New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement Secret Discovery Service #898

Closed

vaamarnath opened this issue Feb 18, 2019 · 10 comments

Labels

help wanted kind/feature priority/important-longterm

Milestone

Contributor

vaamarnath commented Feb 18, 2019

Implement Secret Discovery Service in Contour.

This enhancement request came out of the discussion on #862 for supporting rotating and invalidating certificates using SDS. More info about SDS is available here: https://www.envoyproxy.io/docs/envoy/latest/configuration/secret.

khgandhi commented Feb 26, 2019

@vaamarnath we have a requirement to have SDS implementation in contour as well. Do you have a design that you can share with the details ?

Contributor Author

vaamarnath commented Feb 27, 2019

@khgandhi The current requirement for SDS came in through #862. There is no design available for this issue at this point in time.

\cc @davecheney

davecheney added this to the 0.11.0 milestone

davecheney mentioned this issue

Support tls cert/key via file mount #845

Closed

davecheney added kind/feature help wanted priority/important-soon blocked/needs-design labels

davecheney mentioned this issue

Split Contour and Envoy containers into their own pods #881

Closed

bmadhavan commented Mar 13, 2019

@davecheney If you are ok, I can pick up this task. I can come up with a rough design doc and a list of possible changes in a couple of days.

Contributor

davecheney commented Mar 13, 2019

@bmadhavan sure, feel free to discuss the design here or in a design document. Please note that I will be travelling until the 1st of April and may not be able to reply during that time.

bmadhavan commented Mar 13, 2019

ok. Sure.

vaamarnath mentioned this issue

design: add secure communication between contour, envoy #901

Closed

bmadhavan mentioned this issue

Initial draft of design for SDS support on Contour #960

Merged

bmadhavan commented Mar 25, 2019

@davecheney I have created an initial design draft for SDS support. Can you please take a look.

davecheney mentioned this issue

Provide support for configuring client auth. #433

Closed

davecheney modified the milestones: 0.11.0, 0.12.0

Contributor

davecheney commented Apr 8, 2019

Due to the need to ship Contour 0.11 to address a security issue in Envoy 1.9.0 this has been bumped to the 0.12 milestone.

davecheney added priority/important-longterm and removed priority/important-soon labels

timh removed this from the 0.12.0 milestone

davecheney added a commit that referenced this issue


          design: approve SDS design

87d02d3

Updates #898

Remove the parts of the design about integrating SDS into LDS and CDS,
we'll do those at a later date. For now, just get this work started.

Signed-off-by: Dave Cheney <dave@cheney.net>

davecheney assigned vaamarnath

davecheney removed the blocked/needs-design label

Contributor

davecheney commented Apr 16, 2019

With #901 falling off the 0.12 milestone @vaamarnath and I have talked and the plan is to implement the basic SDS plumbing and we'll revisit the integration points with the rest of Contour later.

I was going to sit down and write down the steps to add SDS to internal/grpc but it turns out we already have 99% of the design from @bmadhavan in #960. I've polished that up and you can find here.

I'm not going to mark this issue as 0.12 as @vaamarnath nor I can commit to taking this one by the 0.12 deadline, but consider the design for adding SDS up for grabs.

Note to implementors: please work incrementally, one PR per high level design point. Please don't send one giant ass PR for the whole thing, that's not cool. You should also add some tests to internal/e2e which are really the func tests of internal/grpc.

Thanks

Dave

davecheney mentioned this issue

Encrypt gRPC traffic between Contour and Envoy #862

Closed

mattalberts commented Apr 25, 2019

@vaamarnath @davecheney Thanks for the notes. I've been building up the full solution over the last few days, adding tests, and verifying functionality. I'll split up the change set into a few PRs, mirroring the suggestion to provide 1 per major design point.

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/grpc: adds SDS and registers xds for sds

7b1d345

Addresses the first high-level design bullet point, creatign a gRPC
server for SDS by adding an SDS cache interface, implementing
FetchSecrets and StreamSecrets, and registering the server as an SDS
handler.

Updates projectcontour#898

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          cmd/contour: adds sds cli

342c14e

Addresses the third high-level design bullet point, support sds in the
contour cli for debugging.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts mentioned this issue

cmd/contour: adds sds cli #1048

Merged

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/contour: auth.SdsSecretConfig for auth.CommonTlsContext

0fd8feb

Addresses the non-goals of the high0level design for secret discovery,
converting auth.CommonTlsContext from TlsCertificates with inline bytes
for secret data to TlsCertificateSdsSecretConfigs for secret references
from the xDS gRPC server.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

This was referenced Apr 25, 2019

internal/contour: auth.SdsSecretConfig for auth.CommonTlsContext #1049

Merged

internal/contour: add SecretCache and link to grpc #1047

Merged

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/grpc: adds SDS and registers xds for sds

7b7a36e

Addresses the first high-level design bullet point, creatign a gRPC
server for SDS by adding an SDS cache interface, implementing
FetchSecrets and StreamSecrets, and registering the server as an SDS
handler.

