Page MenuHomePhabricator

Add TLS support for Snapshots service
Closed, ResolvedPublic5 Estimated Story Points

Description

We need to add encryption in transit and authentication to make sure we can avoid man in the middle attacks when scheduler is communicating with Exports service.

Acceptance criteria
Snapshots service communicates via TLS with the scheduler.

To-Do

  • add ability to accept INTERNAL_ROOT_CA_PEM, TLS_CERT_PEM and TLS_PRIVATE_KEY_PEM and pass them to grpc server, refer to services/hourly as example
  • make sure infrastructure generates client certificate
  • move this to a separate package that can be included as a submodule
  • modify hourlys service to use this new package

Event Timeline

Protsack.stephan renamed this task from Add TLS Support For Exports Service to Add TLS support for snapshots service.Oct 12 2022, 9:38 AM
Protsack.stephan renamed this task from Add TLS support for snapshots service to Add TLS support for Snapshots service.
Protsack.stephan raised the priority of this task from Low to Needs Triage.Oct 12 2022, 9:40 AM
Protsack.stephan removed the point value for this task.
JArguello-WMF claimed this task.