A82: xDS System Root Certificates #436
Conversation
This allows using system root certs in gRPC. For details, see grpc/proposal#436. Risk Level: Low Testing: N/A Docs Changes: Included in PR Signed-off-by: Mark D. Roth <roth@google.com>
This allows using system root certs in gRPC. For details, see grpc/proposal#436. Risk Level: Low Testing: N/A Docs Changes: Included in PR Signed-off-by: Mark D. Roth <roth@google.com> Mirrored from https://github.com/envoyproxy/envoy @ 6364882088d5fce4b39d5ad3d0c0fac51c761b09
As per gRFC A82 (grpc/proposal#436). Closes #37185 COPYBARA_INTEGRATE_REVIEW=#37185 from markdroth:xds_system_root_certs 9ee1e82 PiperOrigin-RevId: 651896612
As per gRFC A82 (grpc/proposal#436). Closes grpc#37185 COPYBARA_INTEGRATE_REVIEW=grpc#37185 from markdroth:xds_system_root_certs 9ee1e82 PiperOrigin-RevId: 651896612
|
|
||
| ### Temporary environment variable protection | ||
|
|
||
| Use of the `use_system_root_certs` field in CDS and LDS will be guarded |
There was a problem hiding this comment.
I'm not sure I noticed that we were going to have different validation for client-side even though this is in a shared message with server-side. Up above it says "Note that LDS validation will be unchanged" which appears to disagree with this line. Only supporting it on client-side might be a bit harder to support, since this is in CommonTlsContext. I agree we don't need it on server-side, but can we add support for it anyway when there is shared code?
Also: s/use_system_root_certs/system_root_certs/
There was a problem hiding this comment.
We did talk about this question specifically before finalizing this gRFC. I had originally intended to support this option on both the client side and server side, just for consistency, but when I went to implement this in C-core, it turned out to be non-trivial, because we don't already have server-side code for using system root certs, so we decided to exclude it.
You're right about the typo. I'll send a separate PR to fix that.
As per gRFC A82 (grpc/proposal#436). Closes grpc#37185 COPYBARA_INTEGRATE_REVIEW=grpc#37185 from markdroth:xds_system_root_certs 9ee1e82 PiperOrigin-RevId: 651896612
As per gRFC A82 (grpc/proposal#436). Closes grpc#37185 COPYBARA_INTEGRATE_REVIEW=grpc#37185 from markdroth:xds_system_root_certs 9ee1e82 PiperOrigin-RevId: 651896612
3 participants
No description provided.