Skip to content

sds: secret discovery service. #180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
htuch merged 7 commits into from
Oct 3, 2017
Merged

sds: secret discovery service. #180

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f2337b4
kds: key discovery service.
PiotrSikora Sep 27, 2017
8cf70cf
review: add KdsSecretConfig.
PiotrSikora Sep 27, 2017
de3db12
review: KDS is now SDS.
PiotrSikora Sep 28, 2017
253bf85
review: move SdsSecretConfig out of TlsCertificate.
PiotrSikora Oct 3, 2017
44831c2
review: add name and type to the Secret.
PiotrSikora Oct 3, 2017
00a0904
review: merge tls_context.proto into sds.proto.
PiotrSikora Oct 3, 2017
90afc07
review: add comment.
PiotrSikora Oct 3, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ The LDS/CDS/EDS/RDS APIs are now frozen and will maintain backwards
compatibility according to standard proto rules (e.g. new fields will not reuse
tags, field types will not change, fields will not be renumbered, etc.).

The remainder of the API (ADS, HDS, RLS, filter fragments other than HTTP
The remainder of the API (ADS, HDS, RLS, SDS, filter fragments other than HTTP
connection manager, the bootstrap proto) are draft work-in-progress. Input is
welcome via issue filing. Small, localized PRs are also welcome, but any major
changes or suggestions should be coordinated in a tracking issue with the
Expand Down Expand Up @@ -74,7 +74,7 @@ closed issue should also be included.
this repository.

* REST-JSON API equivalents will be provided for the basic singleton xDS
subscription services CDS/EDS/LDS/EDS. Advanced APIs such as HDS, ADS and
subscription services CDS/EDS/LDS/RDS/SDS. Advanced APIs such as HDS, ADS and
EDS multi-dimensional LB will be gRPC only. This avoids having to map
complicated bidirectional stream semantics onto REST.

Expand Down Expand Up @@ -110,6 +110,7 @@ Unless otherwise stated, the APIs with the same names as v1 APIs have a similar
* [Listener Discovery Service (LDS)](api/lds.proto). This new API supports dynamic discovery of the listener configuration (which ports to bind to, TLS details, filter chains, etc.).
* [Rate Limit Service (RLS)](api/rls.proto)
* [Route Discovery Service (RDS)](api/rds.proto).
* [Secret Discovery Service (SDS)](api/sds.proto).

In addition to the above APIs, an aggregation API will be provided to allow for
fine grained control over the sequencing of API updates across discovery
Expand Down Expand Up @@ -166,6 +167,6 @@ repeated below and some new v2 terms introduced.

* Upstream: An upstream host receives connections and requests from Envoy and returns responses.

* xDS: CDS/EDS/HDS/LDS/RLS/RDS APIs.
* xDS: CDS/EDS/HDS/LDS/RLS/RDS/SDS APIs.

* Zone: Availability Zone (AZ) in AWS, Zone in GCP.
20 changes: 13 additions & 7 deletions api/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ api_proto_library(
":discovery",
":cds",
":lds",
":sds",
],
)

Expand All @@ -31,11 +32,6 @@ api_proto_library(
deps = [":base"],
)

api_proto_library(
name = "tls_context",
srcs = ["tls_context.proto"],
)

api_proto_library(
name = "cds",
srcs = ["cds.proto"],
Expand All @@ -46,7 +42,7 @@ api_proto_library(
":discovery",
":health_check",
":protocol",
":tls_context",
":sds",
],
)

Expand Down Expand Up @@ -87,7 +83,7 @@ api_proto_library(
":address",
":base",
":discovery",
":tls_context",
":sds",
],
)

Expand All @@ -111,3 +107,13 @@ api_proto_library(
":discovery",
],
)

api_proto_library(
name = "sds",
srcs = ["sds.proto"],
has_services = 1,
deps = [
":base",
":discovery",
],
)
2 changes: 2 additions & 0 deletions api/bootstrap.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import "api/base.proto";
import "api/discovery.proto";
import "api/cds.proto";
import "api/lds.proto";
import "api/sds.proto";

import "google/protobuf/duration.proto";
import "google/protobuf/struct.proto";
Expand Down Expand Up @@ -231,6 +232,7 @@ message Bootstrap {
// to know how to speak to the management server. These cluster definitions
// may not use EDS (i.e. they should be static IP or DNS-based).
repeated Cluster clusters = 2;
repeated Secret secrets = 3;
Copy link
Copy Markdown
Contributor Author

