spiffe: add support for spiffe bundle format #36190

briansonnenberg · 2024-09-18T07:25:06Z

Commit Message: Adds alternative to "trust_domains" config for the spiffe validator—"trust_bundle_map".

Additional Description:

#35567
trust_bundle_map points to a local file containing a SPIFFE bundle map. A file watcher is set up to trigger refreshes to the SPIFFE data when this file is modified. SPIFFE refresh hint and sequence number are currently ignored.

Risk Level: medium
Testing: WIP
Docs Changes: TBD
Release Notes: TBD

repokitteh-read-only · 2024-09-18T07:25:16Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @markdroth
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #36190 was opened by briansonnenberg.

see: more, trace.

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto

jmarantz · 2024-09-23T13:00:08Z

/wait

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto

wbpcode

Thanks for the contribution. some new comments to the API to start the review. And please address the comment from @markdroth .

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto

markdroth · 2024-09-27T20:48:13Z

/lgtm api

kyessenov · 2024-10-01T18:10:22Z

Please merge main.
/wait

alyssawilk · 2024-10-08T13:01:15Z

/wait on CI

wbpcode

Thanks for the contribution and patience. And some comments are added.

changelogs/current.yaml

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.h

wbpcode · 2024-10-17T07:57:33Z

Please also check the CI :)

RyanTheOptimist · 2024-11-27T22:50:09Z

Looks like CI is failing? https://github.com/envoyproxy/envoy/actions/runs/11979451058/job/33401707343

RyanTheOptimist · 2024-11-27T22:50:15Z

/wait

Signed-off-by: Brian Sonnenberg <[email protected]>

briansonnenberg · 2024-12-12T20:34:23Z

@wbpcode @alyssawilk @markdroth

Finally have the CI passing. 😅

Would you folks mind taking another look?

markdroth · 2024-12-13T01:15:33Z

I'm still not thrilled that we're doing this instead of implementing the certificate provider framework, but at least this doesn't preclude us from doing that later.

/lgtm api

adisuissa · 2024-12-17T14:19:26Z

@wbpcode seems that latest comments were addressed, PTAL.

wbpcode · 2024-12-18T15:12:14Z

Will take a look before tomorrow night.

wbpcode

Thanks for the update and the long time investment. It's much better now. I add some comments new but should be easy to address. Thanks again.

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.h

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

test/common/tls/test_data/certs.sh

Signed-off-by: Brian Sonnenberg <[email protected]>

wbpcode

LGTM overall now. Thanks so much for your update, It's near there, only some non-major comments are added.

And merry Christmas!!! 🎄

/wait

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

wbpcode · 2024-12-25T14:10:36Z

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

+          ENVOY_LOG(error, "Failed to load SPIFFE bundle map from '{}': '{}'",
+                    trust_bundle_file_name_, new_trust_bundle.status());


Suggested change

ENVOY_LOG(error, "Failed to load SPIFFE bundle map from '{}': '{}'",

trust_bundle_file_name_, new_trust_bundle.status());

ENVOY_LOG(error, "Failed to load SPIFFE bundle map from '{}': '{}'",

trust_bundle_file_name_, new_trust_bundle.status().message());

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

wbpcode · 2024-12-25T14:15:17Z

test/extensions/transport_sockets/tls/cert_validator/spiffe/BUILD

@@ -19,6 +24,7 @@ envoy_extension_cc_test(
    ],
    data = [
        "//test/common/tls/test_data:certs",
+        "//test/extensions/transport_sockets/tls/cert_validator/spiffe:trust_bundles",


Seems you only move the generated file to this directory. Sorry for the chaos, maybe keep your previous design is better if we cannot split all these out from the tls/test_data cleanly.

I moved the static files to the test directory and left the generated one in the directory that has the generator. I think this is ideal.

Fine, if you think that's OKay. Please also create a test_data sub directory for them.

And Please also merge the main and resolve the CI problem.

Signed-off-by: Brian Sonnenberg <[email protected]>

briansonnenberg requested a review from tyxia as a code owner September 18, 2024 07:25

repokitteh-read-only bot added the api label Sep 18, 2024

repokitteh-read-only bot assigned markdroth Sep 18, 2024

wbpcode reviewed Sep 18, 2024

View reviewed changes

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto Outdated Show resolved Hide resolved

repokitteh-read-only bot added waiting:any and removed waiting:any labels Sep 18, 2024

briansonnenberg mentioned this pull request Sep 18, 2024

SPIFFE: support JWK set bundle format #35567

Closed

markdroth reviewed Sep 19, 2024

View reviewed changes

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto Outdated Show resolved Hide resolved

jmarantz assigned wbpcode Sep 23, 2024

repokitteh-read-only bot added the waiting label Sep 23, 2024

wbpcode reviewed Sep 24, 2024

View reviewed changes

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto Outdated Show resolved Hide resolved

wbpcode reviewed Sep 24, 2024

View reviewed changes

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto Show resolved Hide resolved

wbpcode reviewed Sep 24, 2024

View reviewed changes

repokitteh-read-only bot removed the waiting label Sep 26, 2024

wbpcode reviewed Sep 27, 2024

View reviewed changes

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto Outdated Show resolved Hide resolved

briansonnenberg force-pushed the brian-spiffe branch from 06a982e to b360f38 Compare September 27, 2024 17:16

