diff --git a/api/mesh/v1alpha1/externalservice.pb.go b/api/mesh/v1alpha1/externalservice.pb.go index c974c610eedc..bdb129c66ac8 100644 --- a/api/mesh/v1alpha1/externalservice.pb.go +++ b/api/mesh/v1alpha1/externalservice.pb.go @@ -175,6 +175,8 @@ type ExternalService_Networking_TLS struct { // ServerName overrides the default Server Name Indicator set by Kuma. // The default value is set to "address" specified in "networking". ServerName *wrapperspb.StringValue `protobuf:"bytes,6,opt,name=server_name,json=serverName,proto3" json:"server_name,omitempty"` + // If true then hostname verification will be skipped during certificate verification. + SkipHostnameVerification *wrapperspb.BoolValue `protobuf:"bytes,7,opt,name=skipHostnameVerification,proto3" json:"skipHostnameVerification,omitempty"` } func (x *ExternalService_Networking_TLS) Reset() { @@ -251,6 +253,13 @@ func (x *ExternalService_Networking_TLS) GetServerName() *wrapperspb.StringValue return nil } +func (x *ExternalService_Networking_TLS) GetSkipHostnameVerification() *wrapperspb.BoolValue { + if x != nil { + return x.SkipHostnameVerification + } + return nil +} + var File_api_mesh_v1alpha1_externalservice_proto protoreflect.FileDescriptor var file_api_mesh_v1alpha1_externalservice_proto_rawDesc = []byte{ @@ -266,7 +275,7 @@ var file_api_mesh_v1alpha1_externalservice_proto_rawDesc = []byte{ 0x61, 0x70, 0x69, 0x2f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x64, 0x61, 0x74, 0x61, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x6b, 0x75, 0x6d, 0x61, 0x2d, 0x64, 0x6f, 0x63, 0x2f, 0x63, - 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xec, 0x06, 0x0a, 0x0f, + 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xc4, 0x07, 0x0a, 0x0f, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x54, 0x0a, 0x0a, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x6b, 0x75, 0x6d, 0x61, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, @@ -278,7 +287,7 @@ var file_api_mesh_v1alpha1_externalservice_proto_rawDesc = []byte{ 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x54, 0x61, 0x67, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x42, 0x0c, 0xfa, 0x42, 0x05, 0x9a, 0x01, 0x02, 0x08, 0x01, 0x88, 0xb5, 0x18, 0x01, - 0x52, 0x04, 0x74, 0x61, 0x67, 0x73, 0x1a, 0x90, 0x04, 0x0a, 0x0a, 0x4e, 0x65, 0x74, 0x77, 0x6f, + 0x52, 0x04, 0x74, 0x61, 0x67, 0x73, 0x1a, 0xe8, 0x04, 0x0a, 0x0a, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x12, 0x1e, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x04, 0x88, 0xb5, 0x18, 0x01, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x44, 0x0a, 0x03, 0x74, 0x6c, 0x73, 0x18, 0x02, 0x20, 0x01, @@ -288,7 +297,7 @@ var file_api_mesh_v1alpha1_externalservice_proto_rawDesc = []byte{ 0x6e, 0x67, 0x2e, 0x54, 0x4c, 0x53, 0x52, 0x03, 0x74, 0x6c, 0x73, 0x12, 0x30, 0x0a, 0x13, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x48, 0x6f, 0x73, 0x74, 0x44, 0x4e, 0x53, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, - 0x65, 0x48, 0x6f, 0x73, 0x74, 0x44, 0x4e, 0x53, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x1a, 0xe9, 0x02, + 0x65, 0x48, 0x6f, 0x73, 0x74, 0x44, 0x4e, 0x53, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x1a, 0xc1, 0x03, 0x0a, 0x03, 0x54, 0x4c, 0x53, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x39, 0x0a, 0x07, 0x63, 0x61, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, @@ -311,23 +320,29 @@ var file_api_mesh_v1alpha1_externalservice_proto_rawDesc = []byte{ 0x72, 0x76, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0a, 0x73, - 0x65, 0x72, 0x76, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x1a, 0x37, 0x0a, 0x09, 0x54, 0x61, 0x67, - 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, - 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, - 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, - 0x38, 0x01, 0x3a, 0x66, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x19, 