feat: Extended Root CA for upstream connections (#181) #706
Conversation
This allows for appending a certificate file to the Root CA without altering the system Root CA. This is useful for allowing self-signed certificates on the upstream connections
|
|
This adds support for appending certificates to the Root CA of the proxy process on upstreams. This does not alter the entire system.
|
I got a notification from github saying: "Windows go test #412 - No test was run". Not sure what that means? |
…ix/oathkeeper into fix_issue_118_trust_selfsigend_certs
|
I have added a test case to test that appending a certificate file to root ca works for TLS on upstream connections. Enjoy. |
|
Thank you! Hectic week...will review on Monday! |
There was a problem hiding this comment.
This looks really good. I think we need to improve the TLS set up so that it doesn't load on every request. Also it would be great if you could document this new feature as a new section Upstream Configuration.
Thanks!
|
Are you still up for the changes? 🧐 If you need any help, let us know! |
|
+1 this is extremely useful for internal load balancers that communicate over HTTPS. |
|
Yes i will try and find some time for this. Might need some guidance on where to put the cached transport, but will give it a go. |
* Adds cacheing of UpstreamTransport to avoid excessive IO ops at scale * Adds configuration option `ca_refresh_frequency` for periodic checks of certificate file changes * Adds new Upstream Configuration section
| // UpstreamTransport decides the transport to use for the upstream for the request. | ||
| func (r *RegistryMemory) UpstreamTransport(req *http.Request) (http.RoundTripper, error) { | ||
|
|
||
| r.upstreamRequestCount++ |
There was a problem hiding this comment.
Since we probably have highly concurrent system this might cause issues. I think it would make sense to use atomic.Uint instead ( https://golang.org/pkg/sync/atomic/ ) to count up here :)
|
@christian-roggia is continuing the work done here in #744 :) So I'll be marking this as a draft! |
|
Closing this as it is superseded by #744 |
This allows for appending a certificate file to the Root CA without altering the system Root CA. This is useful for allowing self-signed certificates on the upstream connections
Related issue
Proposed changes
Checklist
vulnerability. If this pull request addresses a security. vulnerability, I
confirm that I got green light (please contact
[email protected]) from the maintainers to push
the changes.
works.
Further comments