Inject Tap service name into proxy PodSpec#3155
Conversation
Signed-off-by: Kevin Leimkuhler <kleimkuhler@icloud.com>
|
This is not dependent on #3154 |
|
Integration test results for 47c5d47: fail 😕 |
Signed-off-by: Kevin Leimkuhler <kleimkuhler@icloud.com>
|
Integration test results for 81516b9: success 🎉 |
siggy
left a comment
There was a problem hiding this comment.
one nit otherwise looks good 🚢 👍
Signed-off-by: Kevin Leimkuhler <kleimkuhler@icloud.com>
Signed-off-by: Kevin Leimkuhler <kleimkuhler@icloud.com>
|
Integration test results for 0c73637: success 🎉 |
|
@siggy After our discussion, I added a comment to clarify that the order of setting I opened #3157 to note on the proxy work to take place to couple spawning the tap server only when identity has not been disabled. There will be a similar issue for control plane as well. |
### Motivation With linkerd/linkerd2#3155 merging, proxy containers will now always have the `LINKERD2_PROXY_TAP_SVC_NAME` variable in their environment. This variable can now be reliably used to check that the client names of incoming tap requests match this value. If the values do not match, we will always return the gRPC Unauthenticated status code. If the values do match, we will accept the connection. If there is no client identity, we will similarly return the gRPC Unauthenticated status code. Closes linkerd/linkerd2#3157 Closes linkerd/linkerd2#3163 Signed-off by: Kevin Leimkuhler <kleimkuhler@icloud.com>
Summary
In order for Pods' tap servers to start authorizing tap clients, the tap server
must be able to check client names against the expected tap service name.
This change injects the
LINKERD2_PROXY_TAP_SVC_NAMEinto proxy PodSpecs.Details
The tap servers on the individual resources being tapped should be able to
verify that the client is the tap service. The
LINKERD2_PROXY_TAP_SVC_NAMEisnow injected as an environment variable in the proxies so that it can check this
value against the client name of the TLS connection. Currently, this environment
will go unused. There is an open PR (linkerd2-proxy#290) to use this variable in
the proxy, but this is not dependent on that merging first.
Note: The variable is not injected if tap is disabled.
Testing
Test output has been updated with the newly injected environment variable.
Signed-off-by: Kevin Leimkuhler kleimkuhler@icloud.com