0x0a, 0x17, 0x45, 0x78, 0x74, 0x65, - 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, - 0x72, 0x63, 0x65, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x11, 0x12, 0x0f, 0x45, 0x78, 0x74, 0x65, 0x72, - 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x06, - 0x22, 0x04, 0x6d, 0x65, 0x73, 0x68, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x04, 0x52, 0x02, 0x10, 0x01, - 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x14, 0x3a, 0x12, 0x0a, 0x10, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, - 0x61, 0x6c, 0x2d, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x42, 0x55, 0x5a, 0x28, 0x67, 0x69, - 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6b, 0x75, 0x6d, 0x61, 0x68, 0x71, 0x2f, - 0x6b, 0x75, 0x6d, 0x61, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, - 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x8a, 0xb5, 0x18, 0x27, 0x50, 0x01, 0xa2, 0x01, 0x0f, 0x45, - 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0xf2, 0x01, - 0x10, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2d, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, - 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x65, 0x72, 0x76, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x56, 0x0a, 0x18, 0x73, 0x6b, 0x69, + 0x70, 0x48, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x56, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, + 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, + 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, + 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x18, 0x73, 0x6b, 0x69, 0x70, 0x48, 0x6f, 0x73, + 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x56, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, + 0x6e, 0x1a, 0x37, 0x0a, 0x09, 0x54, 0x61, 0x67, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, + 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, + 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, + 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x3a, 0x66, 0xaa, 0x8c, 0x89, 0xa6, + 0x01, 0x19, 0x0a, 0x17, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x72, 0x76, + 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xaa, 0x8c, 0x89, 0xa6, 0x01, + 0x11, 0x12, 0x0f, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x72, 0x76, 0x69, + 0x63, 0x65, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x06, 0x22, 0x04, 0x6d, 0x65, 0x73, 0x68, 0xaa, 0x8c, + 0x89, 0xa6, 0x01, 0x04, 0x52, 0x02, 0x10, 0x01, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x14, 0x3a, 0x12, + 0x0a, 0x10, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2d, 0x73, 0x65, 0x72, 0x76, 0x69, + 0x63, 0x65, 0x42, 0x55, 0x5a, 0x28, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, + 0x2f, 0x6b, 0x75, 0x6d, 0x61, 0x68, 0x71, 0x2f, 0x6b, 0x75, 0x6d, 0x61, 0x2f, 0x61, 0x70, 0x69, + 0x2f, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x8a, 0xb5, + 0x18, 0x27, 0x50, 0x01, 0xa2, 0x01, 0x0f, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, + 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0xf2, 0x01, 0x10, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, + 0x6c, 0x2d, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, + 0x33, } var ( @@ -361,11 +376,12 @@ var file_api_mesh_v1alpha1_externalservice_proto_depIdxs = []int32{ 4, // 5: kuma.mesh.v1alpha1.ExternalService.Networking.TLS.client_key:type_name -> kuma.system.v1alpha1.DataSource 5, // 6: kuma.mesh.v1alpha1.ExternalService.Networking.TLS.allowRenegotiation:type_name -> google.protobuf.BoolValue 6, // 7: kuma.mesh.v1alpha1.ExternalService.Networking.TLS.server_name:type_name -> google.protobuf.StringValue - 8, // [8:8] is the sub-list for method output_type - 8, // [8:8] is the sub-list for method input_type - 8, // [8:8] is the sub-list for extension type_name - 8, // [8:8] is the sub-list for extension extendee - 0, // [0:8] is the sub-list for field type_name + 