Client TLS authentication (proto)

This extension has the qualified name envoy.filters.network.client_ssl_auth

Note

This extension is only available in contrib images.

Note

This extension is intended to be robust against untrusted downstream traffic. It assumes that the upstream is trusted.

Tip

This extension extends and can be used with the following extension category:

Client TLS authentication configuration overview.

extensions.filters.network.client_ssl_auth.v3.ClientSSLAuth

[extensions.filters.network.client_ssl_auth.v3.ClientSSLAuth proto]

{
  "auth_api_cluster": ...,
  "stat_prefix": ...,
  "refresh_delay": {...},
  "ip_white_list": []
}
auth_api_cluster

(string, REQUIRED) The cluster manager cluster that runs the authentication service. The filter will connect to the service every 60s to fetch the list of principals. The service must support the expected REST API.

stat_prefix

(string, REQUIRED) The prefix to use when emitting statistics.

refresh_delay

(Duration) Time in milliseconds between principal refreshes from the authentication service. Default is 60000 (60s). The actual fetch time will be this value plus a random jittered value between 0-refresh_delay_ms milliseconds.

ip_white_list

(repeated config.core.v3.CidrRange) An optional list of IP address and subnet masks that should be white listed for access by the filter. If no list is provided, there is no IP allowlist.