@PiotrSikora PiotrSikora Sep 27, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@htuch Thoughts on placement of repeated fields?

message StaticResources {
  repeated Listener listeners = 1;
  repeated Cluster clusters = 2;
  repeated Secret secrets = 3;
}

message Secret {
  TlsCertificate tls_certificate = 1;
}

vs

message StaticResources {
  repeated Listener listeners = 1;
  repeated Cluster clusters = 2;
  Secret secrets = 3;
}

message Secret {
  repeated TlsCertificate tls_certificates = 1;
}

vs

message StaticResources {
  repeated Listener listeners = 1;
  repeated Cluster clusters = 2;
  repeated Secret secrets = 3;
}

message Secret {
  repeated TlsCertificate tls_certificates = 1;
}

Note that Secret will contain more than just TlsCertificate objects in the future.

Copy link
Copy Markdown
Member

@htuch htuch Sep 27, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Option 1 is cleaner, since when we have a DiscoveryResponse, it already is a repeated list of resources, with the caveat below about the recursive definition.

}
StaticResources static_resources = 2;

Expand Down
2 changes: 1 addition & 1 deletion api/cds.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ import "api/base.proto";
import "api/discovery.proto";
import "api/health_check.proto";
import "api/protocol.proto";
import "api/tls_context.proto";
import "api/sds.proto";

import "google/api/annotations.proto";
import "google/protobuf/duration.proto";
Expand Down
2 changes: 1 addition & 1 deletion api/lds.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ package envoy.api.v2;
import "api/address.proto";
import "api/base.proto";
import "api/discovery.proto";
import "api/tls_context.proto";
import "api/sds.proto";

import "google/api/annotations.proto";
import "google/protobuf/struct.proto";
Expand Down
36 changes: 36 additions & 0 deletions api/tls_context.proto → api/sds.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,26 @@ syntax = "proto3";

package envoy.api.v2;

import "api/base.proto";
import "api/discovery.proto";

import "google/api/annotations.proto";
import "google/protobuf/wrappers.proto";

service SecretDiscoveryService{
rpc StreamSecrets(stream DiscoveryRequest)
returns (stream DiscoveryResponse) {
}

rpc FetchSecrets(DiscoveryRequest)
returns (DiscoveryResponse) {
option (google.api.http) = {
post: "/v2/discovery:secrets"
body: "*"
};
}
}

message DataSource {
oneof specifier {
string filename = 1;
Expand Down Expand Up @@ -74,7 +92,9 @@ message CommonTlsContext {

// Multiple TLS certificates can be associated with the same context,
// e.g. to allow both RSA and ECDSA certificates [V2-API-DIFF].
// TLS certificates can be either configured locally or fetched from SDS.
repeated TlsCertificate tls_certificates = 2;
repeated SdsSecretConfig sds_secret_configs = 6;

// How to validate peer certificates.
CertificateValidationContext validation_context = 3;
Expand Down Expand Up @@ -111,3 +131,19 @@ message DownstreamTlsContext {
// If specified, Envoy will reject connections without a valid and matching SNI.
google.protobuf.BoolValue require_sni = 3;
}

message SdsSecretConfig {
// Name (FQDN, UUID, SPKI, SHA256, etc.) by which the secret can be uniquely referred to.
// When both name and config are specified, then secret can be fetched and/or reloaded via SDS.
// When only name is specified, then secret will be loaded from static resources [V2-API-DIFF].
string name = 1;
ConfigSource sds_config = 2;
}

message Secret {
// Name (FQDN, UUID, SPKI, SHA256, etc.) by which the secret can be uniquely referred to.
string name = 1;
oneof type {
TlsCertificate tls_certificate = 2;
}
}