Istio : HTTPS Traffic between Pods working only if sidecar not injected

Question

Steps i have done :

I have two namespaces one with istio injected and another not
Now deploy simple nginx server using this yaml in both namespace

apiVersion: v1
kind: Service
metadata:
  name: software-upgrader
  labels:
    app: software-upgrader
    service: software-upgrader
spec:
  ports:
    - name: http
      port: 25301
  selector:
    app: software-upgrader
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: software-upgrader
spec:
  selector:
    matchLabels:
      app: software-upgrader
      version: v1
  template:
    metadata:
      labels:
        app: software-upgrader
        version: v1
    spec:
      containers:
      - image: gcr.io/mesh7-public-images/scalability/nginx
        imagePullPolicy: IfNotPresent
        name: software-upgrader
        resources:
          limits:
            cpu: 20m
            memory: 32Mi
          requests:
            cpu: 20m
            memory: 32Mi

now deploy HTTPS servers in both namespaces by this steps Steps to deploy HTTPS server
now curl it from another pod in both namespace
The Pod with istio not injected would get 200 OK , while istio-injected pod would get

curl: (56) OpenSSL SSL_read: error:1409445C:SSL routines:ssl3_read_bytes:tlsv13 alert certificate required, errno 0
command terminated with exit code 56

Pardon me of my ignorance do i have to create some Service-entry or Virtual Service for HTTPS to happen between Pods in same namespace to happen if istio is injected?

Pradeep Padmanaban C · Answer 1 · 2022-11-30T10:50:12.990

You have to add Protocol to Service port Definition

apiVersion: v1
kind: Service
metadata:
  name: test-https-server
  labels:
    app: test-https-server
    service: test-https-server
spec:
  ports:
    - name: test-https
      port: 25302
      appProtocol: https
  selector:
    app: test-https-server
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-https-server
spec:
  selector:
    matchLabels:
      app: test-https-server
  template:
    metadata:
      labels:
        app: test-https-server
    spec:
      containers:
      - image: gcr.io/mesh7-public-images/scalability/nginx
        command: ["bash", "-c", "python3 ThreadedHTTPSServer.py 25302"]
        imagePullPolicy: Always
        name: test-https-server
        resources:
          limits:
            cpu: 20m
            memory: 32Mi
          requests:
            cpu: 20m
            memory: 32Mi

This has a example of working example

  ports:
    - name: http
      port: 25302
      appProtocol: https # Should Specify Protocol

Istio appProtocol configuration doc

Istio : HTTPS Traffic between Pods working only if sidecar not injected

1 Answers1