Handling certificate rotation?

[elevran]

In the context of Zero Trust, certificates and tokens are only valid for a short period of time, e.g., a few hours. Afterwards, they are rotated, to minimize the chance of stolen certificates being used to launch attacks. How does the Clusterlink gateway handle such events?

[elevran]

We can take one of two approaches:

1. control plane extended to support SDS and provide up to date certificates to the data plane.
   • Control plane watches for file change notifications (or k8s secrets directly)
   • Go data plane needs to be extended to support SDS notifications
2. Each data plane updates certificates directly
   • Envoy support file based certificate and key rotation (also see here)
   • Go data plane should implement a similar mechanism using (e.g.,) fsnotify