-
Notifications
You must be signed in to change notification settings - Fork 5.3k
Description
Title: Exchange arbitrary metadata during TLS handshake or some other process
Description:
In order for Envoy to produce rich telemetry about details of source and destination workloads, we need a mechanism to exchange this information.
As an example, Istio telemetry produces highly dimensioned metrics that identify source and destination of the traffic. The metrics are dimensioned using source and destination metadata such as NodeID and labels associated with the pods or VMs.
For HTTP this can be achieved easily by forwarding the node metadata to destination in a well-known header, and the destination responding with its own header.
Even though the above solution works, it needlessly sends the same information over and over with every request.
For TCP this does not work, and we have to rely on ip address to metadata mapping at the destination and source.
Options:
- When mTLS is used, it gives us a way exchange this metadata up front.
If there is a way to add metadata during TLS handshake, it works. - Use Ha
Proxy protocolto exchange this information. Not sure if it works both ways. - https://www.akamai.com/us/en/multimedia/documents/technical-publication/tls-aux-associating-auxiliary-data-tls-connections.pdf