feat(ExternalService): add skip hostname verification for external services

api/mesh/v1alpha1/externalservice.proto

@@ -54,6 +54,9 @@ message ExternalService {
       // ServerName overrides the default Server Name Indicator set by Kuma.
       // The default value is set to "address" specified in "networking".
       google.protobuf.StringValue server_name = 6;
+
+      // If true then hostname verification will be skipped during certificate verification.
+      google.protobuf.BoolValue skipHostnameVerification = 7;
     }
 
     TLS tls = 2;

docs/generated/raw/protos/ExternalService.json

@@ -71,6 +71,11 @@
                     "additionalProperties": true,
                     "type": "string",
                     "description": "ServerName overrides the default Server Name Indicator set by Kuma. The default value is set to \"address\" specified in \"networking\"."
+                },
+                "skipHostnameVerification": {
+                    "additionalProperties": true,
+                    "type": "boolean",
+                    "description": "If true then hostname verification will be skipped during certificate verification."
                 }
             },
             "additionalProperties": true,

docs/generated/resources/policy_external-service.md

@@ -35,6 +35,10 @@
 
             ServerName overrides the default Server Name Indicator set by Kuma.
             The default value is set to "address" specified in "networking".    
+
+        - `skipHostnameVerification` (optional)
+
+            If true then hostname verification will be skipped during certificate verification.    
 
     - `disableHostDNSEntry` (optional)
 

pkg/core/xds/types.go

@@ -53,12 +53,13 @@ type TagSelectorSet []mesh_proto.TagSelector
 type DestinationMap map[ServiceName]TagSelectorSet
 
 type ExternalService struct {
-	TLSEnabled         bool
-	CaCert             []byte
-	ClientCert         []byte
-	ClientKey          []byte
-	AllowRenegotiation bool
-	ServerName         string
+	TLSEnabled               bool
+	CaCert                   []byte
+	ClientCert               []byte
+	ClientKey                []byte
+	AllowRenegotiation       bool
+	SkipHostnameVerification bool
+	ServerName               string
 }
 
 type Locality struct {

pkg/xds/envoy/clusters/v3/client_side_tls_configurer.go

@@ -34,6 +34,7 @@ func (c *ClientSideTLSConfigurer) Configure(cluster *envoy_cluster.Cluster) erro
 				ep.ExternalService.ClientCert,
 				ep.ExternalService.ClientKey,
 				ep.ExternalService.AllowRenegotiation,
+				ep.ExternalService.SkipHostnameVerification,
 				ep.Target,
 				sni,
 			)

pkg/xds/envoy/clusters/v3/client_side_tls_configurer_test.go

@@ -149,6 +149,54 @@ var _ = Describe("ClientSideTLSConfigurer", func() {
                         inlineBytes: Y2FjZXJ0
                   sni: custom
             type: EDS
+`,
+		}),
+		Entry("cluster with mTLS and certs but skipHostnameVerification", testCase{
+			clusterName: "testCluster",
+			endpoints: []xds.Endpoint{
+				{
+					Target: "httpbin.org",
+					Port:   3000,
+					Tags:   nil,
+					Weight: 100,
+					ExternalService: &xds.ExternalService{
+						TLSEnabled:               true,
+						CaCert:                   []byte("cacert"),
+						ClientCert:               []byte("clientcert"),
+						ClientKey:                []byte("clientkey"),
+						AllowRenegotiation:       true,
+						SkipHostnameVerification: true,
+						ServerName:               "",
+					},
+				},
+			},
+
+			expected: `
+            connectTimeout: 5s
+            edsClusterConfig:
+              edsConfig:
+                ads: {}
+                resourceApiVersion: V3
+            name: testCluster
+            transportSocketMatches:
+            - match: {}
+              name: httpbin.org
+              transportSocket:
+                name: envoy.transport_sockets.tls
+                typedConfig:
+                  '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  allowRenegotiation: true
+                  commonTlsContext:
+                    tlsCertificates:
+                    - certificateChain:
+                        inlineBytes: Y2xpZW50Y2VydA==
+                      privateKey:
+                        inlineBytes: Y2xpZW50a2V5
+                    validationContext:
+                      trustedCa:
+                        inlineBytes: Y2FjZXJ0
+                  sni: httpbin.org
+            type: EDS
 `,
 		}),
 	)

pkg/xds/envoy/tls/v3/tls.go

@@ -87,7 +87,7 @@ func NewSecretConfigSource(secretName string) *envoy_tls.SdsSecretConfig {
 	}
 }
 
