Replies: 3 comments 1 reply
-
|
It appears as though the certificates are invalid. This could be for a variety of reasons, including (but not limited to):
When you said I would recommend verifying that outside of Kong the certificate is working properly with another client. If that all appears to be working, consider using something like |
Beta Was this translation helpful? Give feedback.
-
|
Yes. It used the client certificate. If I remove bring client certificate code, It will be error. package main
import (
"context"
"crypto/tls"
"crypto/x509"
"fmt"
"io/ioutil"
"os"
"github.com/islishude/grpc-mtls-example/greet"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials"
)
func LoadKeyPair() credentials.TransportCredentials {
certificate, err := tls.LoadX509KeyPair("certs/client.crt", "certs/client.key")
if err != nil {
panic("Load client certification failed: " + err.Error())
}
ca, err := ioutil.ReadFile("certs/server.crt")
if err != nil {
panic("can't read ca file")
}
capool := x509.NewCertPool()
if !capool.AppendCertsFromPEM(ca) {
panic("invalid CA file")
}
tlsConfig := &tls.Config{
Certificates: []tls.Certificate{certificate},
RootCAs: capool,
}
return credentials.NewTLS(tlsConfig)
}
func main() {
conn, err := grpc.Dial("example.com:10200", grpc.WithTransportCredentials(LoadKeyPair()))
if err != nil {
panic(err)
}
defer conn.Close()
client := greet.NewGreetingClient(conn)
var name = "world"
if len(os.Args) > 1 {
name = os.Args[1]
}
resp, err := client.SayHello(context.Background(), &greet.SayHelloRequest{Name: name})
if err != nil {
panic(err)
}
fmt.Println(resp.GetGreet())
}
|
Beta Was this translation helpful? Give feedback.
-
|
By the way. Kong chart version was kong:2.7.0 I found a suspicious point. Here is my service yaml. I patch annotation konghq.com/client-cert: mtls-grpc-client-cert When I check kong service by admin URL.
check kong-ingress-controller log When I restart KIC, all Routes can't be found. Kong-proxy can't work well. I don't understand. It seems that |
Beta Was this translation helpful? Give feedback.
-
|
So after reviewing some of your other comments, it looks like you may have stumbled upon a bug in Kong Gateway. I've created Kong/kong#9270 to try and fix it and get feedback from the Gateway maintainers, I recommend subscribing to that PR for updates and then hopefully that can get this resolved for you. |
Beta Was this translation helpful? Give feedback.
-
I deploy mtls grpc server, and try to call sever by ingress. it stuck at some point.
Here is my idea. But I deploy it in Kubernetes. The same program in local env works well.
step1. create two certificates by cert-manager
then I got two certificates.
step2 deploy pod svc ingress
ingress
Result
local env(Forward pod port)
When I try call grpc server endpoint by ingress. My client logs
Check kong-proxy log.
Source Code: https://github.com/islishude/grpc-mtls-example
I have checked a lot of information, but I could not find any case of kong mtls grpc. The official doc configuration of tls can run Thanks in advance!
Beta Was this translation helpful? Give feedback.
All reactions