EK Istio mTLS STRICT

For https://repo1.dso.mil/platform-one/big-bang/bigbang/-/issues/1013

NOTE: Uses a podSelector rather than enforcing on the whole namespace since logging is a shared namespace.

added statusreview label

added 1 commit

• 7a0147d6 - adding peerauthentication

Compare with previous version

added 1 commit

• 9f642d22 - adding peerauthentication

Compare with previous version

added 1 commit

• 7046c1e2 - adding peerauthentication

Compare with previous version

Adding some more general things:

• We should have two separate peer auth files, completely separated by pod selector (i.e. one for elastic and one for kibana)
• Any exceptions to the STRICT mode should go inside of those same files as portLevelMtls sections
• All portLevelMtls exceptions should be wrapped in a conditional on mtls.mode set to STRICT rather than putting that conditional around the entire file

added statusdoing label and removed statusreview label

added disable-ci label

assigned to @micah.nagel

assigned to @ronwebb

added 2 commits

• e5e97f41 - mTLS updates
• 7b7470f9 - Merge branch 'mtest' into 'issue-1013-efk'

Compare with previous version

added 1 commit

• 709d0def - resolve values issues

Compare with previous version

resolved all threads

added 1 commit

• 87340393 - changelog and naming

Compare with previous version

changed title from Issue 1013 efk to EK Istio mTLS STRICT

changed the description

marked this merge request as draft

removed statusdoing label

added 1 commit

• b8cc2011 - add exception for 9300

Compare with previous version

added 1 commit

• b7d2bfc7 - comment documenting exclusion

Compare with previous version

added 1 commit

• 0366376f - add vs

Compare with previous version

added 1 commit

• f8303171 - weird

Compare with previous version

added 1 commit

• 41c10561 - update

Compare with previous version

marked this merge request as ready

removed disable-ci label

added 1 commit

• f4d094e7 - fix conditional

Compare with previous version

added 1 commit

• 9cd345e0 - fix oscal

Compare with previous version

Everything seemed to check out. Note that I put a conditional around the script test because BB CI will fail on it since the test pod is not istio injected. We could resolve that in the future with a change to gluon, but for now this was a simple hack to make it happy.

See BB MR with all 3 package changes: https://repo1.dso.mil/platform-one/big-bang/bigbang/-/merge_requests/1537

added statusreview label

approved this merge request

merged

mentioned in commit 171c30a4