refactor(tlsbridge): consolidate config schema before release

The tls_bridge schema is new/unreleased — tighten it now, before the operator
renders it and an alpha pins it:

- Collapse enabled+scope -> mode: disabled|enabled (matches operator
  tlsBridgeMode 1:1). Drop the external/all distinction and the whole
  Scope/isInternal/internal_cidrs machinery in Decision — the bridge
  intercepts everything eligible on the configured ports, period. Classify
  loses its now-unused ip param.
- Drop ca_source + ca_cert_path + ca_key_path -> single ca_dir (cert-manager
  Secret key conventions tls.crt/tls.key/ca.crt). ephemeral was never usable
  in production (a real agent can't trust an unexported in-memory CA); it
  survives only as NewEphemeralSource for in-process tests, not a config knob.
  Production CA is always the operator-mounted file.
- Rename skip_hosts -> passthrough_hosts to disambiguate from the existing
  listener.skip_hosts (full pipeline bypass vs bridge tunnel).

Net: 6 fields -> mode + ca_dir + passthrough_hosts (+ existing ports,
upstream_ca_bundle). No migration — nothing consumes the schema yet.

Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/authlib/config/config.go

@@ -5,7 +5,6 @@ package config
 import (
 	"encoding/json"
 	"fmt"
-	"net"
 	"os"
 	"strings"
 
@@ -47,14 +46,21 @@ type Config struct {
 // agent egress — formerly "MITM" — so the outbound plugin pipeline sees
 // decrypted HTTPS).
 type TLSBridgeConfig struct {
-	Enabled          bool     `yaml:"enabled" json:"enabled"`
-	Scope            string   `yaml:"scope" json:"scope"` // external | all
-	InternalCIDRs    []string `yaml:"internal_cidrs" json:"internal_cidrs"`
-	CASource         string   `yaml:"ca_source" json:"ca_source"` // file | ephemeral
-	CACertPath       string   `yaml:"ca_cert_path" json:"ca_cert_path"`
-	CAKeyPath        string   `yaml:"ca_key_path" json:"ca_key_path"`
-	UpstreamCABundle string   `yaml:"upstream_ca_bundle" json:"upstream_ca_bundle"`
-	SkipHosts        []string `yaml:"skip_hosts" json:"skip_hosts"`
+	// Mode is the bridge posture: "disabled" (off) or "enabled" (intercept all
+	// eligible egress on the configured Ports). Empty == disabled.
+	Mode string `yaml:"mode" json:"mode"` // disabled | enabled
+	// CADir holds the per-agent signing CA, mounted from the operator's
+	// cert-manager Secret. The bridge reads tls.crt + tls.key (to sign leaves);
+	// ca.crt is the trust cert handed to the agent. cert-manager Secret key
+	// conventions, so only the directory is configured.
+	CADir string `yaml:"ca_dir" json:"ca_dir"`
+	// UpstreamCABundle is an extra-roots PEM file for re-origination (private-CA
+	// origins the agent trusts); empty == system roots only.
+	UpstreamCABundle string `yaml:"upstream_ca_bundle" json:"upstream_ca_bundle"`
+	// PassthroughHosts are hosts to tunnel (never intercept). Distinct from
+	// listener.skip_hosts, which bypasses the whole pipeline; these still run the
+	// egress gate, they just aren't TLS-terminated.
+	PassthroughHosts []string `yaml:"passthrough_hosts" json:"passthrough_hosts"`
 	// Ports is the set of TCP ports to intercept as TLS. Empty => {443, 8443}.
 	// Only HTTP(S)-bearing ports belong here: the bridge serves the decrypted
 	// stream as HTTP/1.1 or h2, so terminating a non-HTTP TLS protocol (LDAPS,
@@ -64,19 +70,11 @@ type TLSBridgeConfig struct {
 
