You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Ideally, we should add consistent certificate support in:
Backend client (client certificates)
Backend server (regular SSL on the HTTP/2 connection, vanilla gRPC)
Metadata Service client (client certificates)
Metadata Service server (regular SSL...)
Proxy (connection to proxy from client, client config)
Proxy (connection from proxy to backends, proxy config)
Proxy server (proxy config)
To achieve the client certificate support, we need to use the code in backend client. It should be abstracted to avoid repeating ourselves (i.e., the code in backend/client.py is usable on metadata/client.py, and the settings.ssl_client* fields are reusable in both.
To achieve server certificate support, we need to add backend and metadata configuration fields for server SSL certificates, and use them in the servicer.py files.
Update: Added proxy since PR #22 will eventually be finished and then it will be relevant to also add SSL in the proxy.
The text was updated successfully, but these errors were encountered:
We must make sure that we support these additional options:
explicitly provided Certificate Authority cert file (possibly different between the client certificates, which the server should validate, and the server certificates, which the client should validate. If only one is provided, it shold be the common setting which everybody one uses, but the servers should have an specific option to override for client certificate validation.
insecure option (maybe sth like ssl_insecure to bypass certificate authority validation.
Right now, there is some SSL and mTLS support in:
Ideally, we should add consistent certificate support in:
To achieve the client certificate support, we need to use the code in backend client. It should be abstracted to avoid repeating ourselves (i.e., the code in backend/client.py is usable on metadata/client.py, and the
settings.ssl_client*
fields are reusable in both.To achieve server certificate support, we need to add backend and metadata configuration fields for server SSL certificates, and use them in the
servicer.py
files.Update: Added proxy since PR #22 will eventually be finished and then it will be relevant to also add SSL in the proxy.
The text was updated successfully, but these errors were encountered: