feat: add support for certificate fetching via SDS ref secret by zirain · Pull Request #8745 · envoyproxy/gateway

zirain · 2026-04-14T08:28:45Z

suppress #8537

Original idea from @guydc

Regarding the secret-based option mentioned yesterday, I meant that we can still use a secret reference (just like today), but when the secret has a custom type like gateway.envoyproxy.io/sds-ref, we expect certain keys to exist in that secret that provide the necessary metadata, e.g. sds url and sds secret name.

apiVersion: v1
kind: Secret
metadata:
  name: sds-secret-sample
type: gateway.envoyproxy.io/sds-ref
data:
  url: /var/run/sds
  secretName: my-tls-secret

This secret may contain additional things like authorization for sds server access.

netlify · 2026-04-14T08:28:52Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`352c946`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69e73edbe0b4140008a91b1c
😎 Deploy Preview	https://deploy-preview-8745--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5ac7d7798e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

codecov · 2026-04-14T08:39:36Z

Codecov Report

❌ Patch coverage is 72.64151% with 58 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.42%. Comparing base (85e62dd) to head (352c946).

Files with missing lines	Patch %	Lines
internal/xds/translator/translator.go	57.50%	10 Missing and 7 partials ⚠️
internal/xds/translator/sds.go	84.61%	8 Missing and 6 partials ⚠️
internal/gatewayapi/backendtlspolicy.go	71.79%	8 Missing and 3 partials ⚠️
internal/xds/translator/listener.go	57.69%	7 Missing and 4 partials ⚠️
internal/ir/xds.go	63.63%	2 Missing and 2 partials ⚠️
internal/gatewayapi/runner/runner.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #8745    +/-   ##
========================================
  Coverage   74.41%   74.42%            
========================================
  Files         245      246     +1     
  Lines       38977    39139   +162     
========================================
+ Hits        29006    29129   +123     
- Misses       7967     7991    +24     
- Partials     2004     2019    +15

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…ecret Signed-off-by: zirain <zirain2009@gmail.com>

Signed-off-by: zirain <zirain2009@gmail.com>

owenhaynes · 2026-04-16T09:31:24Z

I am looking forward to this. I like the use of no new K8s types. I guess going to have to use some extra tooling so that the secrets can be in all namespaces that BackendTLSPolicy are defined due not being able to use cross reference, which is not a big issue

zirain · 2026-04-16T09:37:13Z

I am looking forward to this. I like the use of no new K8s types. I guess going to have to use some extra tooling so that the secrets can be in all namespaces that BackendTLSPolicy are defined due not being able to use cross reference, which is not a big issue

BackendTLSPolicy use LocalObjectReference, which make it unable to cross namespace reference.
Worth to raise this up on upstream.

Signed-off-by: zirain <zirain2009@gmail.com>

arkodg · 2026-04-18T16:55:49Z

 const (
+	// SDSSecretType is the type for secrets that reference SDS configuration
+	SDSSecretType = "gateway.envoyproxy.io/sds-ref"
+


can we make this opt in at EnvoyGateway or EnvoyProxy level ?
cc @guydc

arkodg · 2026-04-18T18:21:23Z

+    type: gateway.envoyproxy.io/sds-ref
+    data:
+      url: L3Zhci9ydW4vc2VjcmV0cy93b3JrbG9hZC1zcGlmZmUtdWRzL3NvY2tldA==  # /var/run/secrets/workload-spiffe-uds/socket
+      secretName: Uk9PVENB  # ROOTCA


non blocking: prefer just name
cc @guydc

I'd to reserve the name for sds provider name in the future, secretName sounds good to me for now.

Using Name for the provider feels a bit ambiguous, and the naming patterns between the two are not consistent.

name: `foo provider` secretName: `foo secret` url: xxxxx

How about

provider: `foo provider` secret: `foo secret` url: xxxxx

Or

providerName: `foo provider` secretName: `foo secret` url: xxxxx

?