5, // 8: kuma.mesh.v1alpha1.ExternalService.Networking.TLS.skipHostnameVerification:type_name -> google.protobuf.BoolValue + 9, // [9:9] is the sub-list for method output_type + 9, // [9:9] is the sub-list for method input_type + 9, // [9:9] is the sub-list for extension type_name + 9, // [9:9] is the sub-list for extension extendee + 0, // [0:9] is the sub-list for field type_name } func init() { file_api_mesh_v1alpha1_externalservice_proto_init() } diff --git a/api/mesh/v1alpha1/externalservice.proto b/api/mesh/v1alpha1/externalservice.proto index 1b82845d14fd..ec6854b0e4eb 100644 --- a/api/mesh/v1alpha1/externalservice.proto +++ b/api/mesh/v1alpha1/externalservice.proto @@ -54,6 +54,9 @@ message ExternalService { // ServerName overrides the default Server Name Indicator set by Kuma. // The default value is set to "address" specified in "networking". google.protobuf.StringValue server_name = 6; + + // If true then hostname verification will be skipped during certificate verification. + google.protobuf.BoolValue skipHostnameVerification = 7; } TLS tls = 2; diff --git a/docs/generated/raw/protos/ExternalService.json b/docs/generated/raw/protos/ExternalService.json index 80b580e62f05..bfa3f76722df 100644 --- a/docs/generated/raw/protos/ExternalService.json +++ b/docs/generated/raw/protos/ExternalService.json @@ -71,6 +71,11 @@ "additionalProperties": true, "type": "string", "description": "ServerName overrides the default Server Name Indicator set by Kuma. The default value is set to \"address\" specified in \"networking\"." + }, + "skipHostnameVerification": { + "additionalProperties": true, + "type": "boolean", + "description": "If true then hostname verification will be skipped during certificate verification." } }, "additionalProperties": true, diff --git a/docs/generated/resources/policy_external-service.md b/docs/generated/resources/policy_external-service.md index 6b70d2e2d77d..d670d67a3f4f 100644 --- a/docs/generated/resources/policy_external-service.md +++ b/docs/generated/resources/policy_external-service.md @@ -35,6 +35,10 @@ ServerName overrides the default Server Name Indicator set by Kuma. The default value is set to "address" specified in "networking". + + - `skipHostnameVerification` (optional) + + If true then hostname verification will be skipped during certificate verification. - `disableHostDNSEntry` (optional) diff --git a/pkg/core/xds/types.go b/pkg/core/xds/types.go index 76d56d452559..d7bb265f7967 100644 --- a/pkg/core/xds/types.go +++ b/pkg/core/xds/types.go @@ -53,12 +53,13 @@ type TagSelectorSet []mesh_proto.TagSelector type DestinationMap map[ServiceName]TagSelectorSet type ExternalService struct { - TLSEnabled bool - CaCert []byte - ClientCert []byte - ClientKey []byte - AllowRenegotiation bool - ServerName string + TLSEnabled bool + CaCert []byte + ClientCert []byte + ClientKey []byte + AllowRenegotiation bool + SkipHostnameVerification bool + ServerName string } type Locality struct { diff --git a/pkg/xds/envoy/clusters/v3/client_side_tls_configurer.go b/pkg/xds/envoy/clusters/v3/client_side_tls_configurer.go index 624afe6ac480..107cfc28fb33 100644 --- a/pkg/xds/envoy/clusters/v3/client_side_tls_configurer.go +++ b/pkg/xds/envoy/clusters/v3/client_side_tls_configurer.go @@ -34,6 +34,7 @@ func (c *ClientSideTLSConfigurer) Configure(cluster *envoy_cluster.Cluster) erro ep.ExternalService.ClientCert, ep.ExternalService.ClientKey, ep.ExternalService.AllowRenegotiation, + ep.ExternalService.SkipHostnameVerification, ep.Target, sni, ) diff --git a/pkg/xds/envoy/clusters/v3/client_side_tls_configurer_test.go b/pkg/xds/envoy/clusters/v3/client_side_tls_configurer_test.go index fb403528741d..83d63c12e999 100644 --- a/pkg/xds/envoy/clusters/v3/client_side_tls_configurer_test.go +++ b/pkg/xds/envoy/clusters/v3/client_side_tls_configurer_test.go @@ -149,6 +149,54 @@ var _ = Describe("ClientSideTLSConfigurer", func() { inlineBytes: