Deploy amassador with istio gateway resoruce as backend got 503

user_9140511 0
Viewed 406

not sure if anyone met this issue before, after I deployed amassador with istio gateway resoruce as backend I got 503 with

upstream connect error or disconnect/reset before headers. reset reason: connection failure

If I changed ambassador backend to nginx ingress resource, everything works perfectly.

Update, sry for the confusion, in my case, I am access Ambassador and configured mapping rules to istio gateway, https://test-internal.url is the istio ingress gateway resource in my case.

Here is the example config.

kind: Service
metadata:
  annotations:
    cloud.google.com/neg: '{"ingress": true}'
    getambassador.io/config: |
      ---
      apiVersion: ambassador/v1
      kind: Mapping
      name: test-mapping
      ambassador_id: ambassador-1
      prefix: /
      host: test.url
      service: https://test.url
      host_rewrite: test-internal.url
istio
1 Answers

If I understand the question properly you ask about that what is mentioned in ambassador documentation about Routing to Services.

I think the problem is mtls here, ambassador documentation says that

Istio defaults to PERMISSIVE mTLS that does not require authentication between containers in the cluster.

Which AFAIK is not true, because since istio 1.5 default mtls is STRICT.

STRICT -> Connection is an mTLS tunnel (TLS with client cert must be presented).

So if you go down in the documentation there is the same error

$ kubectl apply -f - <<EOF
apiVersion: getambassador.io/v2
kind: Mapping
metadata:
  name: quote-backend
spec:
  prefix: /backend/
  service: quote
EOF


$ curl -k https://{{AMBASSADOR_HOST}}/backend/
upstream connect error or disconnect/reset before headers. reset reason: connection termination

And there is an answer for that

Configure Ambassador to use mTLS certificates

As we have demonstrated above we can tell Ambassador to use the mTLS certificates from Istio to authenticate with the istio-proxy in the quote pod.

$ kubectl apply -f - <<EOF
---
apiVersion: getambassador.io/v2
kind: Mapping
metadata:
  name: quote-backend
spec:
  prefix: /backend/
  service: quote
  tls: istio-upstream
EOF

Now Ambassador will use the Istio mTLS certificates when routing to the quote service.

$ curl -k https://{{AMBASSADOR_HOST}}/backend/
{
    "server": "bewitched-acai-5jq7q81r",
    "quote": "Non-locality is the driver of truth. By summoning, we vibrate.",
    "time": "2020-06-02T11:06:53.854468941Z"
}

There is related documentation about deploying istio and ambassador together on kubernetes.

user_119777600
Related