opensergo-control-plane icon indicating copy to clipboard operation
opensergo-control-plane copied to clipboard

Add optional config for TLS support

Open jnan806 opened this issue 3 years ago • 7 comments

Issue Description

Type: feature request

Describe what feature you want

Add optional config for supporting TLS which user can enable the TLS transport

jnan806 avatar Feb 09 '23 03:02 jnan806

Maybe I can try this?

123liuziming avatar Feb 09 '23 03:02 123liuziming

@123liuziming has assigned to you, and looking forward to your contribution 😃

jnan806 avatar Feb 09 '23 03:02 jnan806

How can users configure the TLS certificate? There are a number of ways to do this, for example:

  1. Use K8s secret
  2. Just injecting the certificate into the environment variable of OpenSergo control plane
  3. Like what Istio does, OpenSergo manage the certificate itself. For example we can send a CSR to K8s and generate the key pair for the TLS connection of OpenSergo, or we can use the CA that users provide. In this way, user do not need to configure the certificate explicitly

123liuziming avatar Feb 12 '23 09:02 123liuziming

How can users configure the TLS certificate? There are a number of ways to do this, for example:

  1. Use K8s secret
  2. Just injecting the certificate into the environment variable of OpenSergo control plane
  3. Like what Istio does, OpenSergo manage the certificate itself. For example we can send a CSR to K8s and generate the key pair for the TLS connection of OpenSergo, or we can use the CA that users provide. In this way, user do not need to configure the certificate explicitly

@123liuziming First, I prefer to plan 3 which means we provide a mechanism to manage the certificate. But now, for convenient we can only implement this by plan 2,through System-Env,Config-Params, or File-Volume(like k8s ConfigMap...).

And then,we can improve it by generate OpenSergo key pairs and inject into plan 2

@sczyh30 What do you think about?

jnan806 avatar Feb 13 '23 01:02 jnan806

We can try plan 2 first, later we may integrate the project into Istio, at that time we can reuse plan 3!

123liuziming avatar Feb 14 '23 01:02 123liuziming

image Go CI seems timeout?

123liuziming avatar Mar 02 '23 09:03 123liuziming

Go CI seems timeout?

I have re-run the CI, but it looks was blocked. So can you force-push it again

jnan806 avatar Mar 03 '23 03:03 jnan806