Comments (4)
I think this article can help (I'm trying to get it working) :
https://www.redhat.com/en/blog/grpc-or-http/2-ingress-connectivity-in-openshift
from chainloop.
Thanks @hanygirgis for the pointer.
It seems that with H/A proxy we'll have the problem we had with AWS ALB or Google Load Balancer, basically for the gRPC endpoint, we are going to need http2 and TLS termination in the pod.
TLS encryption is doable today in the control-plane and CAS pods, you can provide them using these options in the Helm Chart
chainloop/deployment/chainloop/values.yaml
Lines 112 to 115 in 4801f98
This will run the gRPC servers with tls enabled, next, I'd set the cert in the route and enable re-encryption
from chainloop.
and secured routes https://docs.openshift.com/container-platform/4.8/networking/routes/secured-routes.html#nw-ingress-creating-a-passthrough-route_secured-routes
from chainloop.
We do support the three kinds of routes, edges
, reencrypt
and passthrough
The latter two can be enabled with a combination of a) setting server certs for CAS and Controlplane
cas:
tlsConfig:
secret:
name: custom-cert
controlplane:
tlsConfig:
secret:
name: custom-cert
****
and b) adding custom CAs for CP -> CAS communication.
auth:
oidc:
customCAs:
- |-
-----BEGIN CERTIFICATE-----
both of those can be performed via the Helm Chart values.yaml file.
For passthrough, the CLI now supports receiving a custom CA as well to verify the self-signed cert loaded in the pods #1017
from chainloop.
Related Issues (20)
- Add material name validation when attesting
- Support remote policies HOT 3
- bug: the latest version of the chart doesn't render
- add basic helm template sanitize and output in CI HOT 1
- Move attastation package to pkg
- Add indexes to workflows and workflow runs HOT 3
- Make 'chainloop workflow create --name build --project xy --team abc' idempotent HOT 7
- improve how we show validation errors HOT 3
- chainloop '1.86.14' is failing to deploy
- Parameterizable policies
- Show policy violations in att push output HOT 1
- policies: add tests for `ref` parsing
- policies: verify remote policies exist during contract crafting
- policies: improve error response
- policies: detect duplicated attachments and evaluations
- policies: reset evaluation if same material is re-added to the attestation
- Policies: store attachment arguments in evaluations
- Render helm template in CI
- contract format persistence and server-side validations
- policies: store full policy in evaluations
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from chainloop.