Envoy in TCP mode + TLS possible?

[Yaroslav Molochko]

The problem I'm solving at the moment is bunch of software which is not ready for cloud, without any sort of encryption, service discovery and so on. I need it to have service discovery and encryption out of the box by some "magic" and I suspect envoy could be handy here. The only thing I could not get from the documentation is whether you support stunnel like mode? Meaning you have TCP connection over SSL/TLS between daemons with service discovery and load balancing. That would be awesome! 

[Matt Klein]

Hi Yaroslav, 

Yes, Envoy can be used as a drop in stunnel replacement with service discovery, health checking, etc. (We use it in this mode at Lyft for some things). You would want a fairly basic configuration which exposes some # of listeners, proxies using the TCP proxy filter, and sets up some number of upstream clusters to proxy to. SSL can be configured independently for both downstream and upstream connections.

Thanks,

Matt

On Wed, Sep 28, 2016 at 9:38 PM, Yaroslav Molochko <ono...@gmail.com> wrote:

The problem I'm solving at the moment is bunch of software which is not ready for cloud, without any sort of encryption, service discovery and so on. I need it to have service discovery and encryption out of the box by some "magic" and I suspect envoy could be handy here. The only thing I could not get from the documentation is whether you support stunnel like mode? Meaning you have TCP connection over SSL/TLS between daemons with service discovery and load balancing. That would be awesome! 

--
You received this message because you are subscribed to the Google Groups "Envoy Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to envoy-users+unsubscribe@googlegroups.com.
To post to this group, send email to envoy...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/envoy-users/6cde6a42-96b0-4921-9188-99712b9132aa%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Matt Klein

Software Engineer

mkl...@lyft.com / 206.327.4515

[Yaroslav Molochko]

Thanks for the reply, that is awesome! 

четверг, 29 сентября 2016 г., 8:29:58 UTC-7 пользователь Matt Klein написал:

Hi Yaroslav, 

Yes, Envoy can be used as a drop in stunnel replacement with service discovery, health checking, etc. (We use it in this mode at Lyft for some things). You would want a fairly basic configuration which exposes some # of listeners, proxies using the TCP proxy filter, and sets up some number of upstream clusters to proxy to. SSL can be configured independently for both downstream and upstream connections.

Thanks,

Matt

On Wed, Sep 28, 2016 at 9:38 PM, Yaroslav Molochko <ono...@gmail.com> wrote:

The problem I'm solving at the moment is bunch of software which is not ready for cloud, without any sort of encryption, service discovery and so on. I need it to have service discovery and encryption out of the box by some "magic" and I suspect envoy could be handy here. The only thing I could not get from the documentation is whether you support stunnel like mode? Meaning you have TCP connection over SSL/TLS between daemons with service discovery and load balancing. That would be awesome! 

--
You received this message because you are subscribed to the Google Groups "Envoy Users" group.

To unsubscribe from this group and stop receiving emails from it, send an email to envoy-users...@googlegroups.com.

To post to this group, send email to envoy...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/envoy-users/6cde6a42-96b0-4921-9188-99712b9132aa%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.