Register the Corporate CONNECT Proxy's TCP Hop in Istio

Use the sidecar-mode external-proxy ServiceEntry pattern for the proxy listener while leaving application proxy selection and target authorization separate.

For a workload already selecting a corporate CONNECT proxy, the sidecar sees a connection to that listener. Register the first-hop route as TCP in the documented sidecar external-proxy pattern:

apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata:
  name: corporate-forward-proxy
spec:
  hosts:
    - proxy.corp.example
  addresses:
    - 203.0.113.10/32
  ports:
    - number: 3128
      name: tcp-proxy
      protocol: TCP
  location: MESH_EXTERNAL
  resolution: NONE

Replace the IP and port with the actual proxy endpoint. This example matches TCP by address; hosts does not choose an encrypted website inside the tunnel.

The app still needs its supported proxy input, such as HTTPS_PROXY=http://203.0.113.10:3128 for a compatible client. A ServiceEntry does not make an unconfigured application issue proxy requests.

Register this proxy route rather than every website it later tunnels to. The forward proxy opens the onward connection and decides whether the account and requested destination are allowed. Mesh permission for the first TCP hop supplies neither that proxy authorization nor a route-selection instruction for the app.

Erthyglow kevrennek