The idea is that the client establishes TLS connection "directly" with the backend service, without TLS termination at the proxy, i.e. Envoy is simply doing L4 proxying of TCP packets.

However, instead of making routing decisions only based on the listening and/or destination IP:port, we want to take advantage of the fact that the ClientHello (i.e. first message in the TLS handshake) is unencrypted and contains useful information (i.e. ALPN and SNI) to make routing decisions based on that as well.

e.g.

"listeners": [
  {
    "address": "tcp://0.0.0.0:443",
    "filters": [
      {
        "name": "tcp_proxy",
        "config": {
          "stat_prefix": "smart_tcp",
          "route_config": {
            "routes": [
              {
                "domains": [ "google.com", "*.google.com" ],
                "cluster": "service_google"
              },
              {
                "domains": [ "*.appspot.com" ],
                "cluster": "service_app_engine"
              }
            ]
          }
        }
      }
    ]
  }
]

In such scenario, neither the client nor the backend has to trust the proxy, which at this point is just another hop.

SNI-based routing without TLS termination #1843

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions