External Service easily misconfigured in an insecure way

[johnharris85]

Description

The below External Service policy is valid despite the fact that networking.tls.caCert is not set. When this is not set Envoy does not have a trusted_ca configured for the upstream TLS. In this situation Envoy does not verify server certificates so communication to the external service is not secure.

type: ExternalService
mesh: default
name: 'some-name'
tags:
  kuma.io/service: 'some-name'
  kuma.io/protocol: http
networking:
  address: 'example.com:443'
  tls:
    enabled: true
    allowRenegotiation: false

Many people might assume that by default a system CA bundle will be used to verify server certificates seeing as this is not a mandatory field.

If TLS is enabled for an External Service then caCert should be mandatory to avoid insecure misconfiguration.

ref: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/tls.proto#extensions-transport-sockets-tls-v3-upstreamtlscontext

[johngmyers]

Alternatively, it could configure a default bundle of public CAs.

[jakubdyszkiewicz]

Triage: it does not have to be a breaking change. We can introduce a new field like verifyWithSystemBundle: true and document that you need to set this to verify cert against the builtin CA bundle in the system

[lahabana]

Though that would still make the default setup insecure by default no?

[github-actions]

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

[github-actions]

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

[github-actions]

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

[github-actions]

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

[github-actions]

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

[github-actions]

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

[github-actions]

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

[lahabana]

@slonka do we agree that's no longer the case with MeshExternalService?

[lukidzi]

Triage: fixed in MeshExternalService