<p>I am using Kubernetes and kong ingress controller.
I have set up a client, Kong gateway, and server.
The client connects Kong gateway with mTLS, Kong gateway connects the server with plain HTTP with a header contains the client cert pem.</p>
<p>In nginx i can simplely add this config.</p>
<pre><code>server{
    location / {
        proxy_set_header ssl-client-cert $ssl_client_escaped_cert;
    }
}
</code></pre>
<p>In kong gateway, i try to set helm values.yaml</p>
<pre><code>env.nginx_proxy_proxy_set_header: &quot;ssl-client-cert $ssl_client_escaped_cert&quot;
</code></pre>
<p>But in the container <code>/etc/kong_prefix/nginx-kong.conf</code>, it looks like this and the header is not sent out.</p>
<pre><code>server {
    proxy_set_header ssl-client-cert $ssl_client_escaped_cert;
}
</code></pre>
<p>I try to use plugin <code>request-transformer</code> but it considers <code>$ssl_client_escaped_cert</code> as a plain string.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: kong-plugin-client-cert-header
  annotations:
    kubernetes.io/ingress.class: kong
  labels:
    global: &quot;true&quot;
config: 
  add:
    headers:
    - ssl-client-cert: $ssl_client_escaped_cert;
plugin: request-transformer
</code></pre>
<p>How can I get the client cert and send to server as header?</p>

yip102011
<p>You can use the Kong Function plugin to do custom transformation. From that plugin you can use all Nginx variables available:</p>
<ul>
<li><a href="https://docs.konghq.com/hub/kong-inc/serverless-functions" rel="nofollow noreferrer">https://docs.konghq.com/hub/kong-inc/serverless-functions</a></li>
</ul>
<p>For example, your plugin can be configured with something like:</p>
<pre><code>apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: kong-plugin-client-cert-header
config:
  access:
  - |
    kong.service.request.set_header('ssl-client-cert', ('--' or ngx.var.ssl_client_escaped_cert))
plugin: post-function
</code></pre>
