feat: pebble trust context spec - #16
Conversation
benhoyt
left a comment
benhoyt
left a comment
There was a problem hiding this comment.
Looks like a good start. I read this through today and left a few initial comments. Look forward to discussing next week.
| @@ -0,0 +1,806 @@ | |||
| # OP0X7 — TLS Trust Contexts | |||
There was a problem hiding this comment.
Also, let's allocate a spec number before merging.
| # OP0X7 — TLS Trust Contexts | |
| # OP0X7 — Pebble TLS Trust Contexts |
|
|
||
| ## Plan Configuration | ||
|
|
||
| A new top-level section `trust` is added to the Pebble plan. It follows |
There was a problem hiding this comment.
A singular name seems a bit wrong compared to the existing fields here: services, checks, log-targets (all plural). Then again, "trusts" seems funny too. "contexts" maybe?
We also have the hidden feature added by a downstream team called workloads: https://github.com/canonical/pebble/blob/b43995f1453397b006ac21ca3bf7938b93c7ca0d/internals/workloads/workloads.go#L29 -- it's service and exec context too ... I wonder if we could reuse or repurpose that?
- Rename top-level plan key `trust` to `trust-contexts` - Remove `type` field; introduce an `x509` sub-object containing `ca-cert` and `ca-cert-files` in place of the top-level field - Rename `tls-context` to `trust-context` on services, checks, and log-targets; remove the complex form with environment token injection and the `ca-pem-bundle-file` token mechanism entirely - Replace `inherit` chain and built-in `default` trust context with a flat `include-system: true | false` boolean; when no `trust-context` is set on a consumer, the OS system pool is used without injection - Require `ca-cert-files` entries to have permissions that are a subset of 0644; files with more permissive modes are dropped at runtime with a warning rather than causing a plan validation error
benhoyt
left a comment
benhoyt
left a comment
There was a problem hiding this comment.
Updates look good to me, thanks. Seems in a good shape to start the design review with Gustavo.
|
Any update on this? We still see errors in our COS products as a result of this. |
Hi @MichaelThamm. Harry's away this and next week, but is still working through getting the spec approved, and we still expect to have a solution this cycle. |
4 participants
This is a spec that seeks to address canonical/pebble#780 after some prototyping
of CA bundle reloading it was clear that this problem space is best solved through
extending the pebble plan.