Egress HTTPS Metrics
@kflynn is already working on this.
Since Feb 29, 2024.
- Dominant language
- Go
- Stars
- 11.5k
- Forks
- 1.4k
- Avg merge
- 3d 22h
- Merged PRs (30d)
- 53
Description
### What problem are you trying to solve?
The rich metrics that Linkerd provides are rarely available for third party services such as `github.com` because the communication is encrypted from the application all the way to the third party service. The proxy never sees the unencrypted bits.
There should be some solution that allows the proxy to inspect outbound traffic from an application to a third party (or anything outside the mesh), export metrics for that communication and apply policy via service profiles.
### Requirements
- Changes to application code is okay.
- External service configuration is okay.
- Must fail encrypted when not in the mesh.
### Any alternatives you've considered?
- Modify applications to use http instead of https and configure the proxy to upgrade the connection - this has the potential for applications that are not meshed to fail in an unencrypted fashion.
- Add a trust root to the application's container and MITM the encrypted connection - this requires some potentially fragile modification to the application's controller.
- Use kTLS - this requires support in the application's client.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.