Skip to content

Add filter chain matching and SNI-based TLS selection for server-side xDS #6837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jrhee17 merged 6 commits into from
Jul 6, 2026
Merged

Add filter chain matching and SNI-based TLS selection for server-side xDS #6837

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8d2c7b5
minimal impl
jrhee17 Jul 2, 2026
37fd9b6
ai comments
jrhee17 Jul 2, 2026
b76ab4a
ai comments
jrhee17 Jul 2, 2026
1deec8e
fix windows ci failure
jrhee17 Jul 2, 2026
33cf876
address comments by @ikhoon and @minwoox
jrhee17 Jul 6, 2026
f193fce
ai comment
jrhee17 Jul 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions it/xds-client/src/test/java/com/linecorp/armeria/xds/it/BootstrapSecretsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,13 +110,13 @@ class BootstrapSecretsTest {
- name: my-cert
tls_certificate:
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
- name: my-validation
validation_context:
trusted_ca:
filename: %s
filename: '%s'
""";

@Test
Expand Down
18 changes: 9 additions & 9 deletions ...ds-client/src/test/java/com/linecorp/armeria/xds/it/CertificateValidationContextTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,9 +116,9 @@ protected void configure(ServerBuilder sb) {
common_tls_context:
tls_certificates:
- private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
combined_validation_context:
default_validation_context: {}
validation_context_sds_secret_config:
Expand Down Expand Up @@ -159,7 +159,7 @@ void invalidCaCertificateFile(@TempDir File tempDir) throws Exception {
name: validation-certs
validation_context:
trusted_ca:
filename: %s
filename: '%s'
""".formatted(invalidCaFile.getAbsolutePath());
final Secret secret = XdsResourceReader.fromYaml(secretYaml, Secret.class);
version.incrementAndGet();
Expand Down Expand Up @@ -275,7 +275,7 @@ void multipleCaCertificates(@TempDir File tempDir) throws Exception {
name: validation-certs
validation_context:
trusted_ca:
filename: %s
filename: '%s'
""".formatted(multiCaFile.getAbsolutePath());
final Secret secret = XdsResourceReader.fromYaml(secretYaml, Secret.class);
version.incrementAndGet();
Expand Down Expand Up @@ -323,7 +323,7 @@ void validationContextWithSds(@TempDir File tempDir) throws Exception {
name: validation-certs
validation_context:
trusted_ca:
filename: %s
filename: '%s'
""".formatted(caFile.getAbsolutePath());
final Secret secret = XdsResourceReader.fromYaml(secretYaml, Secret.class);
version.incrementAndGet();
Expand Down Expand Up @@ -398,9 +398,9 @@ void validationContextWithSds(@TempDir File tempDir) throws Exception {
common_tls_context:
tls_certificates:
- private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
combined_validation_context:
default_validation_context:
match_subject_alt_names:
Expand Down Expand Up @@ -443,7 +443,7 @@ void mergeValidationContextWithBase(@TempDir File tempDir) throws Exception {
name: validation-certs
validation_context:
trusted_ca:
filename: %s
filename: '%s'
""".formatted(caFile.getAbsolutePath());
final Secret secret = XdsResourceReader.fromYaml(secretYaml, Secret.class);
version.incrementAndGet();
Expand Down Expand Up @@ -491,7 +491,7 @@ void overrideBaseContextFields(@TempDir File tempDir) throws Exception {
name: validation-certs
validation_context:
trusted_ca:
filename: %s
filename: '%s'
match_subject_alt_names:
- exact: "override.example.com"
""".formatted(caFile.getAbsolutePath());
Expand Down
14 changes: 7 additions & 7 deletions it/xds-client/src/test/java/com/linecorp/armeria/xds/it/ControlPlaneTlsIntegrationTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,7 +157,7 @@ void controlPlaneHttpsWithTrustedCaAndSanMatch() {
"""
validation_context:
trusted_ca:
filename: %s
filename: '%s'
match_typed_subject_alt_names:
- san_type: IP_ADDRESS
matcher:
Expand Down Expand Up @@ -192,7 +192,7 @@ void controlPlaneHttpsFailsWithSanMismatch() {
"""
validation_context:
trusted_ca:
filename: %s
filename: '%s'
match_typed_subject_alt_names:
- san_type: IP_ADDRESS
matcher:
Expand All @@ -219,7 +219,7 @@ void controlPlaneHttpsFailsWithBadSpkiPin() throws Exception {
"""
validation_context:
trusted_ca:
filename: %s
filename: '%s'
verify_certificate_spki:
- "%s"
match_typed_subject_alt_names:
Expand Down Expand Up @@ -247,7 +247,7 @@ void controlPlaneHttpsFailsWhenClientCertRequired() {
"""
validation_context:
trusted_ca:
filename: %s
filename: '%s'
match_typed_subject_alt_names:
- san_type: IP_ADDRESS
matcher:
Expand All @@ -273,12 +273,12 @@ void controlPlaneHttpsSucceedsWithClientCert() {
"""
tls_certificates:
- private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
validation_context:
trusted_ca:
filename: %s
filename: '%s'
match_typed_subject_alt_names:
- san_type: IP_ADDRESS
matcher:
Expand Down
4 changes: 2 additions & 2 deletions it/xds-client/src/test/java/com/linecorp/armeria/xds/it/DataSourcePolicyTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,9 +179,9 @@ private static Bootstrap bootstrapYaml(Path certsDir) {
common_tls_context:
tls_certificates:
- private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""".formatted(certsDir.resolve("private_key.pem"),
certsDir.resolve("certificate.pem"));
return XdsResourceReader.fromYaml(bootstrapStr, Bootstrap.class);
Expand Down
24 changes: 12 additions & 12 deletions it/xds-client/src/test/java/com/linecorp/armeria/xds/it/DataSourceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,9 +87,9 @@ void tlsCertificateWithPrivateKeyAndCertificateChain() throws Exception {
name: my-cert
tls_certificate:
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""".formatted(certificate1.privateKeyFile().toPath().toString(),
certificate1.certificateFile().toPath().toString());
final Secret secret = XdsResourceReader.fromYaml(tlsCertYaml, Secret.class);
Expand Down Expand Up @@ -205,9 +205,9 @@ void certificateFilesChanged(@TempDir File tempDir) throws Exception {
name: my-cert
tls_certificate:
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""".formatted(privateKeyFile.getAbsolutePath(),
certificateFile.getAbsolutePath());
final Secret secret = XdsResourceReader.fromYaml(tlsCertYaml, Secret.class);
Expand Down Expand Up @@ -344,9 +344,9 @@ void watchedDirectory(@TempDir File filesDir, @TempDir File watchDir) throws Exc
watched_directory:
path: %s
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""".formatted(watchDir.getAbsolutePath(),
privateKeyFile.getAbsolutePath(),
certificateFile.getAbsolutePath());
Expand Down Expand Up @@ -496,9 +496,9 @@ void missingFilesWithoutWatchedDirectory(@TempDir File tempDir) throws Exception
name: my-cert
tls_certificate:
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""".formatted(privateKeyFile.getAbsolutePath(),
certificateFile.getAbsolutePath());
final Secret secret = XdsResourceReader.fromYaml(tlsCertYaml, Secret.class);
Expand Down Expand Up @@ -615,9 +615,9 @@ void missingFilesWithWatchedDirectory(@TempDir File filesDir, @TempDir File watc
watched_directory:
path: %s
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""".formatted(watchDir.getAbsolutePath(),
privateKeyFile.getAbsolutePath(),
certificateFile.getAbsolutePath());
Expand Down Expand Up @@ -1054,9 +1054,9 @@ void symlinkRotation(@TempDir File tempDir) throws Exception {
watched_directory:
path: %s
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""".formatted(tempDir.getAbsolutePath(),
privateKeyFile.getAbsolutePath(),
certificateFile.getAbsolutePath());
Expand Down
16 changes: 8 additions & 8 deletions it/xds-client/src/test/java/com/linecorp/armeria/xds/it/DynamicSecretTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,17 +84,17 @@ protected void configure(ServerBuilder sb) {
name: my-cert
tls_certificate:
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""";
//language=YAML
private static final String validationContextYaml =
"""
name: my-validation
validation_context:
trusted_ca:
filename: %s
filename: '%s'
""";

