Envoy IP tagging support

projectcontour / contour

Contour is a Kubernetes ingress controller using Envoy proxy.

https://projectcontour.io

Apache License 2.0

3.7k stars 671 forks source link

Envoy IP tagging support #1690

Closed bgagnon closed 1 month ago

bgagnon commented 4 years ago

We have a need for geo-location of incoming client requests for application routing decisions. Contour supports source IP preservation in various ways, including the PROXY protocol.

We think we can leverage Envoy's IP tagging filter for this, but it is not currently available from Contour.

I understand this is really a niche request, but I figured I'd file an issue anyway, as suggested by @youngnick.

bgagnon commented 4 years ago

We have an extra requirement that makes this even more niche: the CIDRs for the tags are changing often enough in our network that we need to automatically refresh this information from the control plane, without interrupting Envoy on the data plane.

This feature could be generalized to support public geo IP databases (like Maxmind) that would also benefit from periodic automated updates.

In a nutshell, the effect for users of Contour is an extra header in the HTTP requests that reach their upstream service and pods. This extra header geo-locates the incoming client request by subnet/site/city/country/continent or whatever granularity is needed.