mirror of
https://github.com/status-im/consul.git
synced 2025-01-09 21:35:52 +00:00
74ca6406ea
For mTLS to work between two proxies in peered clusters with different root CAs, proxies need to configure their outbound listener to use different root certificates for validation. Up until peering was introduced proxies would only ever use one set of root certificates to validate all mesh traffic, both inbound and outbound. Now an upstream proxy may have a leaf certificate signed by a CA that's different from the dialing proxy's. This PR makes changes to proxycfg and xds so that the upstream TLS validation uses different root certificates depending on which cluster is being dialed.
188 lines
6.8 KiB
Go
188 lines
6.8 KiB
Go
package proxycfg
|
|
|
|
import (
|
|
"context"
|
|
|
|
cachetype "github.com/hashicorp/consul/agent/cache-types"
|
|
"github.com/hashicorp/consul/agent/structs"
|
|
"github.com/hashicorp/consul/proto/pbpeering"
|
|
)
|
|
|
|
// UpdateEvent contains new data for a resource we are subscribed to (e.g. an
|
|
// agent cache entry).
|
|
type UpdateEvent struct {
|
|
CorrelationID string
|
|
Result interface{}
|
|
Err error
|
|
}
|
|
|
|
// DataSources contains the dependencies used to consume data used to configure
|
|
// proxies.
|
|
type DataSources struct {
|
|
// CARoots provides updates about the CA root certificates on a notification
|
|
// channel.
|
|
CARoots CARoots
|
|
|
|
// CompiledDiscoveryChain provides updates about a service's discovery chain
|
|
// on a notification channel.
|
|
CompiledDiscoveryChain CompiledDiscoveryChain
|
|
|
|
// ConfigEntry provides updates about a single config entry on a notification
|
|
// channel.
|
|
ConfigEntry ConfigEntry
|
|
|
|
// ConfigEntryList provides updates about a list of config entries on a
|
|
// notification channel.
|
|
ConfigEntryList ConfigEntryList
|
|
|
|
// Datacenters provides updates about federated datacenters on a notification
|
|
// channel.
|
|
Datacenters Datacenters
|
|
|
|
// FederationStateListMeshGateways is the interface used to consume updates
|
|
// about mesh gateways from the federation state.
|
|
FederationStateListMeshGateways FederationStateListMeshGateways
|
|
|
|
// GatewayServices provides updates about a gateway's upstream services on a
|
|
// notification channel.
|
|
GatewayServices GatewayServices
|
|
|
|
// Health provides service health updates on a notification channel.
|
|
Health Health
|
|
|
|
// HTTPChecks provides updates about a service's HTTP and gRPC checks on a
|
|
// notification channel.
|
|
HTTPChecks HTTPChecks
|
|
|
|
// Intentions provides intention updates on a notification channel.
|
|
Intentions Intentions
|
|
|
|
// IntentionUpstreams provides intention-inferred upstream updates on a
|
|
// notification channel.
|
|
IntentionUpstreams IntentionUpstreams
|
|
|
|
// InternalServiceDump provides updates about a (gateway) service on a
|
|
// notification channel.
|
|
InternalServiceDump InternalServiceDump
|
|
|
|
// LeafCertificate provides updates about the service's leaf certificate on a
|
|
// notification channel.
|
|
LeafCertificate LeafCertificate
|
|
|
|
// PreparedQuery provides updates about the results of a prepared query.
|
|
PreparedQuery PreparedQuery
|
|
|
|
// ResolvedServiceConfig provides updates about a service's resolved config.
|
|
ResolvedServiceConfig ResolvedServiceConfig
|
|
|
|
// ServiceList provides updates about the list of all services in a datacenter
|
|
// on a notification channel.
|
|
ServiceList ServiceList
|
|
|
|
// TrustBundle provides updates about the trust bundle for a single peer.
|
|
TrustBundle TrustBundle
|
|
|
|
DataSourcesEnterprise
|
|
}
|
|
|
|
// CARoots is the interface used to consume updates about the CA root
|
|
// certificates.
|
|
type CARoots interface {
|
|
Notify(ctx context.Context, req *structs.DCSpecificRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// CompiledDiscoveryChain is the interface used to consume updates about the
|
|
// compiled discovery chain for a service.
|
|
type CompiledDiscoveryChain interface {
|
|
Notify(ctx context.Context, req *structs.DiscoveryChainRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// ConfigEntry is the interface used to consume updates about a single config
|
|
// entry.
|
|
type ConfigEntry interface {
|
|
Notify(ctx context.Context, req *structs.ConfigEntryQuery, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// ConfigEntry is the interface used to consume updates about a list of config
|
|
// entries.
|
|
type ConfigEntryList interface {
|
|
Notify(ctx context.Context, req *structs.ConfigEntryQuery, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// Datacenters is the interface used to consume updates about federated
|
|
// datacenters.
|
|
type Datacenters interface {
|
|
Notify(ctx context.Context, req *structs.DatacentersRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// FederationStateListMeshGateways is the interface used to consume updates
|
|
// about mesh gateways from the federation state.
|
|
type FederationStateListMeshGateways interface {
|
|
Notify(ctx context.Context, req *structs.DCSpecificRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// GatewayServices is the interface used to consume updates about a gateway's
|
|
// upstream services.
|
|
type GatewayServices interface {
|
|
Notify(ctx context.Context, req *structs.ServiceSpecificRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// Health is the interface used to consume service health updates.
|
|
type Health interface {
|
|
Notify(ctx context.Context, req *structs.ServiceSpecificRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// HTTPChecks is the interface used to consume updates about a service's HTTP
|
|
// and gRPC-based checks (in order to determine which paths to expose through
|
|
// the proxy).
|
|
type HTTPChecks interface {
|
|
Notify(ctx context.Context, req *cachetype.ServiceHTTPChecksRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// Intentions is the interface used to consume intention updates.
|
|
type Intentions interface {
|
|
Notify(ctx context.Context, req *structs.IntentionQueryRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// IntentionUpstreams is the interface used to consume updates about upstreams
|
|
// inferred from service intentions.
|
|
type IntentionUpstreams interface {
|
|
Notify(ctx context.Context, req *structs.ServiceSpecificRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// InternalServiceDump is the interface used to consume updates about a (gateway)
|
|
// service via the internal ServiceDump RPC.
|
|
type InternalServiceDump interface {
|
|
Notify(ctx context.Context, req *structs.ServiceDumpRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// LeafCertificate is the interface used to consume updates about a service's
|
|
// leaf certificate.
|
|
type LeafCertificate interface {
|
|
Notify(ctx context.Context, req *cachetype.ConnectCALeafRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// PreparedQuery is the interface used to consume updates about the results of
|
|
// a prepared query.
|
|
type PreparedQuery interface {
|
|
Notify(ctx context.Context, req *structs.PreparedQueryExecuteRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// ResolvedServiceConfig is the interface used to consume updates about a
|
|
// service's resolved config.
|
|
type ResolvedServiceConfig interface {
|
|
Notify(ctx context.Context, req *structs.ServiceConfigRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// ServiceList is the interface used to consume updates about the list of
|
|
// all services in a datacenter.
|
|
type ServiceList interface {
|
|
Notify(ctx context.Context, req *structs.DCSpecificRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|
|
|
|
// TrustBundle is the interface used to consume updates about a single
|
|
// peer's trust bundle.
|
|
type TrustBundle interface {
|
|
Notify(ctx context.Context, req *pbpeering.TrustBundleReadRequest, correlationID string, ch chan<- UpdateEvent) error
|
|
}
|