Updates projectcontour#898

Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/contour: add SecretCache and link to grpc

c7ba7f4

Addresses the second high-level design bullet point, creating a
SecretCache to be used by Contour to internally identify any changes.
The cache is also registered as a reource type for the gRPC server,
allowing it to respond to requests.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          cmd/contour: adds sds cli

48c93c1

Addresses the third high-level design bullet point, support sds in the
contour cli for debugging.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/contour: auth.SdsSecretConfig for auth.CommonTlsContext

cda64ab

Addresses the non-goals of the high0level design for secret discovery,
converting auth.CommonTlsContext from TlsCertificates with inline bytes
for secret data to TlsCertificateSdsSecretConfigs for secret references
from the xDS gRPC server.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/grpc: adds SDS and registers xds for sds

44dfa61

Addresses the first high-level design bullet point, creatign a gRPC
server for SDS by adding an SDS cache interface, implementing
FetchSecrets and StreamSecrets, and registering the server as an SDS
handler.

Updates projectcontour#898

Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/contour: add SecretCache and link to grpc

9b0b33a

Addresses the second high-level design bullet point, creating a
SecretCache to be used by Contour to internally identify any changes.
The cache is also registered as a reource type for the gRPC server,
allowing it to respond to requests.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          cmd/contour: adds sds cli

87d29a0

Addresses the third high-level design bullet point, support sds in the
contour cli for debugging.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/contour: auth.SdsSecretConfig for auth.CommonTlsContext

94b7897

Addresses the non-goals of the high0level design for secret discovery,
converting auth.CommonTlsContext from TlsCertificates with inline bytes
for secret data to TlsCertificateSdsSecretConfigs for secret references
from the xDS gRPC server.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/contour: add SecretCache and link to grpc

d5999a0

Addresses the second high-level design bullet point, creating a
SecretCache to be used by Contour to internally identify any changes.
The cache is also registered as a reource type for the gRPC server,
allowing it to respond to requests.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          cmd/contour: adds sds cli

dffcf6e

Addresses the third high-level design bullet point, support sds in the
contour cli for debugging.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/contour: auth.SdsSecretConfig for auth.CommonTlsContext

cc473f0

Addresses the non-goals of the high0level design for secret discovery,
converting auth.CommonTlsContext from TlsCertificates with inline bytes
for secret data to TlsCertificateSdsSecretConfigs for secret references
from the xDS gRPC server.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/contour: add SecretCache and link to grpc

43fa0c8

Addresses the second high-level design bullet point, creating a
SecretCache to be used by Contour to internally identify any changes.
The cache is also registered as a reource type for the gRPC server,
allowing it to respond to requests.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          cmd/contour: adds sds cli

93d4a1a

Addresses the third high-level design bullet point, support sds in the
contour cli for debugging.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/contour: auth.SdsSecretConfig for auth.CommonTlsContext

2c55f52

Addresses the non-goals of the high0level design for secret discovery,
converting auth.CommonTlsContext from TlsCertificates with inline bytes
for secret data to TlsCertificateSdsSecretConfigs for secret references
from the xDS gRPC server.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          cmd/contour: adds sds cli

64632ca

Addresses the third high-level design bullet point, support sds in the
contour cli for debugging.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/contour: auth.SdsSecretConfig for auth.CommonTlsContext

b5b7b7f

Addresses the non-goals of the high0level design for secret discovery,
converting auth.CommonTlsContext from TlsCertificates with inline bytes
for secret data to TlsCertificateSdsSecretConfigs for secret references
from the xDS gRPC server.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/contour: auth.SdsSecretConfig for auth.CommonTlsContext

8563c1b

Addresses the non-goals of the high0level design for secret discovery,
converting auth.CommonTlsContext from TlsCertificates with inline bytes
for secret data to TlsCertificateSdsSecretConfigs for secret references
from the xDS gRPC server.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

stevesloka added this to the 0.12.0 milestone

vaamarnath removed their assignment

davecheney removed this from the 0.12.0 milestone

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/contour: auth.SdsSecretConfig for auth.CommonTlsContext

70fb1af

Addresses the non-goals of the high0level design for secret discovery,
converting auth.CommonTlsContext from TlsCertificates with inline bytes
for secret data to TlsCertificateSdsSecretConfigs for secret references
from the xDS gRPC server.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

mattalberts pushed a commit to mattalberts/contour that referenced this issue


          internal/contour: auth.SdsSecretConfig for auth.CommonTlsContext

988faac

Addresses the non-goals of the high0level design for secret discovery,
converting auth.CommonTlsContext from TlsCertificates with inline bytes
for secret data to TlsCertificateSdsSecretConfigs for secret references
from the xDS gRPC server.

Updates: projectcontour#898
Signed-off-by: Matt Alberts <malberts@cloudflare.com>

Contributor

davecheney commented May 7, 2019

I think this issue is now complete, at least wrt. the 0.12 milestone. Thank you to @vaamarnath @mattalberts and @stevesloka for pushing this forward.

davecheney added this to the 0.12.0 milestone

davecheney closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment