GoogleCloudPlatform / GoogleCloudPlatform/kubernetes-engine-samples

whereami: add support for secure gRPC port using ENV variables

Open
#471 1 comment 0 reactions 1 assignee Claimed by @theemadnes View on GitHub
priority: p3 type: feature request
Dominant language
HCL
Stars
1.4k
Forks
1.3k
Avg merge
2d 2h
Merged PRs (30d)
4

Description

Whereami currently supports gRPC with grpc.health.v1.Health checks but only using [insecure non-tls port](https://github.com/GoogleCloudPlatform/kubernetes-engine-samples/blob/ca509d13fa747b639e3d745dc9bfd82bc0b9e64f/whereami/app.py#L147).

Google Cloud Load Balancers require end-to-end encryption so it can use [ALPN](https://en.wikipedia.org/wiki/Application-Layer_Protocol_Negotiation) to upgrade backend connections to HTTP/2. It would be useful if whereami could support [secure port gRPC](https://github.com/joekottke/python-grpc-ssl/blob/master/src/server.py#L88-L99) instead of insecure using environment variables that indicate which certificate and key should be used by the gRPC server. We can then use cert-manager or [SPIFFE+CSI](https://cert-manager.io/docs/projects/csi-driver-spiffe/) to inject the certificates into the pod.

I discussed this briefly with @theemadnes and he requested this issue be assigned to him.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.