Use Case - Front Proxy with mTLS #88
Description
Last meeting we discussed providing some use cases on how people are deploying Envoy in production. We have somewhat of an interesting use case I thought I would share.
We deploy Envoy as a front proxy that sits behind a CDN. Our Envoy Proxy sits behind a network load balancer and has one TLS listener that requires all connections present a client certificate signed by the Cloudflare CA. Many CDN providers, such as Cloudflare and Fastly, provide a way to authenticate origin requests using a CA/self-signed certificate. See the Cloudflare Authenticated Origin Pulls documentation for additional details. This provides similar benefits as deploying Envoy as a sidecar with mTLS; only requests that originate from the CDN provider with a valid certificate will be accepted by the Envoy Proxy.
This affords a few benefits as a front proxy:
- Requires all requests come from the CDN provider (Cloudflare, etc.). If someone does manage to discovery a load balancer DNS record they cannot spoof headers/etc.
- Forcing requests through the CDN provider also ensures requests are filtered by the WAF and DDOS protection is applied by the CDN.
Happy to discuss any specific challenges on getting this deployed and configured correctly, but this is one of our use cases.
Example
An example listener would look something like this:
static_resources:
listeners:
- address:
socket_address:
address: 0.0.0.0
port_value: 8443
listener_filters:
- name: "envoy.filters.listener.tls_inspector"
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
per_connection_buffer_limit_bytes: 32768 # 32 KiB
access_log:
- name: envoy.access_loggers.stdout
typed_config:
"@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
filter_chains:
- filters:
- name: envoy.filters.network.http_connection_manager
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
codec_type: AUTO
stat_prefix: ingress_tls
rds:
route_config_name: ingress_tls
config_source:
api_config_source:
api_type: REST
transport_api_version: V3
cluster_names:
- xds_proxy
refresh_delay: 10s
http_filters:
- name: envoy.filters.http.router
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
transport_socket:
name: envoy.transport_sockets.tls
typed_config:
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
require_client_certificate: true
common_tls_context:
tls_certificates:
- certificate_chain:
filename: /etc/envoy/certs/certificate.pem
private_key:
filename: /etc/envoy/certs/key.pem
validation_context:
trusted_ca:
filename: /etc/envoy/certs/ca.pem
trust_chain_verification: VERIFY_TRUST_CHAIN