docs: Allow AWS IAM SigV4 for SDS AuthN #8067
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bcelenza
force-pushed
the
sds-creds-doc
branch
from
7fef640
to
37d064c
Compare
htuch
suggested changes
Sep 3, 2019
| @@ -15,7 +15,10 @@ Upstream clusters are handled in a similar way, if a cluster client certificate | |||
|
|
|||
| If a static cluster is using SDS, and it needs to define a SDS cluster (unless Google gRPC is used which doesn't need a cluster), the SDS cluster has to be defined before the static clusters using it. | |||
|
|
|||
| The connection between Envoy proxy and SDS server has to be secure. One option is to run the SDS server on the same host and use Unix Domain Socket for the connection. Otherwise it requires mTLS between the proxy and SDS server. In this case, the client certificates for the SDS connection must be statically configured. | |||
| The connection between Envoy proxy and SDS server has to be secure. One option is to run the SDS server on the same host and use Unix Domain Socket for the connection. Otherwise it requires valid authentication between the proxy and SDS server using gRPC channel credentials, call credentials, or both. Credential types in use today are: | |||
There was a problem hiding this comment.
Are we confusing authentication and confidentiality here? There's two aspects:
- We need to ensure that there is always server TLS configured, i.e. an upstream TLS context for Envoy gRPC/REST, and not using someting like grpc::InsecureChannelCredentials() if it's the Google gRPC client.
- We need to authenticate. This should be over a secure channel, see (1), but this is where client certs or SigV4 come into play.
The docs read as if we can solve (2) with (1) and don't cover Envoy gRPC/REST.
There was a problem hiding this comment.
Agree with both points, and will reword. :)
envoyproxy#8042 Signed-off-by: Brian Celenza <[email protected]>
bcelenza
force-pushed
the
sds-creds-doc
branch
from
37d064c
to
22560d4
Compare
|
This pull request has been automatically marked as stale because it has not had activity in the last 7 days. It will be closed in 7 days if no further activity occurs. Please feel free to give a status update now, ping for review, or re-open when it's ready. Thank you for your contributions! |
stale
bot
added
the
stale
|
Hey @htuch, want to make sure I've addressed your feedback appropriately. Happy to field suggestions for wording changes if I still haven't quite nailed it. |
stale
bot
removed
the
stale
danzh2010
pushed a commit
to danzh2010/envoy
that referenced
this pull request
Sep 24, 2019
Per envoyproxy#8042, update documentation to clarify authentication required for SDS connections, and add notes about credential types in use today. Risk Level: Low Testing: Previewed content layout using RST parser. Docs Changes: See description. Signed-off-by: Brian Celenza <[email protected]>
danzh2010
pushed a commit
to danzh2010/envoy
that referenced
this pull request
Oct 4, 2019
Per envoyproxy#8042, update documentation to clarify authentication required for SDS connections, and add notes about credential types in use today. Risk Level: Low Testing: Previewed content layout using RST parser. Docs Changes: See description. Signed-off-by: Brian Celenza <[email protected]>
danzh2010
pushed a commit
to danzh2010/envoy
that referenced
this pull request
Oct 4, 2019
Per envoyproxy#8042, update documentation to clarify authentication required for SDS connections, and add notes about credential types in use today. Risk Level: Low Testing: Previewed content layout using RST parser. Docs Changes: See description. Signed-off-by: Brian Celenza <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description: Per #8042, update documentation to clarify authentication required for SDS connections, and add notes about credential types in use today.
Risk Level: Low
Testing: Previewed content layout using RST parser.
Docs Changes: See description.
Release Notes: N/A