@@ -129,46 +129,52 @@ func AppendURIPrefixToTrustDomain(trustDomainAliases []string) []string {
129129func ApplyToCommonTLSContext (tlsContext * tls.CommonTlsContext , proxy * model.Proxy ,
130130 subjectAltNames []string , crl string , trustDomainAliases []string , validateClient bool ,
131131) {
132- customFileSDSServer := proxy .Metadata .Raw [security .CredentialFileMetaDataName ] == "true"
133- // These are certs being mounted from within the pod. Rather than reading directly in Envoy,
134- // which does not support rotation, we will serve them over SDS by reading the files.
135- // We should check if these certs have values, if yes we should use them or otherwise fall back to defaults.
136- res := security.SdsCertificateConfig {
137- CertificatePath : proxy .Metadata .TLSServerCertChain ,
138- PrivateKeyPath : proxy .Metadata .TLSServerKey ,
139- CaCertificatePath : proxy .Metadata .TLSServerRootCert ,
140- }
141-
142- // TODO: if subjectAltName ends with *, create a prefix match as well.
143- // TODO: if user explicitly specifies SANs - should we alter his explicit config by adding all spifee aliases?
144- matchSAN := util .StringToExactMatch (subjectAltNames )
145- if len (trustDomainAliases ) > 0 {
146- matchSAN = append (matchSAN , util .StringToPrefixMatch (AppendURIPrefixToTrustDomain (trustDomainAliases ))... )
132+ if proxy .Metadata .TLSServerCertificates == nil {
133+ // Create a default TLS server certificate
134+ proxy .Metadata .TLSServerCertificates = []* model.TLSServerCertificate {{}}
147135 }
136+ sdsSecretConfigs := make ([]* tls.SdsSecretConfig , len (proxy .Metadata .TLSServerCertificates ))
137+ for i , cert := range proxy .Metadata .TLSServerCertificates {
138+ customFileSDSServer := proxy .Metadata .Raw [security .CredentialFileMetaDataName ] == "true"
139+ // These are certs being mounted from within the pod. Rather than reading directly in Envoy,
140+ // which does not support rotation, we will serve them over SDS by reading the files.
141+ // We should check if these certs have values, if yes we should use them or otherwise fall back to defaults.
142+ res := security.SdsCertificateConfig {
143+ CertificatePath : cert .TLSServerCertChain ,
144+ PrivateKeyPath : cert .TLSServerKey ,
145+ CaCertificatePath : cert .TLSServerRootCert ,
146+ }
148147
149- // configure server listeners with SDS.
150- if validateClient {
151- defaultValidationContext := & tls.CertificateValidationContext {
152- MatchSubjectAltNames : matchSAN ,
148+ // TODO: if subjectAltName ends with *, create a prefix match as well.
149+ // TODO: if user explicitly specifies SANs - should we alter his explicit config by adding all spifee aliases?
150+ matchSAN := util .StringToExactMatch (subjectAltNames )
151+ if len (trustDomainAliases ) > 0 {
152+ matchSAN = append (matchSAN , util .StringToPrefixMatch (AppendURIPrefixToTrustDomain (trustDomainAliases ))... )
153153 }
154- if crl != "" {
155- defaultValidationContext .Crl = & core.DataSource {
156- Specifier : & core.DataSource_Filename {
157- Filename : crl ,
154+
155+ // configure server listeners with SDS.
156+ if validateClient {
157+ defaultValidationContext := & tls.CertificateValidationContext {
158+ MatchSubjectAltNames : matchSAN ,
159+ }
160+ if crl != "" {
161+ defaultValidationContext .Crl = & core.DataSource {
162+ Specifier : & core.DataSource_Filename {
163+ Filename : crl ,
164+ },
165+ }
166+ }
167+ tlsContext .ValidationContextType = & tls.CommonTlsContext_CombinedValidationContext {
168+ CombinedValidationContext : & tls.CommonTlsContext_CombinedCertificateValidationContext {
169+ DefaultValidationContext : defaultValidationContext ,
170+ ValidationContextSdsSecretConfig : constructSdsSecretConfig (res .GetRootResourceName (), SDSRootResourceName , customFileSDSServer ),
158171 },
159172 }
160- }
161- tlsContext .ValidationContextType = & tls.CommonTlsContext_CombinedValidationContext {
162- CombinedValidationContext : & tls.CommonTlsContext_CombinedCertificateValidationContext {
163- DefaultValidationContext : defaultValidationContext ,
164- ValidationContextSdsSecretConfig : constructSdsSecretConfig (res .GetRootResourceName (), SDSRootResourceName , customFileSDSServer ),
165- },
166- }
167173
174+ }
175+ sdsSecretConfigs [i ] = constructSdsSecretConfig (res .GetResourceName (), SDSDefaultResourceName , customFileSDSServer )
168176 }
169- tlsContext .TlsCertificateSdsSecretConfigs = []* tls.SdsSecretConfig {
170- constructSdsSecretConfig (res .GetResourceName (), SDSDefaultResourceName , customFileSDSServer ),
171- }
177+ tlsContext .TlsCertificateSdsSecretConfigs = sdsSecretConfigs
172178}
173179
174180// constructSdsSecretConfig allows passing a file name and a fallback.
@@ -217,9 +223,19 @@ func ApplyCredentialSDSToServerCommonTLSContext(tlsContext *tls.CommonTlsContext
217223 tlsOpts * networking.ServerTLSSettings , credentialSocketExist bool ,
218224) {
219225 // create SDS config for gateway/sidecar to fetch key/cert from agent.
220- tlsContext .TlsCertificateSdsSecretConfigs = []* tls.SdsSecretConfig {
221- ConstructSdsSecretConfigForCredential (tlsOpts .CredentialName , credentialSocketExist ),
226+ if len (tlsOpts .CredentialNames ) > 0 {
227+ // Handle multiple certificates for RSA and ECDSA
228+ tlsContext .TlsCertificateSdsSecretConfigs = make ([]* tls.SdsSecretConfig , len (tlsOpts .CredentialNames ))
229+ for i , name := range tlsOpts .CredentialNames {
230+ tlsContext .TlsCertificateSdsSecretConfigs [i ] = ConstructSdsSecretConfigForCredential (name , credentialSocketExist )
231+ }
232+ } else {
233+ // Handle single certificate
234+ tlsContext .TlsCertificateSdsSecretConfigs = []* tls.SdsSecretConfig {
235+ ConstructSdsSecretConfigForCredential (tlsOpts .CredentialName , credentialSocketExist ),
236+ }
222237 }
238+
223239 // If tls mode is MUTUAL/OPTIONAL_MUTUAL, create SDS config for gateway/sidecar to fetch certificate validation context
224240 // at gateway agent. Otherwise, use the static certificate validation context config.
225241 if tlsOpts .Mode == networking .ServerTLSSettings_MUTUAL || tlsOpts .Mode == networking .ServerTLSSettings_OPTIONAL_MUTUAL {
0 commit comments