3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-04 01:09:36 +02:00
Code Issues Projects Releases Packages Wiki Activity

mTLS: allow gRPC TLS for all in one (#3854)

Browse source 
* make grpc_insecure an optional bool

* use internal addresses for all in one databroker and tls
This commit is contained in:
Denis Mishin 2023-01-03 12:45:04 -05:00 • committed by GitHub
parent 618b821783
commit e019885218
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 26 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

25
config/envoyconfig/clusters.go
View file

@ -25,10 +25,10 @@ import (
// BuildClusters builds envoy clusters from the given config.
func (b *Builder) BuildClusters(ctx context.Context, cfg *config.Config) ([]*envoy_config_cluster_v3.Cluster, error) {
grpcURL := &url.URL{
grpcURLs := []*url.URL{{
Scheme: "http",
Host: b.localGRPCAddress,
}
}}
httpURL := &url.URL{
Scheme: "http",
Host: b.localHTTPAddress,
@ -37,16 +37,21 @@ func (b *Builder) BuildClusters(ctx context.Context, cfg *config.Config) ([]*env
Scheme: "http",
Host: b.localMetricsAddress,
}
authorizeURLs, err := cfg.Options.GetInternalAuthorizeURLs()
if err != nil {
return nil, err
}
databrokerURLs, err := cfg.Options.GetDataBrokerURLs()
if err != nil {
return nil, err
authorizeURLs, databrokerURLs := grpcURLs, grpcURLs
if !config.IsAll(cfg.Options.Services) {
var err error
authorizeURLs, err = cfg.Options.GetInternalAuthorizeURLs()
if err != nil {
return nil, err
}
databrokerURLs, err = cfg.Options.GetDataBrokerURLs()
if err != nil {
return nil, err
}
}
controlGRPC, err := b.buildInternalCluster(ctx, cfg.Options, "pomerium-control-plane-grpc", []*url.URL{grpcURL}, upstreamProtocolHTTP2)
controlGRPC, err := b.buildInternalCluster(ctx, cfg.Options, "pomerium-control-plane-grpc", grpcURLs, upstreamProtocolHTTP2)
if err != nil {
return nil, err
}