spiffe: add support for spiffe bundle format #36190

briansonnenberg · 2024-09-18T07:25:06Z

Commit Message: Adds alternative to "trust_domains" config for the spiffe validator—"trust_bundle_map".

Additional Description:

#35567
trust_bundle_map points to a local file containing a SPIFFE bundle map. A file watcher is set up to trigger refreshes to the SPIFFE data when this file is modified. SPIFFE refresh hint and sequence number are currently ignored.

Risk Level: medium
Testing: WIP
Docs Changes: TBD
Release Notes: TBD

repokitteh-read-only · 2024-09-18T07:25:16Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @markdroth
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #36190 was opened by briansonnenberg.

see: more, trace.

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto

jmarantz · 2024-09-23T13:00:08Z

/wait

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto

wbpcode

Thanks for the contribution. some new comments to the API to start the review. And please address the comment from @markdroth .

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto

markdroth · 2024-09-27T20:48:13Z

/lgtm api

kyessenov · 2024-10-01T18:10:22Z

Please merge main.
/wait

alyssawilk · 2024-10-08T13:01:15Z

/wait on CI

wbpcode

Thanks for the contribution and patience. And some comments are added.

changelogs/current.yaml

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.h

wbpcode · 2024-10-17T07:57:33Z

Please also check the CI :)

Signed-off-by: Brian Sonnenberg <[email protected]>

briansonnenberg · 2024-12-12T20:34:23Z

@wbpcode @alyssawilk @markdroth

Finally have the CI passing. 😅

Would you folks mind taking another look?

markdroth · 2024-12-13T01:15:33Z

I'm still not thrilled that we're doing this instead of implementing the certificate provider framework, but at least this doesn't preclude us from doing that later.

/lgtm api

adisuissa · 2024-12-17T14:19:26Z

@wbpcode seems that latest comments were addressed, PTAL.

wbpcode · 2024-12-18T15:12:14Z

Will take a look before tomorrow night.

wbpcode

Thanks for the update and the long time investment. It's much better now. I add some comments new but should be easy to address. Thanks again.

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.h

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

test/common/tls/test_data/certs.sh

Signed-off-by: Brian Sonnenberg <[email protected]>

wbpcode

LGTM overall now. Thanks so much for your update, It's near there, only some non-major comments are added.

And merry Christmas!!! 🎄

/wait

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

wbpcode · 2024-12-25T14:10:36Z

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

+          ENVOY_LOG(error, "Failed to load SPIFFE bundle map from '{}': '{}'",
+                    trust_bundle_file_name_, new_trust_bundle.status());


Suggested change

ENVOY_LOG(error, "Failed to load SPIFFE bundle map from '{}': '{}'",

trust_bundle_file_name_, new_trust_bundle.status());

ENVOY_LOG(error, "Failed to load SPIFFE bundle map from '{}': '{}'",

trust_bundle_file_name_, new_trust_bundle.status().message());

ping for this comment

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

wbpcode · 2024-12-25T14:15:17Z

test/extensions/transport_sockets/tls/cert_validator/spiffe/BUILD

@@ -19,6 +24,7 @@ envoy_extension_cc_test(
    ],
    data = [
        "//test/common/tls/test_data:certs",
+        "//test/extensions/transport_sockets/tls/cert_validator/spiffe:trust_bundles",


Seems you only move the generated file to this directory. Sorry for the chaos, maybe keep your previous design is better if we cannot split all these out from the tls/test_data cleanly.

I moved the static files to the test directory and left the generated one in the directory that has the generator. I think this is ideal.

Fine, if you think that's OKay. Please also create a test_data sub directory for them.

And Please also merge the main and resolve the CI problem.

Signed-off-by: Brian Sonnenberg <[email protected]>

wbpcode · 2025-01-06T02:59:34Z

/wait

Signed-off-by: Brian Sonnenberg <[email protected]>

wbpcode

LGTM with some nit comments to improve the code quality (non-block).

