End User Certificate Authentication

Security
3

Yes, this is how we modeled it:

  1. Request from client comes in to Ingress Gateway
  2. Ingress Gateway checks certificate fingerprint against a whitelist
    2.1) If fingerprint exists in whitelist (populated by a secret), request enters the cluster
    2.2) If fingerprint doesn’t exist, request is rejected

My investigation has led me to either an EnvoyFilter (native to Istio/Envoy) or using Gloo with a function level route that will check this, however, I’d like to keep Istio’s Ingress Gateway if possible.