Add CFP-22215 mTLS Authentication document with images

cilium / design-cfps

Repo to store Cilium CFP design docs

Apache License 2.0

21 stars 19 forks source link

Add CFP-22215 mTLS Authentication document with images #5

Closed youngnick closed 1 year ago

youngnick commented 1 year ago

This converts the mTLS Authentication CFP from Google Doc to Markdown for storage here, updating the design along the way.

The document has had a lot of edits to reflect a couple of key changes:

The mTLS solution will now use a BPF authentication map, not the connection table method it did originally
SPIFFE and SPIRE will now be the first authentication type supported (although we will build support for more types)
SPIRE server will by default be installed into the cluster for you when you enable the feature.

youngnick commented 1 year ago

Okay, I think I've resolved all the comments now. @mhofstetter, if you could rereview, that would be great.

youngnick commented 1 year ago

I think this is pretty close if not done, although I should note that I'm planning on coming back and updating as we get further through the design. I'd kinda prefer to merge this as-is, and then iterate to fix any further things (for example, some notes about how big the auth table can get once we've sure we have the mechanics locked down).

youngnick commented 1 year ago

I think that this one is basically done, with further changes coming as we work on it. Any chance of that tick please @joestringer?