<p>In a k8s cluster i need to setup keycloak with a second keycloak as an identity provider.
The problem is that i need to make traffic towards the second keycloak to go through a second envoy which acts as
service mesh entry point and load balancer.</p>
<p>I have found a working solution but it is too complex.
I need to get rid of this envoy listener which listens on requests towards 127.0.0.1 and 9090</p>
<pre><code>  - name: idp
    address:
      socket_address:
        address: 127.0.0.1
        ipv4_compat: true
        port_value: 9090
        protocol: TCP
    filter_chains:
      filters:
      - name: envoy.filters.network.tcp_proxy
        typed_config:
          &quot;@type&quot;: type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
          stat_prefix: idp
          cluster: envoylb
          access_log:
          - name: envoy.access_loggers.file
            typed_config:
              &quot;@type&quot;: type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
              path: &quot;/var/log/envoysidecar.log&quot;
</code></pre>
<p>and replace it with one that catches all traffic and  forwards it to the envoylb cluster</p>
<pre><code>  - name: envoylb
    type: STRICT_DNS
    connect_timeout:
      seconds: 15552000
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name:  envoylb
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: envoylbservice
                port_value: 8298
</code></pre>
<p>I tried several things  but nothing seems to work.</p>

sotiris
<p>Not sure from the question what you try to obtain.
Envoy <code>config.core.v3.SocketAddress</code> must have once specific port to listen.
For the address, you can use 0.0.0.0 to bind any address.</p>
<p>Then by using the filter <code>envoy.filters.network.tcp_proxy</code> envoy can passthrough all the requests from this specific port the desired cluster.</p>
<p>Example:</p>
<pre><code>static_resources:
  listeners:
    - name: idp
      address:
        socket_address:
          address: 0.0.0.0
          port_value: 9090
      filter_chains:
        - filters:
            - name: envoy.filters.network.tcp_proxy
              typed_config:
                &quot;@type&quot;: type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
                stat_prefix: destination
                cluster: envoylb
  clusters:
    - name: envoylb
      type: STRICT_DNS
      connect_timeout:
         seconds: 15552000
      lb_policy: ROUND_ROBIN
      load_assignment:
        cluster_name: envoylb
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: envoylbservice
                      port_value: 8298
</code></pre>
