Juya yanayin TLS na sama na Envoy zuwa ga tarin CA a cikin kwantena

transport_socket:
  name: envoy.transport_sockets.tls
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
    common_tls_context:
      validation_context:
        trusted_ca:
          filename: /etc/envoy/trust/upstream-ca.pem

Ka haɗa wannan da tsarin gungun wakili mai saurin wucewa. Dole hanyar tarin da aka amince da ita ta kasance mai iya karantawa ga tsarin Envoy da ke gudana. A cikin Kubernetes, duba fayil ɗin da aka ɗora a cikin kwantena; takardar shaidar da aka girka kawai a kan kumburin aiki ba ta samar da ita.

Ka haɗa CA da ake buƙata ta hanyar tsarin kayan amincewa na turawar, kuma ka tabbatar da cewa manufar tana samar da takaddun shaidar tsaka-tsaki da ake buƙata. Ka yi amfani da canje-canje ta hanyar tsarin da aka zaɓa na daidaitawa ko sabunta sirri.

Tsarin TLS na wakili mai saurin wucewa da aka rubuta yana samar da SNI da tabbatar da SAN na sunan mai masauki ga mai masaukin da aka warware. Ka riƙe wannan binciken ainihi tare da tabbatar da sarkar.

Buƙatar wget mai nasara na iya amfani da wata hanyar amincewa. Wannan shigar ya shafi TLS da ya fito daga Envoy; a cikin relay CONNECT na yau da kullum, aikace-aikacen ya kasance abokin ciniki na TLS da ke tabbatar da manufa.