Accessing HTTPS Istio Ingress Gateway from Pod

Question

I have a fairly simple setup in my kubernetes cluster, with two zones:

Low trust (public facing)
Medium trust (non public)

Both zones have Istio enabled, with:

Ingress gateway with SSL enabled. For testing within my local docker desktop, I use port 443 for the public facing, and port 443 for medium trust
Virtual service
Destination rule

I am deploying apache HTTPD - acting as a reverse proxy within the low trust. The plan is for the HTTPD to then forward the traffic to istio ingress gateway in the medium trust. Within the medium trust is a Spring boot application.

So, lets say, user is accessing https://lowtrust.avengers.local/avengers. This request will be serviced by the ingress gateway in the lowtrust, and will end up in the HTTPD, which then forward the request to ingress gateway in mediumtrust.

LOWTRUST                      MEDIUMTRUST
| GW--> VS-->HTTPD Pod|======>| GW --> VS -->Java Pod|

I have created a github repo to demonstrate this: https://github.com/alexwibowo/avengersKubernetes

The HTTP proxy configuration is here: https://github.com/alexwibowo/avengersKubernetes/blob/main/httpd/conf/proxy.conf.

The Istio ingress gateway for lowtrust: https://github.com/alexwibowo/avengersKubernetes/blob/main/kubernetes/avengers/charts/avengers-istio/templates/istio-httpd.yaml

and istio ingress gateway for mediumtrust: https://github.com/alexwibowo/avengersKubernetes/blob/main/kubernetes/avengers/charts/avengers-istio/templates/istio-app.yaml

As you can see, both gateways have their own certs configured. At the moment, I kind of 'cheat' by modifying my /etc/host file to have the following:

127.0.0.1            lowtrust.avengers.local
<CLUSTER_IP_ADDRESS> mediumtrust.avengers.local

By doing this, when HTTPD pod making request to 'mediumtrust.avengers.local', it will get directed to the istio ingress gateway (thats my understanding anyway).

I've heard that you can actually set up a mutual TLS for the scenario I've described above. With this approach, I wont need to setup the certificate in my mediumtrust ingress gateway - and just use 'ISTIO_MUTUAL'. I think for this, I will also need to set up a 'proxy' service & virtual service in the lowtrust namespace. The virtual service will then manage the communication between lowtrust & mediumtrust. But I'm not 100% how to do this.

Any help / advice is much appreciated!

Edit 1 (2021/07/01) I've been reading more about this topic. So another option, is to have Service of type 'ExternalName' within the 'lowtrust' namespace. Which, if I might use the analogy, will act like a 'proxy' for connecting to the service on the other namespace. e.g.:

apiVersion: v1
kind: Service
metadata:
  name: cr1-avengers-app
  namespace: "lowtrust"
spec:
  type: ExternalName
  externalName: "cr1-avengers-app.mediumtrust.svc.cluster.local
  ports:
    - port: 8081
      targetPort: 8080
      protocol: TCP
      name: http

But by using this, I will effectively bypass the Istio VirtualService, DestinationRule that I've defined on the mediumtrust namespace.

Hi, do I understand correctly that you are having issues specifically on the path of HTTPD -> medium trust path? IIUC you want to connect to your medium-trust with https from your HTTPD (that was contacted from low-trust). I'd reckon this would require to run the proxypass with SSL: serverfault.com/questions/84821/apache-proxypass-with-ssl — Dawid Kruk
Hi @DawidKruk, I've done that in my proxy conf. Still no luck... — caffeine_inquisitor

caffeine_inquisitor caffeine_inquisitor · Accepted Answer · 2021-07-02T00:29:54

The way I've managed to solve this locally is by having an entry in my windows hostfile. E.g.:

127.0.0.1 lowtrust.avengers.local
10.109.161.243 mediumtrust.avengers.local

10.109.161.243 is the Cluster IP address for my istio-ingressgateway. I got this by running kubectl get svc -n istio-system from command line.

NAME                   TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                                    AGE
istio-ingressgateway   LoadBalancer   10.109.161.243   localhost     15021:30564/TCP,80:31834/TCP,443:31828/TCP,445:32700/TCP,15012:30459/TCP,15443:30397/TCP   21d

I was also missing 'SSLProxyEngine' flag in my reverse proxy configuration. So in the end my VirtualHost configuration looks like below: E.g.:

<VirtualHost *:7000>
    ProxyRequests Off
    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>

    SSLProxyEngine on
    ProxyPass          /avengers        https://mediumtrust.avengers.local/avengers
    ProxyPassReverse   /avengers        https://mediumtrust.avengers.local/avengers

    CustomLog "/tmp/access.log" common
    ErrorLog /tmp/error.log
</VirtualHost>

Accessing HTTPS Istio Ingress Gateway from Pod

1 Answers