 // Validate is called from the loader when TLSBridge != nil.
 func (b *TLSBridgeConfig) Validate() error {
-	if b.Scope != "" && b.Scope != "external" && b.Scope != "all" {
-		return fmt.Errorf("tls_bridge.scope must be 'external' or 'all', got %q", b.Scope)
+	if b.Mode != "" && b.Mode != "disabled" && b.Mode != "enabled" {
+		return fmt.Errorf("tls_bridge.mode must be 'disabled' or 'enabled', got %q", b.Mode)
 	}
-	if b.CASource != "" && b.CASource != "file" && b.CASource != "ephemeral" {
-		return fmt.Errorf("tls_bridge.ca_source must be 'file' or 'ephemeral', got %q", b.CASource)
-	}
-	if b.CASource == "file" && (b.CACertPath == "" || b.CAKeyPath == "") {
-		return fmt.Errorf("tls_bridge.ca_source=file requires ca_cert_path and ca_key_path")
-	}
-	for _, c := range b.InternalCIDRs {
-		if _, _, err := net.ParseCIDR(c); err != nil {
-			return fmt.Errorf("tls_bridge.internal_cidrs: %q is not a valid CIDR: %w", c, err)
-		}
+	if b.Mode == "enabled" && b.CADir == "" {
+		return fmt.Errorf("tls_bridge.mode=enabled requires ca_dir")
 	}
 	for _, p := range b.Ports {
 		if p < 1 || p > 65535 {

authbridge/authlib/config/config_test.go

@@ -733,10 +733,10 @@ spiffe: {}
 func TestConfig_TLSBridgeBlockDecodes(t *testing.T) {
 	y := []byte("mode: proxy-sidecar\n" +
 		"tls_bridge:\n" +
-		"  enabled: true\n" +
-		"  scope: external\n" +
-		"  ca_source: ephemeral\n" +
-		"  skip_hosts: [\"pinned.example.com\"]\n")
+		"  mode: enabled\n" +
+		"  ca_dir: /etc/authbridge/tls-bridge-ca\n" +
+		"  passthrough_hosts: [\"pinned.example.com\"]\n" +
+		"  ports: [443, 9443]\n")
 	p := filepath.Join(t.TempDir(), "cfg.yaml")
 	if err := os.WriteFile(p, y, 0o600); err != nil {
 		t.Fatal(err)
@@ -745,9 +745,12 @@ func TestConfig_TLSBridgeBlockDecodes(t *testing.T) {
 	if err != nil {
 		t.Fatalf("load: %v", err)
 	}
-	if cfg.TLSBridge == nil || !cfg.TLSBridge.Enabled || cfg.TLSBridge.Scope != "external" {
+	if cfg.TLSBridge == nil || cfg.TLSBridge.Mode != "enabled" || cfg.TLSBridge.CADir != "/etc/authbridge/tls-bridge-ca" {
 		t.Fatalf("tls_bridge block did not decode: %+v", cfg.TLSBridge)
 	}
+	if len(cfg.TLSBridge.PassthroughHosts) != 1 || len(cfg.TLSBridge.Ports) != 2 {
+		t.Fatalf("passthrough_hosts/ports did not decode: %+v", cfg.TLSBridge)
+	}
 }
 
