Introducing Mutual Tls Authentication for Syslog-Drains
summary
Adds client-certificate mTLS to syslog-drains so syslog keeps high throughput while authenticating senders, by extending user-provided service credentials to carry certificate and private_key, exposing a new V5 syslog_drain_urls endpoint from Cloud Controller and changing the scheduler’s binding cache to keep both legacy and new bindings. Deployment uses endpoint retries plus an availability flag so components can roll in any order without losing logs. Demo shows V5 returns cert key and optional CA.
AI-written summary · about
chapters (6)
- 0:00Introduction to mTLS for Syslog Drains
- 3:52Choosing the right drain protocol
- 5:18Implementation challenges overview
- 9:11Zero-downtime update strategy
- 13:02Live demo of mTLS setup
- 16:40Conclusion and acknowledgments
related talks
22mEverything You Need to Know About Syslog Drains - Hands on Edition
31mHow We Solved TLS at Scale: Self-Service, Multi-Tenant Cert-manager
24mOur Journey of Implementing TLS at Scale for Services on Kubernetes
31mPractical TLS Advice for Large Infrastructure
22mmTLS: When Certificate Authentication is Done Wrong
32mAchieving Mutual TLS: Secure Pod-to-Pod Communication Without the Hassle
29mUsing mTLS for Secure Baby Monitor Connections
45mSecure Together: Consul + Vault