feat: add support for certificate fetching via SDS ref secret by zirain · Pull Request #8745 · envoyproxy/gateway

zirain · 2026-04-14T08:28:45Z

suppress #8537

Original idea from @guydc

Regarding the secret-based option mentioned yesterday, I meant that we can still use a secret reference (just like today), but when the secret has a custom type like gateway.envoyproxy.io/sds-ref, we expect certain keys to exist in that secret that provide the necessary metadata, e.g. sds url and sds secret name.

apiVersion: v1
kind: Secret
metadata:
  name: sds-secret-sample
type: gateway.envoyproxy.io/sds-ref
data:
  url: /var/run/sds
  secretName: my-tls-secret

This secret may contain additional things like authorization for sds server access.

netlify · 2026-04-14T08:28:52Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`0efb282`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69e8cb7552eb260008593aa9
😎 Deploy Preview	https://deploy-preview-8745--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5ac7d7798e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

codecov · 2026-04-14T08:39:36Z

Codecov Report

❌ Patch coverage is 69.23077% with 84 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.63%. Comparing base (f33ec41) to head (0efb282).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/xds/translator/translator.go	50.98%	18 Missing and 7 partials ⚠️
internal/xds/translator/sds.go	82.60%	14 Missing and 6 partials ⚠️
internal/xds/translator/listener.go	50.00%	14 Missing and 4 partials ⚠️
internal/gatewayapi/backendtlspolicy.go	73.07%	11 Missing and 3 partials ⚠️
internal/ir/xds.go	57.14%	4 Missing and 2 partials ⚠️
internal/gatewayapi/runner/runner.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8745      +/-   ##
==========================================
- Coverage   73.64%   73.63%   -0.02%     
==========================================
  Files         245      246       +1     
  Lines       48864    49076     +212     
==========================================
+ Hits        35985    36135     +150     
- Misses      10874    10919      +45     
- Partials     2005     2022      +17

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

owenhaynes · 2026-04-16T09:31:24Z

I am looking forward to this. I like the use of no new K8s types. I guess going to have to use some extra tooling so that the secrets can be in all namespaces that BackendTLSPolicy are defined due not being able to use cross reference, which is not a big issue

zirain · 2026-04-16T09:37:13Z

I am looking forward to this. I like the use of no new K8s types. I guess going to have to use some extra tooling so that the secrets can be in all namespaces that BackendTLSPolicy are defined due not being able to use cross reference, which is not a big issue

BackendTLSPolicy use LocalObjectReference, which make it unable to cross namespace reference.
Worth to raise this up on upstream.

arkodg · 2026-04-18T16:55:49Z

 const (
+	// SDSSecretType is the type for secrets that reference SDS configuration
+	SDSSecretType = "gateway.envoyproxy.io/sds-ref"
+


can we make this opt in at EnvoyGateway or EnvoyProxy level ?
cc @guydc

add EnableSDSSecretRef in EnvoyGateway.

arkodg · 2026-04-18T18:21:23Z

+    type: gateway.envoyproxy.io/sds-ref
+    data:
+      url: L3Zhci9ydW4vc2VjcmV0cy93b3JrbG9hZC1zcGlmZmUtdWRzL3NvY2tldA==  # /var/run/secrets/workload-spiffe-uds/socket
+      secretName: Uk9PVENB  # ROOTCA


non blocking: prefer just name
cc @guydc

I'd to reserve the name for sds provider name in the future, secretName sounds good to me for now.

Using Name for the provider feels a bit ambiguous, and the naming patterns between the two are not consistent.

name: `foo provider` secretName: `foo secret` url: xxxxx

How about

provider: `foo provider` secret: `foo secret` url: xxxxx

Or

providerName: `foo provider` secretName: `foo secret` url: xxxxx

?

I prefer the former one for simplicity.

secretName sgtm

zhaohuabing · 2026-04-20T04:41:52Z

 	// If set to true, the Lua EnvoyExtensionPolicy feature will be disabled.
 	DisableLua bool `json:"disableLua"`
+	// EnableSDSSecretRef enables read SDS(Secret Discovery Service) settings from a secret(with type gateway.envoyproxy.io/sds-ref).
+	EnableSDSSecretRef bool `json:"enableSDSSecretRef"`


I think we are gating the broader "fetching certificates from third-party SDS" feature, not just the specific "SDS secret type"?

It might makes sense to use a more general name like EnableThirdPartySDS here.

cc @arkodg

arkodg

LGTM thanks

guydc

LGTM!

