This repository has been archived by the owner on Jul 11, 2023. It is now read-only.
certificate/rotation: correctly rotate certs #2789
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
eduser25
approved these changes
Mar 9, 2021
Codecov Report
@@ Coverage Diff @@
## main #2789 +/- ##
==========================================
- Coverage 64.97% 64.72% -0.26%
==========================================
Files 151 151
Lines 6773 6798 +25
==========================================
- Hits 4401 4400 -1
- Misses 2354 2380 +26
Partials 18 18
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
snehachhabria
approved these changes
Mar 9, 2021
draychev
approved these changes
Mar 9, 2021
Certificates are not being rotated as expected because the channel on which they are making announcements is no longer used and had been dropped in favor of the pub-sub messaging infra. This change fixes cert rotation as follows: 1. Uses the pub-sub model to publish cert rotation events when a cert corresponding to a given CN is rotated. 2. Updates the certificates stored in Envoy for those proxies whose identity matches the CN being rotated. Verified that updated certs are correctly pushed to proxies with this change. Resolves openservicemesh#2786 Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram
force-pushed
the
certrotate-event
branch
from
fe82968 to
d62d229
Compare
eduser25
approved these changes
Mar 9, 2021
shashankram
force-pushed
the
certrotate-event
branch
2 times, most recently
from
6e30199 to
9996b4c
Compare
Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram
force-pushed
the
certrotate-event
branch
from
9996b4c to
ba92701
Compare
Signed-off-by: Shashank Ram <shashr2204@gmail.com>
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
Certificates are not being rotated as expected
because the channel on which they are making
announcements is no longer used and had been
dropped in favor of the pub-sub messaging infra.
This change fixes cert rotation as follows:
events when a cert corresponding to a given CN
is rotated.
proxies whose identity matches the CN being rotated.
Verified that updated certs are correctly pushed to
proxies with this change.
Resolves #2786
Signed-off-by: Shashank Ram shashr2204@gmail.com
Affected area:
Please answer the following questions with yes/no.
No