Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

MeshTLS doesn't set TLS version on delegated gateway #12107

Open
lukidzi opened this issue Nov 26, 2024 · 0 comments
Open

MeshTLS doesn't set TLS version on delegated gateway #12107

lukidzi opened this issue Nov 26, 2024 · 0 comments
Labels
kind/bug A bug triage/accepted The issue was reviewed and is complete enough to start working on it

Comments

@lukidzi
Copy link
Contributor

lukidzi commented Nov 26, 2024 •
edited
Loading

What happened?

While investigating the flake, I noticed that the TLS version for the delegated gateway was not set at all. Since MeshTLS is a 'from' policy, and the delegated gateway does not have a listener (inbound), no policy is matched.

https://github.com/kumahq/kuma/blob/master/pkg/plugins/policies/core/matchers/dataplane.go#L304

User impact

The user is unable to configure TLS version and cipher for delegated gateway

Possible solutions

  • create an artificial listener to match the policy
  • change MeshTLS to have to section and allow defining TLS version/Cipher
@lukidzi lukidzi added triage/pending This issue will be looked at on the next triage meeting kind/bug A bug labels Nov 26, 2024
@lukidzi lukidzi mentioned this issue Nov 26, 2024
Merged
lukidzi added a commit that referenced this issue Nov 27, 2024
@lukidzi
test(e2e): disable meshmtls test with delegated gateway (#12108)
c542d02 
## Motivation

I noticed a flake and began investigating. I discovered the TLS version
and cipher are not configured for the delegated gateway. Since the
`MeshTLS` policy is a `from` policy and the delegated gateway has no
inbound listener, the policy cannot be matched to any listener. The test
passed because the request was sent before the configuration was fully
delivered.

## Implementation information

Excluded the test and added `MustPassRepeatedly(5)` to ensure better
validation once the issue is resolved.

## Supporting documentation

<!-- Is there a MADR? An Issue? A related PR? -->

xref: #12107

<!--
> Changelog: skip
-->
<!--
Uncomment the above section to explicitly set a [`> Changelog:` entry
here](https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md#submitting-a-patch)?
-->

Signed-off-by: Lukasz Dziedziak <[email protected]>
kumahq bot pushed a commit that referenced this issue Nov 27, 2024
@lukidzi @kumahq
test(e2e): disable meshmtls test with delegated gateway (#12108)
e76eb12 
I noticed a flake and began investigating. I discovered the TLS version
and cipher are not configured for the delegated gateway. Since the
`MeshTLS` policy is a `from` policy and the delegated gateway has no
inbound listener, the policy cannot be matched to any listener. The test
passed because the request was sent before the configuration was fully
delivered.

Excluded the test and added `MustPassRepeatedly(5)` to ensure better
validation once the issue is resolved.

<!-- Is there a MADR? An Issue? A related PR? -->

xref: #12107

<!--
> Changelog: skip
-->
<!--
Uncomment the above section to explicitly set a [`> Changelog:` entry
here](https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md#submitting-a-patch)?
-->

Signed-off-by: Lukasz Dziedziak <[email protected]>
kumahq bot pushed a commit that referenced this issue Nov 27, 2024
@lukidzi @kumahq
test(e2e): disable meshmtls test with delegated gateway (#12108)
b96620c 
## Motivation

I noticed a flake and began investigating. I discovered the TLS version
and cipher are not configured for the delegated gateway. Since the
`MeshTLS` policy is a `from` policy and the delegated gateway has no
inbound listener, the policy cannot be matched to any listener. The test
passed because the request was sent before the configuration was fully
delivered.

## Implementation information

Excluded the test and added `MustPassRepeatedly(5)` to ensure better
validation once the issue is resolved.

## Supporting documentation

<!-- Is there a MADR? An Issue? A related PR? -->

xref: #12107

<!--
> Changelog: skip
-->
<!--
Uncomment the above section to explicitly set a [`> Changelog:` entry
here](https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md#submitting-a-patch)?
-->

Signed-off-by: Lukasz Dziedziak <[email protected]>
kumahq bot pushed a commit that referenced this issue Nov 27, 2024
@lukidzi @kumahq
test(e2e): disable meshmtls test with delegated gateway (#12108)
18c9414 
I noticed a flake and began investigating. I discovered the TLS version
and cipher are not configured for the delegated gateway. Since the
`MeshTLS` policy is a `from` policy and the delegated gateway has no
inbound listener, the policy cannot be matched to any listener. The test
passed because the request was sent before the configuration was fully
delivered.

Excluded the test and added `MustPassRepeatedly(5)` to ensure better
validation once the issue is resolved.

<!-- Is there a MADR? An Issue? A related PR? -->

xref: #12107

<!--
> Changelog: skip
-->
<!--
Uncomment the above section to explicitly set a [`> Changelog:` entry
here](https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md#submitting-a-patch)?
-->

Signed-off-by: Lukasz Dziedziak <[email protected]>
kumahq bot pushed a commit that referenced this issue Nov 27, 2024
@lukidzi @kumahq
test(e2e): disable meshmtls test with delegated gateway (#12108)
822c3c9 
I noticed a flake and began investigating. I discovered the TLS version
and cipher are not configured for the delegated gateway. Since the
`MeshTLS` policy is a `from` policy and the delegated gateway has no
inbound listener, the policy cannot be matched to any listener. The test
passed because the request was sent before the configuration was fully
delivered.

Excluded the test and added `MustPassRepeatedly(5)` to ensure better
validation once the issue is resolved.

<!-- Is there a MADR? An Issue? A related PR? -->

xref: #12107

<!--
> Changelog: skip
-->
<!--
Uncomment the above section to explicitly set a [`> Changelog:` entry
here](https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md#submitting-a-patch)?
-->

Signed-off-by: Lukasz Dziedziak <[email protected]>
@bartsmykla bartsmykla added triage/accepted The issue was reviewed and is complete enough to start working on it and removed triage/pending This issue will be looked at on the next triage meeting labels Dec 2, 2024
@lobkovilya lobkovilya mentioned this issue Dec 2, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/bug A bug triage/accepted The issue was reviewed and is complete enough to start working on it
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@bartsmykla @lukidzi