Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[New Feature] Support for inline certificates and keys in Zenoh transport configuration. #575

Closed
gabrik opened this issue Oct 26, 2023 · 2 comments

Comments

@gabrik
Copy link
Contributor

gabrik commented Oct 26, 2023

Describe the feature

It would be good to have the possibility to include the certificate and key data inline in the Zenoh configuration.
This allows for "portable" configuration files as they will not have any dependency on external files.

Nowadays if we want to include information about TLS/mTLS certificates we need to include the path, thus both configuration file and certificate files need to be shipped to the application. This can also cause errors if the path does not match between the development machine and the deployment machine.

Thus to have the possibility to inline them, ideally using base64 encoding (similarly to what is done by Kubernetes in its configuration files.

An example configuration file will be:

{
    "connect": {
        "endpoints": [
            "tls/REDACTED.routers.REDACTED.zettascale.cloud:7447",
            "tls/REDACTED.routers.REDACTED.zettascale.cloud:7447"
        ]
    },
    "transport": {
        "link": {
            "tls": {
                "client_auth": true,
                "client_certificate_data": ["QkVHSU......"],
                "client_private_key_data": ["QkVHSA......"],
                "root_ca_certificate_data": ["QkVHSU......"],
                "server_name_verification": false
            }
        }
    }
}

I added them as string arrays because ideally, we could think to support multiple certificates/keys.

@gabrik
Copy link
Contributor Author

gabrik commented Oct 31, 2023

In order to keep track of the work needed:

To support this the TLS configuration schema has to be updated: zenoh-config/src/lib.rs

And then update the ConfigurationInspector of TLS (QUIC uses the same): here.

The assumption is that only the path or only the data can be present, thus when inspecting the configuration an error must be returned if both are present.

@gabrik
Copy link
Contributor Author

gabrik commented Nov 3, 2023

Solved by #577

@gabrik gabrik closed this as completed Nov 3, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant