opensergo / opensergo-control-plane

Universal cloud-native microservice governance control plane (微服务治理控制面)
Apache License 2.0
35 stars 23 forks source link

Add optional config for TLS support #53

Open jnan806 opened 1 year ago

jnan806 commented 1 year ago

Issue Description

Type: feature request

Describe what feature you want

Add optional config for supporting TLS which user can enable the TLS transport

123liuziming commented 1 year ago

Maybe I can try this?

jnan806 commented 1 year ago

@123liuziming has assigned to you, and looking forward to your contribution 😃

123liuziming commented 1 year ago

How can users configure the TLS certificate? There are a number of ways to do this, for example:

  1. Use K8s secret
  2. Just injecting the certificate into the environment variable of OpenSergo control plane
  3. Like what Istio does, OpenSergo manage the certificate itself. For example we can send a CSR to K8s and generate the key pair for the TLS connection of OpenSergo, or we can use the CA that users provide. In this way, user do not need to configure the certificate explicitly
jnan806 commented 1 year ago

How can users configure the TLS certificate? There are a number of ways to do this, for example:

  1. Use K8s secret
  2. Just injecting the certificate into the environment variable of OpenSergo control plane
  3. Like what Istio does, OpenSergo manage the certificate itself. For example we can send a CSR to K8s and generate the key pair for the TLS connection of OpenSergo, or we can use the CA that users provide. In this way, user do not need to configure the certificate explicitly

@123liuziming First, I prefer to plan 3 which means we provide a mechanism to manage the certificate. But now, for convenient we can only implement this by plan 2,through System-Env,Config-Params, or File-Volume(like k8s ConfigMap...).

And then,we can improve it by generate OpenSergo key pairs and inject into plan 2

@sczyh30 What do you think about?

123liuziming commented 1 year ago

We can try plan 2 first, later we may integrate the project into Istio, at that time we can reuse plan 3!

123liuziming commented 1 year ago

image Go CI seems timeout?

jnan806 commented 1 year ago

Go CI seems timeout?

I have re-run the CI, but it looks was blocked. So can you force-push it again