Skip to content

Instantly share code, notes, and snippets.

@skippy

skippy/edge-envoy.json

Last active November 18, 2017 23:52
Show Gist options
  • Save skippy/410197ac2d9e192e7af9458bcf5b469f to your computer and use it in GitHub Desktop.
Save skippy/410197ac2d9e192e7af9458bcf5b469f to your computer and use it in GitHub Desktop.
Download ZIP
failing ssl usage
Raw
edge-envoy.json
{
"listeners": [
{
"address": "tcp://0.0.0.0:443",
"ssl_context": {
"cert_chain_file": "/etc/envoy/cert/cert.crt",
"private_key_file": "/etc/envoy/cert/cert.key",
"ca_cert_file": "/etc/envoy/cert/cert.ca"
},
"filters": [
{
"type": "read",
"name": "http_connection_manager",
"config": {
"codec_type": "auto",
"generate_request_id": true,
"server_name": "",
"stat_prefix": "ingress_https",
"route_config": {
"virtual_hosts": [
{
"name": "backend",
"domains": ["*"],
"routes": [
{
"timeout_ms": 0,
"prefix": "/service-pdf/",
"prefix_rewrite": "/",
"cluster": "service-pdf"
}
]
}
]
},
"filters": [
{
"type": "both",
"name": "health_check",
"config": {
"pass_through_mode": false,
"endpoint": "/healthcheck"
}
},
{
"type": "decoder",
"name": "router",
"config": {}
}
],
"access_log": [
{
"path": "/dev/stdout"
}
]
}
}
]
}
],
"admin": {
"access_log_path": "/dev/stdout",
"address": "tcp://0.0.0.0:8001"
},
"cluster_manager": {
"clusters": [
{
"name": "service-pdf",
"connect_timeout_ms": 250,
"type": "logical_dns",
"service_name": "service-pdf",
"lb_type": "least_request",
"ssl_context": {
"ca_cert_file": "/etc/envoy/cert/cert.ca"
},
"hosts": [
{
"url": "tcp://service-pdf.default.svc.cluster.local:443"
}
]
}
]
}
}
Raw
output.sh
$ # the envoy version
$ kubectl exec <envoy_edge_pod_name> -- envoy --version
envoy version: fc5b5da4901b5e4ffb0307b98c30076f695ea962/Clean/RELEASE
$ # hitting the service-envoy directly from edge envoy
$ kubectl exec <envoy_edge_pod_name> -- curl --cacert /etc/envoy/cert/cert.ca -is https://service-pdf.default.svc.cluster.local/status.json
HTTP/1.1 200 OK
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-type: application/json; charset=utf-8
etag: W/"b0eb2270edbaee695628701ced790922"
cache-control: max-age=0, private, must-revalidate
x-request-id: d4b8a446-efa1-4b2e-ae06-bed7d77d9b4f
x-runtime: 0.002212
x-envoy-upstream-service-time: 3
date: Thu, 01 Jun 2017 03:09:38 GMT
server:
transfer-encoding: chunked
{"revision":"b5484f8","time":"2017-06-01T03:09:38.836Z","app_key":"service.pdf"}
$ # hitting the envoy-edge directly
$ curl -k $(minikube service --https --url envoy-internal)/service-pdf/status.json
