mirror of https://github.com/hashicorp/consul
28b4b3a85d
Description Add x-fowarded-client-cert information on trusted incoming connections. Envoy provides support forwarding and annotating the x-forwarded-client-cert header via the forward_client_cert_details set_current_client_cert_details filter fields. It would be helpful for consul to support this directly in its config. The escape hatches are a bit cumbersome for this purpose. This has been implemented on incoming connections to envoy. Outgoing (from the local service through the sidecar) will not have a certificate, and so are left alone. A service on an incoming connection will now get headers something like this: ``` X-Forwarded-Client-Cert:[By=spiffe://efad7282-d9b2-3298-f6d8-38b37fb58df3.consul/ns/default/dc/dc1/svc/counting;Hash=61ad5cbdfcb50f5a3ec0ca60923d61613c149a9d4495010a64175c05a0268ab2;Cert="-----BEGIN%20CERTIFICATE-----%0AMIICHDCCAcOgAwIBAgIBCDAKBggqhkjOPQQDAjAxMS8wLQYDVQQDEyZwcmktMTli%0AYXdyb2YuY29uc3VsLmNhLmVmYWQ3MjgyLmNvbnN1bDAeFw0yMjA0MjkwMzE0NTBa%0AFw0yMjA1MDIwMzE0NTBaMAAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARVIZ7Y%0AZEXfbOGBfxGa7Vuok1MIng%2FuzLQK2xLVlSTIPDbO5hstTGP%2B%2FGx182PYFP3jYqk5%0Aq6rYWe1wiPNMA30Io4H8MIH5MA4GA1UdDwEB%2FwQEAwIDuDAdBgNVHSUEFjAUBggr%0ABgEFBQcDAgYIKwYBBQUHAwEwDAYDVR0TAQH%2FBAIwADApBgNVHQ4EIgQgrp4q50oX%0AHHghMbxz5Bk8OJFWMdfgH0Upr350WlhyxvkwKwYDVR0jBCQwIoAgUe6uERAIj%2FLM%0AyuFzDc3Wbp9TGAKBJYAwyhF14ToOQCMwYgYDVR0RAQH%2FBFgwVoZUc3BpZmZlOi8v%0AZWZhZDcyODItZDliMi0zMjk4LWY2ZDgtMzhiMzdmYjU4ZGYzLmNvbnN1bC9ucy9k%0AZWZhdWx0L2RjL2RjMS9zdmMvZGFzaGJvYXJkMAoGCCqGSM49BAMCA0cAMEQCIDwb%0AFlchufggNTijnQ5SUcvTZrWlZyq%2FrdVC20nbbmWLAiAVshNNv1xBqJI1NmY2HI9n%0AgRMfb8aEPVSuxEHhqy57eQ%3D%3D%0A-----END%20CERTIFICATE-----%0A";Chain="-----BEGIN%20CERTIFICATE-----%0AMIICHDCCAcOgAwIBAgIBCDAKBggqhkjOPQQDAjAxMS8wLQYDVQQDEyZwcmktMTli%0AYXdyb2YuY29uc3VsLmNhLmVmYWQ3MjgyLmNvbnN1bDAeFw0yMjA0MjkwMzE0NTBa%0AFw0yMjA1MDIwMzE0NTBaMAAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARVIZ7Y%0AZEXfbOGBfxGa7Vuok1MIng%2FuzLQK2xLVlSTIPDbO5hstTGP%2B%2FGx182PYFP3jYqk5%0Aq6rYWe1wiPNMA30Io4H8MIH5MA4GA1UdDwEB%2FwQEAwIDuDAdBgNVHSUEFjAUBggr%0ABgEFBQcDAgYIKwYBBQUHAwEwDAYDVR0TAQH%2FBAIwADApBgNVHQ4EIgQgrp4q50oX%0AHHghMbxz5Bk8OJFWMdfgH0Upr350WlhyxvkwKwYDVR0jBCQwIoAgUe6uERAIj%2FLM%0AyuFzDc3Wbp9TGAKBJYAwyhF14ToOQCMwYgYDVR0RAQH%2FBFgwVoZUc3BpZmZlOi8v%0AZWZhZDcyODItZDliMi0zMjk4LWY2ZDgtMzhiMzdmYjU4ZGYzLmNvbnN1bC9ucy9k%0AZWZhdWx0L2RjL2RjMS9zdmMvZGFzaGJvYXJkMAoGCCqGSM49BAMCA0cAMEQCIDwb%0AFlchufggNTijnQ5SUcvTZrWlZyq%2FrdVC20nbbmWLAiAVshNNv1xBqJI1NmY2HI9n%0AgRMfb8aEPVSuxEHhqy57eQ%3D%3D%0A-----END%20CERTIFICATE-----%0A";Subject="";URI=spiffe://efad7282-d9b2-3298-f6d8-38b37fb58df3.consul/ns/default/dc/dc1/svc/dashboard] ``` Closes #12852 |
||
|---|---|---|
| .. | ||
| acl.go | ||
| acl_cache.go | ||
| acl_cache_test.go | ||
| acl_oss.go | ||
| acl_test.go | ||
| auto_encrypt.go | ||
| autopilot.go | ||
| autopilot_oss.go | ||
| catalog.go | ||
| catalog_oss.go | ||
| check_definition.go | ||
| check_definition_test.go | ||
| check_type.go | ||
| config_entry.go | ||
| config_entry_discoverychain.go | ||
| config_entry_discoverychain_oss.go | ||
| config_entry_discoverychain_test.go | ||
| config_entry_export_oss_test.go | ||
| config_entry_exports.go | ||
| config_entry_exports_test.go | ||
| config_entry_gateways.go | ||
| config_entry_gateways_test.go | ||
| config_entry_intentions.go | ||
| config_entry_intentions_oss.go | ||
| config_entry_intentions_test.go | ||
| config_entry_mesh.go | ||
| config_entry_mesh_oss.go | ||
| config_entry_oss.go | ||
| config_entry_oss_test.go | ||
| config_entry_test.go | ||
| connect.go | ||
| connect_ca.go | ||
| connect_ca_test.go | ||
| connect_oss.go | ||
| connect_proxy_config.go | ||
| connect_proxy_config_oss.go | ||
| connect_proxy_config_test.go | ||
| discovery_chain.go | ||
| discovery_chain_oss.go | ||
| errors.go | ||
| federation_state.go | ||
| identity.go | ||
| intention.go | ||
| intention_oss.go | ||
| intention_test.go | ||
| operator.go | ||
| peering.go | ||
| prepared_query.go | ||
| prepared_query_test.go | ||
| protobuf_compat.go | ||
| sanitize_oss.go | ||
| service_definition.go | ||
| service_definition_test.go | ||
| snapshot.go | ||
| structs.go | ||
| structs_filtering_test.go | ||
| structs_oss.go | ||
| structs_oss_test.go | ||
| structs_test.go | ||
| system_metadata.go | ||
| testing.go | ||
| testing_catalog.go | ||
| testing_connect_proxy_config.go | ||
| testing_intention.go | ||
| testing_service_definition.go | ||
| txn.go | ||