Uploaded image for project: 'Maistra'
  1. Maistra
  2. MAISTRA-2242

Support different root certificates

XMLWordPrintable

    • Icon: Story Story
    • Resolution: Done
    • Icon: Blocker Blocker
    • maistra-2.1.0
    • None
    • None
    • None
    • Sprint 3, Sprint 4, Sprint 5, Sprint 6, Sprint 7, Sprint 8, Sprint 9, Sprint 10

      As a mesh administrator, I want to be able to join two meshes into a federation that do not share a root certificate, so that administrative domains can be completely separate

      There has been some work upstream to support SPIFFE TrustBundles - they offer exactly the functionality required here, by mapping trust domains to certificate chains. We should look at cherry-picking that work, if possible.

      Acceptance Criteria:

      • Every mesh can define its own trust domain and cert chain
      • Proxies validate remote certificates depending on the trust domain

      This story covers exchange of certificate chains at Federation initialization- for continuous updates of cert chains, see MAISTRA-2238

          1.
          		 Create a new test case for supporting two meshes with their trust domain and cert chain into a federation Sub-task Closed Major Yuanlin Xu
          2.
          		 Create a new test case for validating remote certificates depending on the trust domain Sub-task Closed Major Yuanlin Xu
          3.
          		 Backport multi-root support for Envoy Sub-task Closed Major Dmitri Dolguikh (Inactive)
          4.
          		 Distribute root certs via SDS Sub-task Closed Major Daniel Grimm

              dgrimm@redhat.com Daniel Grimm
              dgrimm@redhat.com Daniel Grimm
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: