Pilot needs to generate LDSv2 response with 2 almost exact filter chains (one for TCP, one for TLS with tls_context) for each port, instead of 1 filter chain in case without multiplexing, e.g.

listeners:
- address:
    socket_address: { address: 127.0.0.1, port_value: 10000 }
  listener_filters:
  - name: "envoy.listener.tls_inspector"
    config: {}
  filter_chains:
  - filter_chain_match:
      # transport_protocol: "TCP" # still being decided
    filters:
    - name: envoy.http_connection_manager
      config:
        stat_prefix: ingress_http
        codec_type: AUTO
        route_config:
          name: local_route
          virtual_hosts:
          - name: local_service
            domains: ["*"]
            routes:
            - match: { prefix: "/" }
              route: { host_rewrite: www.google.com, cluster: service_google }
        http_filters:
        - name: envoy.router
  - filter_chain_match:
      # transport_protocol: "TLS" # still being decided
    tls_context:
      common_tls_context:
        tls_certificates:
        - certificate_chain: { filename: "test/common/ssl/test_data/san_dns_cert.pem" }
          private_key: { filename: "test/common/ssl/test_data/san_dns_key.pem" }
    filters:
    - name: envoy.http_connection_manager
      config:
        stat_prefix: ingress_http
        codec_type: AUTO
        route_config:
          name: local_route
          virtual_hosts:
          - name: local_service
            domains: ["*"]
            routes:
            - match: { prefix: "/" }
              route: { host_rewrite: www.google.com, cluster: service_google }
        http_filters:
        - name: envoy.router

On the Envoy side, those are the PRs that might be of interest, but you don't need them for config generation, really:

TLS sniffing PR (superseded by the one below): listener: add TLS inspector listener filter. envoyproxy/envoy#2949
TLS sniffing PR that uses BoringSSL instead of parsing bytes: listener: add TLS inspector listener filter. envoyproxy/envoy#3062
Filter chain selection PR: listener: add support for multiple filter chains. envoyproxy/envoy#3217

Enable incremental mTLS adoption by using envoy TLS/TCP port multiplexing feature #5059

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions