emissary-ingress / emissary

open source Kubernetes-native API gateway for microservices built on the Envoy Proxy
https://www.getambassador.io
Apache License 2.0
4.33k stars 682 forks source link

"cert_required" property configurable per path (not only for the whole Host) #5502

Open juanjoku opened 7 months ago

juanjoku commented 7 months ago

Please describe your use case / problem.

Currently, Emissary allows configuring the "cert_required" property for each Host (well, or for a TLSContext configured for a Host). But it may be interesting that this "cert_required" can be configured for specific paths within the host.

For example:

Describe the solution you'd like

Allow, at the Mapping level, to indicate whether the client certificate is optional or required.

Or is this feasible with Emisary, and I have not found how do it? !!

Additional context

For example, this is possible using NGINX (its equivalent "ssl_verify_client" property can be adjusted for each path in the same host)