<p>I want to create external authentication for Service A, which listens to traffic on port <code>8080</code>.
What I desire is to have a second container (<em>Service B</em>) running in the same pod as <em>Service A</em>, that intercepts, evaluates and (maybe) forwards the traffic going in on port <code>8080</code>
"Maybe" means that <em>Service B</em> should filter out every request, that is not authenticated.</p>

<p><em>Service B</em> would be injected into every service that is getting deployed in order to ensure consistent authorisation and still keep the deployment process simple.</p>

<p>(How) is this possible?</p>

Nils Martel
<p><strong>East-West Traffic Flow</strong></p>

<p>This is of-course possible and you can do your own sidecar or you could use a battle tested sidecar such as envoy. There are service meshes(istio, linkerd) which provides this functionality out of the box as well and some of these service meshes uses envoy internally. The sidecar deployed with each pod will intercept east west traffic between services deployed in the kubernetes cluster.</p>

<p><strong>North-South Traffic Flow</strong></p>

<p>Ingress(nginx etc), API gateway(contour etc) can intercept north-south traffic and provide authentication service at the front door. Some of these ingress controllers use envoy internally as well. In this flow there is no sidecar deployed with each pod.</p>
