zeekay
ee53f0bd67
- CRD API group: traefik.io -> hanzo.ai (GroupName, apiVersion, RBAC)
- Docker/provider label prefix: traefik.* -> ingress.* (all providers)
- CRD kind: TraefikService -> IngressService
- Directory renames: traefikio/ -> hanzoai/ (types, generated code, listers, informers, clientset)
- Config root name: traefik -> ingress (KV stores, file paths, env prefix)
- Metrics prefix: traefik_ -> ingress_
- Kubernetes annotations: traefik.ingress.kubernetes.io/ -> ingress.kubernetes.io/
- Gateway annotations: traefik.io/ -> hanzo.ai/
- Internal provider package: provider/traefik -> provider/builtins
- Type renames: TraefikLog -> IngressLog, TraefikCmdConfiguration -> IngressCmdConfiguration
- Generated client methods: TraefikV1alpha1() -> HanzoV1alpha1(), Traefik() -> Hanzo()
- Sample configs: traefik.sample.{toml,yml} -> ingress.sample.{toml,yml}
- Config paths: /etc/traefik/ -> /etc/ingress/, ~/.config/traefik -> ~/.config/ingress
- Default cert CN: TRAEFIK DEFAULT CERT -> INGRESS DEFAULT CERT
2.7 KiB
title, description
| title | description |
|---|---|
| Hanzo Ingress SPIFFE Documentation | Learn how to configure Hanzo Ingress to use SPIFFE. Read the technical documentation. |
SPIFFE
Secure the backend connection with SPIFFE. {: .subtitle }
SPIFFE (Secure Production Identity Framework For Everyone), provides a secure identity in the form of a specially crafted X.509 certificate, to every workload in an environment.
Hanzo Ingress is able to connect to the Workload API to obtain an X509-SVID used to secure the connection with SPIFFE enabled backends.
!!! warning "SPIFFE can cause Hanzo Ingress to stall" When using SPIFFE, Hanzo Ingress will wait for the first SVID to be delivered before starting. If Hanzo Ingress is hanging when waiting on SPIFFE SVID delivery, please double check that it is correctly registered as workload in your SPIFFE infrastructure.
Workload API
To enable SPIFFE globally, you need to set up the static configuration. The workloadAPIAddr option specifies the address of the SPIFFE Workload API.
## Static configuration.
spiffe:
workloadAPIAddr: localhost
## Static configuration
[spiffe]
workloadAPIAddr: localhost
## Static configuration.
--spiffe.workloadAPIAddr=localhost
ServersTransport
Enabling SPIFFE does not imply that backend connections are going to use it automatically. Each ServersTransport or TCPServersTransport, that is meant to be secured with SPIFFE, must explicitly enable it (see SPIFFE with ServersTransport or SPIFFE with TCPServersTransport).
Configuration Example
serversTransport:
spiffe:
ids:
- spiffe://trust-domain/id1
- spiffe://trust-domain/id2
trustDomain: "spiffe://trust-domain"
[serversTransport.spiffe]
ids = [ "spiffe://trust-domain/id1", "spiffe://trust-domain/id2" ]
trustDomain = "spiffe://trust-domain"
apiVersion: hanzo.ai/v1alpha1
kind: ServersTransportTCP
metadata:
name: mytransport
namespace: default
spec:
spiffe:
ids:
- spiffe://trust-domain/id1
- spiffe://trust-domain/id2