Skip to content

istiod: Send both current and deprecated xDS TLS certificate provider fields#58257

Merged
istio-testing merged 4 commits intoistio:masterfrom
laz-canva:istio-tls-backwards-compat
Nov 12, 2025
Merged

istiod: Send both current and deprecated xDS TLS certificate provider fields#58257
istio-testing merged 4 commits intoistio:masterfrom
laz-canva:istio-tls-backwards-compat

Conversation

@laz-canva
Copy link
Copy Markdown
Contributor

@laz-canva laz-canva commented Nov 11, 2025 •
edited
Loading

Fixes istiod's gRPC generator to send both current and deprecated xDS TLS certificate
provider fields for backward compatibility with all gRPC client versions.

Problem:

  • Istio currently sends only deprecated xDS TLS certificate provider fields
  • Newer gRPC clients (grpc-go >= 1.66, grpc-cpp >= 1.66, modern grpc-java) only recognize current fields
  • This causes validation failures: tls_certificate_provider_instance is required in downstream-tls-context (see this pr discussion)
  • Users cannot upgrade their gRPC client libraries beyond version 1.65

Fix:

Send both field versions during the transition.

For identity certificates:

  • ✅ NEW: Field 14 (tls_certificate_provider_instance)
  • ✅ KEEP: Field 11 (tls_certificate_certificate_provider_instance)

For CA certificates:

  • ✅ NEW: Field 13 ca_certificate_provider_instance in default_validation_context
  • ✅ KEEP: Field 4 (validation_context_certificate_provider_instance)

Result: Compatibility with old and new gRPC clients

Testing: Unit tests in new file pilot/pkg/networking/grpcgen/tls_test.go

Migration Plan:
This is Phase 1 of a 3-phase migration following Istio's deprecation policy
(minimum 2 releases before removal). Deprecated fields will be removed in Phase 3.

To help us figure out who should review this PR, please put an X in all the areas that this PR affects.

  • Networking

Does this PR introduce a user-facing change?

  • Yes (release notes required)

@laz-canva laz-canva requested a review from a team as a code owner November 11, 2025 02:37
@istio-testing istio-testing added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. needs-ok-to-test labels Nov 11, 2025
@istio-testing
Copy link
Copy Markdown
Collaborator

istio-testing commented Nov 11, 2025

Hi @laz-canva. Thanks for your PR.

I'm waiting for a istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@laz-canva laz-canva changed the title grpc-agent: Send both current and deprecated xDS TLS certificate provider fields istiod: Send both current and deprecated xDS TLS certificate provider fields Nov 11, 2025
@laz-canva
Send both current and deprecated xDS TLS fields for gRPC clients
8154210 
Fixes istiod's gRPC generator to send both current and deprecated xDS TLS
certificate provider fields for backward compatibility with all gRPC client
versions.

When serving proxyless gRPC clients (GENERATOR=grpc), istiod now sends:

Identity certificates:
- Field 14: tls_certificate_provider_instance (current)
- Field 11: tls_certificate_certificate_provider_instance (deprecated)

CA certificates:
- Field 13: ca_certificate_provider_instance (current)
- Field 4: validation_context_certificate_provider_instance (deprecated)

This fixes validation failures in modern gRPC clients (grpc-go >= 1.66,
grpc-cpp >= 1.66, grpc-java recent versions) that only recognize current
fields, while maintaining compatibility with older clients that only
recognize deprecated fields.

Signed-off-by: adam lazur <laz@canva.com>
@laz-canva laz-canva force-pushed the istio-tls-backwards-compat branch from a5c1695 to 8154210 Compare November 11, 2025 02:47
@laz-canva laz-canva mentioned this pull request Nov 11, 2025
Merged
Stevenjin8
Stevenjin8 reviewed Nov 11, 2025
View reviewed changes
Comment thread releasenotes/notes/grpc-xds-tls-fields.yaml Outdated
Stevenjin8
Stevenjin8 reviewed Nov 11, 2025
View reviewed changes
Comment thread releasenotes/notes/grpc-xds-tls-fields.yaml Outdated
Stevenjin8
Stevenjin8 reviewed Nov 11, 2025
View reviewed changes
Comment thread pilot/pkg/networking/grpcgen/grpcgen.go
TlsCertificateProviderInstance: currentCertProviderInstance,

// DEPRECATED field (field 11) - kept for backward compatibility with older gRPC clients
// TODO: Remove this field after 2 releases (when all users have upgraded gRPC clients)
Copy link
Copy Markdown
Contributor

@Stevenjin8 Stevenjin8 Nov 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I generally agree with this. I know for proxy versions, we allow the proxy to be one version behind the control plane. I wonder what our support posture is for proxyless grpc given that 1.66 is definity out of support

Copy link
Copy Markdown
Contributor Author

@laz-canva laz-canva Nov 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My plan was simply to mimic that model, but gRPC releases and Istio releases are independent so it's maybe less clear cut?

