sds: clusters and listeners read static secrets from Bootstrap.static_resources

include/envoy/secret/BUILD

@@ -0,0 +1,24 @@
+licenses(["notice"])  # Apache 2
+
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_library",
+    "envoy_package",
+)
+
+envoy_package()
+
+envoy_cc_library(
+    name = "secret_interface",
+    hdrs = ["secret.h"],
+)
+
+envoy_cc_library(
+    name = "secret_manager_interface",
+    hdrs = ["secret_manager.h"],
+    deps = [
+        ":secret_interface",
+        "//source/common/json:json_loader_lib",
+        "@envoy_api//envoy/api/v2/auth:cert_cc",
+    ],
+)

include/envoy/secret/secret.h

@@ -0,0 +1,59 @@
+#pragma once
+
+#include <stdexcept>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+#include "envoy/common/exception.h"
+#include "envoy/ssl/context.h"
+
+namespace Envoy {
+namespace Secret {
+
+/**
+ * Secret contains certificate chain and private key
+ */
+class Secret {
+public:
+  virtual ~Secret() {}
+
+  /**
+   * @return a name of the SDS secret
+   */
+  virtual const std::string& getName() PURE;
+
+  /**
+   * @return a string of certificate chain
+   */
+  virtual const std::string& getCertificateChain() PURE;
+  /**
+   * @return a string of private key
+   */
+  virtual const std::string& getPrivateKey() PURE;
+};
+
+typedef std::shared_ptr<Secret> SecretSharedPtr;
+
+typedef std::unordered_map<std::string, SecretSharedPtr> SecretSharedPtrMap;
+
+typedef std::vector<SecretSharedPtr> SecretSharedPtrVector;
+
+/**
+ * Throws when the requested static secret is not available
+ */
+class EnvoyStaticSecretException : public EnvoyException {
+public:
+  EnvoyStaticSecretException(const std::string& message) : EnvoyException(message) {}
+};
+
+/**
+ * Throws when the requested dynamic secret is not available
+ */
+class EnvoyDynamicSecretNotReadyException : public EnvoyException {
+public:
+  EnvoyDynamicSecretNotReadyException(const std::string& message) : EnvoyException(message) {}
+};
+
+} // namespace Secret
+} // namespace Envoy

include/envoy/secret/secret_manager.h

@@ -0,0 +1,38 @@
+#pragma once
+
+#include <google/protobuf/util/json_util.h>
+
+#include <iomanip>
+#include <sstream>
+#include <string>
+
+#include "envoy/secret/secret.h"
+
+#include "common/json/json_loader.h"
+
+namespace Envoy {
+namespace Secret {
+
+/**
+ * A manager for all static secrets
+ */
+class SecretManager {
+public:
+  virtual ~SecretManager() {}
+
+  /**
+   * Add or update static secret
+   *
+   * @param secret Updated Secret
+   * @return true when successful, otherwise returns false
+   */
+  virtual bool addOrUpdateStaticSecret(const SecretSharedPtr secret) PURE;
+
+  /**
+   * @return the static secret for the given name
+   */
+  virtual SecretSharedPtr getStaticSecret(const std::string& name) PURE;
+};
+
+} // namespace Secret
+} // namespace Envoy

include/envoy/server/BUILD

@@ -95,6 +95,7 @@ envoy_cc_library(
         "//include/envoy/local_info:local_info_interface",
         "//include/envoy/ratelimit:ratelimit_interface",
         "//include/envoy/runtime:runtime_interface",
+        "//include/envoy/secret:secret_manager_interface",
         "//include/envoy/ssl:context_manager_interface",
         "//include/envoy/thread_local:thread_local_interface",
         "//include/envoy/tracing:http_tracer_interface",
@@ -171,6 +172,7 @@ envoy_cc_library(
     hdrs = ["transport_socket_config.h"],
     deps = [
         "//include/envoy/network:transport_socket_interface",
+        "//include/envoy/secret:secret_manager_interface",
         "//include/envoy/ssl:context_manager_interface",
         "//source/common/protobuf",
     ],

include/envoy/server/instance.h

@@ -11,6 +11,7 @@
 #include "envoy/network/listen_socket.h"
 #include "envoy/ratelimit/ratelimit.h"
 #include "envoy/runtime/runtime.h"
+#include "envoy/secret/secret_manager.h"
 #include "envoy/server/admin.h"
 #include "envoy/server/drain_manager.h"
 #include "envoy/server/hot_restart.h"
@@ -113,6 +114,11 @@ class Instance {
    */
   virtual ListenerManager& listenerManager() PURE;
 