 func TestTLSBridgeConfig_Validate(t *testing.T) {
@@ -757,13 +760,10 @@ func TestTLSBridgeConfig_Validate(t *testing.T) {
 		wantErr bool
 	}{
 		{"valid empty", TLSBridgeConfig{}, false},
-		{"valid full", TLSBridgeConfig{Scope: "all", CASource: "ephemeral", InternalCIDRs: []string{"10.0.0.0/8", "172.30.0.0/16"}}, false},
-		{"bad scope", TLSBridgeConfig{Scope: "internal"}, true},
-		{"bad ca_source", TLSBridgeConfig{CASource: "vault"}, true},
-		{"file ca without paths", TLSBridgeConfig{CASource: "file"}, true},
-		{"file ca with paths", TLSBridgeConfig{CASource: "file", CACertPath: "/c", CAKeyPath: "/k"}, false},
-		{"bad cidr typo", TLSBridgeConfig{InternalCIDRs: []string{"10.0.0.0/8", "10.0.0.0./8"}}, true},
-		{"bad cidr missing mask", TLSBridgeConfig{InternalCIDRs: []string{"10.0.0.0"}}, true},
+		{"valid disabled", TLSBridgeConfig{Mode: "disabled"}, false},
+		{"valid enabled with ca_dir", TLSBridgeConfig{Mode: "enabled", CADir: "/etc/authbridge/tls-bridge-ca"}, false},
+		{"bad mode", TLSBridgeConfig{Mode: "external"}, true},
+		{"enabled without ca_dir", TLSBridgeConfig{Mode: "enabled"}, true},
 		{"valid ports", TLSBridgeConfig{Ports: []int{443, 8443, 9443}}, false},
 		{"port zero", TLSBridgeConfig{Ports: []int{0}}, true},
 		{"port too high", TLSBridgeConfig{Ports: []int{70000}}, true},

authbridge/authlib/listener/forwardproxy/server.go

@@ -890,9 +890,7 @@ func (s *Server) handleConnect(w http.ResponseWriter, r *http.Request) {
 		authority := r.Host // CONNECT target is already host:port
 		key := hostOnly(r.Host)
 		if !s.TLSBridge.Skip.Contains(key) {
-			// ip is the hostname for a name CONNECT target (ParseIP→nil ⇒ never
-			// matched as in-cluster; the transparent path keys on the dialed IP).
-			if v, _ := s.TLSBridge.Decision.Classify(key, key, portOf(r.Host), first); v == tlsbridge.Terminate {
+			if v, _ := s.TLSBridge.Decision.Classify(key, portOf(r.Host), first); v == tlsbridge.Terminate {
 				_ = upstream.Close() // bridgeServe dials its own verified upstream
 				if s.bridgeServe(clientConn, authority, key) {
 					return

authbridge/authlib/listener/forwardproxy/tlsbridge_integration_test.go

@@ -95,8 +95,8 @@ func TestTransparentBridge(t *testing.T) {
 	}
 	originHostPort := originURL.Host // "127.0.0.1:port"
 
-	// 2) Build the bridge Engine. ScopeAll so the loopback origin isn't
-	//    treated as in-cluster and skipped.
+	// 2) Build the bridge Engine. Ports is set to the origin's port so the
+	//    bridge intercepts it (the bridge has no in-cluster vs external scope).
 	src, err := tlsbridge.NewEphemeralSource()
 	if err != nil {
 		t.Fatalf("NewEphemeralSource: %v", err)
@@ -108,7 +108,6 @@ func TestTransparentBridge(t *testing.T) {
 	}
 	engine := &tlsbridge.Engine{
 		Decision: tlsbridge.NewDecision(tlsbridge.DecisionOpts{
-			Scope: tlsbridge.ScopeAll,
 			Ports: map[int]bool{portOf(originHostPort): true},
 		}),
 		Term:     tlsbridge.NewTerminator(minter),
@@ -267,7 +266,6 @@ func TestTransparentBridge_CustomPort(t *testing.T) {
 		// Only the custom port is configured — proves both that it IS bridged
 		// (despite shouldSniff not knowing it) and that the default set is replaced.
 		Decision: tlsbridge.NewDecision(tlsbridge.DecisionOpts{
-			Scope: tlsbridge.ScopeAll,
 			Ports: map[int]bool{customPort: true},
 		}),
 		Term:     tlsbridge.NewTerminator(minter),
@@ -369,9 +367,8 @@ func TestConnectBridge(t *testing.T) {
 	}
 	originHostPort := originURL.Host // "127.0.0.1:port"
 
