R.B. Boyer f0e6e4e697

state: prohibit changing an exported tcp discovery chain in a way that would break SAN validation (#13727) ...

For L4/tcp exported services the mesh gateways will not be terminating
TLS. A caller in one peer will be directly establishing TLS connections
to the ultimate exported service in the other peer.

The caller will be doing SAN validation using the replicated SpiffeID
values shipped from the exporting side. There are a class of discovery
chain edits that could be done on the exporting side that would cause
the introduction of a new SpiffeID value. In between the time of the
config entry update on the exporting side and the importing side getting
updated peer stream data requests to the exported service would fail due
to SAN validation errors.

This is unacceptable so instead prohibit the exporting peer from making
changes that would break peering in this way.

2022-07-12 11:17:33 -05:00

..

middleware

Restructure gRPC server setup (#12586)

2022-03-22 12:40:24 +00:00

private

proxycfg: server-local config entry data sources

2022-07-04 10:48:36 +01:00

public

state: prohibit changing an exported tcp discovery chain in a way that would break SAN validation (#13727)

2022-07-12 11:17:33 -05:00