You can definitely “lazy load” TLS certs into Envoy. The SDS (Secrets Discovery Service) supports this, and is touched on in TFA: https://www.envoyproxy.io/doc

You can definitely “lazy load” TLS certs into Envoy. The SDS (Secrets Discovery Service) supports this, and is touched on in TFA: https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ssl#secret-discovery-service-sds https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overv... You provide a gRPC service that can return the keypair needed for any host, with host config also being dynamic. https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#sds-configuration https://www.envoyproxy.io/docs/envoy/latest/configuration/se...