TCP TLS SNI routing

[omersiar]

Hello Everyone,

Like an HAproxy (OpenShift Route), can network packages be routed based on TLS SNI? This way required instances would be reduced and cost would decreased.

TLS Service Name Indication actually works well for non-HTTP traffic as well

[ted-ross]

This is an interesting idea. It is not supported currently but we've talked about adding something like this in the context of the Protocol Observer functionality that is being developed. In this case, a protocol field like SNI (or HTTP hostname) could be pulled out of the initial handshake and used to map to a routing-key.

Do you have more specifics on how you would use such a feature?

[omersiar]

Specifically, Apache Kafka with Mutual TLS (mTLS). Strimzi project already utilizing OCP Route if the Kafka Cluster is secured with mTLS, it creates service and route (passthrough TLS) for each broker. I am also assuming Client Hello for the mTLS and TLS has the same properties, so it would be the same for TLS as well.

So the network packages from Kafka clients can connect through Virtual IP > HAproxy > Single Pod routed based on SNI

An easy hack can be redirecting packages to the Virtual IP (or ideally OCP Router's internal service), although this would open up other services to the clients but can be mitigated introducing "allowed hostnames" annotation maybe, which is not ideal.