This repository has been archived by the owner on Jul 11, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 277
Automated Root Certificate rotation in OSM #4502
Labels
area/certificate-management
Certificate management
kind/feature-request
Feature request
priority/P0
P0 priority
size/XXL
40 days (2 months)
Milestone
Comments
jaellio
added a commit
to jaellio/osm
that referenced
this issue
Apr 20, 2022
Adds the Go types for the MeshRootCertificate API Part of openservicemesh#4502 Signed-off-by: jaellio <[email protected]>
jaellio
added a commit
to jaellio/osm
that referenced
this issue
Apr 20, 2022
Adds the Go types for the MeshRootCertificate API Part of openservicemesh#4502 Signed-off-by: jaellio <[email protected]>
jaellio
added a commit
to jaellio/osm
that referenced
this issue
Apr 20, 2022
Adds the Go types for the MeshRootCertificate API Part of openservicemesh#4502 Signed-off-by: jaellio <[email protected]>
jaellio
added a commit
to jaellio/osm
that referenced
this issue
Apr 20, 2022
Adds the Go types for the MeshRootCertificate API Part of openservicemesh#4502 Signed-off-by: jaellio <[email protected]>
jaellio
added a commit
to jaellio/osm
that referenced
this issue
Apr 21, 2022
Adds the Go types for the MeshRootCertificate API Part of openservicemesh#4502 Signed-off-by: jaellio <[email protected]>
jaellio
added a commit
that referenced
this issue
Apr 22, 2022
Loads the SDS configuration for the envoy bootstrap config from the file system. Previously, the certificates were provided inline to the Envoy bootstrap configuration which was stored in k8s Secret volume mounted to the Pod. This change will allow OSM to update the certificates used when establishing a connection with xDS without having to recreate the Pod. This allows the envoy xDS certificates to be rotated without potential data plane downtime. This change updates the existing envoy bootstrap k8s secret to include the TLS and validation context SDS configs, xDS certificate, key, and ca cert. This change is a part of the automated root certificate rotation work (#4502) Signed-off-by: jaellio <[email protected]>
nojnhuh
pushed a commit
that referenced
this issue
Apr 22, 2022
* apis: add MeshRootCertificate API types Adds the Go types for the MeshRootCertificate API Part of #4502 Signed-off-by: jaellio <[email protected]> * Use v1alpha2 Signed-off-by: jaellio <[email protected]> * Update ProviderSpec Signed-off-by: jaellio <[email protected]>
jaellio
added a commit
to jaellio/osm
that referenced
this issue
Apr 22, 2022
Adds the CRD for MeshRootCertificate API. Part of openservicemesh#4502 Signed-off-by: jaellio <[email protected]>
jaellio
added a commit
to jaellio/osm
that referenced
this issue
Apr 22, 2022
Adds the CRD for MeshRootCertificate API. Part of openservicemesh#4502 Signed-off-by: jaellio <[email protected]>
jaellio
added a commit
to jaellio/osm
that referenced
this issue
Apr 28, 2022
Supports multiple clients in Manager struct. Refactoring as a part of the root cert rotation work. During root cert rotation, there will be 2 CertManagers - the CertManager being rotated in and the CertManager being rotated out as specified in the MeshRootCertificates. Part of openservicemesh#4502 Signed-off-by: jaellio <[email protected]>
jaellio
added a commit
to jaellio/osm
that referenced
this issue
Apr 28, 2022
Supports multiple clients in Manager struct. Refactoring as a part of the root cert rotation work. During root cert rotation, there will be 2 CertManagers - the CertManager being rotated in and the CertManager being rotated out as specified in the MeshRootCertificates. Part of openservicemesh#4502 Signed-off-by: jaellio <[email protected]>
This was referenced May 2, 2022
keithmattix
pushed a commit
to keithmattix/osm
that referenced
this issue
May 3, 2022
* apis: add MeshRootCertificate API types Adds the Go types for the MeshRootCertificate API Part of openservicemesh#4502 Signed-off-by: jaellio <[email protected]> * Use v1alpha2 Signed-off-by: jaellio <[email protected]> * Update ProviderSpec Signed-off-by: jaellio <[email protected]>
jaellio
added a commit
that referenced
this issue
May 6, 2022
Supports multiple clients in Manager struct. Refactoring as a part of the root cert rotation work. During root cert rotation, there will be 2 CertManagers - the CertManager being rotated in and the CertManager being rotated out as specified in the MeshRootCertificates. The ca is moved from the Manager to the CertManagers for each cert provider. Part of #4502 Signed-off-by: jaellio <[email protected]>
Automatic root certificate rotation is out of scope for our immediate plans; we're going to start with a user-guided rotation and then elicit feedback from users |
The OSM project has been officially archived by the CNCF. There will be no more new development on any repo under the OpenServiceMesh organization. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Labels
area/certificate-management
Certificate management
kind/feature-request
Feature request
priority/P0
P0 priority
size/XXL
40 days (2 months)
#Please describe the Improvement and/or Feature Request
As of today OSM's root certificate once created cannot be automatically rotated. This issue will track the root certificate rotation feature in OSM.
The tasks include:
Scope (please mark with X where applicable)
The text was updated successfully, but these errors were encountered: