Envoy is a powerful proxy that can be used to connect services in a secure way, with encryption and mutual authentication, using certificates. It can be used to connect services running in Kubernetes with external infrastructure, such as on-premise services, databases, etc.

At Adobe Experience Manager Cloud Service we use Envoy to connect pods running in Kubernetes with customer dedicated infrastructure, such as on-premise services, databases, etc. This allows, for example, different pods to have their own dedicated egress ip instead of the cluster's, or connections from pods to multiple customer on-premise services using VPN.

We will show how we are using Envoy to connect pods with external infrastructure, and how we debug issues when the tunnels are not working as expected.