upstream connect error or disconnect/reset before headers
$ #after servers have been restarted with the ssl_context removed
$ curl -i -k $(minikube service --https --url envoy-internal)/service-pdf/status.json
HTTP/1.1 200 OK
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-type: application/json; charset=utf-8
etag: W/"335be8e7ab9ca8d69dde9e7e0fb361f6"
cache-control: max-age=0, private, must-revalidate
x-request-id: 00416fed-9b60-4426-b9d2-d7f8bea67b94
x-runtime: 0.002838
x-envoy-upstream-service-time: 5
date: Thu, 01 Jun 2017 03:27:50 GMT
server:
transfer-encoding: chunked
{"revision":"b5484f8","time":"2017-06-01T03:27:50.869Z","app_key":"service.pdf"}
Raw
service-envoy-cert.ca
-----BEGIN CERTIFICATE-----
MIIDPjCCAiagAwIBAgIUJMw91+jtpX1/E8CNp4er4eoUt20wDQYJKoZIhvcNAQEL
BQAwJDEiMCAGA1UEAxMZZGVmYXVsdC5zdmMuY2x1c3Rlci5sb2NhbDAeFw0xNzA2
MDEwMzU1NDhaFw0yNzA1MzAwMzU2MThaMCQxIjAgBgNVBAMTGWRlZmF1bHQuc3Zj
LmNsdXN0ZXIubG9jYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDC
bW1hs2WQyfto71GouJZgnaUcl9SxBMeLTsQTO0R8q8DCVYUeIkrY1RZ+bxv7KOF1
yly69inaKn/0syeeAfBQsJtSvqXV0HrHgDfD+rdOl3bdLe8h/7prmpSJEhYveJJZ
TdGDPiEkaqwxSYVPZxCCdIAjKvhxQ8AkxyVU1/KC9pGnl+bUw0eCGDDr/PRM2BWe
rknFQlUAdJn6uEYFY1IyiKbrXsOA5PSyFmGA5XchM1tRgLiHKXtS0Zfifbdjc8Im
gKli5ZlEeFbg5Ih8hpM88/hnqy2nsAiErA2vFcTWlbCDHM33F2/9Dhu0UCx1jZ6z
ePSvL0MKhbScABpyMMgFAgMBAAGjaDBmMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB
Af8EBTADAQH/MB0GA1UdDgQWBBQfrYYUqi6RYBHZEesdFAiWSpdUCzAkBgNVHREE
HTAbghlkZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsMA0GCSqGSIb3DQEBCwUAA4IB
AQCaG2Mo1PW4corgfe1+tGMej6E2p7i+ApG5UNwFjATB7LNpdw2ey6GDWb/LBFFA
6oLor1duFAg5at0EcKb/7tMLa/K2Nk81WW0h+e8CAHydtVwtBnwOy/pIgR9uIWPy
YIX/Eo/AtFnPrKFLO0w8tOOEl/JEF7DKB/tTxP278Z3q6vD7FZE5IpkeBNgVq3bL
HKuCEPMjGBH1tJY52ySQQHPkbiEOVYvwasvdBm8JpRuYnWOmS/YZZIC4DZ8rZwBE
bNDGty10HCYvesDHbrL7mBYIfnt7MQYHfwHMjkBBWFfTeg20hvxO9sBaIW0ZqVb9
Yed8+/FgjJxMbK3DYw72wgAa
-----END CERTIFICATE-----
Raw
service-envoy-cert.crt
-----BEGIN CERTIFICATE-----
MIIDaTCCAlGgAwIBAgIUaz5FOp/ljP9/13KdOW3r2kj30vkwDQYJKoZIhvcNAQEL
BQAwJDEiMCAGA1UEAxMZZGVmYXVsdC5zdmMuY2x1c3Rlci5sb2NhbDAeFw0xNzA2
MDEwNDM0MDNaFw0xNzA2MDEwNjM0MzNaMDAxLjAsBgNVBAMTJXNlcnZpY2UtcGRm
LmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwwdjAQBgcqhkjOPQIBBgUrgQQAIgNi
AAQ55e4R6YIssDREmBSLj2DbXJ0JzBntG2NPgDO1L/zXGGgQdMyhBxHFzq+gYaWS
yjt/3TrtNVAgOZDat5DCK/Opk49HgknEPkwGnN1r5DqOJ6NhtARhbOKBnrejpP+H
t3ujggEzMIIBLzAOBgNVHQ8BAf8EBAMCA6gwHQYDVR0lBBYwFAYIKwYBBQUHAwEG
CCsGAQUFBwMCMB0GA1UdDgQWBBQURgZtnSZ7qVeKYA0ABb9q/relSTAfBgNVHSME
GDAWgBQfrYYUqi6RYBHZEesdFAiWSpdUCzBKBggrBgEFBQcBAQQ+MDwwOgYIKwYB
BQUHMAKGLmh0dHBzOi8vdmF1bHQ6ODIwMC92MS9wa2kvaW50ZXJuYWwtc2Vydmlj
ZXMvY2EwMAYDVR0RBCkwJ4Ilc2VydmljZS1wZGYuZGVmYXVsdC5zdmMuY2x1c3Rl
ci5sb2NhbDBABgNVHR8EOTA3MDWgM6Axhi9odHRwczovL3ZhdWx0OjgyMDAvdjEv
cGtpL2ludGVybmFsLXNlcnZpY2VzL2NybDANBgkqhkiG9w0BAQsFAAOCAQEAvBWx
Gf/VSUp2w1sjuOi7UYv794eii0VWVDwIVqwZmLIm61xQWzLi1l5Q6TQkeQ5iUoAm
tV4IeExd/fxyH2lnrxAB9BRb3GPCh8a9WwaVZB7jzNf6VPnvQdHP9fWwgBuJYwU8
Dek8nWYRS6F/zw/a5JM3Lym6mld8kirpfvvcXXi4KAIjuLeW6Noo3++3WARTWmFW
30z/xPSHd/T4Whe5p47094S3LKbCTjsFmDeL5oQR/DsRsJuUO3p4fT3k45Alsdhb
z2e2Tx00xSX9PmNE8toroBROG6upcTIvxED7oME38R4NncEfx/xI9/iRWhAEVWBL
Y6q1CWzSap3ehxOXGQ==
-----END CERTIFICATE-----
Raw
service-envoy-cert.key
-----BEGIN EC PRIVATE KEY-----
MIGkAgEBBDD0q5Oc/9+N6vshJn6uxpWnJHRIfR1vKN782A/evDPjYODCOxFSr8dC
Nc6eHxNPFm6gBwYFK4EEACKhZANiAAQ55e4R6YIssDREmBSLj2DbXJ0JzBntG2NP
gDO1L/zXGGgQdMyhBxHFzq+gYaWSyjt/3TrtNVAgOZDat5DCK/Opk49HgknEPkwG
nN1r5DqOJ6NhtARhbOKBnrejpP+Ht3s=
-----END EC PRIVATE KEY-----
Raw
service-envoy.json
{
"listeners": [
{
"address": "tcp://0.0.0.0:443",
"ssl_context": {
"alpn_protocols": "h2,http/1.1",
"alt_alpn_protocols": "http/1.1",
"cert_chain_file": "/etc/envoy/cert/cert.crt",
"private_key_file": "/etc/envoy/cert/cert.key",
"ca_cert_file": "/etc/envoy/cert/cert.ca"
},
"filters": [
{
"type": "read",
"name": "http_connection_manager",
"config": {
"codec_type": "auto",
"generate_request_id": true,
"add_user_agent": true,
"server_name": "",
"stat_prefix": "service-pdf",
"use_remote_address": true,
"route_config": {
"virtual_hosts": [
{
"name": "service-pdf",
"domains": ["*"],
"routes": [
{
"prefix": "/",
"cluster": "local-service"
}
]
}
]
},
"filters": [
{
"type": "both",
"name": "health_check",
"config": {
"pass_through_mode": false,
"endpoint": "/healthcheck"
}
},
{
"type": "decoder",
"name": "router",
"config": {}
}
],
"access_log": [
{
"path": "/dev/stdout"
}
]
}
}
]
}
],
"admin": {
"access_log_path": "/dev/stdout",
"address": "tcp://0.0.0.0:8001"
},
"cluster_manager": {
"clusters": [
{
"name": "local-service",
"service_name": "local-service",
"connect_timeout_ms": 250,
"type": "static",
"lb_type": "round_robin",
"hosts": [
{
"url": "tcp://127.0.0.1:3000"
}
],
"health_check": {
"type": "http",
"timeout_ms": 5000,
"interval_ms": 5000,
"interval_jitter_ms": 2000,
"unhealthy_threshold": 2,
"healthy_threshold": 2,
"path": "/status.json"
}
}
]
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment