feat: wire internal gRPC TLS#540
Open
niconosenzo wants to merge 1 commit into
Open
Conversation
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
niconosenzo
force-pushed
the
wire-grpc-mtls
branch
from
July 9, 2026 15:51
018dde6 to
ea28906
Compare
This comment has been minimized.
This comment has been minimized.
niconosenzo
force-pushed
the
wire-grpc-mtls
branch
from
July 10, 2026 10:07
ea28906 to
820b2fd
Compare
This comment has been minimized.
This comment has been minimized.
niconosenzo
marked this pull request as ready for review
July 10, 2026 10:15
Verolop
reviewed
Jul 10, 2026
Verolop
left a comment
Verolop
left a comment
Contributor
There was a problem hiding this comment.
left a couple of comments for minor naming & cleanup.
The main part looks great to me 🚀
This comment has been minimized.
This comment has been minimized.
niconosenzo
force-pushed
the
wire-grpc-mtls
branch
from
July 13, 2026 10:21
1a052be to
a3276d6
Compare
This comment has been minimized.
This comment has been minimized.
niconosenzo
marked this pull request as draft
July 13, 2026 14:35
niconosenzo
force-pushed
the
wire-grpc-mtls
branch
from
July 13, 2026 15:12
a3276d6 to
ce89fb8
Compare
This comment has been minimized.
This comment has been minimized.
niconosenzo
marked this pull request as ready for review
July 14, 2026 10:28
niconosenzo
force-pushed
the
wire-grpc-mtls
branch
2 times, most recently
from
July 15, 2026 13:29
71b41ff to
e00016a
Compare
This comment has been minimized.
This comment has been minimized.
niconosenzo
force-pushed
the
wire-grpc-mtls
branch
from
July 15, 2026 13:38
e00016a to
bff23a2
Compare
This comment has been minimized.
This comment has been minimized.
niconosenzo
force-pushed
the
wire-grpc-mtls
branch
from
July 15, 2026 13:49
bff23a2 to
ed4929e
Compare
This comment has been minimized.
This comment has been minimized.
niconosenzo
force-pushed
the
wire-grpc-mtls
branch
from
July 17, 2026 16:26
ed4929e to
c66181e
Compare
Issue component-scoped server/client certificates and configure multiadmin, multigateway, multiorch, and multipooler to authenticate internal gRPC connections. Use <component>.<cluster>.<namespace>.multigres.internal identities so internal trust does not depend on customer DNS. Preserve public gateway SANs on Multigateway, project TLS Secrets with modes compatible with non-root workloads, and keep stale certificate cleanup retryable. Signed-off-by: Nicolas Nosenzo <niconosenzo@gmail.com>
niconosenzo
force-pushed
the
wire-grpc-mtls
branch
from
July 17, 2026 16:26
c66181e to
c734c29
Compare
This comment has been minimized.
This comment has been minimized.
🔬 Go Test Coverage ReportSummary
Status✅ PASS DetailShow New Coverage |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Wire internal gRPC TLS/mTLS through the operator, completing the operator-side of the mTLS support added in multigres/multigres#826.
Issue component-scoped server/client certificates and configure multiadmin, multigateway, multiorch, and multipooler to authenticate internal gRPC connections.
Use
<component>.<cluster>.<namespace>.multigres.internalidentities so internal trust does not depend on customer DNS. Preserve public gateway SANs on Multigateway, project TLS Secrets with modes compatible with non-root workloads, and keep stale certificate cleanup retryable.Internal traffic policy:
All TLS wiring is gated on certCommonName being set, clusters without it are unaffected.