ateapi: require an egress gateway address - #1717
haiyanmeng wants to merge 1 commit into
Conversation
--egress-gateway-address defaulted to empty, and empty meant ateapi sent no EgressGateway to atelet. An actor started that way installs no nftables redirect and leaves on the masquerade path, so it never reaches the PEP and its EgressPolicy is silently unenforced. A cluster could land there by omitting one flag, with nothing in the logs to say policy had stopped applying. Refuse to start when the flag is empty. Every in-tree deployment already sets it, so this only closes the misconfiguration. The downstream handling of an absent gateway is left in place: this makes the untunneled path unreachable by configuration, not impossible to express on the atelet and ateom APIs.
| postgresSchema = pflag.String("postgres-schema", "public", "PostgreSQL schema for Substrate tables. This overrides a search_path connection parameter.") | ||
|
|
||
| actorIDJWTPoolFile = pflag.String("actor-id-jwt-pool", "", "The file that contains the serialized JWT authority pool for signing actor JWTs") | ||
| egressGatewayAddress = pflag.String("egress-gateway-address", "", "Address of the egress PEP. Empty disables tunneled egress.") |
There was a problem hiding this comment.
#1689 would have it say empty means there's no egress support, so you have ingress only. That seems reasonable for some use cases.
There was a problem hiding this comment.
In the long term, we plan to support per-Actor egress gateway configuration #1591.
|
We cross references this with the issue around the removal of this flag. I think this is a temporary thing and if we can't get to this before v1, we should prefix it with "experimental-" or something similar to mark it as headed for removal. |
In the long term, we plan to support per-Actor egress gateway configuration #1591. If #1591 cannot be done for the GA timeline, we definitely should prefix it with "experimental-" or something similar to mark it as headed for removal. |
|
Bowei Du (@bowei) , it may still be valuable to have this PR merged considering it may take time to get #1591 done. Let me know if you prefer converting this to a draft or closing it. |
3 participants
--egress-gateway-addressofate-api-serverdefaulted to empty, and empty meant ateapi sent no EgressGateway to atelet. An actor started that way installs no nftables redirect and leaves on the masquerade path, so it never reaches the PEP and its EgressPolicy is silently unenforced. A cluster could land there by omitting one flag, with nothing in the logs to say policy had stopped applying.Refuse to start when the flag is empty. Every in-tree deployment already sets it, so this only closes the misconfiguration.
The downstream handling of an absent gateway is left in place: this makes the untunneled path unreachable by configuration, not impossible to express on the atelet and ateom APIs.