mirror of https://github.com/linkerd/linkerd2.git
8d9cfbf670
### Summary In order for Pods' tap servers to start authorizing tap clients, the tap server must be able to check client names against the expected tap service name. This change injects the `LINKERD2_PROXY_TAP_SVC_NAME` into proxy PodSpecs. ### Details The tap servers on the individual resources being tapped should be able to verify that the client is the tap service. The `LINKERD2_PROXY_TAP_SVC_NAME` is now injected as an environment variable in the proxies so that it can check this value against the client name of the TLS connection. Currently, this environment will go unused. There is an open PR (linkerd2-proxy#290) to use this variable in the proxy, but this is *not* dependent on that merging first. Note: The variable is not injected if tap is disabled. ### Testing Test output has been updated with the newly injected environment variable. Signed-off-by: Kevin Leimkuhler <kleimkuhler@icloud.com> |
||
|---|---|---|
| .. | ||
| injected_nginx.stderr | ||
| injected_nginx.stderr.verbose | ||
| injected_nginx.yaml | ||
| injected_nginx_redis.stderr | ||
| injected_nginx_redis.stderr.verbose | ||
| injected_nginx_redis.yaml | ||
| injected_redis.stderr | ||
| injected_redis.stderr.verbose | ||
| injected_redis.yaml | ||