feat(tlsbridge): config block + main wiring + trust self-check

Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/authlib/config/config.go

@@ -37,6 +37,33 @@ type Config struct {
 	// = today's spiffe-helper-driven behavior (until the chart/operator
 	// follow-ups land and start populating the block).
 	SPIFFE *SPIFFEConfig `yaml:"spiffe,omitempty" json:"spiffe,omitempty"`
+	// TLSBridge, when non-nil and Enabled, terminates agent outbound TLS so the
+	// outbound pipeline sees decrypted HTTPS. See docs/.../tlsbridge-design.md.
+	TLSBridge *TLSBridgeConfig `yaml:"tls_bridge,omitempty" json:"tls_bridge,omitempty"`
+}
+
+// TLSBridgeConfig configures the outbound TLS bridge (MITM termination of
+// agent egress so the outbound plugin pipeline sees decrypted HTTPS).
+type TLSBridgeConfig struct {
+	Enabled          bool     `yaml:"enabled" json:"enabled"`
+	Scope            string   `yaml:"scope" json:"scope"` // external | all
+	InternalCIDRs    []string `yaml:"internal_cidrs" json:"internal_cidrs"`
+	CASource         string   `yaml:"ca_source" json:"ca_source"` // file | ephemeral
+	CACertPath       string   `yaml:"ca_cert_path" json:"ca_cert_path"`
+	CAKeyPath        string   `yaml:"ca_key_path" json:"ca_key_path"`
+	UpstreamCABundle string   `yaml:"upstream_ca_bundle" json:"upstream_ca_bundle"`
+	SkipHosts        []string `yaml:"skip_hosts" json:"skip_hosts"`
+}
+
+// Validate is called from the loader when TLSBridge != nil.
+func (b *TLSBridgeConfig) Validate() error {
+	if b.Scope != "" && b.Scope != "external" && b.Scope != "all" {
+		return fmt.Errorf("tls_bridge.scope must be 'external' or 'all', got %q", b.Scope)
+	}
+	if b.CASource == "file" && (b.CACertPath == "" || b.CAKeyPath == "") {
+		return fmt.Errorf("tls_bridge.ca_source=file requires ca_cert_path and ca_key_path")
+	}
+	return nil
 }
 
 // MTLSMode names the inbound + outbound TLS posture. Vocabulary
@@ -461,5 +488,11 @@ func Load(path string) (*Config, error) {
 		return nil, err
 	}
 
+	if cfg.TLSBridge != nil {
+		if err := cfg.TLSBridge.Validate(); err != nil {
+			return nil, err
+		}
+	}
+
 	return &cfg, nil
 }

authbridge/authlib/config/config_test.go

@@ -727,6 +727,29 @@ spiffe: {}
 	}
 }
 
+// --- TLS bridge config ---
+
+// The tls_bridge block decodes into TLSBridgeConfig and Load surfaces it.
+func TestConfig_TLSBridgeBlockDecodes(t *testing.T) {
+	y := []byte("mode: proxy-sidecar\n" +
+		"tls_bridge:\n" +
+		"  enabled: true\n" +
+		"  scope: external\n" +
+		"  ca_source: ephemeral\n" +
+		"  skip_hosts: [\"pinned.example.com\"]\n")
+	p := filepath.Join(t.TempDir(), "cfg.yaml")
+	if err := os.WriteFile(p, y, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	cfg, err := Load(p)
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if cfg.TLSBridge == nil || !cfg.TLSBridge.Enabled || cfg.TLSBridge.Scope != "external" {
+		t.Fatalf("tls_bridge block did not decode: %+v", cfg.TLSBridge)
+	}
+}
+
 // Absent mtls block leaves cfg.MTLS nil — today's behavior, no TLS.
 func TestLoad_MTLS_AbsentBlock(t *testing.T) {
 	dir := t.TempDir()

authbridge/authlib/tlsbridge/engine.go

@@ -1,6 +1,11 @@
 package tlsbridge
 
-import "net/http"
+import (
+	"log/slog"
+	"net/http"
+	"os"
+	"strings"
+)
 