And could you check the CI. Thanks.

wbpcode · 2025-01-08T12:25:44Z

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

+          ENVOY_LOG(error, "Failed to load SPIFFE bundle map from '{}': '{}'",
+                    trust_bundle_file_name_, new_trust_bundle.status());


ping for this comment

wbpcode · 2025-01-08T12:26:03Z

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

@@ -30,10 +33,133 @@ namespace Tls {

 using SPIFFEConfig = envoy::extensions::transport_sockets::tls::v3::SPIFFECertValidatorConfig;

+absl::StatusOr<std::shared_ptr<SpiffeData>>
+SPIFFEValidator::parseTrustBundles(const std::string& trust_bundle_mapping_str) {
+  Json::ObjectSharedPtr parsed_json_bundle;


nit: remove this line.

wbpcode · 2025-01-08T12:26:37Z

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

+    return absl::InvalidArgumentError("Invalid JSON found in SPIFFE bundle");
+  }
+
+  parsed_json_bundle = json_parse_result.value();


Suggested change

parsed_json_bundle = json_parse_result.value();

Json::ObjectSharedPtr parsed_json_bundle = json_parse_result.value();

wbpcode · 2025-01-08T12:29:13Z

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

+
+  // User configured "trust_domains", not "trust_bundles"
+  spiffe_data_ = std::make_shared<SpiffeData>();
+  spiffe_data_->trust_bundle_stores_.reserve(n_trust_domains);


Suggested change

spiffe_data_->trust_bundle_stores_.reserve(n_trust_domains);

spiffe_data_->trust_bundle_stores_.reserve(message.trust_domains().size());

wbpcode · 2025-01-08T12:29:25Z

source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc

@@ -55,10 +181,36 @@ SPIFFEValidator::SPIFFEValidator(const Envoy::Ssl::CertificateValidationContextC
    }
  }

-  const auto size = message.trust_domains().size();
-  trust_bundle_stores_.reserve(size);
+  const auto n_trust_domains = message.trust_domains().size();


nit: remove this line.

wbpcode · 2025-01-08T12:37:29Z

cc @tyxia could you take another look when you have some free time?

wbpcode · 2025-01-08T12:38:30Z

If @tyxia no explict comments, I think we can merge this after the CI and nit comments are addressed. Thanks for all your time and investment. 🌹

tyxia

Thanks for contribution!

briansonnenberg requested a review from tyxia as a code owner September 18, 2024 07:25

repokitteh-read-only bot added the api label Sep 18, 2024

repokitteh-read-only bot assigned markdroth Sep 18, 2024

wbpcode reviewed Sep 18, 2024

View reviewed changes

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto Outdated Show resolved Hide resolved

repokitteh-read-only bot added waiting:any and removed waiting:any labels Sep 18, 2024

briansonnenberg mentioned this pull request Sep 18, 2024

SPIFFE: support JWK set bundle format #35567

Closed

markdroth reviewed Sep 19, 2024

View reviewed changes

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto Outdated Show resolved Hide resolved

jmarantz assigned wbpcode Sep 23, 2024

repokitteh-read-only bot added the waiting label Sep 23, 2024

wbpcode reviewed Sep 24, 2024

View reviewed changes

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto Outdated Show resolved Hide resolved

wbpcode reviewed Sep 24, 2024

View reviewed changes

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto Show resolved Hide resolved

wbpcode reviewed Sep 24, 2024

View reviewed changes

repokitteh-read-only bot removed the waiting label Sep 26, 2024

wbpcode reviewed Sep 27, 2024

View reviewed changes

api/envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto Outdated Show resolved Hide resolved

briansonnenberg force-pushed the brian-spiffe branch from 06a982e to b360f38 Compare September 27, 2024 17:16

repokitteh-read-only bot removed the api label Sep 27, 2024

repokitteh-read-only bot added the waiting label Oct 1, 2024

briansonnenberg force-pushed the brian-spiffe branch from b360f38 to 28b5308 Compare October 1, 2024 18:15

repokitteh-read-only bot removed the waiting label Oct 1, 2024

repokitteh-read-only bot added the waiting label Oct 8, 2024

repokitteh-read-only bot removed the waiting label Oct 16, 2024

briansonnenberg force-pushed the brian-spiffe branch from ff1fb7e to 38f5dee Compare October 16, 2024 16:56

wbpcode reviewed Oct 17, 2024

View reviewed changes

briansonnenberg added 8 commits December 10, 2024 21:10

format

c7d5d18

Signed-off-by: Brian Sonnenberg <[email protected]>

Fix tests and exception handling

cb2c9d5

Signed-off-by: Brian Sonnenberg <[email protected]>

More config exception testing.

ed26529

Signed-off-by: Brian Sonnenberg <[email protected]>

Removed dupe checking because json library auto-removes dupes.

e16fd5d

Signed-off-by: Brian Sonnenberg <[email protected]>

More config exception tests.