As it is it'll be:

  1. both compatible (this PR)
  2. warning that next release will drop backwards compat (warning in release notes only?)
  3. drop backwards compat + upgrade note

I could argue for dropping step 2 as it's not adding a ton of value in this case, and the number of people affected (proxyless gRPC + Istio users) seems to be pretty small?

I'm happy to do whatever Istio devs prefer.

@Stevenjin8
Copy link
Copy Markdown
Contributor

Stevenjin8 commented Nov 12, 2025

/ok-to-test

@istio-testing istio-testing added ok-to-test Set this label allow normal testing to take place for a PR not submitted by an Istio org member. and removed needs-ok-to-test labels Nov 12, 2025
@laz-canva laz-canva force-pushed the istio-tls-backwards-compat branch from 28d82c8 to 6f53274 Compare November 12, 2025 07:26
@laz-canva
Add nolint directives for deprecated field tests
cfe9532 
The tls_test.go file intentionally tests deprecated xDS fields
for backward compatibility verification. Add nolint:staticcheck
directives to suppress SA1019 warnings about accessing these
deprecated fields.

Signed-off-by: adam lazur <laz@canva.com>
@laz-canva laz-canva force-pushed the istio-tls-backwards-compat branch from e8ab2f3 to 1261975 Compare November 12, 2025 07:35
@laz-canva
Add nolint directives for deprecated field tests
fa1a769 
The tls_test.go file intentionally tests deprecated xDS fields
for backward compatibility verification. Add nolint:staticcheck
directives to suppress SA1019 warnings about accessing these
deprecated fields.

Signed-off-by: adam lazur <laz@canva.com>
@laz-canva laz-canva force-pushed the istio-tls-backwards-compat branch from 1261975 to fa1a769 Compare November 12, 2025 08:04
@istio-testing istio-testing merged commit 57cbeb1 into istio:master Nov 12, 2025
33 checks passed
ejona86 pushed a commit to grpc/grpc-java that referenced this pull request Nov 12, 2025
@laz-canva @ampcode-com
xds: Support deprecated xDS TLS fields for Istio compat (#12435)
3fc026c 
## Problem

When using xDS with Istio's grpc-agent in proxyless mode, Java gRPC
fails with:

```
LDS response Listener validation error: 
tls_certificate_provider_instance is required in downstream-tls-context
```

**Root Cause:**

Istio sends deprecated certificate provider fields for backward
compatibility with older Envoy versions. Java gRPC currently only reads
the current fields, causing validation failures.

Specifically, Istio uses these deprecated fields:
1. **Field 11**: `tls_certificate_certificate_provider_instance`
(deprecated) instead of field 14 (`tls_certificate_provider_instance`)
2. **Field 4**: `validation_context_certificate_provider_instance` in
`CombinedValidationContext` (deprecated) instead of
`ca_certificate_provider_instance` in `default_validation_context`

## Fix

Istio is adding support for the new fields in
istio/istio#58257. Add fallback logic to support
deprecated certificate provider fields before that is rolled out:

**For identity certificates:**
1. Try current field 14 (`tls_certificate_provider_instance`) first
2. Fall back to deprecated field 11
(`tls_certificate_certificate_provider_instance`)

**For validation context in CombinedValidationContext:**
1. Try `ca_certificate_provider_instance` in
`default_validation_context` first
2. Fall back to deprecated field 4
(`validation_context_certificate_provider_instance`)

This matches the behavior of
[grpc-cpp](https://github.com/grpc/grpc/blob/master/src/core/xds/grpc/xds_common_types_parser.cc#L435-L474)
and
[grpc-go](https://github.com/grpc/grpc-go/blob/master/internal/xds/xdsclient/xdsresource/unmarshal_cds.go#L310-L344)
implementations.

