postgres: add ability to terminate SSL at Envoy by cpakulski · Pull Request #14634 · envoyproxy/envoy

cpakulski · 2021-01-11T19:33:16Z

Commit Message:
Adds ability to use starttls transport socket to terminate SSL at Envoy and pass unencrypted traffic upstream to Postgres server.

Additional Description:
Risk Level: Low
Testing: Added unit and integration tests.
Docs Changes: Yes.
Release Notes: Yes.
Fixes #10942

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Signed-off-by: Christoph Pakulski <christoph@tetrate.io> Co-authored-by: Fabrízio de Royes Mello <fabrizio@ongres.com>

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

repokitteh-read-only · 2021-01-11T19:33:23Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to api/envoy/.
API shepherd assignee is @htuch
CC @envoyproxy/api-watchers: FYI only for changes made to api/envoy/.

🐱

Caused by: #14634 was opened by cpakulski.

see: more, trace.

api/envoy/extensions/filters/network/postgres_proxy/v3alpha/postgres_proxy.proto

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

fabriziomello · 2021-01-12T13:31:26Z

@cpakulski As you already know I did a lot of tests against this new implementation using Postgres regression test suite. But need to test more cases: replication and authentication using client certificates (testing it today).

htuch

/lgtm api

source/extensions/filters/network/postgres_proxy/postgres_filter.cc

source/extensions/filters/network/postgres_proxy/postgres_decoder.cc

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

cpakulski · 2021-01-31T15:12:06Z

/retest

repokitteh-read-only · 2021-01-31T15:12:10Z

Retrying Azure Pipelines:
Check envoy-presubmit isn't fully completed, but will still attempt retrying.
Retried failed jobs in: envoy-presubmit

🐱

Caused by: a #14634 (comment) was created by @cpakulski.

see: more, trace.

cpakulski · 2021-02-01T14:39:55Z

/retest

repokitteh-read-only · 2021-02-01T14:40:00Z

Retrying Azure Pipelines:
Retried failed jobs in: envoy-presubmit

🐱

Caused by: a #14634 (comment) was created by @cpakulski.

see: more, trace.

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

dio

Looks good. Observed bad merging in the version history.

dio · 2021-02-02T10:03:35Z

docs/root/version_history/current.rst

 * http: change frame flood and abuse checks to the upstream HTTP/2 codec to ON by default. It can be disabled by setting the `envoy.reloadable_features.upstream_http2_flood_checks` runtime key to false.
 * overload: add support for scaling :ref:`transport connection timeouts<envoy_v3_api_enum_value_config.overload.v3.ScaleTimersOverloadActionConfig.TimerType.TRANSPORT_SOCKET_CONNECT>`. This can be used to reduce the TLS handshake timeout in response to overload.
+* postgres: added ability to :ref:`terminate SSL<envoy_v3_api_field_extensions.filters.network.postgres_proxy.v3alpha.PostgresProxy.terminate_ssl>`.
+* server: added :ref:`fips_mode <statistics>` statistic.


Bad merging?

Corrected. Thanks for catching it!

source/extensions/filters/network/postgres_proxy/postgres_decoder.cc

source/extensions/filters/network/postgres_proxy/postgres_decoder.h

test/extensions/filters/network/postgres_proxy/postgres_integration_test.cc

fabriziomello · 2021-02-02T11:55:56Z

And all Postgres regression are OK with last commits of this PR: https://github.com/fabriziomello/envoy-postgres-regression/runs/1810089899?check_suite_focus=true

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

dio · 2021-02-02T21:53:04Z

@cpakulski sorry, another sync to main?

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

dio

Thanks, awesome work! @fabriziomello I think we need to pull in the regression test to be part of the envoy test suite, as mentioned before, probably verify_examples is one of the possible places to do so.

cpakulski · 2021-02-02T22:59:02Z

Thanks @dio for reviewing and valuable comments!

cpakulski · 2021-02-03T00:02:43Z

/retest

repokitteh-read-only · 2021-02-03T00:02:47Z

Retrying Azure Pipelines:
Retried failed jobs in: envoy-presubmit

🐱

Caused by: a #14634 (comment) was created by @cpakulski.

see: more, trace.

fabriziomello · 2021-02-03T13:23:42Z

Thanks, awesome work! @fabriziomello I think we need to pull in the regression test to be part of the envoy test suite, as mentioned before, probably verify_examples is one of the possible places to do so.

Are you meant here? https://github.com/envoyproxy/envoy/tree/main/examples/postgres

dio · 2021-02-05T05:48:43Z

@fabriziomello yes.

cpakulski and others added 8 commits January 4, 2021 17:18

Initial implementaion of SSL termination for postgres filter.

dd5f741

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Added stat entry to monitor number of terminated SSL sessions.

1cab4e4

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Add config option to control terminating SSL.

b5e5d2a

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Added integration tests.

4a045f1

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Updated documentation.

b219b5c

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Merge branch 'master' into issue/10942

0a03c21

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Added release notes.

