One Size Doesn’t Fit All: Adding Org-Specific Gateway API Extensions with Envoy Gateway
summary
Demonstrates building an extension server that implements Envoy Gateway’s gRPC hooks (post-translate, XDS route/cluster/listener) to mutate XDS: it adds a hard-coded Spire agent cluster (UDS/TCP) and injects an SDS secret config into upstream TLS transport_sockets, forming a Spiffe SVID from CRD fields. The demo defines a custom backend MTLS policy CRD, deploys the extension server (sidecar or separate pod via Helm), verifies via config-dump, and shows the echo backend receiving a client certificate.
AI-written summary · about
chapters (13)
- 0:00Gateway API and Envoy Gateway
- 3:30Why use extension servers
- 6:19What is an extension server
- 9:49Extension server resources
- 13:23Demo overview
- 16:15Zero trust architecture
- 20:11Initial state inspection
- 22:18Custom backend MTLS policy
- 23:46Configuring extensions
- 25:10Developing the server
- 28:41Deploying the server
- 30:29End-to-end demo
- 31:11Q&A
related talks
33mOne Size Doesn’t Fit All: Adding Org-Specific Gateway API Extensions with Envoy Gateway
26mSecuring the Gateway: A Deep Dive Into Envoy Gateway's Advanced Security Pol...
11mLightning Talk: Building a Scalable Multi-Protocol API Gateway with Envoy
21mDeep Dive: Envoy
29mgRPC load balancing and Service Mesh
31mBehind the Scenes of Building a Gateway API Dataplane...
33mEnvoy Gateway Project Update
38mEnvoy Deep Dive