Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve client AT-TLS handling #3940

Open
pablocarle opened this issue Jan 10, 2025 · 0 comments
Open

Improve client AT-TLS handling #3940

pablocarle opened this issue Jan 10, 2025 · 0 comments
Labels

Comments

@pablocarle
Copy link
Contributor

Is your feature request related to a problem? Please describe.
In AT-TLS scenarios:

  • If using ICSF hardware-stored key:
    All routes starting from GW will need AT-TLS outbound enabled (controlled via client.attls setting)

Currently, these requests depend on whether https is enabled in the service data in eureka.

In container scenarios, we want to avoid sending plain text to a service even if AT-TLS inbound is enabled on it (i.e. ZSS)

Another thing the API ML services don't handle properly currently is that we only verify the global setting, while the setting can also be set on a component level in zowe.yaml.

Describe the solution you'd like

  • Gateway could rely on the client.attls setting to determine if the internal communication should go through HTTP (client.attls enabled) or https (client.attls disabled)
  • In container scenarios this parameter should be disabled by default.
  • There could be logic to determine when to override the expected protocol in the service (registration data vs client.attls enabled or disabled)

Describe alternatives you've considered
Services simply switching the secure or normal port in the eureka registration may be insecure.

@pablocarle pablocarle added enhancement New feature or request new New issue that has not been worked on yet labels Jan 10, 2025
@EvaJavornicka EvaJavornicka added Priority: High size/M and removed new New issue that has not been worked on yet labels Jan 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Development

No branches or pull requests

2 participants