feat(gateway): in-cluster Shared auth for third-party custom domains - #3948
feat(gateway): in-cluster Shared auth for third-party custom domains#3948oscdjj wants to merge 11 commits into
Conversation
Materialize exact FQDNs on Shared SRR, annotate owners, and index Application watches by third_party_domain for cert ConfigMap fan-out.
Admit exact custom FQDNs into tls-hosts when CustomDomainTLS Secrets exist, enforce exact-host owners, and requeue on Secret create/update/delete.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
When SRR hostPatterns mix logical and exact FQDNs, emit Host Exact matches alongside regex matches so dual-host Application routes remain reachable.
Only mark the CM cert cache loaded after a successful List so a transient error does not stick an empty cache for the rest of the reconcile.
Protect well-known custom/viewer TLS Secret names even when missing so optional mounts cannot race past admission. Refuse in-place Update of unmanaged olares-mesh-in-custom-tls Secrets so private keys are not written into pre-existing volumes.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 32682fe. Configure here.
| customTLSSyncTotal.WithLabelValues("unmanaged").Inc() | ||
| klog.Errorf("mesh-in-custom-tls: refuse overwrite unmanaged secret ns=%s name=%s", | ||
| hashCallerNS(callerNS), constants.MeshInCustomTLSSecretName) | ||
| return customTLSErr(callerNS, "refuse unmanaged", errUnmanagedCustomTLSReplica) |
There was a problem hiding this comment.
Unmanaged sync double-counts metrics
Low Severity
The unmanaged-secret path increments olares_mesh_in_custom_tls_sync_total with unmanaged and then calls customTLSErr, which increments the same counter with error and logs again. One refuse event is counted twice and operators summing by result overstate failures.
Reviewed by Cursor Bugbot for commit 32682fe. Configure here.
1 participant
Summary
Enable in-cluster Shared access via Eligible third-party custom domains (same auth as platform hosts).
third_party_domain+ per-ownerthird_levelexact hosts; owners annotationthird_party_domainNote
High Risk
Touches gateway routing, TLS private-key replication, admission webhooks, and mesh-in SNI behavior—security-sensitive paths where misconfiguration could leak certs or break in-cluster access.
Overview
Adds Eligible third-party custom domains to in-cluster Shared gateway routing: SRRs gain exact
third_party_domainand per-userthird_levelhost patterns plus agateway.olares.io/exact-host-ownersannotation so mesh-in can scope hosts per viewer without broadcasting logical wildcards.The shared-route producer now gates hosts via cert/CNAME/DNS checks (optional ConfigMap cert materializer), indexes Applications by
third_party_domain, and re-reconciles when labeled custom-domain-cert ConfigMaps change.HTTPRoutes with both logical and exact patterns get separate Host Exact matches so dual-host SRRs remain reachable. CoreDNS (sys-event) rewrites eligible exact FQDNs in-cluster.
Mesh-in projects
custom-tls-hosts.txt, syncs per-callerolares-mesh-in-custom-tlsfrom gateway CustomDomainTLS Secrets (only after materialization for tls-hosts), and fail-closed SNI (custom cert or reject—never the viewer platform cert). Pod admission extends the TLS replica mount guard to custom aggregate secrets. Webhook injects the custom certs volume on mesh-in pods.Also bumps
beclab/sys-eventto 0.2.27.Reviewed by Cursor Bugbot for commit 32682fe. Bugbot is set up for automated code reviews on this repo. Configure here.