MeshTrust
This resource is experimental. It works only on Kubernetes and requires MeshServices to be enabled.
The MeshTrust resource enables mesh applications to accept encrypted traffic from different trust domains. It allows users to provide a certificate that will be used to validate incoming traffic.
Use cases:
- Deploying a gateway without requiring a sidecar
- Accepting mTLS traffic from applications running outside of the mesh
When using SPIRE as the identity provider, MeshTrust does not work because SPIRE is responsible for providing the trust.
Autogenerated MeshTrust
MeshIdentity by default triggers the automatic creation of a MeshTrust resource based on its definition. Such resources can be identified by checking the origin field in the specification.
spec:
...
origin:
kri: kri_mid_default_default_kuma-system_my-identity_
Multizone
By design, each zone has a different trust domain to increase security (unless explicitly configured otherwise). In this case, cross-zone traffic does not work out of the box and requires a manual step. To enable cross-zone traffic, the user must manually copy the MeshTrust between zones.
Examples
Allow encrypted traffic from different trust domain to the Mesh
apiVersion: kuma.io/v1alpha1
kind: MeshTrust
metadata:
name: zone-2-trust
namespace: kuma-system
labels:
kuma.io/origin: zone
kuma.io/zone: zone-1
kuma.io/mesh: default
spec:
caBundles:
- type: Pem
pem:
value: |-
-----BEGIN CERTIFICATE-----
MIIDdjCCAl6gAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwRDELMAkGA1UEBhMCR0Ix
EDAOBgNVBAgMB0VuZ2xhbmQxEjAQBgNVBAoMCUFsaWNlIEx0ZDEPMA0GA1UEAwwG
S3VtYUNBMB4XDTIxMDUxMjEzMzU1MVoXDTMxMDUxMDEzMzU1MVowUDELMAkGA1UE
BhMCR0IxEDAOBgNVBAgMB0VuZ2xhbmQxEjAQBgNVBAoMCUFsaWNlIEx0ZDEbMBkG
A1UEAwwSS3VtYUludGVybWVkaWF0ZUNBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEA1VzY9vOr8+SINzqA8Rwk4bpeex32Zn9BGAUTweRgomQC7Yfzrm6/
Vk74/T/46n3FydpdEZTdoFKCF8EsA0eqAEfWi6tu7D41GOUFUYpdRJBJEq+HE17Q
N8SFMquy8NhCtK8th8ytSu2ThvCOq1MHT5WjtQUmRGSJMlcfWA5TsCIK0Sb3cSf3
jadjEqcmcvJN6Xa0Y0VivcPg5eB+We7BNnp4ogqmZw0veoPjc14HVZpqxrra9Yez
DRai6rnHqDjnkMMhe9MmSkCKD9Ldwduq0ZfuOQFIBOaX+4MKUyDN4tTMCcRRl/Nl
A4JgrNNWCFfUQV0VmQ0Tc8+cn/+gokHAZwIDAQABo2YwZDAdBgNVHQ4EFgQUGNjz
Te727HX4AqZDMn1L9XzkTaYwHwYDVR0jBBgwFoAUSu2E4Ue5aPzdWQCCNp36Pf3i
YbcwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcN
AQELBQADggEBACuOczJlf4wcT9rfAIrZHuI5aCzYTKOxJllhN5e/eEhMYpsox6Zb
4CZXS3wdJ3fVugddLWDzIAjrNE1DrOpugUPurNIpHsT6u+SHFXkRsXyHFfMA+CZJ
0tOYEtP1r3BnqsY/nh0GJqHJxaJolEaqFaKgKTQPTinOxTKFxsHa1OHlsvkdxvot
d2BQhPQYWes3LMPxtGhS5kwKaXaB3gzTnzjGvgGNeJ+l0AiWqXkivixpox3/6mMa
90mwssl4sRQQLR1kLFU4hwghNm52Pk7o7HSTEXsnB+ZhHB9skpetY6R4uKWh8xap
Xmj4PDrAA5OKZzSO7Yhdt0vXPOIrjShMxvA=
-----END CERTIFICATE-----
trustDomain: test.zone-2.mesh.local