Listener components

Listener configuration overview

listener.Filter

[listener.Filter proto]

{
  "name": "...",
  "config": "{...}"
}

name

(string, REQUIRED) The name of the filter to instantiate. The name must match a supported filter. The built-in filters are:

• envoy.client_ssl_auth
• envoy.echo
• envoy.http_connection_manager
• envoy.mongo_proxy
• envoy.ratelimit
• envoy.redis_proxy
• envoy.tcp_proxy

config

(Struct) Filter specific configuration which depends on the filter being instantiated. See the supported filters for further documentation.

listener.FilterChainMatch

[listener.FilterChainMatch proto]

Specifies the match criteria for selecting a specific filter chain for a listener.

{
  "sni_domains": []
}

sni_domains

(string) If non-empty, the SNI domains to consider. May contain a wildcard prefix, e.g. *.example.com.

Attention

See the FAQ entry on how to configure SNI for more information.

listener.FilterChain

[listener.FilterChain proto]

A filter chain wraps a set of match criteria, an option TLS context, a set of filters, and various other parameters.

{
  "filter_chain_match": "{...}",
  "tls_context": "{...}",
  "filters": [],
  "use_proxy_proto": "{...}",
  "transport_socket": "{...}"
}

filter_chain_match

(listener.FilterChainMatch) The criteria to use when matching a connection to this filter chain.

tls_context

(auth.DownstreamTlsContext) The TLS context for this filter chain.

filters

(listener.Filter) A list of individual network filters that make up the filter chain for connections established with the listener. Order matters as the filters are processed sequentially as connection events happen. Note: If the filter list is empty, the connection will close by default.

use_proxy_proto

(BoolValue) Whether the listener should expect a PROXY protocol V1 header on new connections. If this option is enabled, the listener will assume that that remote address of the connection is the one specified in the header. Some load balancers including the AWS ELB support this option. If the option is absent or set to false, Envoy will use the physical peer address of the connection as the remote address.

transport_socket

(core.TransportSocket) See base.TransportSocket description.

listener.ListenerFilter

[listener.ListenerFilter proto]

{
  "name": "...",
  "config": "{...}"
}

name

(string, REQUIRED) The name of the filter to instantiate. The name must match a supported filter. The built-in filters are:

• envoy.listener.original_dst

config

(Struct) Filter specific configuration which depends on the filter being instantiated. See the supported filters for further documentation.