envoyproxy/envoy

Config validation without secret validation

Open

#9809 aperta il 23 gen 2020

Vedi su GitHub
 (5 commenti) (0 reazioni) (0 assegnatari)C++ (5373 fork)batch import
area/configurationhelp wanted

Metriche repository

Star
 (27.997 star)
Metriche merge PR
 (Merge medio 8g) (378 PR mergiate in 30 g)

Descrizione

Currently when running Envoy with --mode validate it will attempt to load and validate the contents of the secrets referenced by the config. While this might be useful when the config is validated in the context in which Envoy will ultimately run, it makes setting up config validation as part of a CI pipeline tricky due to having to generate various test secrets.

A mode that validates that the config is correct (i.e. passes pgv validation) without relying on the state of the file system would simply this process and make it possible to do lightweight config validations.

I imagine this would require stubbing out a lot of the TLS classes that are used during validation for ones that won't actually try to read any of the file content.

Guida contributor