+  /**
+   * @return the server's secret manager
+   */
+  virtual Secret::SecretManager& secretManager() PURE;
+
   /**
    * @return the server's CLI options.
    */

include/envoy/server/transport_socket_config.h

@@ -3,6 +3,7 @@
 #include <string>
 
 #include "envoy/network/transport_socket.h"
+#include "envoy/secret/secret_manager.h"
 #include "envoy/ssl/context_manager.h"
 
 #include "common/protobuf/protobuf.h"
@@ -27,6 +28,11 @@ class TransportSocketFactoryContext {
    * @return Stats::Scope& the transport socket's stats scope.
    */
   virtual Stats::Scope& statsScope() const PURE;
+
+  /**
+   * @return Secret::SecretManager& reference of the SecretMangaer instance.
+   */
+  virtual Secret::SecretManager& secretManager() PURE;
 };
 
 class TransportSocketConfigFactory {

include/envoy/ssl/BUILD

@@ -29,6 +29,7 @@ envoy_cc_library(
     deps = [
         ":context_config_interface",
         ":context_interface",
+        "//include/envoy/secret:secret_manager_interface",
         "//include/envoy/stats:stats_interface",
     ],
 )

include/envoy/ssl/context_manager.h

@@ -2,6 +2,7 @@
 
 #include <functional>
 
+#include "envoy/secret/secret_manager.h"
 #include "envoy/ssl/context.h"
 #include "envoy/ssl/context_config.h"
 #include "envoy/stats/stats.h"
@@ -49,6 +50,11 @@ class ContextManager {
    * Iterate through all currently allocated contexts.
    */
   virtual void iterateContexts(std::function<void(const Context&)> callback) PURE;
+
+  /**
+   * Return the secret manager
+   */
+  virtual Secret::SecretManager& secretManager() PURE;
 };
 
 } // namespace Ssl

source/common/config/bootstrap_json.cc

@@ -5,6 +5,7 @@
 #include "common/config/cds_json.h"
 #include "common/config/json_utility.h"
 #include "common/config/lds_json.h"
+#include "common/config/tls_context_json.h"
 #include "common/config/utility.h"
 #include "common/json/config_schemas.h"
 #include "common/protobuf/utility.h"
@@ -130,5 +131,20 @@ void BootstrapJson::translateBootstrap(const Json::Object& json_config,
   }
 }
 
+void BootstrapJson::translateStaticSecretsBootstrap(
+    const Json::Object& json_secrets, envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+
+  for (const Json::ObjectSharedPtr& secret : json_secrets.getObjectArray("secrets")) {
+    auto secret_object = bootstrap.mutable_static_resources()->mutable_secrets()->Add();
+    secret_object->set_name(secret->getString("name"));
+
+    if (secret->hasObject("tls_certificate")) {
+      TlsContextJson::translateTlsCertificate(*secret->getObject("tls_certificate"),
+                                              *secret_object->mutable_tls_certificate());
+    } else if (secret->hasObject("session_ticket_keys")) {
+    }
+  }
+}
+
 } // namespace Config
 } // namespace Envoy

source/common/config/bootstrap_json.h

@@ -23,6 +23,14 @@ class BootstrapJson {
    */
   static void translateBootstrap(const Json::Object& json_config,
                                  envoy::config::bootstrap::v2::Bootstrap& bootstrap);
+
+  /**
+   * Translate static secrets to v2 envoy::config::bootstrap::v2::Bootstrap.
+   * @param json_config source static secrets.
+   * @param bootstrap destination v2 envoy::config::bootstrap::v2::Bootstrap.
+   */
+  static void translateStaticSecretsBootstrap(const Json::Object& json_secrets,
+                                              envoy::config::bootstrap::v2::Bootstrap& bootstrap);
 };
 
