tls server

The tls server binding decodes encrypted TLS protocol on the inbound network stream, producing higher level cleartext application streams for each request.

Authorization is enforced by a guard, supplied with the verified peer certificate chain from a mutually authenticated TLS session.

tls_server:
  type: tls
  kind: server
  vault: server
  exit: default_server
  options:
    keys:
      - localhost
    sni:
      - localhost
    alpn:
      - echo
  routes:
    - when:
        - alpn: echo
      exit: echo_server

Configuration (* required)

options

object

The tls specific options.

options:
  keys:
  - localhost
  sni:
  - localhost
  alpn:
  - echo

options.keys

array of string

A list of reference names for the Vault key.

options.trust

array of string

A list of reference names for the Vault certificate.

options.signers

array of string

A list of reference names for the Vault signer certificate.

options.trustcacerts

boolean

Trust CA certificates. When the this property is not explicitly set it will be automatically set to true if options.trust is null.

options.sni

array of string

A list of the Server Name Indications.

options.alpn

array of string

Application protocols.

options.mutual

enum [ required, requested, none ]

Mutual authentication. When the this property is not explicitly set it will be automatically set to none if options.trust is null, otherwise it will be set to required.

options.authorization

object as map of named object properties

Authorization by a named guard, supplied with the verified peer certificate chain from a mutually authenticated TLS session. The guard is consulted after the handshake has completed. When the peer is not verified no credentials are supplied, so a routes[].guarded route does not authorize.

authorization:
  my_x509_guard:
    credentials:
      certificates: pem

authorization.credentials

object

Defines how the peer certificate chain is presented to the guard.

credentials.certificates

enum [ pem ]

Format of the supplied certificate chain. pem supplies the verified peer certificate chain as concatenated PEM, leaf certificate first.

routes

array of object

Conditional tls specific routes. At least one of routes or the top-level exit is required.

routes:
  - when:
      - alpn: echo
  exit: echo_server

routes[].guarded

object as map of named array of string

List of roles required by each named guard to authorize this route.

routes:
  - guarded:
      my_guard:
        - read:items

routes[].when

array of object

List of conditions (any match) to match this route. Read more: When a route matches

routes:
  - when:
      - alpn: echo

when[].authority

string

Associated authority.

when[].alpn

string

Application protocol.

when[].port

integer, string, array

Port number(s), including port number ranges.

when[].trust

array of string

Vault trust certificate aliases the peer's certificate chain must be verified against to match this route.

when[].mutual

enum [ required, none ]

Mutual authentication state required to match this route.

routes[].exit

string

Next binding when following this route.

routes:
  - when:
    ...
    exit: echo_server

exit

string

Default exit binding when no conditional routes are viable.

exit: echo_server

telemetry

object

Defines the desired telemetry for the binding.

telemetry.metrics

array

Telemetry metrics to track

telemetry:
  metrics:
    - stream.*

telemetry.attributes

object as map of named string properties

Telemetry attributes to add to the binding metrics.