mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-11-10 10:13:50 +08:00
haiyanmeng
45f1270f92
It Watches `ate-system/egress-mitm-ca-pool`, unmarshals it with `localca.Unmarshal`, and server-side-applies a ClusterTrustBundle whose `spec.trustBundle` is the PEM concatenation of every CA's RootCertificate.Raw, in pool order, and nothing else. A part of #823 Context: https://github.com/agent-substrate/substrate/issues/932 plans to add a clusterTrustBundle data source to SystemInfo volumes (https://github.com/agent-substrate/substrate/issues/802) that projects the trust anchors of a named [ClusterTrustBundle](https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/#cluster-trust-bundles) (certificates.k8s.io/v1beta1) to a PEM file in the volume, the substrate analog of the [Kubernetes clusterTrustBundle projected volume source] (https://kubernetes.io/docs/concepts/storage/projected-volumes/#clustertrustbundle). After both #823 and https://github.com/agent-substrate/substrate/issues/932 land, Substrate users will be responsible for wiring the provided ClusterTrustBundle for `ate-egress-trust` into its trust store. > It's a good idea to open an issue first for discussion. - [x] Tests pass - [x] Appropriate changes to documentation are included in the PR