In some edge case scenarios, usually in enterprise organisations, Identity Providers could be external accessible through http proxies. In this cases envoy could be configured to use internally http/s proxy environment settings, however these settings will apply to all http calls to control plane either by pilot or istiod, it cannot be segregated per type of request, whether is identity or jwks resolver.
Authservice is already able to use CONNECT capability within Istio to fetch the required JWKS are then cached we could use to expose internally within the mesh.
Alternatively a proxy server like ngnx can be used but would rather prefer an integrated solution.
Initial implementation of this endpoint I am implementing and will appreciate your input before I invest more time on it: https://github.com/istio-ecosystem/authservice/compare/main...ilgatnau:authservice:feat/jwks_server?expand=1
JFYI this is a requirement for a Tier 1 enterprise having same issue.
In some edge case scenarios, usually in enterprise organisations, Identity Providers could be external accessible through http proxies. In this cases envoy could be configured to use internally http/s proxy environment settings, however these settings will apply to all http calls to control plane either by pilot or istiod, it cannot be segregated per type of request, whether is identity or jwks resolver.
Authservice is already able to use CONNECT capability within Istio to fetch the required JWKS are then cached we could use to expose internally within the mesh.
Alternatively a proxy server like ngnx can be used but would rather prefer an integrated solution.
Initial implementation of this endpoint I am implementing and will appreciate your input before I invest more time on it: https://github.com/istio-ecosystem/authservice/compare/main...ilgatnau:authservice:feat/jwks_server?expand=1
JFYI this is a requirement for a Tier 1 enterprise having same issue.