Khombisa umongo we-TLS ophezulu we-Envoy kubhange le-CA elingaphakathi kwekhonteyina

Nge-TLS eqalwa yiqoqo le-forward-proxy eliguqukayo, lungiselela i-trusted_ca kulelo qoqo ngenkathi ugcina ukuqinisekiswa kwe-SAN kwendawo.

transport_socket:
  name: envoy.transport_sockets.tls
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
    common_tls_context:
      validation_context:
        trusted_ca:
          filename: /etc/envoy/trust/upstream-ca.pem

Hlanganisa lokhu nokulungiselelwa kweqoqo le-forward-proxy eliguqukayo. Indlela yebhange evunyelwe kufanele ifundeke yinhlangano ye-Envoy esebenzayo. Ku-Kubernetes, hlola ifayela elifakwe ngaphakathi kwekhonteyina; isitifiketi esifakwe kuphela kunodi yomsebenzi asikunikezi lokho.

Faka i-CA edingekayo ngenqubo yezinto zokuthembela zokusatshalaliswa, futhi qinisekisa ukuthi indawo ihlinzeka ngezitifiketi eziphakathi ezidingekayo. Sebenzisa izinguquko ngendlela ekhethiwe yokulungiselela noma yokubuyekeza izimfihlo.

Ukulungiselelwa kwe-TLS ye-forward-proxy eguqukayo okubhaliwe kunikeza ukuqinisekiswa kwe-SNI ne-SAN yegama lomsingathi womsingathi oxazululiwe. Gcina lokho kuhlola kobunikazi kanye nokuqinisekiswa kweketanga.

Isicelo se-wget esiphumelelayo singasebenzisa omunye umthombo wokuthembela. Lokhu okokufaka kuhlanganisa i-TLS evela ku-Envoy; kusidlulisi se-CONNECT esijwayelekile, uhlelo luhlala luyiklayenti le-TLS eliqinisekisa indawo.

Izihloko ezihlobene