-	// 2) Build the bridge Engine. ScopeAll so the loopback origin isn't
-	//    treated as in-cluster and skipped. Ports must include the origin's
-	//    random port (the CONNECT classify keys on portOf(r.Host)).
+	// 2) Build the bridge Engine. Ports must include the origin's random port
+	//    (the CONNECT classify keys on portOf(r.Host)).
 	src, err := tlsbridge.NewEphemeralSource()
 	if err != nil {
 		t.Fatalf("NewEphemeralSource: %v", err)
@@ -383,7 +380,6 @@ func TestConnectBridge(t *testing.T) {
 	}
 	engine := &tlsbridge.Engine{
 		Decision: tlsbridge.NewDecision(tlsbridge.DecisionOpts{
-			Scope: tlsbridge.ScopeAll,
 			Ports: map[int]bool{portOf(originHostPort): true},
 		}),
 		Term:     tlsbridge.NewTerminator(minter),
@@ -575,7 +571,6 @@ func TestBridge_UnverifiableUpstream_FallsOpenToTunnel(t *testing.T) {
 	}
 	engine := &tlsbridge.Engine{
 		Decision: tlsbridge.NewDecision(tlsbridge.DecisionOpts{
-			Scope: tlsbridge.ScopeAll,
 			Ports: map[int]bool{portOf(originHostPort): true},
 		}),
 		Term:     tlsbridge.NewTerminator(minter),
@@ -714,7 +709,6 @@ func TestBridge_PinnedClient_AutoSkipsThenTunnels(t *testing.T) {
 	}
 	engine := &tlsbridge.Engine{
 		Decision: tlsbridge.NewDecision(tlsbridge.DecisionOpts{
-			Scope: tlsbridge.ScopeAll,
 			Ports: map[int]bool{portOf(originHostPort): true},
 		}),
 		Term:     tlsbridge.NewTerminator(minter),
@@ -879,7 +873,6 @@ func TestBridge_NonTLS_Passthrough(t *testing.T) {
 	}
 	engine := &tlsbridge.Engine{
 		Decision: tlsbridge.NewDecision(tlsbridge.DecisionOpts{
-			Scope: tlsbridge.ScopeAll,
 			Ports: map[int]bool{portOf(originHostPort): true},
 		}),
 		Term:     tlsbridge.NewTerminator(minter),

authbridge/authlib/listener/forwardproxy/transparent.go

@@ -131,16 +131,14 @@ func (s *Server) HandleTransparentConn(clientConn net.Conn, dst string) {
 
 	if s.TLSBridge != nil {
 		// host is the policy authority: "<sniffed-SNI>:port" when a name was
-		// recovered, else dst ("<dial-IP>:port"). key is the SNI name or dial IP;
-		// ip is always the dialed IP (for the in-cluster CIDR gate).
-		ip := hostOnly(dst)
+		// recovered, else dst ("<dial-IP>:port"). key is the SNI name or dial IP.
 		key := hostOnly(host)
 		var first []byte
 		if pc, ok := clientConn.(*peekedConn); ok {
 			first, _ = pc.Peek(5)
 		}
 		if !s.TLSBridge.Skip.Contains(key) {
-			v, reason := s.TLSBridge.Decision.Classify(key, ip, portOf(dst), first)
+			v, reason := s.TLSBridge.Decision.Classify(key, portOf(dst), first)
 			if v == tlsbridge.Terminate {
 				_ = upstream.Close() // bridgeServe dials its own verified upstream; drop the pre-dial
 				if s.bridgeServe(clientConn, host, key) {

authbridge/authlib/tlsbridge/decision.go

@@ -1,7 +1,6 @@
 package tlsbridge
 
 import (
-	"net"
 	"sync"
 )
 
@@ -12,37 +11,21 @@ const (
 	Terminate
 )
 
