destination: add UriLikeIdentity and server_name (#285)

Changes the `TlsIdentity` type in the destination API such that: - we add an extra `UriLikeIdentity` identity type that should contain identities that are in URI format (e.g. SPIFFE) - we add a `server_name` to the `TlsIdentity` type. This allows us to differentiate between an SNI value and a TLS Id value. This is mainly needed because in certain identity systems (SPIFFE/SPIRE) the TLS SAN can be in URI form. A URI cannot be used as a SNI extension in a `ClientHello`, so an alternative SNI value needs to be provided. This brings the need to distinguish between these two concepts. For context: linkerd/linkerd2-proxy#2506 Signed-off-by: Zahari Dichev <zaharidichev@gmail.com> Co-authored-by: Oliver Gould <ver@buoyant.io>
linkerd · Jan 5, 2024 · 2da43c5 · 2da43c5
1 parent a3c6b13
commit 2da43c5
Show file tree

Hide file tree

Showing 17 changed files with 404 additions and 265 deletions.
diff --git a/go/destination/destination.pb.go b/go/destination/destination.pb.go
diff --git a/go/destination/destination_grpc.pb.go b/go/destination/destination_grpc.pb.go
diff --git a/go/grpc_route/grpc_route.pb.go b/go/grpc_route/grpc_route.pb.go
diff --git a/go/http_route/http_route.pb.go b/go/http_route/http_route.pb.go
diff --git a/go/http_types/http_types.pb.go b/go/http_types/http_types.pb.go
diff --git a/go/identity/identity.pb.go b/go/identity/identity.pb.go
diff --git a/go/identity/identity_grpc.pb.go b/go/identity/identity_grpc.pb.go
diff --git a/go/inbound/inbound.pb.go b/go/inbound/inbound.pb.go
diff --git a/go/inbound/inbound_grpc.pb.go b/go/inbound/inbound_grpc.pb.go
diff --git a/go/meta/meta.pb.go b/go/meta/meta.pb.go
diff --git a/go/net/net.pb.go b/go/net/net.pb.go
diff --git a/go/outbound/outbound.pb.go b/go/outbound/outbound.pb.go
diff --git a/go/outbound/outbound_grpc.pb.go b/go/outbound/outbound_grpc.pb.go
diff --git a/go/tap/tap.pb.go b/go/tap/tap.pb.go
diff --git a/go/tap/tap_grpc.pb.go b/go/tap/tap_grpc.pb.go
diff --git a/proto/destination.proto b/proto/destination.proto
@@ -103,12 +103,19 @@ message WeightedAddr {
   AuthorityOverride authority_override = 7;
 }
 
-// Which strategy should be used for verifying TLS.
 message TlsIdentity {
   reserved 2;
   reserved "k8s_pod_identity";
 
-  oneof strategy { DnsLikeIdentity dns_like_identity = 1; }
+  oneof strategy {
+    DnsLikeIdentity dns_like_identity = 1;
+    UriLikeIdentity uri_like_identity = 3;
+  }
+
+  // The server name of the endpoint. This is the value that needs to be included
+  // by clients in the ClientHello SNI extension of the TLS handshake when they
+  // initiate TLS connections to servers.
+  DnsLikeIdentity server_name = 4;
 
   // Verify the certificate based on the Kubernetes pod identity.
   message DnsLikeIdentity {
@@ -118,6 +125,15 @@ message TlsIdentity {
     //    {name}.{namespace}.{type}.identity.{control-namespace}.{trust-domain...}
     string name = 1;
   }
+
+  // Verify the certificate based on an URI identity.
+  message UriLikeIdentity {
+    // A URI name that encodes workload identity.
+    //
+    // For example:
+    //    spiffe://trust-domain/workload-dentifier
+    string uri = 1;
+  }
 }
 
 message AuthorityOverride { string authority_override = 1; }

diff --git a/src/gen/io.linkerd.proxy.destination.rs b/src/gen/io.linkerd.proxy.destination.rs