istio: ingressgateway can't access https service.

@kongyi-ibm Yes, terminating TLS and originating TLS by the gateway should work. You just create a DestinationRule to your service, and specify tls mode as SIMPLE. Something like:

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: originate-tls-for-my-service
spec:
  host: myservice
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: SIMPLE # initiates HTTPS

@vadimeisenbergibm Hi would you please add example to istio document for SSL termination at ingress and SSL originatin at gateway to https service. I tried many config but I could run just one scenario 1- GATEWAY SSL termination (SIMPLE) 2- Virtual service http and not tls 3- DR tls mode : SIMPLE 4- PA : Permessive.
I expect that PA STRICT must work but it does not work. I think add this scenario to https://istio.io/latest/docs/ops/common-problems/network-issues/#tls-configuration-mistakes will be useful

@lubinson @ijsnellf let me describe how to configure it, will submit a PR to istio.io.

Thank you for the propt reply @vadimeisenbergibm ! We found that the best practice to achieve this properly would be with mTLS, namely by referencing the certificate for the running service, although we’ve run into another issue which we opened via #24908

@kish3007 Sorry, I did not see your questions.

Regarding the TLS services - I checked and it looks like neither Grafana nor Kiali show TLS services. If so, it seems that in order to monitor a service and to collect HTTP metrics on it, you have to perform TLS termination by the ingress gateway, and then to perform TLS origination again on the route from the ingress gateway to the service. For that, you have to mount the service certificate/private key in the ingress gateway pod which is not ideal, or to use Secret Discovery Service.

Alternatively, you can change the HTTPS service to become an HTTP one, let the ingress gateway perform TLS termination, and use Istio mutual TLS to encrypt the traffic to the service inside the mesh.

@kish3007 Please note that in the TLS passthrough mode you cannot use http routes, you can only use tls, see https://istio.io/docs/examples/advanced-gateways/ingress-sni-passthrough/#configure-an-ingress-gateway.

Also note that the traffic is TLS, Istio does not see the encrypted HTTP traffic, so Istio does not show it as HTTP in the dashboard.

Except the SSL passthrough, do we have any other solution can let ingressgateway to terminal SSL and send https request to backend https service ?

I want to implement the solution like this ( it is most like the enable secret backend in ingress ).

https request --> ingressgateway --> https service

---

Gateway: spec: selector: istio: ingressgateway servers:

• hosts:
  • ‘*’ port: name: https number: 443 protocol: HTTPS tls: mode: SIMPLE privateKey: /etc/istio/ingressgateway-certs/tls.key serverCertificate: /etc/istio/ingressgateway-certs/tls.crt

---

Virtualservice: spec: gateways:

• mygateway hosts:
• ‘*’ http:
• match:
  • uri: prefix: /search route:
  • destination: host: search.default.svc.cluster.local port: number: 3738

---

Service definition: pec: clusterIP: 10.0.0.216 externalTrafficPolicy: Cluster ports:

• name: https nodePort: 31702 port: 3738 protocol: TCP targetPort: 3738 selector: app: search sessionAffinity: None type: NodePort status: loadBalancer: {}

But when I use curl to access, the ingress always report 503. But I can curl from the envoy sidecar and get correct response

[root@pe103 ~]# curl -v -k https://9.112.245.103:31390/search/admin/resources/health/ping

• About to connect() to 9.112.245.103 port 31390 (#0)
• Trying 9.112.245.103…
• Connected to 9.112.245.103 (9.112.245.103) port 31390 (#0)
• Initializing NSS with certpath: sql:/etc/pki/nssdb
• skipping SSL peer certificate verification
• Server certificate:

•   subject: CN=*
  

•   start date: Jun 09 15:40:43 2017 GMT
  

•   expire date: May 26 03:41:13 2027 GMT
  

•   common name: *
  

•   issuer: CN=testcert.watsoncommerce.ibm.com
  

GET /search/admin/resources/health/ping HTTP/1.1 User-Agent: curl/7.29.0 Host: 9.112.245.103:31390 Accept: /

< HTTP/1.1 503 Service Unavailable < content-length: 57 < content-type: text/plain < date: Mon, 26 Nov 2018 16:57:17 GMT < server: envoy < x-envoy-upstream-service-time: 8 <

• Connection #0 to host 9.112.245.103 left intact

---

[root@pe103 ~]# istioctl authn tls-check search.default.svc.cluster.local HOST:PORT STATUS SERVER CLIENT AUTHN POLICY DESTINATION RULE search.default.svc.cluster.local:3738 OK HTTP HTTP - -

---

from ingressgateway log, it looks like the ingressgateway can find target backend, but just can not generate connection

[2018-11-26T16:57:17.946Z] “GET /search/admin/resources/health/ping HTTP/1.1” 503 - 0 57 12 8 “10.1.1.0” “curl/7.29.0” “8c92b97e-933a-9590-b1d8-5584b0be636c” “9.112.245.103:31390” “10.1.146.230:3738”

@lubinson Here is the example I wrote https://preliminary.istio.io/docs/examples/advanced-gateways/ingress-sni-passthrough/

Note that you have to use PASSTHROUGH tls mode since the gateway must not perform TLS termination. Also note that the VirtualService should have tls match by sni_hosts.