…ecret Signed-off-by: zirain <zirain2009@gmail.com>

Signed-off-by: zirain <zirain2009@gmail.com>

…roxy#8745) * feat: add support for certificate fetching and rotation via SDS ref secret Signed-off-by: zirain <zirain2009@gmail.com> * fix Signed-off-by: zirain <zirain2009@gmail.com> * fix review comments Signed-off-by: zirain <zirain2009@gmail.com> * fix lint Signed-off-by: zirain <zirain2009@gmail.com> * add EnableSDSSecretRef in EnvoyGateway Signed-off-by: zirain <zirain2009@gmail.com> * fix gen Signed-off-by: zirain <zirain2009@gmail.com> * rename Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Jake Oliver <jake@truelayer.com>

owenhaynes · 2026-06-04T08:44:32Z

As there are no docs for this I am trying to understand from the testdata what spire-uds backend is used for as see no backendRefs which link to it.

Is this just a unnecessary resource currently or will be used later?

zirain requested a review from a team as a code owner April 14, 2026 08:28

zirain force-pushed the sds-ref branch from acfe23c to 5ac7d77 Compare April 14, 2026 08:29

chatgpt-codex-connector Bot reviewed Apr 14, 2026

View reviewed changes

Comment thread internal/xds/translator/listener.go

Comment thread internal/gatewayapi/backendtlspolicy.go Outdated

zirain force-pushed the sds-ref branch from 5ac7d77 to 5c67cda Compare April 14, 2026 09:03

zirain added this to the v1.8.0-rc.1 Release milestone Apr 16, 2026

guydc reviewed Apr 17, 2026

View reviewed changes

Comment thread internal/gatewayapi/backendtlspolicy.go Outdated

Comment thread internal/gatewayapi/backendtlspolicy.go Outdated

Comment thread internal/xds/translator/sds.go Outdated

arkodg reviewed Apr 18, 2026

View reviewed changes

zhaohuabing reviewed Apr 20, 2026

View reviewed changes

Comment thread api/v1alpha1/shared_types.go Outdated

arkodg approved these changes Apr 22, 2026

View reviewed changes

zirain requested review from guydc and zhaohuabing April 22, 2026 09:12

guydc approved these changes Apr 22, 2026

View reviewed changes

zirain added 7 commits April 22, 2026 21:21

feat: add support for certificate fetching and rotation via SDS ref s…

d9d3c8d

…ecret Signed-off-by: zirain <zirain2009@gmail.com>

fix

da6a10a

Signed-off-by: zirain <zirain2009@gmail.com>

fix review comments

7cec151

Signed-off-by: zirain <zirain2009@gmail.com>

fix lint

e2a2589

Signed-off-by: zirain <zirain2009@gmail.com>

add EnableSDSSecretRef in EnvoyGateway

5fcaeaf

Signed-off-by: zirain <zirain2009@gmail.com>

fix gen

3ba98d9

Signed-off-by: zirain <zirain2009@gmail.com>

rename

0efb282

Signed-off-by: zirain <zirain2009@gmail.com>

zirain force-pushed the sds-ref branch from 352c946 to 0efb282 Compare April 22, 2026 13:21

cnvergence approved these changes Apr 22, 2026

View reviewed changes

zirain merged commit 30fa914 into envoyproxy:main Apr 22, 2026
62 of 64 checks passed

zirain deleted the sds-ref branch April 22, 2026 22:57

zirain mentioned this pull request Apr 24, 2026

SDS ref follow-ups #8839

Open

2 tasks

guydc mentioned this pull request May 1, 2026

Session resumption shared key #8462

Open

d-xo mentioned this pull request May 5, 2026

Allow gateway.envoyproxy.io/sds secrets in listener tls.certificateRefs #8915

Open

This was referenced May 6, 2026

feat: add sds allowedNamespaces in EnvoyProxy #8917

Closed

Feat: Native support for certificate fetching and rotation via SDS server #6366

Closed

zirain mentioned this pull request Jul 6, 2026

Allow TLS listeners to reference certificates by name without requiring a Kubernetes Secret #9421

Open

Uh oh!

Conversation

zirain commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

owenhaynes commented Apr 16, 2026

Uh oh!

zirain commented Apr 16, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arkodg Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

zirain Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

arkodg Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zirain Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arkodg Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

arkodg left a comment

Choose a reason for hiding this comment

Uh oh!

guydc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

owenhaynes commented Jun 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

zirain commented Apr 14, 2026 •

edited

Loading

netlify Bot commented Apr 14, 2026 •

edited

Loading

codecov Bot commented Apr 14, 2026 •

edited

Loading

arkodg Apr 18, 2026 •

edited

Loading

zhaohuabing Apr 20, 2026 •

edited

Loading

zhaohuabing Apr 20, 2026 •

edited

Loading