-type Scope int
-
-const (
-	ScopeExternal Scope = iota // default: do not bridge internal/mesh destinations
-	ScopeAll                   // bridge everything eligible (no-mesh / standalone)
-)
-
 type DecisionOpts struct {
-	Ports         map[int]bool
-	Scope         Scope
-	InternalCIDRs []string
-	SkipHosts     []string
+	Ports     map[int]bool
+	SkipHosts []string
 }
 
 type Decision struct {
-	ports    map[int]bool
-	scope    Scope
-	internal []*net.IPNet
-	skip     map[string]bool
+	ports map[int]bool
+	skip  map[string]bool
 }
 
 func NewDecision(o DecisionOpts) *Decision {
-	d := &Decision{ports: o.Ports, scope: o.Scope, skip: map[string]bool{}}
+	d := &Decision{ports: o.Ports, skip: map[string]bool{}}
 	if d.ports == nil {
 		d.ports = map[int]bool{443: true, 8443: true}
 	}
-	for _, c := range o.InternalCIDRs {
-		if _, n, err := net.ParseCIDR(c); err == nil {
-			d.internal = append(d.internal, n)
-		}
-	}
 	for _, h := range o.SkipHosts {
 		d.skip[h] = true
 	}
@@ -55,8 +38,11 @@ func NewDecision(o DecisionOpts) *Decision {
 // the configured ports, never drifting from Classify's port gate.
 func (d *Decision) HandlesPort(port int) bool { return d.ports[port] }
 
-// Classify decides whether to bridge. first is the peeked client bytes.
-func (d *Decision) Classify(host, ip string, port int, first []byte) (Verdict, string) {
+// Classify decides whether to bridge. first is the peeked client bytes. The
+// bridge intercepts everything eligible on the configured ports (no in-cluster
+// vs external distinction): a port + valid-TLS-record + not-skip-listed
+// connection is terminated; anything else passes through.
+func (d *Decision) Classify(host string, port int, first []byte) (Verdict, string) {
 	if !d.ports[port] {
 		return Passthrough, "port"
 	}
@@ -66,25 +52,9 @@ func (d *Decision) Classify(host, ip string, port int, first []byte) (Verdict, s
 	if d.skip[host] {
 		return Passthrough, "skip"
 	}
-	if d.scope == ScopeExternal && d.isInternal(ip) {
-		return Passthrough, "in-cluster"
-	}
 	return Terminate, ""
 }
 
-func (d *Decision) isInternal(ip string) bool {
-	parsed := net.ParseIP(ip)
-	if parsed == nil {
-		return false // a hostname (not an IP) is never matched as in-cluster — see CONNECT-path note
-	}
-	for _, n := range d.internal {
-		if n.Contains(parsed) {
-			return true
-		}
-	}
-	return false
-}
-
 // looksLikeTLSRecord validates the 5-byte TLS record header (not just 0x16):
 // content type 22 (handshake), legacy record version 0x03 with minor 0x01-0x04
 // (TLS 1.0–1.3; SSLv3's 0x0300 is rejected). It checks the record layer, not the

authbridge/authlib/tlsbridge/decision_test.go

@@ -4,70 +4,46 @@ import "testing"
 
