{"push_id":2730291975,"size":1,"distinct_size":1,"ref":"refs/heads/master","head":"30a48a7d8bef578cb2bc3bfafcdc71c82302bdba","before":"f208acb3a5f7d6dd86e361ec0e5222a4a035f9ed","commits":[{"sha":"30a48a7d8bef578cb2bc3bfafcdc71c82302bdba","author":{"name":"Eliza Weisman","email":"f43a79dfd42415a8656f99967c2caaf66ded84db@buoyant.io"},"message":"Accept TLS connnections even when TLS configuration isn't available (#22)\n\nCloses linkerd/linkerd2#1272.\r\n\r\nCurrently, if TLS is enabled but the TLS configuration isn't available\r\n(yet), the proxy will pass through all traffic to the application.\r\nHowever, the destination service will tell other proxies to send TLS\r\ntraffic to the pod unconditionally, so the proxy will pass through TLS\r\nhandshakes to the application that are destined for the proxy itself.\r\n\r\nIn linkerd/linkerd2#1272, @briansmith suggested that we change the \r\nproxy so that when it hasn't yet loaded a TLS configuration, it will\r\naccept TLS handshakes, but fail them. This branch implements that \r\nbehaviour by making the `rustls::sign::CertifiedKey` in `CertResolver`\r\noptional, and changing the `CertResolver` to return `None` when \r\n`rustls` asks it to resolve a certificate in that case. The server\r\nconfig watch is now initially created with `Conditional::Some` with an\r\nempty `CertResolver`, rather than `Conditional::None(NoConfig)`, so\r\nthat the proxy will accept incoming handshakes, but fail them.\r\n\r\nSigned-off-by: Eliza Weisman <eliza@buoyant.io","distinct":true,"url":"https://api.github.com/repos/linkerd/linkerd2-proxy/commits/30a48a7d8bef578cb2bc3bfafcdc71c82302bdba"}]}
{"actor":{"display_login":"hawkw"}}