How do I segregate internal and external loads using Istio Ingress?

Question

On my Kubernetes cluster I would like to segregate access to internal and external apps. In my example below I have app1 and app2 both exposed to the internet but would like only app1 exposed to the internet and app2 only available for users in the internal vnet.

My initial thought was to just make a new service (blue box) and use the "internal=true" attribute and my cloud provider creates the internal IP and I'm good. The issue is the gateway points to the deployment (pods) so it seem like to create an internal ingress I need to copy all 3 blue boxes.

Is there an easy way to tie in a new service and gateway without a new deployment (blue boxes) or maybe restrict external access via policy?

Could you tell me if I'm correct, you want to be able to make requests from outside and inside to app1, but you want to block every request from outside to app2 which would accept only requests inside the mesh? — Jakub, Feb 17 '20 at 10:43

score 0 · Accepted Answer · answered Feb 20 '20 at 10:27

Based on my knowledge you can create virtual service to do that

The reserved word mesh is used to imply all the sidecars in the mesh. When this field is omitted, the default gateway (mesh) will be used, which would apply the rule to all sidecars in the mesh. If a list of gateway names is provided, the rules will apply only to the gateways. To apply the rules to both gateways and sidecars, specify mesh as one of the gateway names.

You can check my another answer on stackoverflow, there is whole reproduction of someone problem where i made virtual service with a gateway to access(in a example just a curl) from outside, and if you want to make it only inside the mesh just delete this gateway and leave only mesh one, like in below example.

Specially the virtual service

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginxvirt
spec:
  gateways:
  - mesh #inside cluster
  hosts:
  - nginx.default.svc.cluster.local #inside cluster
  http:
  - name: match-myuid
    match:
    - uri:
        prefix: /
    rewrite:
      uri: /
    route:
    - destination:
        host: nginx.default.svc.cluster.local
        port:
          number: 80

And some external and internal tests

External

with additional gateway to allow external traffic

curl -v -H "host: nginx.com" loadbalancer_istio_ingress_gateway_ip/

HTTP/1.1 200 OK
without additional gateway to allow external traffic, just the mesh one

curl -v -H "host: nginx.com" loadbalancer_istio_ingress_gateway_ip/

HTTP/1.1 404 Not Found

Internal

Created some basic ubuntu pod for tests

kubectl exec -ti ubu1 -- /bin/bash

With mesh gateway

curl -v nginx/

HTTP/1.1 200 OK
Without mesh gateway

curl -v nginx/

HTTP/1.1 404 Not Found

Based on that you can use gateway "mesh" which will work only inside the mesh and won't allow external requests.

I can bring you pack of yamls to test if you want, if you wanna test it.

Let me know if that answer your question or you have any more questions.

I ended up using the community Nginx Ingres. Controller because it was really straightforward to setup dual ingress controllers. https://kubernetes.github.io/ingress-nginx/user-guide/multiple-ingress/ I didn’t get a chance to test the above answer, but I think you got it. I didn’t know about the mesh keyword. Thanks. — Psychic Rush, May 04 '21 at 08:00

How do I segregate internal and external loads using Istio Ingress?

1 Answers1