 func TestDecision_Classify(t *testing.T) {
 	d := NewDecision(DecisionOpts{
-		Ports:         map[int]bool{443: true, 8443: true},
-		Scope:         ScopeExternal,
-		InternalCIDRs: []string{"10.0.0.0/8"},
-		SkipHosts:     []string{"pinned.example.com"},
+		Ports:     map[int]bool{443: true, 8443: true},
+		SkipHosts: []string{"pinned.example.com"},
 	})
 	tlsHello := []byte{0x16, 0x03, 0x01, 0x00, 0x05} // handshake, TLS1.0 record, len
 	cases := []struct {
 		name   string
 		host   string
-		ip     string
 		port   int
 		first  []byte
 		expect Verdict
 		reason string
 	}{
-		{"happy external https", "api.example.com", "93.184.216.34", 443, tlsHello, Terminate, ""},
-		{"non-tls first byte", "api.example.com", "93.184.216.34", 443, []byte("GET / "), Passthrough, "non-tls"},
-		{"unlisted port", "api.example.com", "93.184.216.34", 9999, tlsHello, Passthrough, "port"},
-		{"internal under external scope", "tool.svc", "10.96.1.2", 443, tlsHello, Passthrough, "in-cluster"},
-		{"skip-listed host", "pinned.example.com", "1.2.3.4", 443, tlsHello, Passthrough, "skip"},
-		{"short record (<5 bytes)", "api.example.com", "1.2.3.4", 443, []byte{0x16, 0x03}, Passthrough, "non-tls"},
+		{"happy https", "api.example.com", 443, tlsHello, Terminate, ""},
+		{"happy 8443", "api.example.com", 8443, tlsHello, Terminate, ""},
+		{"non-tls first byte", "api.example.com", 443, []byte("GET / "), Passthrough, "non-tls"},
+		{"unlisted port", "api.example.com", 9999, tlsHello, Passthrough, "port"},
+		{"skip-listed host", "pinned.example.com", 443, tlsHello, Passthrough, "skip"},
+		{"short record (<5 bytes)", "api.example.com", 443, []byte{0x16, 0x03}, Passthrough, "non-tls"},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			v, reason := d.Classify(tc.host, tc.ip, tc.port, tc.first)
+			v, reason := d.Classify(tc.host, tc.port, tc.first)
 			if v != tc.expect || reason != tc.reason {
 				t.Errorf("got (%v,%q), want (%v,%q)", v, reason, tc.expect, tc.reason)
 			}
 		})
 	}
 }
 
-func TestDecision_ScopeAll(t *testing.T) {
-	d := NewDecision(DecisionOpts{Scope: ScopeAll, InternalCIDRs: []string{"10.0.0.0/8"}})
-	tlsHello := []byte{0x16, 0x03, 0x01, 0x00, 0x05}
-	// scope=all does NOT passthrough internal destinations.
-	if v, reason := d.Classify("tool.svc", "10.96.1.2", 443, tlsHello); v != Terminate || reason != "" {
-		t.Errorf("got (%v,%q), want (%v,%q)", v, reason, Terminate, "")
-	}
-}
-
 func TestDecision_DefaultPortsWhenNil(t *testing.T) {
 	d := NewDecision(DecisionOpts{}) // nil Ports -> {443,8443}
 	tlsHello := []byte{0x16, 0x03, 0x01, 0x00, 0x05}
-	if v, reason := d.Classify("api.example.com", "1.2.3.4", 443, tlsHello); v != Terminate || reason != "" {
+	if v, reason := d.Classify("api.example.com", 443, tlsHello); v != Terminate || reason != "" {
 		t.Errorf("port 443: got (%v,%q), want (%v,%q)", v, reason, Terminate, "")
 	}
-	if v, reason := d.Classify("api.example.com", "1.2.3.4", 80, tlsHello); v != Passthrough || reason != "port" {
+	if v, reason := d.Classify("api.example.com", 80, tlsHello); v != Passthrough || reason != "port" {
 		t.Errorf("port 80: got (%v,%q), want (%v,%q)", v, reason, Passthrough, "port")
 	}
 }
 
-func TestDecision_MultiCIDR(t *testing.T) {
-	d := NewDecision(DecisionOpts{
-		Scope:         ScopeExternal,
-		InternalCIDRs: []string{"10.0.0.0/8", "192.168.0.0/16"},
-	})
-	tlsHello := []byte{0x16, 0x03, 0x01, 0x00, 0x05}
-	// IP matching the SECOND cidr exercises the loop past the first entry.
-	if v, reason := d.Classify("tool.svc", "192.168.1.5", 443, tlsHello); v != Passthrough || reason != "in-cluster" {
-		t.Errorf("got (%v,%q), want (%v,%q)", v, reason, Passthrough, "in-cluster")
-	}
-}
-
 func TestSkipSet_AutoSkip(t *testing.T) {
 	s := NewSkipSet()
 	if s.Contains("h") {