: multiple grpc/http2 services for ingress listeners 2022-05-26 10:43:58 -04:00
server.go Enable servers to configure arbitrary proxies from the catalog (#13244) 2022-05-27 12:38:52 +01:00
server_oss.go Fixup acl.EnterpriseMeta 2022-04-05 15:11:49 -07:00
serverless_plugin_oss_test.go Support making requests to lambda from connect proxies. 2022-05-05 17:42:30 -04:00
testing.go xds: fix for delta xDS reconnect bug in LDS/CDS (#12174) 2022-01-25 11:24:27 -06:00
xds.go Remove unused customEDSClusterJSON 2020-03-27 15:38:16 -04:00
xds_protocol_helpers_test.go Remove intermediate representation of SPIFFE IDs 2022-05-31 09:55:37 -06:00
z_xds_packages.go Add connection limit setting to service defaults 2022-05-24 10:13:38 -07:00
z_xds_packages_test.go xds: ensure that all envoyproxy/go-control-plane protobuf symbols are linked into the final binary (#10131) 2021-04-29 14:58:26 -05:00