Added support for upstream verification for TCPProxy #6079
Conversation
tsaarni
requested review from
skriss and
sunjayBhatia
and removed request for
a team
sunjayBhatia
requested review from
a team and
davinci26
and removed request for
a team
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## main #6079 +/- ##
==========================================
- Coverage 78.82% 78.81% -0.02%
==========================================
Files 138 138
Lines 19766 19790 +24
==========================================
+ Hits 15581 15597 +16
- Misses 3878 3884 +6
- Partials 307 309 +2
|
tsaarni
force-pushed
the
tcpproxy-tls-validation
branch
from
4420dca to
1987eac
Compare
tsaarni
added
the
release-note/minor
tsaarni
force-pushed
the
tcpproxy-tls-validation
branch
from
1987eac to
6308022
Compare
Signed-off-by: Tero Saarni <[email protected]>
tsaarni
force-pushed
the
tcpproxy-tls-validation
branch
from
6308022 to
6773a1a
Compare
|
|
||
| c.Request(clusterType).Equals(&envoy_discovery_v3.DiscoveryResponse{ | ||
| Resources: resources(t, | ||
| tlsCluster(cluster("default/kuard/443/c6ccd34de5", "default/kuard/securebackend", "default_kuard_443"), []byte(featuretests.CERTIFICATE), "subjname", "", nil, nil), |
There was a problem hiding this comment.
maybe a refactor for the future, but since we only really have one fixture for cert content, we end up asserting on the same value everywhere ([]byte(featuretests.CERTIFICATE)), would be good to maybe at least use the field from caSecret for readability? (looks like sec2 in the other test below?)
There was a problem hiding this comment.
👍 While adding the test I was reminded that I would have preferred to remove the hardcoded test certificates & private keys from the code. I'll check if I could simplify this.
There was a problem hiding this comment.
I've updated the tests so that they use the field from CA secret, though this will be bit simpler if we merge #6100 as it will allow passing the secret itself.
There was a problem hiding this comment.
Now updated according to #6100
Signed-off-by: Tero Saarni <[email protected]>
Signed-off-by: Tero Saarni <[email protected]>
This PR adds support for upstream verification for TCPProxy.
As discussed in #4373 (comment) the API has always allowed setting
httpproxy.spec.tcpproxy.services.validationbut it has been ignored by the implementation.Updates #4373