Ztunnel provides an experimental implementation of the ztunnel component of ambient mesh.
Note: istio/ztunnel
is currently intended for experimental usage only.
Ztunnel is intended to be a purpose built implementation of the node proxy in ambient mesh. Part of the goals of this included keeping a narrow feature set, implementing only the bare minimum requirements for ambient. This ensures the project remains simple and high performance.
Explicitly out of scope for ztunnel include:
- Terminating user HTTP traffic
- Terminating user HTTP traffic (its worth repeating)
- Generic extensibility such as
ext_authz
, WASM, linked-in extensions, Lua, etc.
In general, ztunnel does not aim to be a generic extensible proxy; Envoy is better suited for that task. If a feature is not directly used to implement the node proxy component in ambient mesh, it is unlikely to be accepted.
The Ztunnel build enables the fips
feature by default, which in turn enables the fips
feature
on BoringSSL.
FIPS has
strict requirements
to ensure that compliance is granted only to the exact binary tested.
FIPS compliance was granted
to an old version of BoringSSL that was tested with Clang 12.0.0
.
Installing Clang 12.0.0
on modern environments is at best difficult. For linux
x86_64
, we work around
this problem by shipping the pre-built binaries under vendor/boringssl-fips/linux_x86_64
. We then tell the BoringSSL libraries
to use this path by setting the BORING_BSSL_PATH
environment variable in .cargo/config.toml
.
For non-linux/x86_64 platforms, you can disable FIPS by doing the following:
- Run cargo with the
--no-default-features
flag (e.g.cargo build --no-default-features
). - Comment out the
BORING_BSSL_*
environment variables in.cargo/config.toml
. We're actively looking into ways to avoid this step, so it should not be needed in the future.
Some IDEs (such as the Intellij-series) do not support
globally applying arguments to cargo. In this case, it is probably easier to remove fips
as a default feature in
Cargo.toml
.
# ...
[features]
default = []
# ...