v3

Documentation

Index

• func CreateDownstreamTlsContext(downstreamMesh core_xds.CaRequest, mesh core_xds.IdentityCertRequest) (*envoy_tls.DownstreamTlsContext, error)
• func CreateUpstreamTlsContext(mesh core_xds.IdentityCertRequest, upstreamMesh core_xds.CaRequest, ...) (*envoy_tls.UpstreamTlsContext, error)
• func KumaIDMatcher(tagName, tagValue string) *envoy_type_matcher.StringMatcher
• func MeshSpiffeIDPrefixMatcher(mesh string) *envoy_type_matcher.StringMatcher
• func NewSecretConfigSource(secretName string) *envoy_tls.SdsSecretConfig
• func ServiceSpiffeIDMatcher(mesh string, service string) *envoy_type_matcher.StringMatcher
• func StaticDownstreamTlsContext(keyPair *tls.KeyPair) *envoy_tls.DownstreamTlsContext
• func UpstreamTlsContextOutsideMesh(ca, cert, key []byte, allowRenegotiation bool, hostname string, sni string) (*envoy_tls.UpstreamTlsContext, error)

Functions

func CreateDownstreamTlsContext

func CreateDownstreamTlsContext(downstreamMesh core_xds.CaRequest, mesh core_xds.IdentityCertRequest) (*envoy_tls.DownstreamTlsContext, error)

CreateDownstreamTlsContext creates DownstreamTlsContext for incoming connections It verifies that incoming connection has TLS certificate signed by Mesh CA with URI SAN of prefix spiffe://{mesh_name}/ It secures inbound listener with certificate of "identity_cert" that will be received from the SDS (it contains URI SANs of all inbounds).

func CreateUpstreamTlsContext

func CreateUpstreamTlsContext(mesh core_xds.IdentityCertRequest, upstreamMesh core_xds.CaRequest, upstreamService string, sni string) (*envoy_tls.UpstreamTlsContext, error)

CreateUpstreamTlsContext creates UpstreamTlsContext for outgoing connections It verifies that the upstream server has TLS certificate signed by Mesh CA with URI SAN of spiffe://{mesh_name}/{upstream_service} The downstream client exposes for the upstream server cert with multiple URI SANs, which means that if DP has inbound with services "web" and "web-api" and communicates with "backend" the upstream server ("backend") will see that DP with TLS certificate of URIs of "web" and "web-api". There is no way to correlate incoming request to "web" or "web-api" with outgoing request to "backend" to expose only one URI SAN.

Pass "*" for upstreamService to validate that upstream service is a service that is part of the mesh (but not specific one)

func KumaIDMatcher

func KumaIDMatcher(tagName, tagValue string) *envoy_type_matcher.StringMatcher

func MeshSpiffeIDPrefixMatcher

func MeshSpiffeIDPrefixMatcher(mesh string) *envoy_type_matcher.StringMatcher

func NewSecretConfigSource

func NewSecretConfigSource(secretName string) *envoy_tls.SdsSecretConfig

func ServiceSpiffeIDMatcher

func ServiceSpiffeIDMatcher(mesh string, service string) *envoy_type_matcher.StringMatcher

func StaticDownstreamTlsContext

func StaticDownstreamTlsContext(keyPair *tls.KeyPair) *envoy_tls.DownstreamTlsContext

func UpstreamTlsContextOutsideMesh

func UpstreamTlsContextOutsideMesh(ca, cert, key []byte, allowRenegotiation bool, hostname string, sni string) (*envoy_tls.UpstreamTlsContext, error)