GoogleCloudPlatform / GoogleCloudPlatform/kubernetes-engine-samples
whereami: add support for secure gRPC port using ENV variables
- Dominant language
- HCL
- Stars
- 1.4k
- Forks
- 1.3k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 4
Description
Whereami currently supports gRPC with grpc.health.v1.Health checks but only using [insecure non-tls port](https://github.com/GoogleCloudPlatform/kubernetes-engine-samples/blob/ca509d13fa747b639e3d745dc9bfd82bc0b9e64f/whereami/app.py#L147).
Google Cloud Load Balancers require end-to-end encryption so it can use [ALPN](https://en.wikipedia.org/wiki/Application-Layer_Protocol_Negotiation) to upgrade backend connections to HTTP/2. It would be useful if whereami could support [secure port gRPC](https://github.com/joekottke/python-grpc-ssl/blob/master/src/server.py#L88-L99) instead of insecure using environment variables that indicate which certificate and key should be used by the gRPC server. We can then use cert-manager or [SPIFFE+CSI](https://cert-manager.io/docs/projects/csi-driver-spiffe/) to inject the certificates into the pod.
I discussed this briefly with @theemadnes and he requested this issue be assigned to him.
Contributor guide
Assessment
This issue has not been assessed yet.