Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Tidy up and homogeneize support for SSL in both Backend and MetadataService (server and client) #21

Open
1 of 7 tasks
alexbarcelo opened this issue Nov 17, 2023 · 1 comment

Comments

@alexbarcelo
Copy link
Member

alexbarcelo commented Nov 17, 2023

Right now, there is some SSL and mTLS support in:

  • dataclay.backend.client

Ideally, we should add consistent certificate support in:

  • Backend client (client certificates)
  • Backend server (regular SSL on the HTTP/2 connection, vanilla gRPC)
  • Metadata Service client (client certificates)
  • Metadata Service server (regular SSL...)
  • Proxy (connection to proxy from client, client config)
  • Proxy (connection from proxy to backends, proxy config)
  • Proxy server (proxy config)

To achieve the client certificate support, we need to use the code in backend client. It should be abstracted to avoid repeating ourselves (i.e., the code in backend/client.py is usable on metadata/client.py, and the settings.ssl_client* fields are reusable in both.

To achieve server certificate support, we need to add backend and metadata configuration fields for server SSL certificates, and use them in the servicer.py files.

Update: Added proxy since PR #22 will eventually be finished and then it will be relevant to also add SSL in the proxy.

@alexbarcelo
Copy link
Member Author

We must make sure that we support these additional options:

  • explicitly provided Certificate Authority cert file (possibly different between the client certificates, which the server should validate, and the server certificates, which the client should validate. If only one is provided, it shold be the common setting which everybody one uses, but the servers should have an specific option to override for client certificate validation.
  • insecure option (maybe sth like ssl_insecure to bypass certificate authority validation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant