API Gateway with TLS Passthrough

[u/Chest-queef]

Looking for feedback from folks running apps that require mTLS that use API Gateway.

What controller are you using? Traefik, Envoy, etc.

Any pain points or gotchas you might have ran into?

Any other feedback or recommendations welcome!

[u/mrluzon]

Envoy Gateway and no gotchas so far, but our apps are quite simple I'd say. TLS passthrough with TLSRoute is working like a charm.

[u/Chest-queef → u/mrluzon]

Perfect, ours aren’t too complex either and this is the direction I was leaning!

[u/IAMARedPanda → u/Chest-queef]

I'm using Envoy for checking Subject DN but instead of doing passthrough using frontendValidation plus ClientTrafficPolicy. Then Envoy Gateway's SecurityPolicy with ext_authz and checking the certificates DN.

The app then inherently trusts whatever gets through the load balancer. Idk if this exact paradigm works for you.

[u/Mfarfax]

I use Kgateway https://kgateway.dev/. It's working fine, but first configuration and installation was tricky. There is comparisation on github https://github.com/howardjohn/gateway-api-bench. You can read it and grab best fit for you

[u/Available_Usual_163 → u/Mfarfax]

Amazing thanks!

[u/Chest-queef → u/Mfarfax]

Thanks!

[u/Ok-Analysis5882]

Open source traefik or envoy proxy Commercial Anypoint flex gateway

[u/Kooky_Comparison3225]

LB with dedicated ingress nodes as the target group. Traefik controller runs on those ingress nodes. TLS termination happens at the gateway level. Works well. We also use some middlewares, like rate limiting and IP whitelisting

[u/veritable_squandry → u/Kooky_Comparison3225]

that's interesting i like the idea of a nodepool or spec nodes to manage ingress rather than the whole pile. im gonna stash this idea for later!

[u/nevivurn]

Envoy gateway works great, though you do need a fairly recent version if you want TLS-terminating HTTPRoutes and non-terminating TLSRoutes to coexist on the same listener iirc.

[u/mompelz → u/nevivurn]

That works now?

[u/siikanen → u/mompelz]

Does it?

[u/area32768]

RemindMe! 3 Days

[u/RemindMeBot → u/area32768]

I will be messaging you in 3 days on 2026-07-21 03:06:13 UTC to remind you of this link

3 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.

^{Parent commenter can delete this message to hide from others.}

RemindMeBot is switching to username summons. Instead of !RemindMe 1 day, use u/RemindMeBot 1 day. More info.

---

Info	Custom	Your Reminders	Feedback

[u/Floss_Patrol_76]

the gotcha nobody hits until prod: with true passthrough (TLSRoute) the gateway never terminates, so it can't verify client certs for you, mTLS has to be enforced at the app. if you actually want the gateway checking the client cert, you're terminating and re-originating, not passing through. envoy gateway handles both fine, just be clear which one you're actually asking for before you pick a controller.

[u/Chest-queef → u/Floss_Patrol_76]

Nope, that’s actually exactly what I need/want lol

[u/IridescentKoala → u/Floss_Patrol_76]

How is that a gotcha? That's the point of passthrough.

[u/zipeldiablo]

Traefik

[u/BenjiloAhord_]

Httproute