// YAML
Expand Down Expand Up @@ -168,7 +168,7 @@ protected void configure(ServerBuilder sb) {
- name: my-validation
validation_context:
trusted_ca:
filename: %s
filename: '%s'
""";

@Test
Expand Down Expand Up @@ -285,7 +285,7 @@ void sdsSecretLoadedWithAds() throws Exception {
- name: my-validation
validation_context:
trusted_ca:
filename: %s
filename: '%s'
""";

@Test
Expand Down Expand Up @@ -504,7 +504,7 @@ void sdsValidationContextOnly() throws Exception {
name: my-cert-validation
validation_context:
trusted_ca:
filename: %s
filename: '%s'
""".formatted(certificate2.certificateFile().toPath().toString());
final Secret secret2 = XdsResourceReader.fromYaml(validationYaml, Secret.class);
version.incrementAndGet();
Expand Down Expand Up @@ -604,9 +604,9 @@ void sdsValidationContextOnly() throws Exception {
- name: my-cert
tls_certificate:
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""";

@Test
Expand Down
20 changes: 10 additions & 10 deletions it/xds-client/src/test/java/com/linecorp/armeria/xds/it/ErrorHandlingTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -701,9 +701,9 @@ void sdsInvalidCertificateFile(@TempDir File tempDir) throws Exception {
name: my-cert
tls_certificate:
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""".formatted(certificate.privateKeyFile().toPath().toString(),
invalidCertFile.getAbsolutePath());
final Secret secret = XdsResourceReader.fromYaml(secretYaml, Secret.class);
Expand Down Expand Up @@ -748,9 +748,9 @@ void sdsInvalidPrivateKeyFile(@TempDir File tempDir) throws Exception {
name: my-cert
tls_certificate:
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""".formatted(invalidKeyFile.getAbsolutePath(),
certificate.certificateFile().toPath().toString());
final Secret secret = XdsResourceReader.fromYaml(secretYaml, Secret.class);
Expand Down Expand Up @@ -794,9 +794,9 @@ void sdsMissingCertificateFile(@TempDir File tempDir) throws Exception {
name: my-cert
tls_certificate:
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""".formatted(certificate.privateKeyFile().toPath().toString(),
missingFile.getAbsolutePath());
final Secret secret = XdsResourceReader.fromYaml(secretYaml, Secret.class);
Expand Down Expand Up @@ -836,9 +836,9 @@ void sdsMissingSecretName() throws Exception {
name: wrong-cert-name
tls_certificate:
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""".formatted(certificate.privateKeyFile().toPath().toString(),
certificate.certificateFile().toPath().toString());
final Secret secret = XdsResourceReader.fromYaml(secretYaml, Secret.class);
Expand Down Expand Up @@ -872,9 +872,9 @@ void sdsMissingSecretName() throws Exception {
name: my-cert
tls_certificate:
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""".formatted(certificate.privateKeyFile().toPath().toString(),
certificate.certificateFile().toPath().toString());
final Secret correctSecret = XdsResourceReader.fromYaml(correctSecretYaml, Secret.class);
Expand Down
4 changes: 2 additions & 2 deletions it/xds-client/src/test/java/com/linecorp/armeria/xds/it/PipeEndpointTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -331,9 +331,9 @@ private static Secret tlsCertSecret(String name, XdsCertificateExtension cert) {
name: %s
tls_certificate:
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""".formatted(name,
cert.privateKeyFile().toPath().toString(),
cert.certificateFile().toPath().toString());
Expand Down
4 changes: 2 additions & 2 deletions it/xds-client/src/test/java/com/linecorp/armeria/xds/it/ResourceNodeMetricTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1032,9 +1032,9 @@ void listenerRootWithSdsSecretUpdate() throws Exception {
name: my-cert
tls_certificate:
private_key:
filename: %s
filename: '%s'
certificate_chain:
filename: %s
filename: '%s'
""";

//language=YAML
Expand Down
Loading
Loading