tls: enable enforce_rsa_key_usage by default#43433
Conversation
Signed-off-by: tyxia <tyxia@google.com>
Signed-off-by: tyxia <tyxia@google.com>
Signed-off-by: tyxia <tyxia@google.com>
|
/retest |
|
CC @envoyproxy/api-shepherds: Your approval is needed for changes made to |
| max_session_keys_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, max_session_keys, 1)) { | ||
|
|
||
| if (!config.has_enforce_rsa_key_usage()) { | ||
| ENVOY_LOG( |
There was a problem hiding this comment.
Maybe we shouldn't warn in this case, and just rely on the release note. With this warning, there's no way to launch envoy without some warning logged: either this message if it's unset, a log of using a deprecated feature if it is set and is true, and a log of using a deprecated feature and the below log message if its set and false. If we remove this case and only warn for !enforce_rsa_key_usage_ then people who are using the new behavior don't get a warning, which seems fine.
There was a problem hiding this comment.
Make sense. Thanks for suggestions!
4 participants
Commit Message:
Additional Description:
Risk Level:
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]