@@ -196,6 +196,21 @@ const (
196196
197197 // ActivatorSANKey is the config for the SAN used to validate the activator TLS certificate.
198198 ActivatorSANKey = "activator-san"
199+
200+ // ActivatorCertKey is the config for the secret name, which stores certificates
201+ // to serve the TLS traffic from ingress to activator.
202+ ActivatorCertKey = "activator-cert-secret"
203+
204+ // QueueProxyCAKey is the config for the secret name, which stores CA public certificate used
205+ // to sign the queue-proxy TLS certificate.
206+ QueueProxyCAKey = "queue-proxy-ca"
207+
208+ // QueueProxySANKey is the config for the SAN used to validate the queue-proxy TLS certificate.
209+ QueueProxySANKey = "queue-proxy-san"
210+
211+ // QueueProxyCertKey is the config for the secret name, which stores certificates
212+ // to serve the TLS traffic from activator to queue-proxy.
213+ QueueProxyCertKey = "queue-proxy-cert-secret"
199214)
200215
201216// DomainTemplateValues are the available properties people can choose from
@@ -302,6 +317,20 @@ type Config struct {
302317 // ActivatorSAN defines the SAN (Subject Alt Name) used to validate the activator TLS certificate.
303318 // It is used only when ActivatorCA is specified.
304319 ActivatorSAN string
320+
321+ // ActivatorCertSecret defines the secret name of the server certificates to serve the TLS traffic from ingress to activator.
322+ ActivatorCertSecret string
323+
324+ // QueueProxyCA defines the secret name of the CA public certificate used to sign the queue-proxy TLS certificate.
325+ // The traffic to queue-proxy is not encrypted if QueueProxyCA is empty.
326+ QueueProxyCA string
327+
328+ // QueueProxySAN defines the SAN (Subject Alt Name) used to validate the queue-proxy TLS certificate.
329+ // It is used only when QueueProxyCA is specified.
330+ QueueProxySAN string
331+
332+ // QueueProxyCertSecret defines the secret name of the server certificates to serve the TLS traffic from activator to queue-proxy.
333+ QueueProxyCertSecret string
305334}
306335
307336// HTTPProtocol indicates a type of HTTP endpoint behavior
@@ -359,6 +388,10 @@ func defaultConfig() *Config {
359388 MeshCompatibilityMode : MeshCompatibilityModeAuto ,
360389 ActivatorCA : "" ,
361390 ActivatorSAN : "" ,
391+ ActivatorCertSecret : "" ,
392+ QueueProxyCA : "" ,
393+ QueueProxySAN : "" ,
394+ QueueProxyCertSecret : "" ,
362395 }
363396}
364397
@@ -392,6 +425,10 @@ func NewConfigFromMap(data map[string]string) (*Config, error) {
392425 cm .AsString (DefaultExternalSchemeKey , & nc .DefaultExternalScheme ),
393426 cm .AsString (ActivatorCAKey , & nc .ActivatorCA ),
394427 cm .AsString (ActivatorSANKey , & nc .ActivatorSAN ),
428+ cm .AsString (ActivatorCertKey , & nc .ActivatorCertSecret ),
429+ cm .AsString (QueueProxyCAKey , & nc .QueueProxyCA ),
430+ cm .AsString (QueueProxySANKey , & nc .QueueProxySAN ),
431+ cm .AsString (QueueProxyCertKey , & nc .QueueProxyCertSecret ),
395432 asMode (MeshCompatibilityModeKey , & nc .MeshCompatibilityMode ),
396433 asLabelSelector (NamespaceWildcardCertSelectorKey , & nc .NamespaceWildcardCertSelector ),
397434 ); err != nil {
@@ -456,6 +493,14 @@ func NewConfigFromMap(data map[string]string) (*Config, error) {
456493 return nil , fmt .Errorf ("%q must be set when %q was set" , ActivatorCAKey , ActivatorSANKey )
457494 }
458495
496+ if nc .QueueProxyCA != "" && nc .QueueProxySAN == "" {
497+ return nil , fmt .Errorf ("%q must be set when %q was set" , QueueProxySANKey , QueueProxyCAKey )
498+ }
499+
500+ if nc .QueueProxyCA == "" && nc .QueueProxySAN != "" {
501+ return nil , fmt .Errorf ("%q must be set when %q was set" , QueueProxyCAKey , QueueProxySANKey )
502+ }
503+
459504 return nc , nil
460505}
461506
0 commit comments