 } // namespace Config

source/common/secret/BUILD

@@ -0,0 +1,31 @@
+licenses(["notice"])  # Apache 2
+
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_library",
+    "envoy_package",
+)
+
+envoy_package()
+
+envoy_cc_library(
+    name = "secret_impl_lib",
+    srcs = ["secret_impl.cc"],
+    hdrs = ["secret_impl.h"],
+    deps = [
+        "//include/envoy/secret:secret_interface",
+        "//source/common/config:datasource_lib",
+        "@envoy_api//envoy/api/v2/auth:cert_cc",
+    ],
+)
+
+envoy_cc_library(
+    name = "secret_manager_impl_lib",
+    srcs = ["secret_manager_impl.cc"],
+    hdrs = ["secret_manager_impl.h"],
+    deps = [
+        ":secret_impl_lib",
+        "//include/envoy/secret:secret_manager_interface",
+        "//include/envoy/server:instance_interface",
+    ],
+)

source/common/secret/secret_impl.cc

@@ -0,0 +1,17 @@
+#include "common/secret/secret_impl.h"
+
+#include <string>
+
+#include "common/common/assert.h"
+#include "common/config/datasource.h"
+
+namespace Envoy {
+namespace Secret {
+
+SecretImpl::SecretImpl(const envoy::api::v2::auth::Secret& config)
+    : name_(config.name()), certificate_chain_(Config::DataSource::read(
+                                config.tls_certificate().certificate_chain(), true)),
+      private_key_(Config::DataSource::read(config.tls_certificate().private_key(), true)) {}
+
+} // namespace Secret
+} // namespace Envoy

source/common/secret/secret_impl.h

@@ -0,0 +1,26 @@
+#pragma once
+
+#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/secret/secret.h"
+
+namespace Envoy {
+namespace Secret {
+
+class SecretImpl : public Secret {
+public:
+  SecretImpl(const envoy::api::v2::auth::Secret& config);
+
+  const std::string& getName() override { return name_; }
+
+  const std::string& getCertificateChain() override { return certificate_chain_; }
+
+  const std::string& getPrivateKey() override { return private_key_; }
+
+private:
+  std::string name_;
+  std::string certificate_chain_;
+  std::string private_key_;
+};
+
+} // namespace Secret
+} // namespace Envoy

source/common/secret/secret_manager_impl.cc

@@ -0,0 +1,19 @@
+#include "common/secret/secret_manager_impl.h"
+
+#include "common/common/logger.h"
+#include "common/secret/secret_impl.h"
+
+namespace Envoy {
+namespace Secret {
+
+bool SecretManagerImpl::addOrUpdateStaticSecret(const SecretSharedPtr secret) {
+  static_secrets_[secret->getName()] = secret;
+  return true;
+}
+
+SecretSharedPtr SecretManagerImpl::getStaticSecret(const std::string& name) {
+  return (static_secrets_.find(name) != static_secrets_.end()) ? static_secrets_[name] : nullptr;
+}
+
+} // namespace Secret
+} // namespace Envoy

source/common/secret/secret_manager_impl.h

@@ -0,0 +1,30 @@
+#pragma once
+
+#include <shared_mutex>
+#include <unordered_map>
+
+#include "envoy/secret/secret.h"
+#include "envoy/secret/secret_manager.h"
+#include "envoy/server/instance.h"
+
+#include "common/common/logger.h"
+#include "common/secret/secret_impl.h"
+
+namespace Envoy {
+namespace Secret {
+
+class SecretManagerImpl : public SecretManager, Logger::Loggable<Logger::Id::upstream> {
+public:
+  SecretManagerImpl(){};
+
+  virtual ~SecretManagerImpl() {}
+
+  bool addOrUpdateStaticSecret(const SecretSharedPtr secret) override;
+  SecretSharedPtr getStaticSecret(const std::string& name) override;
+
+private:
+  SecretSharedPtrMap static_secrets_;
+};
+
+} // namespace Secret
+} // namespace Envoy

source/common/ssl/BUILD

@@ -32,6 +32,7 @@ envoy_cc_library(
         "ssl",
     ],
     deps = [
+        "//include/envoy/secret:secret_manager_interface",
         "//include/envoy/ssl:context_config_interface",
         "//source/common/common:assert_lib",
         "//source/common/config:datasource_lib",