Allow TLS cipher configuration

Please describe your use case / problem. Currently, TLS ciphers used by Ambassador cannot be configured. Even with the envoy_override directive, it looks like only routing configuration can be override, while TLS ciphers belong to Envoy’s listener configuration.

Describe the solution you’d like Configuration alongside the TLS certificate configuration

Describe alternatives you’ve considered Another Envoy override

Additional context While the currently used cipher suite still gives a green rating with the Qualys SSL Labs test, some of the ciphers are marked weak already. Furthermore, it is always possible that a cipher may be broken so that the cipher suite needs to be reconfigured quickly.

[mehstg]

The initial request states that it does not work with envoy_override, so my understanding is that it wasn’t a proposal, but a request.

The ability to remove weak cipher suites and older protocols is something we really need

[peterthomassen]

The situation has improved a bit (TLS version can be specified since version 0.61.0, also providing an indirect lever for set of cipher suites), but cipher suites themselves are still not configurable. I continue to think this is an important issue.