Y2FjZXJ0 sni: custom type: EDS +`, + }), + Entry("cluster with mTLS and certs but skipHostnameVerification", testCase{ + clusterName: "testCluster", + endpoints: []xds.Endpoint{ + { + Target: "httpbin.org", + Port: 3000, + Tags: nil, + Weight: 100, + ExternalService: &xds.ExternalService{ + TLSEnabled: true, + CaCert: []byte("cacert"), + ClientCert: []byte("clientcert"), + ClientKey: []byte("clientkey"), + AllowRenegotiation: true, + SkipHostnameVerification: true, + ServerName: "", + }, + }, + }, + + expected: ` + connectTimeout: 5s + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + name: testCluster + transportSocketMatches: + - match: {} + name: httpbin.org + transportSocket: + name: envoy.transport_sockets.tls + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + allowRenegotiation: true + commonTlsContext: + tlsCertificates: + - certificateChain: + inlineBytes: Y2xpZW50Y2VydA== + privateKey: + inlineBytes: Y2xpZW50a2V5 + validationContext: + trustedCa: + inlineBytes: Y2FjZXJ0 + sni: httpbin.org + type: EDS `, }), ) diff --git a/pkg/xds/envoy/tls/v3/tls.go b/pkg/xds/envoy/tls/v3/tls.go index d8459284e23a..84274a97691d 100644 --- a/pkg/xds/envoy/tls/v3/tls.go +++ b/pkg/xds/envoy/tls/v3/tls.go @@ -87,7 +87,7 @@ func NewSecretConfigSource(secretName string) *envoy_tls.SdsSecretConfig { } } -func UpstreamTlsContextOutsideMesh(ca, cert, key []byte, allowRenegotiation bool, hostname string, sni string) (*envoy_tls.UpstreamTlsContext, error) { +func UpstreamTlsContextOutsideMesh(ca, cert, key []byte, allowRenegotiation bool, skipHostnameVerification bool, hostname string, sni string) (*envoy_tls.UpstreamTlsContext, error) { tlsContext := &envoy_tls.UpstreamTlsContext{ AllowRenegotiation: allowRenegotiation, Sni: sni, @@ -108,22 +108,24 @@ func UpstreamTlsContextOutsideMesh(ca, cert, key []byte, allowRenegotiation bool tlsContext.CommonTlsContext = &envoy_tls.CommonTlsContext{} } var matchNames []*envoy_tls.SubjectAltNameMatcher - subjectAltNameMatch := hostname - if len(sni) > 0 { - subjectAltNameMatch = sni - } - for _, typ := range []envoy_tls.SubjectAltNameMatcher_SanType{ - envoy_tls.SubjectAltNameMatcher_DNS, - envoy_tls.SubjectAltNameMatcher_IP_ADDRESS, - } { - matchNames = append(matchNames, &envoy_tls.SubjectAltNameMatcher{ - SanType: typ, - Matcher: &envoy_type_matcher.StringMatcher{ - MatchPattern: &envoy_type_matcher.StringMatcher_Exact{ - Exact: subjectAltNameMatch, + if !skipHostnameVerification { + subjectAltNameMatch := hostname + if len(sni) > 0 { + subjectAltNameMatch = sni + } + for _, typ := range []envoy_tls.SubjectAltNameMatcher_SanType{ + envoy_tls.SubjectAltNameMatcher_DNS, + envoy_tls.SubjectAltNameMatcher_IP_ADDRESS, + } { + matchNames = append(matchNames, &envoy_tls.SubjectAltNameMatcher{ + SanType: typ, + Matcher: &envoy_type_matcher.StringMatcher{ + MatchPattern: &envoy_type_matcher.StringMatcher_Exact{ + Exact: subjectAltNameMatch, + }, }, - }, - }) + }) + } } tlsContext.CommonTlsContext.ValidationContextType = &envoy_tls.CommonTlsContext_ValidationContext{ ValidationContext: &envoy_tls.CertificateValidationContext{ diff --git a/pkg/xds/topology/outbound.go b/pkg/xds/topology/outbound.go index 94c92a3ea2f4..b7ed699af7a1 100644 --- a/pkg/xds/topology/outbound.go +++ b/pkg/xds/topology/outbound.go @@ -466,12 +466,13 @@ func NewExternalServiceEndpoint( } es := &core_xds.ExternalService{ - TLSEnabled: tls.GetEnabled(), - CaCert: caCert, - ClientCert: clientCert, - ClientKey: clientKey, - AllowRenegotiation: tls.GetAllowRenegotiation().GetValue(), - ServerName: tls.GetServerName().GetValue(), + TLSEnabled: tls.GetEnabled(), + CaCert: caCert, + ClientCert: clientCert, + ClientKey: clientKey, + AllowRenegotiation: tls.GetAllowRenegotiation().GetValue(), + SkipHostnameVerification: tls.GetSkipHostnameVerification().GetValue(), + ServerName: tls.GetServerName().GetValue(), } if es.TLSEnabled {