-func UpstreamTlsContextOutsideMesh(ca, cert, key []byte, allowRenegotiation bool, hostname string, sni string) (*envoy_tls.UpstreamTlsContext, error) {
+func UpstreamTlsContextOutsideMesh(ca, cert, key []byte, allowRenegotiation bool, skipHostnameVerification bool, hostname string, sni string) (*envoy_tls.UpstreamTlsContext, error) {
 	tlsContext := &envoy_tls.UpstreamTlsContext{
 		AllowRenegotiation: allowRenegotiation,
 		Sni:                sni,
@@ -108,22 +108,24 @@ func UpstreamTlsContextOutsideMesh(ca, cert, key []byte, allowRenegotiation bool
 			tlsContext.CommonTlsContext = &envoy_tls.CommonTlsContext{}
 		}
 		var matchNames []*envoy_tls.SubjectAltNameMatcher
-		subjectAltNameMatch := hostname
-		if len(sni) > 0 {
-			subjectAltNameMatch = sni
-		}
-		for _, typ := range []envoy_tls.SubjectAltNameMatcher_SanType{
-			envoy_tls.SubjectAltNameMatcher_DNS,
-			envoy_tls.SubjectAltNameMatcher_IP_ADDRESS,
-		} {
-			matchNames = append(matchNames, &envoy_tls.SubjectAltNameMatcher{
-				SanType: typ,
-				Matcher: &envoy_type_matcher.StringMatcher{
-					MatchPattern: &envoy_type_matcher.StringMatcher_Exact{
-						Exact: subjectAltNameMatch,
+		if !skipHostnameVerification {
+			subjectAltNameMatch := hostname
+			if len(sni) > 0 {
+				subjectAltNameMatch = sni
+			}
+			for _, typ := range []envoy_tls.SubjectAltNameMatcher_SanType{
+				envoy_tls.SubjectAltNameMatcher_DNS,
+				envoy_tls.SubjectAltNameMatcher_IP_ADDRESS,
+			} {
+				matchNames = append(matchNames, &envoy_tls.SubjectAltNameMatcher{
+					SanType: typ,
+					Matcher: &envoy_type_matcher.StringMatcher{
+						MatchPattern: &envoy_type_matcher.StringMatcher_Exact{
+							Exact: subjectAltNameMatch,
+						},
 					},
-				},
-			})
+				})
+			}
 		}
 		tlsContext.CommonTlsContext.ValidationContextType = &envoy_tls.CommonTlsContext_ValidationContext{
 			ValidationContext: &envoy_tls.CertificateValidationContext{

pkg/xds/topology/outbound.go

@@ -466,12 +466,13 @@ func NewExternalServiceEndpoint(
 	}
 
 	es := &core_xds.ExternalService{
-		TLSEnabled:         tls.GetEnabled(),
-		CaCert:             caCert,
-		ClientCert:         clientCert,
-		ClientKey:          clientKey,
-		AllowRenegotiation: tls.GetAllowRenegotiation().GetValue(),
-		ServerName:         tls.GetServerName().GetValue(),
+		TLSEnabled:               tls.GetEnabled(),
+		CaCert:                   caCert,
+		ClientCert:               clientCert,
+		ClientKey:                clientKey,
+		AllowRenegotiation:       tls.GetAllowRenegotiation().GetValue(),
+		SkipHostnameVerification: tls.GetSkipHostnameVerification().GetValue(),
+		ServerName:               tls.GetServerName().GetValue(),
 	}
 
 	if es.TLSEnabled {