pomerium / pomerium / 5810660443

45%

push

github

config: add new mTLS enforcement setting (#4443)

Add an "enforcement" option to the new downstream mTLS configuration
settings group.

When not set, or when set to "policy_default_deny", keep the current
behavior of adding an invalid_client_certificate rule to all policies.

When the enforcement mode is set to just "policy", remove the default
invalid_client_certificate rule that would be normally added.

When the enforcement mode is set to "reject_connection", configure the
Envoy listener with the require_client_certificate setting and remove
the ACCEPT_UNTRUSTED option.

Add a corresponding field to the Settings proto.

59 of 59 new or added lines in 6 files covered. (100.0%)

13992 of 21948 relevant lines covered (63.75%)

118.96 hits per line