Debugging Envoy Tunnels: A Deep Dive
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 11:00· Level 1 | Hall Entrance N10 | Room E·
summary
Adobe runs Envoy tunnels with mTLS across 60+ Azure clusters serving 31,000 customer environments and 200,000+ K8s deployments; this session reproduces failures with docker compose + curl demos, shows four concrete root causes—expired certificate, unrecognized CA, key/cert modulus mismatch, and connection overflow/rate limits—and walks through fixes: increase selective Envoy logging, inspect cert dates and issuers, run an OpenSSL modulus check, and monitor Grafana metrics. Source code for the demos is published on GitHub.
AI-written summary · about
chapters (8)
- 0:00Debugging Envoy tunnels
- 3:30Why Adobe needed Envoy tunnels
- 7:06MTLS setup for debugging
- 13:26Expired certificates debugging
- 16:43Unknown CA issues debugging
- 20:18Key mismatch debugging
- 25:25Rate limiting debugging
- 28:18Resources and closing
related talks
38mEnvoy Deep Dive
01h 25mCloud-Native Building Blocks: An Interactive Envoy Proxy Workshop
37mSecuring Cloud Native Communication, From End User to Service
21mDeep Dive: Envoy
29mUnderstanding, maintaining and securing Envoy's supply chain
23mUsing Envoy as an Egress Proxy for TLS Enabled Traffic
29mSpanning the Globe with Envoy at Stripe
29mEnvoy Gateway End User Threat Model Report: Raising Awarenes...