 // Engine bundles everything the forward proxy needs to bridge TLS.
 // A nil *Engine means the bridge is disabled.
@@ -11,3 +16,25 @@ type Engine struct {
 	Upstream *http.Client
 	CAPEM    []byte
 }
+
+// RunTrustSelfCheck logs a loud WARN when the bridge CA is not present in the
+// trust file the agent runtime is told to use (SSL_CERT_FILE / NODE_EXTRA_CA_CERTS
+// / REQUESTS_CA_BUNDLE). A trust-miss is then a visible signal, not an opaque
+// in-agent handshake error. Best-effort. In Phase 1 (test-only) no agent trust
+// env is set, so this simply notes that egress will safely tunnel.
+func RunTrustSelfCheck(caPEM []byte) {
+	want := strings.TrimSpace(string(caPEM))
+	for _, env := range []string{"SSL_CERT_FILE", "NODE_EXTRA_CA_CERTS", "REQUESTS_CA_BUNDLE"} {
+		p := os.Getenv(env)
+		if p == "" {
+			continue
+		}
+		if b, err := os.ReadFile(p); err == nil && strings.Contains(string(b), want) {
+			slog.Info("tls-bridge trust self-check OK", "env", env, "path", p)
+			return
+		}
+	}
+	slog.Warn("tls-bridge trust self-check: CA not found in any agent trust file " +
+		"(SSL_CERT_FILE/NODE_EXTRA_CA_CERTS/REQUESTS_CA_BUNDLE); agent will not trust " +
+		"minted leaves and egress will safely tunnel (expected in Phase 1 / test-only)")
+}

authbridge/cmd/authbridge-proxy/main.go

@@ -34,6 +34,7 @@ import (
 	"github.com/kagenti/kagenti-extensions/authbridge/authlib/shared"
 	"github.com/kagenti/kagenti-extensions/authbridge/authlib/spiffe"
 	authtls "github.com/kagenti/kagenti-extensions/authbridge/authlib/tls"
+	"github.com/kagenti/kagenti-extensions/authbridge/authlib/tlsbridge"
 
 	// Only HTTP listeners are compiled in: no extproc/extauthz
 	// (no gRPC, no envoy types).
@@ -247,6 +248,49 @@ func main() {
 		slog.Info("mTLS disabled (no mtls block in config)")
 	}
 
+	// TLS bridge: when enabled, the forward proxy terminates agent outbound
+	// TLS (MITM) so the outbound pipeline sees decrypted HTTPS. Constructed
+	// here and set on fpSrv below (mirroring fpSrv.SkipHosts / fpSrv.Shared).
+	// A nil *Engine leaves today's blind-tunnel behavior intact.
+	var bridge *tlsbridge.Engine
+	if cfg.TLSBridge != nil && cfg.TLSBridge.Enabled {
+		var src tlsbridge.CASource
+		if cfg.TLSBridge.CASource == "file" {
+			src, err = tlsbridge.NewFileSource(cfg.TLSBridge.CACertPath, cfg.TLSBridge.CAKeyPath)
+		} else {
+			src, err = tlsbridge.NewEphemeralSource()
+		}
+		if err != nil {
+			log.Fatalf("tls-bridge CA init failed: %v", err)
+		}
+		var extra []byte
+		if cfg.TLSBridge.UpstreamCABundle != "" {
+			if extra, err = os.ReadFile(cfg.TLSBridge.UpstreamCABundle); err != nil {
+				log.Fatalf("tls-bridge upstream_ca_bundle read failed: %v", err)
+			}
+		}
+		up, uerr := tlsbridge.NewUpstreamClient(extra)
+		if uerr != nil {
+			log.Fatalf("tls-bridge upstream client failed: %v", uerr)
+		}
+		minter := tlsbridge.NewMinter(src, tlsbridge.MinterOpts{})
+		scope := tlsbridge.ScopeExternal
+		if cfg.TLSBridge.Scope == "all" {
+			scope = tlsbridge.ScopeAll
+		}
+		bridge = &tlsbridge.Engine{
+			Decision: tlsbridge.NewDecision(tlsbridge.DecisionOpts{
+				Scope: scope, InternalCIDRs: cfg.TLSBridge.InternalCIDRs, SkipHosts: cfg.TLSBridge.SkipHosts,
+			}),
+			Term:     tlsbridge.NewTerminator(minter),
+			Skip:     tlsbridge.NewSkipSet(),
+			Upstream: up,
+			CAPEM:    src.CACertPEM(),
+		}
+		tlsbridge.RunTrustSelfCheck(bridge.CAPEM)
+		slog.Info("tls-bridge enabled", "scope", cfg.TLSBridge.Scope, "ca_source", cfg.TLSBridge.CASource)
+	}
+
 	// Proxy-sidecar: reverse proxy on the inbound path + forward proxy
 	// on the outbound path.
 	rpSrv, err := reverseproxy.NewServer(inboundH, sessions, cfg.Listener.ReverseProxyBackend, rpMTLS)
@@ -266,6 +310,7 @@ func main() {
 		log.Fatalf("listener.skip_hosts: %v", err)
 	}
 	fpSrv.SkipHosts = skipHosts
+	fpSrv.TLSBridge = bridge
 	sharedStore := shared.New()
 	defer sharedStore.Close() // stop the TTL janitor on normal main return
 	rpSrv.Shared = sharedStore