tls proxy

The tls proxy binding detects ClientHello server_name extension to provide TLS virtual hosting by routing based on server name.

tls_proxy:
  type: tls
  kind: proxy

Configuration (* required)

vault

string

Vault name.

routes*

array of object

Conditional tls specific routes.

routes:
  - when:
      - alpn: echo
  exit: echo_server

routes[].guarded

object as map of named array of string

List of roles required by each named guard to authorize this route.

routes:
  - guarded:
      my_guard:
        - read:items

routes[].when

array of object

List of conditions (any match) to match this route. Read more: When a route matches

routes:
  - when:
      - alpn: echo

when[].authority

string

Associated authority.

when[].alpn

string

Application protocol.

when[].port

integer, string, array

Port number(s), including port number ranges.

routes[].exit

string

Next binding when following this route.

routes:
  - when:
    ...
    exit: echo_server

routes[].with

object

Client certificate selection for this route, evaluated before the TLS handshake completes. Rejected on server and proxy kind bindings.

routes:
  - guarded:
      x509:
        - client
    with:
      certificate:
        subject.cn: ${guarded['x509'].identity}

with.certificate*

object

Selects the vault key whose certificate to present when the far end requests client authentication, matching exactly one of subject.cn or subject.dn against each candidate certificate. When more than one candidate matches, the candidate with the latest notBefore is selected, breaking ties on thumbprint. When no candidate matches, no certificate is presented. When with.certificate is omitted, falls back to selecting a certificate using the secure.name info of the inbound stream.

certificate.subject.cn

string

Matches the subject common name of a candidate certificate. Supports dynamic parameter substitution using the following pattern:

• ${guarded['x509'].identity} – Substitutes a guarded identity value.
• ${guarded['x509'].attributes.*} – Substitutes a guarded attribute value.

certificate.subject.dn

string

Matches the subject distinguished name of a candidate certificate. Literal values are canonicalized when the configuration is loaded. Supports dynamic parameter substitution using the following pattern:

• ${guarded['x509'].identity} – Substitutes a guarded identity value.
• ${guarded['x509'].attributes.*} – Substitutes a guarded attribute value.

exit

string

Default exit binding when no conditional routes are viable.

exit: echo_server

telemetry

object

Defines the desired telemetry for the binding.

telemetry.metrics

array

Telemetry metrics to track

telemetry:
  metrics:
    - stream.*

telemetry.attributes

object as map of named string properties

Telemetry attributes to add to the binding metrics.