Support HTTPS
krancour opened this issue · comments
What would you like to be added?
Support for HTTPS.
Why is this needed?
Currently, HTTPS is not supported by Osiris at all. For the most common case, this can be worked around by using an ingress controller that terminates SSL and makes HTTP calls to backend services, but this inadequately addresses two somewhat common use cases:
- Applications / organizations with an end-to-end encryption requirement.
- Intra-cluster traffic that may have an encryption requirement, but is not routed through an ingress controller since it does not originate from outside the cluster.
A practical consideration here is that this will likely impact how we go about collecting and aggregating the metrics on which we base scaling decisions.
My sense is that the most practical method of implementing an HTTPS proxy without access to the upstream's certificate and private key (which it should not have anyway) is to implement an L4 (i.e. TCP) proxy. Since TCP is a stream-based protocol (not request-based), counting requests would be both meaningless and impossible. It might be necessary, instead, to count active connections-- or, more accurately, number of connections active at any point over the last interval.
This was closed by #27.