cvgw / k8s-dev-helm Goto Github PK

When a new instance of the envoy load-balancer is created it creates a new LB on the cloud provider. For AWS this means that a new LB with a different DNS name is created. This breaks the client side envoy config which hardcodes the LB DNS name and requires the client config to be updated.

When a new service is added to the cluster which should be exposed via the envoy LB a number of manual updates must occur

• Envoy config must add new listener and backend
• Envoy pod must expose new port for added listener
• Envoy service must add target for port added on Envoy pod
• Client side envoy must be updated with new listener and backend

To achieve mTLS x509 certs must be distributed to both the client and server side.
Currently this is achieved by creating a new root CA and then a signed cert to be used by both client and server.
This is a manual process which requires copying the generated cert from the server to the client.
This process should be automated for convenience, reliability, and security.

Requirements:

• public and private key signed by CA with available CA-cert
• public and private key retrievable by both client and server
• CA-cert retrievable by both client and server