{"action":"created","issue":{"url":"https://api.github.com/repos/envoyproxy/envoy/issues/4763","repository_url":"https://api.github.com/repos/envoyproxy/envoy","labels_url":"https://api.github.com/repos/envoyproxy/envoy/issues/4763/labels{/name}","comments_url":"https://api.github.com/repos/envoyproxy/envoy/issues/4763/comments","events_url":"https://api.github.com/repos/envoyproxy/envoy/issues/4763/events","html_url":"https://github.com/envoyproxy/envoy/issues/4763","id":371206684,"node_id":"MDU6SXNzdWUzNzEyMDY2ODQ=","number":4763,"title":"SDS feature request:  only fetch trusted CA from SDS for CertificateValidationContext","user":{"login":"qiwzhang","id":11790727,"node_id":"MDQ6VXNlcjExNzkwNzI3","avatar_url":"https://avatars0.githubusercontent.com/u/11790727?v=4","gravatar_id":"","url":"https://api.github.com/users/qiwzhang","html_url":"https://github.com/qiwzhang","followers_url":"https://api.github.com/users/qiwzhang/followers","following_url":"https://api.github.com/users/qiwzhang/following{/other_user}","gists_url":"https://api.github.com/users/qiwzhang/gists{/gist_id}","starred_url":"https://api.github.com/users/qiwzhang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qiwzhang/subscriptions","organizations_url":"https://api.github.com/users/qiwzhang/orgs","repos_url":"https://api.github.com/users/qiwzhang/repos","events_url":"https://api.github.com/users/qiwzhang/events{/privacy}","received_events_url":"https://api.github.com/users/qiwzhang/received_events","type":"User","site_admin":false},"labels":[{"id":421403909,"node_id":"MDU6TGFiZWw0MjE0MDM5MDk=","url":"https://api.github.com/repos/envoyproxy/envoy/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":{"login":"qiwzhang","id":11790727,"node_id":"MDQ6VXNlcjExNzkwNzI3","avatar_url":"https://avatars0.githubusercontent.com/u/11790727?v=4","gravatar_id":"","url":"https://api.github.com/users/qiwzhang","html_url":"https://github.com/qiwzhang","followers_url":"https://api.github.com/users/qiwzhang/followers","following_url":"https://api.github.com/users/qiwzhang/following{/other_user}","gists_url":"https://api.github.com/users/qiwzhang/gists{/gist_id}","starred_url":"https://api.github.com/users/qiwzhang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qiwzhang/subscriptions","organizations_url":"https://api.github.com/users/qiwzhang/orgs","repos_url":"https://api.github.com/users/qiwzhang/repos","events_url":"https://api.github.com/users/qiwzhang/events{/privacy}","received_events_url":"https://api.github.com/users/qiwzhang/received_events","type":"User","site_admin":false},"assignees":[{"login":"qiwzhang","id":11790727,"node_id":"MDQ6VXNlcjExNzkwNzI3","avatar_url":"https://avatars0.githubusercontent.com/u/11790727?v=4","gravatar_id":"","url":"https://api.github.com/users/qiwzhang","html_url":"https://github.com/qiwzhang","followers_url":"https://api.github.com/users/qiwzhang/followers","following_url":"https://api.github.com/users/qiwzhang/following{/other_user}","gists_url":"https://api.github.com/users/qiwzhang/gists{/gist_id}","starred_url":"https://api.github.com/users/qiwzhang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qiwzhang/subscriptions","organizations_url":"https://api.github.com/users/qiwzhang/orgs","repos_url":"https://api.github.com/users/qiwzhang/repos","events_url":"https://api.github.com/users/qiwzhang/events{/privacy}","received_events_url":"https://api.github.com/users/qiwzhang/received_events","type":"User","site_admin":false}],"milestone":null,"comments":10,"created_at":"2018-10-17T18:20:25Z","updated_at":"2018-10-28T23:47:24Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"*Title*: only fetch trusted CA from SDS for CertificateValidationContext\r\n\r\n*Description*:\r\nIstio likes to use SDS to send trusted CA for CertificateValidationContext.  But its SDS server doesn't have info for other fields, such as verify_subject_alt_name.  The discovery server has the info for \"verify_subject_alt_name\".\r\n\r\nLike to change SDS that:\r\n* Only trusted CA can be fetched from SDS,  the other fields of CertificateValidationContext can be specified in LDS/CDS from discovery server.\r\n* Keep the current SDS of fetching whole CertificateValidationContext from SDS server.\r\n\r\n\r\nProposed Config change PR is:  https://github.com/envoyproxy/envoy/pull/4730\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/envoyproxy/envoy/issues/comments/433753870","html_url":"https://github.com/envoyproxy/envoy/issues/4763#issuecomment-433753870","issue_url":"https://api.github.com/repos/envoyproxy/envoy/issues/4763","id":433753870,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMzc1Mzg3MA==","user":{"login":"JimmyCYJ","id":28548492,"node_id":"MDQ6VXNlcjI4NTQ4NDky","avatar_url":"https://avatars0.githubusercontent.com/u/28548492?v=4","gravatar_id":"","url":"https://api.github.com/users/JimmyCYJ","html_url":"https://github.com/JimmyCYJ","followers_url":"https://api.github.com/users/JimmyCYJ/followers","following_url":"https://api.github.com/users/JimmyCYJ/following{/other_user}","gists_url":"https://api.github.com/users/JimmyCYJ/gists{/gist_id}","starred_url":"https://api.github.com/users/JimmyCYJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JimmyCYJ/subscriptions","organizations_url":"https://api.github.com/users/JimmyCYJ/orgs","repos_url":"https://api.github.com/users/JimmyCYJ/repos","events_url":"https://api.github.com/users/JimmyCYJ/events{/privacy}","received_events_url":"https://api.github.com/users/JimmyCYJ/received_events","type":"User","site_admin":false},"created_at":"2018-10-28T23:47:24Z","updated_at":"2018-10-28T23:47:24Z","author_association":"CONTRIBUTOR","body":"> IIRC, having pilot delivering secure naming mapping is an interim solution when we didn't have SDS, and citadel is only issuing certificates to ConfigMap. Do we have am issue tracking this at Istio side?\r\n\r\n@myidpt @wattli may have more context about this."}}
{"actor":{"display_login":"JimmyCYJ"}}