Consul connect mTLS

[marcogschmidt]

similar to what we did with Istio. Talk to @yuval-k and maybe @ilackarms Gloo is an ingress to the consul connect cluster. Every VM has a consul agent (node agent in istio, which provides certificates & tokens)

Putting one of their sidecars through our gateway-proxy

• get a certificate that Consul will recognize, which its sidecars will accept. (look into how outside certificates validate themselves to the service mesh)
• generate a cert, add it to the consul's 'validation_context' equivalent?

[kdorosh]

Mostly a link dump.

The work we did with istio to support SDS: https://github.com/solo-io/gloo/pull/559

The Gloo and Istio guide: https://docs.solo.io/gloo/latest/gloo_integrations/service_mesh/gloo_istio_mtls/

We should be able to plug in the consul connect mTLS config into our upstreamssl plugin by converting consul connect mTLS config into Gloo ssl config (either on upstreams or in TLS secrets).

Consul mTLS high-level architecture docs here: https://www.consul.io/docs/connect/connect-internals.html#mutual-transport-layer-security-mtls-

Consul connect client docs: https://www.consul.io/docs/connect/native.html

Most important link, api we want to use to get consul connect certs: https://www.consul.io/api/agent/connect.html#certificate-authority-ca-roots

Note:

This endpoint should be used by proxies and native integrations.

Talking about GET to /agent/connect/ca/roots

Raw consul connect client go docs, probably not useful for our case (since envoy needs to connect to service, not gloo): https://www.consul.io/docs/connect/native/go.html#raw-tls-connection

[github-actions[bot]]

This issue has been marked as stale because of no activity in the last 180 days. It will be closed in the next 180 days unless it is tagged "no stalebot" or other activity occurs.

[dmaclaury]

Is this issue still being considered for development? It'd be great to see this functionality available.

[github-actions[bot]]

This issue has been marked as stale because of no activity in the last 180 days. It will be closed in the next 180 days unless it is tagged "no stalebot" or other activity occurs.