Using istio as an reverse proxy for external TLS services

user_5776617 0
Viewed 929

Istio allows you to route a http request in a VirtualService to an external host provided a ServiceEntry exists. For example: 

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: httpbin-ext
spec:
  hosts:
  - httpbin.org
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  location: MESH_EXTERNAL
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - httpbin.domain.co
  gateways:
  - public-gateway.istio-system.svc.cluster.local
  - mesh
  http:
  - match:
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 443
      host: httpbin.domain.co
    route:
    - destination:
        host: httpbin.org
        port:
          number: 80

However this only allows for a HTTP endpoint - how do I configure the external endpoint to be TLS/HTTPS?

istio kubernetes
1 Answers

This took me hours to work out - so worth sharing I feel.

In order to terminate this service as a TLS, a Destination Rule is required. My final config:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: httpbin-ext
spec:
  hosts:
  - httpbin.org
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNAL
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - httpbin.domain.co
  gateways:
  - public-gateway.istio-system.svc.cluster.local
  - mesh
  http:
  - match:
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 443
      host: httpbin.domain.co
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 80
      host: httpbin.domain.co
    route:
    - destination:
        host: httpbin.org
        port:
          number: 443
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: httpbin-org
spec:
  host: httpbin.org
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: SIMPLE
user_57766170
Related