Envoy config that demonstrates how to use the TLS inspector to route traffic to differently for TLS and non TLS connections with client cert validation for TLS

envoy-tls-inspector-tls-plaintext.yaml

static_resources:
  listeners:
    - name: mylistener
      address:
        socket_address:
          protocol: TCP
          address: 0.0.0.0
          port_value: 20443
      listener_filters:
        - name: tls_inspector
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector

      filter_chains:
        - name: tls
          transport_socket:
            name: tls
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
              require_client_certificate: true
              common_tls_context:
                validation_context:
                  trusted_ca:
                    filename: /tmp/root.cer
                #alpn_protocols: h2
                tls_certificates:
                  - certificate_chain:
                      filename: /tmp/tls.crt
                    private_key:
                      filename: /tmp/tls.key
                tls_params:
                  cipher_suites: [ "ECDHE-ECDSA-AES128-GCM-SHA256",
                                   "ECDHE-RSA-AES128-GCM-SHA256",
                                   "ECDHE-ECDSA-AES256-GCM-SHA384",
                                   "ECDHE-RSA-AES256-GCM-SHA384",
                                   "AES128-GCM-SHA256",
                                   "AES256-GCM-SHA384" ]
          filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stream_idle_timeout: 0s
                access_log:
                  - name: envoy.access_loggers.stdout
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
                codec_type: AUTO
                stat_prefix: ingress_https
                route_config:
                  virtual_hosts:
                    - name: default
                      domains: "*"
                      routes:
                        - match:
                            prefix: "/content"
                          route:
                            cluster: content-cluster
                            timeout: 1s
                        - match:
                            prefix: "/grpc.reflection.v1alpha.ServerReflection/"
                          route:
                            cluster: grpc-cluster
                http_filters:
                  - name: envoy.filters.http.router
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

        - name: plaintext
          filters:
            - name: tcp_proxy
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
                stat_prefix: plaintext
                cluster: content-cluster
#              typed_config:
#                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
#                stream_idle_timeout: 0s
#                codec_type: AUTO
#                stat_prefix: plaintext
#                route_config:
#                  name: local_route
#                  virtual_hosts:
#                    - name: http
#                      domains:
#                        - "*"
#                      routes:
#                        - match:
#                            prefix: "/health/"
#                          route:
#                            cluster: content-cluster
#                            timeout: 20s
#                http_filters:
#                  - name: envoy.filters.http.router
#                    typed_config:
#                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router               

      filter_chain_matcher:
        matcher_tree:
          input:
            name: transport
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.matching.common_inputs.network.v3.TransportProtocolInput
          exact_match_map:
            map:
              "tls":
                action:
                  name: tls
                  typed_config:
                    "@type": type.googleapis.com/google.protobuf.StringValue
                    value: tls
        on_no_match:
          action:
            name: plaintext
            typed_config:
              "@type": type.googleapis.com/google.protobuf.StringValue
              value: plaintext



  clusters:
    - name: grpc-cluster
      connect_timeout: 2s
      type: STRICT_DNS
      dns_lookup_family: V4_ONLY
      lb_policy: ROUND_ROBIN
      http2_protocol_options: {}
      load_assignment:
        cluster_name: grpc-cluster
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: localhost
                      port_value: 3001
      #for TLS to the upstream
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          # https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ssl
          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
      health_checks:
        timeout: 1s
        interval: 100s
        unhealthy_threshold: 2
        healthy_threshold: 2
        grpc_health_check: {}
    
    - name: content-cluster
      connect_timeout: 20s
      type: STRICT_DNS
      dns_lookup_family: V4_ONLY
      lb_policy: ROUND_ROBIN
      load_assignment:
        cluster_name: content-cluster
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: localhost
                      port_value: 3333
      # for TLS to the upstream
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          # https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ssl
          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
      health_checks:
        timeout: 1s
        interval: 100s
        unhealthy_threshold: 2
        healthy_threshold: 2
        http_health_check:
          path: "/health"