I prefer the former one for simplicity.

Signed-off-by: zirain <zirain2009@gmail.com>

zhaohuabing · 2026-04-20T04:41:52Z

 	// If set to true, the Lua EnvoyExtensionPolicy feature will be disabled.
 	DisableLua bool `json:"disableLua"`
+	// EnableSDSSecretRef enables read SDS(Secret Discovery Service) settings from a secret(with type gateway.envoyproxy.io/sds-ref).
+	EnableSDSSecretRef bool `json:"enableSDSSecretRef"`


I think we are gating the broader "fetching certificates from third-party SDS" feature, not just the specific "SDS secret type"?

It might makes sense to use a more general name like EnableThirdPartySDS here.

cc @arkodg

zhaohuabing · 2026-04-20T04:45:17Z


 const (
+	// SDSSecretType is the type for secrets that reference SDS configuration
+	SDSSecretType = "gateway.envoyproxy.io/sds-ref"


Non-blocking nit: gateway.envoyproxy.io/sds should be good enough?

Suggested change

SDSSecretType = "gateway.envoyproxy.io/sds-ref"

SDSSecretType = "gateway.envoyproxy.io/sds"

Signed-off-by: zirain <zirain2009@gmail.com>

zirain requested a review from a team as a code owner April 14, 2026 08:28

zirain force-pushed the sds-ref branch from acfe23c to 5ac7d77 Compare April 14, 2026 08:29

chatgpt-codex-connector bot reviewed Apr 14, 2026

View reviewed changes

Comment thread internal/xds/translator/listener.go

Comment thread internal/gatewayapi/backendtlspolicy.go Outdated

zirain added 2 commits April 14, 2026 17:03

feat: add support for certificate fetching and rotation via SDS ref s…

686328d

…ecret Signed-off-by: zirain <zirain2009@gmail.com>

fix

5c67cda

Signed-off-by: zirain <zirain2009@gmail.com>

zirain force-pushed the sds-ref branch from 5ac7d77 to 5c67cda Compare April 14, 2026 09:03

zirain added this to the v1.8.0-rc.1 Release milestone Apr 16, 2026

guydc reviewed Apr 17, 2026

View reviewed changes

Comment thread internal/gatewayapi/backendtlspolicy.go Outdated

Comment thread internal/gatewayapi/backendtlspolicy.go Outdated

Comment thread internal/xds/translator/sds.go Outdated

zirain added 2 commits April 18, 2026 19:22

fix review comments

c1faf4d

Signed-off-by: zirain <zirain2009@gmail.com>

fix lint

01f79ab

Signed-off-by: zirain <zirain2009@gmail.com>

arkodg reviewed Apr 18, 2026

View reviewed changes

zirain added 2 commits April 20, 2026 09:33

add EnableSDSSecretRef in EnvoyGateway

d4d8430

Signed-off-by: zirain <zirain2009@gmail.com>

fix gen

1505c01

Signed-off-by: zirain <zirain2009@gmail.com>

zhaohuabing reviewed Apr 20, 2026

View reviewed changes

zirain added 2 commits April 21, 2026 17:09

rename

bbd5ef0

Signed-off-by: zirain <zirain2009@gmail.com>

Merge branch 'main' into sds-ref

352c946

	SDSSecretType = "gateway.envoyproxy.io/sds-ref"
	SDSSecretType = "gateway.envoyproxy.io/sds"

Conversation

zirain commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

owenhaynes commented Apr 16, 2026

Uh oh!

zirain commented Apr 16, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arkodg Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

arkodg Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zirain Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

zirain commented Apr 14, 2026 •

edited

Loading

netlify bot commented Apr 14, 2026 •

edited

Loading

codecov bot commented Apr 14, 2026 •

edited

Loading

arkodg Apr 18, 2026 •

edited

Loading

zhaohuabing Apr 20, 2026 •

edited

Loading

zhaohuabing Apr 20, 2026 •

edited

Loading