As a part of evulating consul as a service mesh, I’m trying to figure out how to forward the mTLS identity to the workload (for authorization purposes within the workload). Support for this was as far as I know added to envoy in version 1.11, but I can’t figure out how to configure this in consul. R…

@eoftedal - I’m trying to do exactly the same thing as you. Did you manage to find a way? I’m wondering if the only option is to fully define entire listener configs for envoy_public_listener_json and envoy_listener_json via the escape hatch

[image] Envoy sidecar bootstrap config - add one line Consul In case it helps anyone, I configured a custom envoy_public_listener_json and used it with a proxy default . Steps: cat <<EOF | jq '. | @json' { "@type": "type.googleapis.com/envoy.config.listener.v3.Listene…

Configuring envoy to forward mTLS identity to workload as http header

Consul

byrneo December 1, 2021, 10:28am 3

Topic		Replies	Views
Identity awareness in Service Mesh Consul	3	741	January 6, 2022
Envoy sidecar bootstrap config - add one line Consul	7	2000	December 2, 2021
Is there a way to use the own TLS certificate in consul service mesh instead of the certficiates issued by consul? Consul	2	225	July 2, 2024
Configuring TLS versions and cipher suites when using Consul Connect Envoy Consul service-mesh	2	1941	November 18, 2020
Disabling mTLS in sidecar proxy Consul k8s , connect	3	1521	December 7, 2021

Configuring envoy to forward mTLS identity to workload as http header

Related topics