4e24a39

Signed-off-by: Brian Sonnenberg <[email protected]>

Proto format

ca49af5

Signed-off-by: Brian Sonnenberg <[email protected]>

Missing test files

b4cd27d

Signed-off-by: Brian Sonnenberg <[email protected]>

docs ci fix

843d881

Signed-off-by: Brian Sonnenberg <[email protected]>

repokitteh-read-only bot removed the api label Dec 13, 2024

wbpcode requested changes Dec 19, 2024

View reviewed changes

Addressed comments

c6219dc

Signed-off-by: Brian Sonnenberg <[email protected]>

wbpcode reviewed Dec 25, 2024

View reviewed changes

repokitteh-read-only bot added the waiting label Dec 25, 2024

Addressed comments

79c388b

Signed-off-by: Brian Sonnenberg <[email protected]>

repokitteh-read-only bot removed the waiting label Jan 2, 2025

repokitteh-read-only bot added the waiting label Jan 6, 2025

briansonnenberg added 2 commits January 6, 2025 19:18

Moved static test data to its own directory

dd5653f

Signed-off-by: Brian Sonnenberg <[email protected]>

Merge branch 'main' into brian-spiffe

3046cd7

Signed-off-by: Brian Sonnenberg <[email protected]>

repokitteh-read-only bot removed the waiting label Jan 7, 2025

wbpcode reviewed Jan 8, 2025

View reviewed changes

wbpcode assigned tyxia and unassigned markdroth Jan 8, 2025

tyxia approved these changes Jan 8, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

spiffe: add support for spiffe bundle format #36190

spiffe: add support for spiffe bundle format #36190

briansonnenberg commented Sep 18, 2024 •

edited

Loading

repokitteh-read-only bot commented Sep 18, 2024

jmarantz commented Sep 23, 2024

wbpcode left a comment

markdroth commented Sep 27, 2024

kyessenov commented Oct 1, 2024

alyssawilk commented Oct 8, 2024

wbpcode left a comment

wbpcode commented Oct 17, 2024

briansonnenberg commented Dec 12, 2024

markdroth commented Dec 13, 2024

adisuissa commented Dec 17, 2024

wbpcode commented Dec 18, 2024

wbpcode left a comment

wbpcode left a comment

wbpcode Dec 25, 2024

wbpcode Jan 8, 2025

wbpcode Dec 25, 2024

briansonnenberg Jan 2, 2025

wbpcode Jan 3, 2025

wbpcode Jan 3, 2025

wbpcode commented Jan 6, 2025

wbpcode left a comment

wbpcode Jan 8, 2025

wbpcode Jan 8, 2025

wbpcode Jan 8, 2025

wbpcode Jan 8, 2025

wbpcode Jan 8, 2025

wbpcode commented Jan 8, 2025

wbpcode commented Jan 8, 2025

tyxia left a comment

		ENVOY_LOG(error, "Failed to load SPIFFE bundle map from '{}': '{}'",
		trust_bundle_file_name_, new_trust_bundle.status());

	parsed_json_bundle = json_parse_result.value();
	Json::ObjectSharedPtr parsed_json_bundle = json_parse_result.value();

	spiffe_data_->trust_bundle_stores_.reserve(n_trust_domains);
	spiffe_data_->trust_bundle_stores_.reserve(message.trust_domains().size());

spiffe: add support for spiffe bundle format #36190

Are you sure you want to change the base?

spiffe: add support for spiffe bundle format #36190

Conversation

briansonnenberg commented Sep 18, 2024 • edited Loading

repokitteh-read-only bot commented Sep 18, 2024

jmarantz commented Sep 23, 2024

wbpcode left a comment

Choose a reason for hiding this comment

markdroth commented Sep 27, 2024

kyessenov commented Oct 1, 2024

alyssawilk commented Oct 8, 2024

wbpcode left a comment

Choose a reason for hiding this comment

wbpcode commented Oct 17, 2024

briansonnenberg commented Dec 12, 2024

markdroth commented Dec 13, 2024

adisuissa commented Dec 17, 2024

wbpcode commented Dec 18, 2024

wbpcode left a comment

Choose a reason for hiding this comment

wbpcode left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wbpcode commented Jan 6, 2025

wbpcode left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wbpcode commented Jan 8, 2025

wbpcode commented Jan 8, 2025

tyxia left a comment

Choose a reason for hiding this comment

briansonnenberg commented Sep 18, 2024 •

edited

Loading