MySQL proxy (proto)

This extension has the qualified name envoy.filters.network.mysql_proxy

Note

This extension is only available in contrib images.

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension is not hardened and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category:

extensions.filters.network.mysql_proxy.v3.MySQLProxy

{
  "stat_prefix": ...,
  "downstream_ssl": ...
}

stat_prefix: (string, REQUIRED) The human readable prefix to use when emitting statistics.

downstream_ssl: (extensions.filters.network.mysql_proxy.v3.MySQLProxy.SSLMode) Controls whether to terminate SSL sessions initiated by downstream clients. If enabled, the filter chain must use starttls transport socket. Defaults to DISABLE.

Downstream SSL operational modes.

DISABLE: (DEFAULT) ⁣Do not terminate SSL session initiated by a client. The MySQL proxy filter will pass all encrypted and unencrypted packets to the upstream server.

REQUIRE: ⁣The MySQL proxy filter will terminate SSL session initiated by a client and close downstream connections that do not initiate SSL. The filter will mediate caching_sha2_password RSA authentication when the upstream MySQL server requires full authentication over the plaintext connection. The filter chain must use starttls transport socket.

ALLOW: ⁣The MySQL proxy filter will accept downstream client’s encryption settings. If the client wants to use clear-text, Envoy will not enforce SSL encryption. If the client wants to use encryption, Envoy will terminate SSL and mediate caching_sha2_password RSA authentication when needed. The filter chain must use starttls transport socket.