<p>We have a Kubernetes cluster with Istio 1.0 (with Envoy proxy) and some other stuff.
We use Istio's Gateway to verify client certificates. We would like to pass client certificate's subject to the internal services.</p>

<p><a href="https://www.envoyproxy.io/docs/envoy/latest/api-v1/network_filters/http_conn_man#config-http-conn-man-forward-client-cert" rel="nofollow noreferrer">Here</a> in Envoy's documentation I have found the following configuration option: <code>forward_client_cert</code> which enables passing the subject among other information in header <code>x-forwarded-client-cert</code>, although I could not find the way to enable it in Istio.</p>

<p>Has anyone tried to do something similar and succeeded? Or Istio is not supporting that?</p>

<p>This is a late answer, but forwarding client cert details is supported in the <a href="https://github.com/istio/istio/issues/8263" rel="nofollow noreferrer">1.1.0 release</a>. This is the default behavior of an https gateway, however, you need to have mutual TLS enabled globally for this to work. To do so apply the following <code>MeshPolicy</code> object:</p>

<pre><code>apiVersion: "authentication.istio.io/v1alpha1"
kind: "MeshPolicy"
metadata:
  name: "default"
spec:
  peers:
  - mtls: {}
</code></pre>

<p>Once this is applied, https calls to ingress will forward an <code>X-Forwarded-Client-Cert</code> header to the server.</p>

<p>Keep in mind however, once global mtls is enabled, service to service calls within the cluster must also use tls. This can be done by creating a <code>DestinationRule</code> for each service with the mode set to <code>ISTIO_MUTUAL</code> (or <code>MUTUAL</code> if you want to use your own client certificates instead of those generated by Citadel):</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: myApp
  namespace: default
spec:
  host: myApp
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
</code></pre>
