feat: add support for certificate fetching and rotation via SDS server by zirain · Pull Request #8537 · envoyproxy/gateway

zirain · 2026-03-17T04:21:15Z

The idea is introduce a new API SDS in EnvoyProxy to define an external SDS server.

It could be a Service or Backend
Users could use kind: SDS incaCertificateRefs or clientCertificateRef, name will be used to fetch certificate from (external) SDS server.

netlify · 2026-03-17T04:21:21Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`5e3ea59`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69ba0cb115b89e000823ef93
😎 Deploy Preview	https://deploy-preview-8537--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

zirain · 2026-03-17T04:21:59Z

+	// such as the SPIRE or others.
+	//
+	// +optional
+	SDS *SDSProvider `json:"sds,omitempty"`


do we need to support multiple SDS here?

probably safer to do a list

In that case, we need to figure out how to reference to specific sds provider in clientCertificateRef:

caCertificateRefs: - name: ROOTCA kind: SDS

we probably need something like sds-provider-name://ROOTCA but which make thing more complex, becasue we use BackendObjectReference/BackendCluster to reference the backend, there's no provider name.

we rely on parentRef like semantics

AFAIT, CACertificateRefs uses gwapiv1.SecretObjectReference or gwapiv1.LocalObjectReference.

Sorry, I missed the context. I’d like to better understand the reasoning behind this. Is the concern that introducing additional custom resources could impact reconciliation performance?

IMO, a CRD provides a better user experience, as it more closely aligns with Gateway API semantics. Using an implicit kind/name could be surprising to users, as it diverges from the behavior defined in the Gateway API specification.

Regarding the secret-based option mentioned yesterday, I meant that we can still use a secret reference (just like today), but when the secret has a custom type like gateway.envoyproxy.io/sds-ref, we expect certain keys to exist in that secret that provide the necessary metadata, e.g. sds url and sds secret name.

apiVersion: v1 kind: Secret metadata: name: sds-secret-sample type: gateway.envoyproxy.io/sds-ref data: url: /var/run/sds secretName: my-tls-secret

This secret may contain additional things like authorization for sds server access.

this sounds goos to me without introuduce any new API.
The only thing is that it's more like a hook instead of a new API.

+1 to trying out @guy's suggestion, we can make this experimental
this avoids the need for an SDSProvider in the EnvoyProxy and instead requires an opt in flag like SupportSDSSecret in the EnvoyGateway API

+1
This approach is more structured than a flat url while also avoids introducing an additional EG API.

codecov · 2026-03-17T06:58:15Z

Codecov Report

❌ Patch coverage is 72.83951% with 44 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.19%. Comparing base (cc23457) to head (5e3ea59).
⚠️ Report is 121 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/provider/kubernetes/controller.go	17.64%	26 Missing and 2 partials ⚠️
internal/gatewayapi/backendtlspolicy.go	82.45%	8 Missing and 2 partials ⚠️
internal/gatewayapi/listener.go	92.85%	2 Missing ⚠️
internal/xds/translator/sds.go	93.10%	1 Missing and 1 partial ⚠️
internal/xds/translator/translator.go	85.71%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8537      +/-   ##
==========================================
+ Coverage   74.10%   74.19%   +0.08%     
==========================================
  Files         242      243       +1     
  Lines       37638    37727      +89     
==========================================
+ Hits        27893    27991      +98     
+ Misses       7790     7782       -8     
+ Partials     1955     1954       -1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: zirain <zirain2009@gmail.com>

arkodg · 2026-03-19T06:06:32Z

+// such as the SPIRE or others.
+type SDSProvider struct {
+	// BackendObjectReference references a Kubernetes object that represents the backend.
+	gwapiv1.BackendObjectReference `json:",inline"`


shouldnt this be

gateway/api/v1alpha1/shared_types.go

Line 600 in ffceb4f

type BackendCluster struct {

?

this related to #8537 (comment)

arkodg · 2026-03-19T06:07:58Z

 	// Name of the Secret object.
-	Name string `json:"name" yaml:"name"`
+	Name    string `json:"name" yaml:"name"`
+	FromSDS *bool  `json:"fromSDS,omitempty" yaml:"fromSDS,omitempty"`


does this need to be a named sds string ?

I have no strong option about use a SDSName instead of the combination of FromSDS+Name.

arkodg · 2026-03-19T06:11:39Z

+	// such as the SPIRE or others.
+	//
+	// +optional
+	SDS *SDSProvider `json:"sds,omitempty"`


also needs smething like https://gateway-api.sigs.k8s.io/reference/1.5/spec/#allowedroutes to allow which namespaces and BTLSP can reference it

Under what conditions, we need to limit a BTLSP reference to SDS provider.

we dont want an unknown app to reference an sds secret unless allowed by the platform team

this could be done in the next iterater or later.
Let's focus on #8537 (comment) first, do we really need mutiple SDS providers, and how will the API looks like.

cnvergence · 2026-03-19T15:18:03Z

+// such as the SPIRE or others.
+type SDSProvider struct {
+	// BackendObjectReference references a Kubernetes object that represents the backend.
+	gwapiv1.BackendObjectReference `json:",inline"`


should we validate if it is a Service or Backend?

we should, let's make an agreement about should this be multiple or not first.

zirain commented Mar 17, 2026

View reviewed changes

zirain force-pushed the sds branch from 98b1426 to 355467f Compare March 17, 2026 06:48

zirain added 6 commits March 18, 2026 10:23

api

ff56929

Signed-off-by: zirain <zirain2009@gmail.com>

process backend

60325a5

Signed-off-by: zirain <zirain2009@gmail.com>

fix

9335fa3

Signed-off-by: zirain <zirain2009@gmail.com>

fix and add tests

e561923

Signed-off-by: zirain <zirain2009@gmail.com>

fix test

856b536

Signed-off-by: zirain <zirain2009@gmail.com>

fix

5e3ea59

Signed-off-by: zirain <zirain2009@gmail.com>

zirain force-pushed the sds branch from a10e428 to 5e3ea59 Compare March 18, 2026 02:23

zirain marked this pull request as ready for review March 18, 2026 02:23

zirain requested a review from a team as a code owner March 18, 2026 02:23

zirain added this to the v1.8.0-rc.1 Release milestone Mar 19, 2026

arkodg reviewed Mar 19, 2026

View reviewed changes

cnvergence reviewed Mar 19, 2026

View reviewed changes

zirain mentioned this pull request Apr 14, 2026

feat: add support for certificate fetching via SDS ref secret #8745

Open

zirain marked this pull request as draft April 14, 2026 09:34

zirain closed this Apr 16, 2026

Conversation

zirain commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

guydc Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zirain Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

zirain commented Mar 17, 2026 •

edited

Loading

netlify bot commented Mar 17, 2026 •

edited

Loading

guydc Apr 10, 2026 •

edited

Loading

zirain Apr 11, 2026 •

edited

Loading

codecov bot commented Mar 17, 2026 •

edited

Loading