## Testing

* Added new tests for both deprecated field paths (field 11 and field 4)
* All existing tests pass
* Manual local testing with Istio in proxyless mode verified the
compatibility fix works

---------

Co-authored-by: Amp <amp@ampcode.com>
ejona86 pushed a commit to ejona86/grpc-java that referenced this pull request Nov 12, 2025
@laz-canva @ampcode-com @ejona86
xds: Support deprecated xDS TLS fields for Istio compat (grpc#12435)
9de52af 
## Problem

When using xDS with Istio's grpc-agent in proxyless mode, Java gRPC
fails with:

```
LDS response Listener validation error: 
tls_certificate_provider_instance is required in downstream-tls-context
```

**Root Cause:**

Istio sends deprecated certificate provider fields for backward
compatibility with older Envoy versions. Java gRPC currently only reads
the current fields, causing validation failures.

Specifically, Istio uses these deprecated fields:
1. **Field 11**: `tls_certificate_certificate_provider_instance`
(deprecated) instead of field 14 (`tls_certificate_provider_instance`)
2. **Field 4**: `validation_context_certificate_provider_instance` in
`CombinedValidationContext` (deprecated) instead of
`ca_certificate_provider_instance` in `default_validation_context`

## Fix

Istio is adding support for the new fields in
istio/istio#58257. Add fallback logic to support
deprecated certificate provider fields before that is rolled out:

**For identity certificates:**
1. Try current field 14 (`tls_certificate_provider_instance`) first
2. Fall back to deprecated field 11
(`tls_certificate_certificate_provider_instance`)

**For validation context in CombinedValidationContext:**
1. Try `ca_certificate_provider_instance` in
`default_validation_context` first
2. Fall back to deprecated field 4
(`validation_context_certificate_provider_instance`)

This matches the behavior of
[grpc-cpp](https://github.com/grpc/grpc/blob/master/src/core/xds/grpc/xds_common_types_parser.cc#L435-L474)
and
[grpc-go](https://github.com/grpc/grpc-go/blob/master/internal/xds/xdsclient/xdsresource/unmarshal_cds.go#L310-L344)
implementations.

## Testing

* Added new tests for both deprecated field paths (field 11 and field 4)
* All existing tests pass
* Manual local testing with Istio in proxyless mode verified the
compatibility fix works

---------

Co-authored-by: Amp <amp@ampcode.com>
ejona86 pushed a commit to grpc/grpc-java that referenced this pull request Nov 13, 2025
@laz-canva @ampcode-com @ejona86
xds: Support deprecated xDS TLS fields for Istio compat (#12435)
53cd1a2 
## Problem

When using xDS with Istio's grpc-agent in proxyless mode, Java gRPC
fails with:

```
LDS response Listener validation error: 
tls_certificate_provider_instance is required in downstream-tls-context
```

**Root Cause:**

Istio sends deprecated certificate provider fields for backward
compatibility with older Envoy versions. Java gRPC currently only reads
the current fields, causing validation failures.

Specifically, Istio uses these deprecated fields:
1. **Field 11**: `tls_certificate_certificate_provider_instance`
(deprecated) instead of field 14 (`tls_certificate_provider_instance`)
2. **Field 4**: `validation_context_certificate_provider_instance` in
`CombinedValidationContext` (deprecated) instead of
`ca_certificate_provider_instance` in `default_validation_context`

## Fix

Istio is adding support for the new fields in
istio/istio#58257. Add fallback logic to support
deprecated certificate provider fields before that is rolled out:

**For identity certificates:**
1. Try current field 14 (`tls_certificate_provider_instance`) first
2. Fall back to deprecated field 11
(`tls_certificate_certificate_provider_instance`)

**For validation context in CombinedValidationContext:**
1. Try `ca_certificate_provider_instance` in
`default_validation_context` first
2. Fall back to deprecated field 4
(`validation_context_certificate_provider_instance`)

This matches the behavior of
[grpc-cpp](https://github.com/grpc/grpc/blob/master/src/core/xds/grpc/xds_common_types_parser.cc#L435-L474)
and
[grpc-go](https://github.com/grpc/grpc-go/blob/master/internal/xds/xdsclient/xdsresource/unmarshal_cds.go#L310-L344)
implementations.

## Testing

* Added new tests for both deprecated field paths (field 11 and field 4)
* All existing tests pass
* Manual local testing with Istio in proxyless mode verified the
compatibility fix works

---------

Co-authored-by: Amp <amp@ampcode.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Stevenjin8 Stevenjin8 Stevenjin8 left review comments

@ramaraochavali ramaraochavali ramaraochavali approved these changes

Assignees

No one assigned

Labels

area/networking ok-to-test Set this label allow normal testing to take place for a PR not submitted by an Istio org member. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@laz-canva @istio-testing @Stevenjin8 @ramaraochavali @istio-policy-bot