From 365946166697eaf1746c08f65bf3d01c0bb1819b Mon Sep 17 00:00:00 2001
From: kevinlin <linjiang1205@gmail.com>
Date: Sun, 9 Oct 2022 18:13:32 +0800
Subject: [PATCH] Update reverse-proxy document for istio/envoy

---
 docs/reverse-proxy.md | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/docs/reverse-proxy.md b/docs/reverse-proxy.md
index 74bbff71..4ab7ac00 100644
--- a/docs/reverse-proxy.md
+++ b/docs/reverse-proxy.md
@@ -59,3 +59,34 @@ server {
     }
 }
 ```
+
+## istio/envoy
+If you using [Istio](https://istio.io/) ingressgateway or [Envoy](https://www.envoyproxy.io/) as reverse proxy, there are some tips for you. 
+
+### Envoy
+You need add a new upgrade_type named `tailscale-control-protocol`. [see detail](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-upgradeconfig)
+
+### Istio
+Same as envoy, we can use `EnvoyFilter` to add upgrade_type.
+```yaml
+apiVersion: networking.istio.io/v1alpha3
+kind: EnvoyFilter
+metadata:
+  name: headscale-behind-istio-ingress
+  namespace: istio-system
+spec:
+  configPatches:
+  - applyTo: NETWORK_FILTER
+    match:
+      listener:
+        filterChain:
+          filter:
+            name: envoy.filters.network.http_connection_manager
+    patch:
+      operation: MERGE
+      value:
+        typed_config:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          upgrade_configs:
+            - upgrade_type: tailscale-control-protocol
+```
\ No newline at end of file