mirror of https://github.com/linkerd/linkerd2.git
c9c41e2e8a
### Summary As an initial attempt to secure the connection from clients to the gRPC tap server on the tap Pod, the tap `addr` only listened on localhost. As @adleong pointed out #3257, this was not actually secure because the inbound proxy would establish a connection to localhost anyways. This change removes the gRPC tap server listener and changes `TapByResource` requests to interface with the server object directly. From this, we know that all `TapByResourceRequests` have gone through the tap APIServer and thus authorized by RBAC. ### Details [NewAPIServer]( |
||
|---|---|---|
| .. | ||
| destination | ||
| heartbeat | ||
| identity | ||
| proxy-injector | ||
| public-api | ||
| sp-validator | ||
| tap | ||