John Harris

Support for mTLS connection to rethink (not user / pass)

1

As far as I can see this isn't currently supported? Happy to work on a PR if that's something of interest?

External Service easily misconfigured in an insecure way

9

### Description The below External Service policy is valid despite the fact that `networking.tls.caCert` is not set. When this is not set Envoy does not have a trusted_ca configured for...

Add `ADOPTERS.md`

7

### Description We should add an `ADOPTERS.md` file and evangelize it to track OSS adoption of the project in the community.

### Description Not all features of the TrafficRoute (https://kuma.io/docs/1.7.x/policies/traffic-route/#usage) policy are supported by the mesh gateway MeshGatewayRoute (https://kuma.io/docs/1.7.x/policies/mesh-gateway-route/). For example: - Request and response modification - Load balancing

Support absence of header via present_match in TrafficRoute

1

### Description There isn't support for matching the absence of headers and routing to a service on that basis, for example via present_match in an envoy header matcher, see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-msg-config-route-v3-headermatcher

Perform security analysis / pen testing / etc and document results (& planned efforts)

1

### Description We should: - Develop and frequently run security tests - Document (on Kuma.io) the security testing that is performed against Kuma today (and any results) - Document (on...

Support etcd lifecycle (deploy / upgrade) as static pods

13

Currently etcdadm supports etcd as a systemd service, but it would be great to support deploying etcd as static pods in the same way that kubeadm currently does. This isn't...

Confusing Config options w/ OIDC discovery

4

The readme for OIDC indicates that either ACME or unix listen socket are required. They aren't (works fine without) and the checks for this condition (https://github.com/spiffe/spire/blob/master/support/oidc-discovery-provider/config.go#L138) are broken anyway :smile:...

/kind feature **Describe the solution you'd like** The ability to make the apiserver LB port (currently 6443 hardcoded) configurable. **Anything else you would like to add:** N/A **Environment:** - Wardroom...

Ability to filter admin API output

2

### Description Would be useful to have the ability to filter the queries to the admin API for endpoints that return all items of a type. Open to ideas how...