envoyproxy/envoy

Config validation without secret validation

Open

#9 809 ouverte le 23 janv. 2020

Voir sur GitHub
 (5 commentaires) (0 réactions) (0 assignés)C++ (5 373 forks)batch import
area/configurationhelp wanted

Métriques du dépôt

Stars
 (27 997 stars)
Métriques de merge PR
 (Merge moyen 8j) (378 PRs mergées en 30 j)

Description

Currently when running Envoy with --mode validate it will attempt to load and validate the contents of the secrets referenced by the config. While this might be useful when the config is validated in the context in which Envoy will ultimately run, it makes setting up config validation as part of a CI pipeline tricky due to having to generate various test secrets.

A mode that validates that the config is correct (i.e. passes pgv validation) without relying on the state of the file system would simply this process and make it possible to do lightweight config validations.

I imagine this would require stubbing out a lot of the TLS classes that are used during validation for ones that won't actually try to read any of the file content.

Guide contributeur