Change to use APPEND_FORWARD for terminating gateway

Signed-off-by: Mark Anderson <manderson@hashicorp.com>
This commit is contained in:
Mark Anderson 2022-05-03 13:57:57 -07:00
parent 6430af1c0e
commit 863bc16530
1 changed files with 2 additions and 3 deletions

View File

@ -1153,9 +1153,8 @@ func (s *ResourceGenerator) makeFilterChainTerminatingGateway(
if meshConfig := cfgSnap.MeshConfig(); meshConfig == nil || meshConfig.HTTP == nil || !meshConfig.HTTP.SanitizeXForwardedClientCert { if meshConfig := cfgSnap.MeshConfig(); meshConfig == nil || meshConfig.HTTP == nil || !meshConfig.HTTP.SanitizeXForwardedClientCert {
opts.forwardClientDetails = true opts.forwardClientDetails = true
// Note: filter Connection may not be mTLS, so then ALWAYS_FORWARD_ONLY. For mTLS connections we might want APPEND_FORWARD. // This assumes that we have a client cert (mTLS) (implied by the context of this function)
// Open question; how do I determine if this is mTLS or not? opts.forwardClientPolicy = envoy_http_v3.HttpConnectionManager_APPEND_FORWARD
opts.forwardClientPolicy = envoy_http_v3.HttpConnectionManager_ALWAYS_FORWARD_ONLY
} }
} }