Using Envoy as an Egress Proxy for TLS Enabled Traffic
summary
Combines Envoy with the open‑source SSLproxy (github.com/sonertari/SSLproxy) to perform TLS man‑in‑the‑middle for egress: iptables redirect sends outbound TLS to SSLproxy on port 8443, SSLproxy forges ephemeral certs, decrypts traffic and injects an SSLproxy protocol header to forward plaintext to Envoy listening on port 10090. Implements an Envoy SSLproxy listener filter that parses client/destination metadata so Envoy sees original source/dst and emits telemetry (demo with Istio bookinfo fetching forbes.com shows hostname, URL and source info). Works for observability; CA distribution and upstreaming remain open.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:49Cloud-Native Applications Bring New Security Challenges
- 2:27Egress Connectivity is Must to Have for Modern Microservice Applications rely on external services for critical part of their functionality
- 4:25Envoy's Limitations For Egress Security and Proposed Solut
- 5:38SSL Proxy for Deep SSL Inspection
- 7:02Using SSL Proxy for Egress TLS Interception
- 9:44Enabling Envoy to Intercept Egress TLS with SSL Proxy SSL Proxy provides MITM and Enables Envoy Traffic Management & Security for TLS
- 11:53Envoy Extension - SSL Proxy Listener Filter SSL Proxy Listener Fiter Provides Interface to SSL Prowy
- 14:50ISTIO Control Plane Integration Using EnvoyFilter CRD Configures Envoy as transparent proxy for Observability Mode Only
- 21:12Open Items & Next Steps
related talks
11mLightning Talk: Building a Scalable Multi-Protocol API Gateway with Envoy
39mNetwork Observability with Envoy
42mAccelerating Envoy with the Linux Kernel
26mDisrupting Malicious Traffic with Egress Proxies
36mEnhancing Envoy: Certificate Handling at the Edge
12mLightning Talk: Leveraging Envoy's New Filter Chain Matchers for Advanced TLS Rou...
21mDeep Dive: Envoy
36mEnhancing Envoy: Certificate Handling at the Edge