-
Notifications
You must be signed in to change notification settings - Fork 5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add Support for Consul Connect #7407
Conversation
What is the current status of the PR? Are you still hitting some road blocks? |
@apollo13 yes, there is some problem still related to mTLS. I can't find anything obviously wrong but mTLS doesn't work. If any maintainer is reading this, could you please help me find the code where mTLS handshake and verification happens? |
Ah that's to bad. @ldez do you think that anyone from the traefik team could provide some pointers here? Having traefik talk to the consul service mesh would be a massive win security wise. |
Hey @Gufran, we'd like to help you get started on that. Could you maybe join our office hours tommorow? That would be quicker: https://info.traefik.io/traefik-developer-office-hours |
I think I've fixed the issue and gotten TLS working for the consul connect services (confirmed with WireShark). I'll be happy to finish up the remaining items in the checklist (test and docs), but I'm not sure what the proper etiquette for continuing someone else's work is. Is it acceptable if I fork this PR, make the required changes and create a new PR from my fork? |
Hi @SantoDE , we got the PR into a working state and would need some specific feedback. I'll try to describe the issue here and if that doesn't end well I'd like to join the next community session. The problem that we currently face is that consul connect certificates do not have a valid DNS/IP SAN. One bad way we can get this working is setting The tl;dr: We would need a supported way in traefik to customize the certificate validation process aside from the options that Looking forward to hear back from you. |
We are glad to see that this PR is moving forward. :) First and foremost, could you rebase the PR? This topic is far away from being trivial, and we are actively discussing the best way to address it. We can also let this configuration not be exposed and apply it only for consul connect and wait for another need to expose it. We are also wondering why the certificate validation does not check the spiffe id? (in the actual state, it only check the certificate chain) |
@Gufran Can you add me as maintainer to your repo?
Will do ASAP
Yes, and I appreciate it! I know that the PR is not perfect, but I thought code would illustrate our issues better…
I just know enough Go to be dangerous. I opted for
Because a) I wanted to have something minimal to show, b) I have yet to investigate how spiffe works -- but I plan to add this (though I do not think it should have an impact on the general discussion about how to allow more fine grained cert validation). |
This of course needs to be done. I'll add a checklist at the end of this post to sum of the tasks, that I think still need to be done. Please let me know if I missed anything :)
I don't have a particular preference and I think @apollo13 is better equipped to make a decision on this, but I'd like to hear what makes you prefer TODO:
I'd like to sign up for docs and tests, since I believe @apollo13 has a better understanding of TLS and would be more likely to make good calls in that area. You okay with that, @appollo13? |
Sounds perfect, I hate docs & tests anyways :) |
Hi @Gufran, I rebased & updated the PR to include SPIFFE etc. I squashed the commits down into one single commit: apollo13@bb45ec3 -- it would be great if you could force push this one into your branch. EDIT:// Pushed also a cleanup commit; this is the branch https://github.com/apollo13/traefik/tree/consul-connect-backend-rebased |
Okay @jbdoumenjou My branch https://github.com/apollo13/traefik/tree/consul-connect-backend-rebased includes the changes for SPIFFE verification and uses I hope @Gufran wil push my changes into this PR soonish. @RavensburgOP 1,4,5 of your TODOs are done :) |
Hi, maybe do not work on tests and docs yet. I have a few ideas and if we are going to follow them you'd have to rewrite most of the tests/docs. Mainly I want to automatically connect to the sidecar instead having to specify it explicitly (this would also fix your default rule issues). I'll try to outline that over the weekend.
…On Sat, Jan 23, 2021, at 10:11, Christian Ravn wrote:
Hey @apollo13 <https://github.com/apollo13> :)
I'll hold out on updating the todo until it's in the @Gufran
<https://github.com/Gufran>'s fork, so the list matches what is in the
PR
I'll take a look at docs and tests later today or tomorrow
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#7407 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAAT5C5YHP4OZWV4U6EUYWLS3KHFZANCNFSM4SKOPXUA>.
|
Hi @apollo13, I've added you as a collaborator on my fork, you should be able to push to my branch now. |
Thank you very much @Gufran. No worries about not having time, you already put a lot in and layed the ground work for which I am very much grateful. I wouldn't be able to work on this if it weren't for you! |
fec2c5e
to
9ec9911
Compare
@RavensburgOP I added some code so that |
Co-authored-by: Tom Moulard <tom.moulard@epita.fr>
Co-authored-by: Tom Moulard <tom.moulard@epita.fr>
Co-authored-by: mpl <mathieu.lonjaret@gmail.com>
…two containers behind a single service.
157baae
to
efdf25b
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Lovely, many thanks to the whole team for helping pushing this through. This will be "the one" feature of traefik 2.5 for me. |
What does this PR do?
The change set introduces support for Consul Connect enabled services.
Motivation
There is no edge proxy available that can route traffic to a connect enabled service. Consul Connect, despite being a powerful and easy to use service mesh, is useless to a lot of people who are mainly looking to route traffic from internet to private services. A service running inside Connect service mesh can only receive traffic via its sidecar, and sidecar will only communicate with a network peer using mutual TLS. The solution is easy, but haven't been implemented in any form.
Traefik already supports Consul Catalog, it is only a matter of utilizing the certificates for upstream connection wherever applicable and it becomes the perfect edge proxy for connect mesh.
More
Additional Notes
This PR is in progress, I need some help to figure out how to set the TLS configuration on a connection without specifying it in service tags.
Related: #3544
Continues consul connect integration from #6373
Co-authored-by: Florian Apolloner apollo13@users.noreply.github.com