198df34

Signed-off-by: Christoph Pakulski <christoph@tetrate.io> Co-authored-by: Fabrízio de Royes Mello <fabrizio@ongres.com>

Removed unnecessary log message.

46cfa39

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

repokitteh-read-only bot added the api label Jan 11, 2021

repokitteh-read-only bot assigned htuch Jan 11, 2021

htuch reviewed Jan 11, 2021

View reviewed changes

api/envoy/extensions/filters/network/postgres_proxy/v3alpha/postgres_proxy.proto Outdated Show resolved Hide resolved

htuch reviewed Jan 11, 2021

View reviewed changes

api/envoy/extensions/filters/network/postgres_proxy/v3alpha/postgres_proxy.proto Outdated Show resolved Hide resolved

htuch reviewed Jan 11, 2021

View reviewed changes

api/envoy/extensions/filters/network/postgres_proxy/v3alpha/postgres_proxy.proto Show resolved Hide resolved

cpakulski added 4 commits January 11, 2021 23:41

Adjusted api and docs.

3eb29f8

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Merge branch 'master' into issue/10942

19d7abc

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Moved release note to 1.18.

de02783

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Adjusted config to reflect changes to postgres proto api.

181d374

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

cpakulski marked this pull request as ready for review January 12, 2021 02:59

cpakulski requested a review from dio as a code owner January 12, 2021 02:59

htuch reviewed Jan 13, 2021

View reviewed changes

repokitteh-read-only bot removed the api label Jan 13, 2021

htuch mentioned this pull request Jan 13, 2021

Migrate FixedHeap resource monitor to api v3 #12841

Closed

Base automatically changed from master to main January 15, 2021 23:02

dio reviewed Jan 19, 2021

View reviewed changes

source/extensions/filters/network/postgres_proxy/postgres_filter.cc Show resolved Hide resolved

dio reviewed Jan 19, 2021

View reviewed changes

source/extensions/filters/network/postgres_proxy/postgres_decoder.cc Show resolved Hide resolved

Updated proto and code with correct links to documentation.

2dc4fdc

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

repokitteh-read-only bot added the api label Jan 21, 2021

Merge remote-tracking branch 'upstream/main' into issue/10942_1

515296d

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

cpakulski added 2 commits January 30, 2021 00:51

Kick CI

2ccf95c

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Fixed compile error in unit test.

6f6eea6

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Merge branch 'master' into issue/10942_1

70ce13d

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

cpakulski requested a review from dio February 1, 2021 22:41

dio reviewed Feb 2, 2021

View reviewed changes

cpakulski added 2 commits February 2, 2021 15:20

Corrected release notes after merge from main.

3965861

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Merge branch 'master' into issue/10942_1

7070e4d

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

cpakulski requested a review from dio February 2, 2021 21:10

Merge branch 'master' into issue/10942_1

fa261a8

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

dio approved these changes Feb 2, 2021

View reviewed changes

cpakulski requested a review from lizan February 3, 2021 23:05

lizan approved these changes Feb 11, 2021

View reviewed changes

lizan merged commit 1aa31dd into envoyproxy:main Feb 11, 2021

riptl mentioned this pull request Jan 13, 2022

postgres: Support StartTLS upstream and plain-text downstream #19527

Closed

AnindyaKrDas mentioned this pull request Oct 29, 2025

Envoy tls_inspector: parseClientHello failed (WRONG_VERSION_NUMBER) for PostgreSQL clients using native SSLRequest; Gateway TLS listener rejects connection (no matching filter chain) #41760

Closed

Licht-T mentioned this pull request Mar 23, 2026

mysql_proxy: MySQL SSL termination #44089

Open

clubanderson mentioned this pull request Mar 24, 2026

🌱 envoy: Postgres filter: implement Postgres SSL termination and monitoring kubestellar/console-kb#1709

Merged

Conversation

cpakulski commented Jan 11, 2021

Uh oh!

repokitteh-read-only bot commented Jan 11, 2021

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fabriziomello commented Jan 12, 2021

Uh oh!

htuch left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cpakulski commented Jan 31, 2021

Uh oh!

repokitteh-read-only bot commented Jan 31, 2021

Uh oh!

cpakulski commented Feb 1, 2021

Uh oh!

repokitteh-read-only bot commented Feb 1, 2021

Uh oh!

dio left a comment

Choose a reason for hiding this comment

Uh oh!

dio Feb 2, 2021

Choose a reason for hiding this comment

Uh oh!

cpakulski Feb 2, 2021

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fabriziomello commented Feb 2, 2021

Uh oh!

dio commented Feb 2, 2021

Uh oh!

dio left a comment

Choose a reason for hiding this comment

Uh oh!

cpakulski commented Feb 2, 2021

Uh oh!

cpakulski commented Feb 3, 2021

Uh oh!

repokitteh-read-only bot commented Feb 3, 2021

Uh oh!

fabriziomello commented Feb 3, 2021

Uh oh!

dio commented Feb 5, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants