Allow http health checks on https upstreams

Title: Allow http health checks on https upstreams

Description:

My use case is an upstream cluster offers (for legacy reasons) health checks via http on a different port than the content which is offered with TLS encryption. The documentation states:

Health checks occur over the transport socket specified for the cluster. This implies that if a cluster is using a TLS-enabled transport socket, the health check will also occur over TLS.

In this feature request I would like to propose to change this.

This is useful because our old proxy relies on those checks being available as non TLS checks, hence migration would be simplified by mirroring the same behaviour in envoy.

There is already an mechanism to select different transports within a cluster using transport_socket_matches. An elegant approach would be to lookup the transport with a specific metadata set for the health endpoint. This could be configurable metadata entry or be a fixed one (eg. envoyIsHealthCheck ).

I am not familiar with the code yet, but given that feature request is reasonable I could try to implement it by myself. Thanks for providing this awesome project, with that feature added it would bring even more value to my use case.