Configuring Istio to use new HTTPS connection to external service

Question

I have a VirtualService that splits traffic between an internal Service and an external ServiceEntry, based on HTTP route prefix.

The external service requires HTTPS traffic.

I test routes using curl like below:

curl https://my-service.domain.com/internal-route  -> should go to internal service

curl https://my-service.domain.com/external-route  -> should go to external service

What I tried so far:

1. Use HTTP routes for both internal and external service.

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
spec:
  gateways:
    - ...
  hosts:
    - my-service.domain.com
  http:
    - match:
        - uri:
            prefix: /internal-route
      route:
        - destination:
            host: my-service.my-ns.svc.cluster.local
    - match:
        - uri:
            prefix: /external-route
      route:
        - destination:
            host: external-service.otherdomain.com
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
spec:
  hosts:
    - external-service.otherdomain.com
  ports:
    - number: 443
      name: https
      protocol: HTTP
  location: MESH_EXTERNAL
  resolution: DNS

When I try this, the external service indicates that HTTP traffic is being sent to its HTTPS port (443). This makes sense, since Istio is terminating the TLS connection and using HTTP to forward the request to the external service.

2. Using a "tls" match type (for external service) and "http" route (for internal service) within the same VirtualService.

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
spec:
  gateways:
    - ...
  hosts:
    - my-service.domain.com
  http:
    - match:
        - uri:
            prefix: /internal-route
      route:
        - destination:
            host: my-service.my-ns.svc.cluster.local
  tls:
    - match:
        - port: 443
          sniHosts:
            - my-service.domain.com
      route:
        - destination:
            host: external-service.otherdomain.com
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
spec:
  hosts:
    - external-service.otherdomain.com
  ports:
    - number: 443
      name: https
      protocol: TLS
  location: MESH_EXTERNAL
  resolution: DNS

This results in Istio returning a HTTP 404 when I try to reach a route that should go to the external service.

3. Same as above, with ServiceEntry protocol set to HTTP instead of TLS.

How can I configure Istio to terminate the TLS connection and then use HTTPS (via a new TLS connection) to send traffic to the external service?

EDIT 1:

I found in the Istio docs (one and two) that this should be possible by adding a DestinationRule, but this does not seem to have any effect.

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: tls-foo
spec:
  host: external-service.otherdomain.com
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 80
        tls:
          mode: SIMPLE

Answer 1

404 errors in Istio occurs mainly because of following reasons as mentioned in the official Istio troubleshooting documents

- Gateway to virtual service TLS mismatch

- When multiple gateways are configured with same TLS certificate

In your case it might be caused due to Gateway to virtual service TLS mismatch, the reason is you are trying to use two different types of routing rules in the same virtual service. There are two types of mismatches that cause these 404 errors


- Gateway TLS termination: In this scenario TLS will be getting terminated by the gateway while might have configured TLS based routes in VirtualService. This can be verified by using `istioctl proxy-config routes` command.

- Gateway TLS passthrough: This occurs when the http traffic is getting matched with the TLS traffic passed through the gateway by the VirtualService. This can be verified by using the `istioctl proxy-config listener` and `istioctl proxy-config route` commands.

Follow the official documentation embedded above for more information on how to fix these issues.

Note: The commands are taken from Istio official docs.

Answer 2

Below is the configuration that I finally found to work.

Key items to note:

• DestinationRule tls mode SIMPLE is what "turns on" TLS origination
  • The port number selects which traffic the DestinationRule applies to
  • Therefore, it must match the port number in the other configs (see below)
• The port number must be the same in all these places:
  • DestinationRule trafficPolicy.portLevelSettings
  • VirtualService http.route.destination
  • ServiceEntry ports.number
• ServiceEntry ports.protocol doesn't seem to matter

The actual port number you use above doesn't matter. If you use something other than port 433, add a targetPort of 443 to ServiceEntry. This changes the port number to the standard 443 for HTTPS before making the connection to the external service. (Below, I just used 443 everywhere for simplicity.)

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
spec:
  gateways:
    - ...
  hosts:
    - my-service.domain.com
  http:
    - name: "internal-routes"
      match:
        - uri:
            prefix: "/internal"
      route:
        - destination:
            host: my-service.my-ns.svc.cluster.local
    - name: "external-routes"
      match:
        - uri:
            prefix: "/external"
      rewrite:
        authority: external.otherdomain.com
      route:
        - destination:
            host: external.otherdomain.com
            port:
              number: 443 # Can be anything
                          # Must match DestinationRule and ServiceEntry
                          # Can be overridden by ServiceEntry targetPort

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
spec:
  host: external.otherdomain.com
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443  # selects traffic on port 443 to host above
        tls:
          mode: SIMPLE # turns on TLS origination for selected traffic

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
spec:
  hosts:
    - external.otherdomain.com
  ports:
    - number: 443       # specifies that host above accepts traffic on this port
      name: http        # ignored
      protocol: HTTPS   # ignored
      # targetPort: 443 # only needed if not 443 above
  location: MESH_EXTERNAL
  resolution: DNS