-
Notifications
You must be signed in to change notification settings - Fork 606
Add sds_name into gateway config. #772
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 2 commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -335,6 +335,13 @@ message Server { | |
| // Optional: If specified, only support the specified cipher list. | ||
| // Otherwise default to the default cipher list supported by Envoy. | ||
| repeated string cipher_suites = 9; | ||
|
|
||
| // Optional: If specified, the gateway controllers (with SDS enabled) | ||
| // use the specified name as the SDS secret config name to call the SDS | ||
| // server, to retrieve the key and certificates. Otherwise, the gateway | ||
| // controllers (with SDS enabled) uses the first value in the hosts as | ||
| // the SDS secret config name to call the SDS server. | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I dont think you should use the first value in hosts. Thats very arbitrary and could end up fetching someone else's secret. There is no mandate for the hosts in a gateway to be unique. Second, this API is very adhoc. How does this work with the certificates that the end user specifies? Do they work together or is there some other magic behind the scenes ? The agreement earlier was to make this a oneOf such that the user either specifies the certs or the secret name. Not both. And certainly not this gratuitous default of picking the first host. Please fix this before implementing it. |
||
| string sds_name = 10; | ||
| } | ||
|
|
||
| // Set of TLS related options that govern the server's behavior. Use | ||
|
|
||
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sorry, nit: uses --> use
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done. Thanks!