[code sync] Merge code from sonic-net/sonic-gnmi:master to kubesonic - #233
Merged
Lun Yue (lunyue-ms) merged 2 commits intoSep 14, 2026
Merged
Conversation
mssonicbld
commented
Sep 11, 2026
mssonicbld
commented
Collaborator
Why I did it The gNMI server supports an optional client-certificate mode for deployments that use password, JWT, certificate, or mixed application authentication. The current optional mode uses tls.RequestClientCert. This asks the client for a certificate but does not verify a certificate when one is supplied. It also prevents certificate-based application authentication from receiving the verified certificate chain it requires. The optional mode should continue allowing clients without certificates while verifying any certificate that a client chooses to provide. This change deliberately preserves the existing application-authentication policy. It does not require client certificates for password or JWT clients, reject configurations without application authentication, change listener binding, or modify the no-TLS behavior. How I did it Select tls.VerifyClientCertIfGiven when --allow_no_client_auth is enabled. Retain tls.RequireAndVerifyClientCert when optional mode is disabled. Update the flag description to state that a supplied certificate must be valid. Add TLS handshake coverage showing that: a client may omit its certificate; a trusted client certificate is accepted and verified; and an untrusted client certificate is rejected. Add compatibility coverage confirming that optional client certificates continue to support: no application authentication; password authentication; JWT authentication; and mixed certificate/password authentication.
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Collaborator
Author
|
/azp run |
|
Commenter does not have sufficient privileges for PR 233 in repo Azure/sonic-gnmi.msft |
mssonicbld
force-pushed
the
sonicbld/kubesonic-merge
branch
from
September 12, 2026 03:03
ff4f360 to
35a63e4
Compare
Collaborator
Author
|
/azp run |
|
Commenter does not have sufficient privileges for PR 233 in repo Azure/sonic-gnmi.msft |
mssonicbld
force-pushed
the
sonicbld/kubesonic-merge
branch
from
September 13, 2026 03:02
35a63e4 to
79faaae
Compare
Collaborator
Author
|
/azp run |
|
Commenter does not have sufficient privileges for PR 233 in repo Azure/sonic-gnmi.msft |
mssonicbld
force-pushed
the
sonicbld/kubesonic-merge
branch
from
September 14, 2026 03:03
79faaae to
3824836
Compare
Collaborator
Author
|
/azp run |
|
Commenter does not have sufficient privileges for PR 233 in repo Azure/sonic-gnmi.msft |
Lun Yue (lunyue-ms)
approved these changes
Sep 14, 2026
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.