aws / aws/aws-app-mesh-roadmap
Feature Request: Ability to use App Mesh envoy as a HTTPS proxy
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 344
- Forks
- 24
- PR merge metrics
- No merged PRs in 30d
Description
Tell us about your request
Currently, we use App Mesh for SDN within our ECS Fargate estate. We have a number of ECS services communicating over HTTP backends, wherein the TLS connection is handled envoy>envoy. We also have a number of backends to domains on the internet that are handled using TCP backends with custom ports (because App Mesh can't handle multiple TCP backends on the same port (https://github.com/aws/aws-app-mesh-roadmap/issues/195)). However, we have a third use case where, due to, for example, a prebuilt library, the application is set to call 443 over HTTPS and we can't customise that port or protocol. This currently results in us having to set 443 as an exempted port for proxying which is not the desired behaviour. Putting aside the ability to connect to multiple TCP endpoints on the same port, it would be useful to have the ability to use Envoy as a HTTPS proxy (service --https--> envoy ---https---> target) in order to resolve this, which is something I believe the core envoy supports.
Which integration(s) is this request for?
ECS on Fargate.
Are you currently working around this issue?
Exempting 443 as a proxy port on the ECS service/s.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository files, tests, or entry points are named in the request. Start by locating the App Mesh ECS on Fargate proxy configuration and any Envoy integration documentation, then determine how HTTPS proxying is exposed and tested. Done means applications can use HTTPS on port 443 through Envoy to HTTPS internet targets without exempting that port.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100