Revision 1fae8644a50ce7fbcf603a6d5d82eca56050e906 authored by John Fastabend on 18 January 2019, 18:58:08 UTC, committed by Thomas Graf on 25 January 2019, 20:35:12 UTC
[ upstream commit a7beef597de252fdc008b3e34612410857c9c7dd ] Initially, we will support a pre-shared key model where all endpoints have a pre-shared keys loaded from a file. The file layout is as follows with a key per line. authname authkey encname enckey [scope] This allows keys to be scoped so that it is possible to have a key per node if desired. If scope is omitted the key is considered a default key used if a more specific key is not found. My three node testing file reads as follows, hmac(sha256) abcdefghijklmnopqrstuvwzyzABCDEF cbc(aes) abcdefghijklmnopqrstuvwzyzABCDEF ubuntu-kvm1 hmac(sha256) abcdefghijklmnopqrstuvwzyzABCDEF cbc(aes) abcdefghijklmnopqrstuvwzyzABCDEF ubuntu-kvm2 hmac(sha256) abcdefghijklmnopqrstuvwzyzABCDEF cbc(aes) abcdefghijklmnopqrstuvwzyzABCDEF The file is loaded at init time so any changes will have to be consumed by a restart. In the future we can add watchers for the file and allow using etcd secrets (files). Also note the logic is built so that other methods of key exchanges can be added later if folks want a different model. Looking forward we can more specific scope types to do per identity keys if needed. Signed-off-by: John Fastabend <john.fastabend@gmail.com>
1 parent 8cafbc6
.gitignore
# Compiled Object files, Static and Dynamic libs (Shared Objects)
*.o
*.a
*.so
# LLVM IR files
*.ll
*.ll-*
# Folders
_obj
_test
tests/cilium-files
test/test_results
_build/
# Architecture specific extensions/prefixes
*.cgo1.go
*.cgo2.c
_cgo_defun.c
_cgo_gotypes.go
_cgo_export.*
_testmain.go
*.exe
*.test
*.prof
*.swn
*.swp
.vagrant
vagrant.kubeconfig
coverage.out
coverage-all.out
coverage-all.html
.DS_Store
.idea/
*.plist
cilium/bash_autocomplete
*.swo
outgoing
*cscope.files
*cscope.out
*cscope.in.out
*cscope.po.out
*tags
man/
test/tmp.yaml
test/*_service_manifest.json
test/*_manifest.yaml
test/*_policy.json
test/*.xml
# Emacs backup files
*~
# Automatically generated when needed
.dockerignore
# Temporary files that allow build containers/VMs work without git
GIT_VERSION
test/bpf/_results
# generated from make targets
*.ok
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...