Support for Custom Plugins with Mesh

[alehechka]

Support for Custom Plugins with Mesh

[tspearconquest]

We have another use-case for this.

We currently use the Traefik Ingress Controller's modsecurity plugin to route client to service requests through our WAF after passing through Traefik, before being sent on to the service. In the future, we would like to have our WAF also inspect service to service traffic within our cluster.

We could do this with ExternalName services and Ingress Routes as OP has done for their own separate use-case, but it would be simpler if we could address this transparently by loading the same plugin, or one similar to it but designed for the mesh, into the mesh itself. The goal is to have all requests which get routed through the service mesh are transparently routed through the WAF, where we can audit them for indicators of compromise/attack, OWASP Top Ten risks, etc, and put enforcing mode policies in place to block malicious inter-service requests in case a service becomes compromised and the attacker starts trying to move laterally in the cluster to other services.