TCPProxy usage example

[stasmir]

Hi,

Could you please elaborate on a tcpproxy usage?
What are the cases to use 'tcpproxy' with tls passthrough (true or false) instead of 'routes' option?
It is not clear from https://projectcontour.io/docs/v1.23.2/config/tls-termination/ why it may be necessary to use tcpproxy?

Is the difference between passthrough options 'true' and 'false' the place of TLS termination only (a pod or a load-balancer level)?

[sunjayBhatia]

What are the cases to use 'tcpproxy' with tls passthrough (true or false) instead of 'routes' option?

Some users have used this when they want their backend to terminate tls or in order to proxy protocols other than HTTP

Is the difference between passthrough options 'true' and 'false' the place of TLS termination only (a pod or a load-balancer level)?

passthrough: true means TLS will be terminated at the backend pod, passthrough: false means Envoy will terminate TLS and forward the unencrypted TCP stream to the backend (or re-encrypt the stream using upstream TLS settings: https://projectcontour.io/docs/v1.24.0/config/upstream-tls/)

[dimashenkov]

@sunjayBhatia is this enough to expose tcp service ? I have difficulties , traffic on 443 and 80 works but on port 4222 cant pass through

apiVersion: projectcontour.io/v1
kind: HTTPProxy
metadata:
  name: nats-server-nats-blackpearl-dev-product-frankfurt-****-cloud
  namespace: blackpearl
  labels:
    argocd.argoproj.io/instance: nats-blackpearl-qa
spec:
  ingressClassName: contour-private
  tcpproxy:
    healthCheckPolicy:
      healthyThresholdCount: 5
      intervalSeconds: 5
      timeoutSeconds: 2
      unhealthyThresholdCount: 3
    services:
      - name: nats-server
        port: 4222
  virtualhost:
    fqdn: nats.blackpearl.dev.product.frankfurt.****.cloud
    tls:
      secretName: wildcard-tls

kc get svc -n contour-private                  
NAME                    TYPE           CLUSTER-IP       EXTERNAL-IP                                                                        PORT(S)                                     AGE
contour-private         ClusterIP      172.20.223.171   <none>                                                                             8001/TCP                                    5h55m
contour-private-envoy   LoadBalancer   172.20.236.186   a34aabb*********-020698b179c02278.elb.eu-central-1.amazonaws.com   80:31661/TCP,443:30803/TCP,4222:31010/TCP