repokitteh-read-only bot removed the api label Sep 27, 2024

repokitteh-read-only bot added the waiting label Oct 1, 2024

briansonnenberg force-pushed the brian-spiffe branch from b360f38 to 28b5308 Compare October 1, 2024 18:15

repokitteh-read-only bot removed the waiting label Oct 1, 2024

repokitteh-read-only bot added the waiting label Oct 8, 2024

repokitteh-read-only bot removed the waiting label Oct 16, 2024

briansonnenberg force-pushed the brian-spiffe branch from ff1fb7e to 38f5dee Compare October 16, 2024 16:56

wbpcode reviewed Oct 17, 2024

View reviewed changes

briansonnenberg requested a review from botengyao as a code owner November 22, 2024 20:10

repokitteh-read-only bot added api and removed waiting labels Nov 22, 2024

repokitteh-read-only bot added the waiting label Nov 27, 2024

briansonnenberg added 2 commits December 4, 2024 19:31

Merge branch 'main' into brian-spiffe

866c2d2

Signed-off-by: Brian Sonnenberg <[email protected]>

Update json library usage to conform with the recent NoThrow changes

d231876

Signed-off-by: Brian Sonnenberg <[email protected]>

repokitteh-read-only bot removed the waiting label Dec 4, 2024

briansonnenberg added 10 commits December 5, 2024 21:06

CI fix

e126e81

Signed-off-by: Brian Sonnenberg <[email protected]>

Update and add tests for file error handling

9d46c66

Signed-off-by: Brian Sonnenberg <[email protected]>

format

c7d5d18

Signed-off-by: Brian Sonnenberg <[email protected]>

Fix tests and exception handling

cb2c9d5

Signed-off-by: Brian Sonnenberg <[email protected]>

More config exception testing.

ed26529

Signed-off-by: Brian Sonnenberg <[email protected]>

Removed dupe checking because json library auto-removes dupes.

e16fd5d

Signed-off-by: Brian Sonnenberg <[email protected]>

More config exception tests.

4e24a39

Signed-off-by: Brian Sonnenberg <[email protected]>

Proto format

ca49af5

Signed-off-by: Brian Sonnenberg <[email protected]>

Missing test files

b4cd27d

Signed-off-by: Brian Sonnenberg <[email protected]>

docs ci fix

843d881

Signed-off-by: Brian Sonnenberg <[email protected]>

repokitteh-read-only bot removed the api label Dec 13, 2024

wbpcode requested changes Dec 19, 2024

View reviewed changes

Addressed comments

c6219dc

Signed-off-by: Brian Sonnenberg <[email protected]>

wbpcode reviewed Dec 25, 2024

View reviewed changes

repokitteh-read-only bot added the waiting label Dec 25, 2024

Addressed comments

79c388b

Signed-off-by: Brian Sonnenberg <[email protected]>

repokitteh-read-only bot removed the waiting label Jan 2, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

spiffe: add support for spiffe bundle format #36190

spiffe: add support for spiffe bundle format #36190

briansonnenberg commented Sep 18, 2024 •

edited

Loading

repokitteh-read-only bot commented Sep 18, 2024

jmarantz commented Sep 23, 2024

wbpcode left a comment

markdroth commented Sep 27, 2024

kyessenov commented Oct 1, 2024

alyssawilk commented Oct 8, 2024

wbpcode left a comment

wbpcode commented Oct 17, 2024

RyanTheOptimist commented Nov 27, 2024

RyanTheOptimist commented Nov 27, 2024

briansonnenberg commented Dec 12, 2024

markdroth commented Dec 13, 2024

adisuissa commented Dec 17, 2024

wbpcode commented Dec 18, 2024

wbpcode left a comment

wbpcode left a comment

wbpcode Dec 25, 2024

wbpcode Dec 25, 2024

briansonnenberg Jan 2, 2025

wbpcode Jan 3, 2025

wbpcode Jan 3, 2025

		ENVOY_LOG(error, "Failed to load SPIFFE bundle map from '{}': '{}'",
		trust_bundle_file_name_, new_trust_bundle.status());

spiffe: add support for spiffe bundle format #36190

Are you sure you want to change the base?

spiffe: add support for spiffe bundle format #36190

Conversation

briansonnenberg commented Sep 18, 2024 • edited Loading

repokitteh-read-only bot commented Sep 18, 2024

jmarantz commented Sep 23, 2024

wbpcode left a comment

Choose a reason for hiding this comment

markdroth commented Sep 27, 2024

kyessenov commented Oct 1, 2024

alyssawilk commented Oct 8, 2024

wbpcode left a comment

Choose a reason for hiding this comment

wbpcode commented Oct 17, 2024

RyanTheOptimist commented Nov 27, 2024

RyanTheOptimist commented Nov 27, 2024

briansonnenberg commented Dec 12, 2024

markdroth commented Dec 13, 2024

adisuissa commented Dec 17, 2024

wbpcode commented Dec 18, 2024

wbpcode left a comment

Choose a reason for hiding this comment

wbpcode left a comment

Choose a reason for hiding this comment

wbpcode Dec 25, 2024

Choose a reason for hiding this comment

wbpcode Dec 25, 2024

Choose a reason for hiding this comment

briansonnenberg Jan 2, 2025

Choose a reason for hiding this comment

wbpcode Jan 3, 2025

Choose a reason for hiding this comment

wbpcode Jan 3, 2025

Choose a reason for hiding this comment

briansonnenberg commented Sep 18, 2024 •

edited

Loading