Support CA rotation in front-proxy

@kylape

Currently, we load client cert/key, and root CAs at startup time but don't rotate them:

Lines 56 to 69 in 15cbe0f

    
           cert, err := tls.LoadX509KeyPair(clientCert, clientKeyFile) 
        
           if err != nil { 
        
           	return nil, err 
        
           } 
        
           transport := http.DefaultTransport.(*http.Transport).Clone() 
        
           transport.TLSClientConfig = &tls.Config{ 
        
           	Certificates: []tls.Certificate{cert}, 
        
           	RootCAs:      caCertPool, 
        
           } 
        
           proxy := httputil.NewSingleHostReverseProxy(target) 
        
           proxy.Transport = transport 
        
           return &KCPProxy{proxy: proxy, backend: backend}, nil

I suppose rotation is done by re-deployment currently? We should rather support in-process rotation.

cc @kylape @csams

Navigation Menu

Repository navigation

Support CA rotation in front-proxy #1308

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	cert, err := tls.LoadX509KeyPair(clientCert, clientKeyFile)
	if err != nil {
	return nil, err
	}

	transport := http.DefaultTransport.(*http.Transport).Clone()
	transport.TLSClientConfig = &tls.Config{
	Certificates: []tls.Certificate{cert},
	RootCAs: caCertPool,
	}
	proxy := httputil.NewSingleHostReverseProxy(target)
	proxy.Transport = transport

	return &KCPProxy{proxy: proxy, backend: backend}, nil

Support CA rotation in front-proxy #1308

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions