CODEWITHSUNDEEP
kubernetesgoogle-cloud-platformgoogle-kubernetes-engineistio
Jackie
Jackie

Reputation: 23477

How do I point Kubernetes Ingress to the Istio ingress gateway?

I have a currently functioning Istio application. I would now like to add HTTPS using the Google Cloud managed certs. I setup the ingress there like this...

apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: managed-cert
  namespace: istio-system
spec:
  domains:
    - mydomain.co
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: managed-cert-ingress
  namespace: istio-system
  annotations:
    kubernetes.io/ingress.global-static-ip-name: managed-cert
    networking.gke.io/managed-certificates: managed-cert
    kubernetes.io/ingress.class: "gce"
spec:
  defaultBackend:
    service:
      name: istio-ingressgateway
      port:
        number: 443
---

But when I try going to the site (https://mydomain.co) I get...

Secure Connection Failed

An error occurred during a connection to earth-615.mydomain.co. Cannot communicate securely with peer: no common encryption algorithm(s).

Error code: SSL_ERROR_NO_CYPHER_OVERLAP

The functioning virtual service/gateway looks like this...

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: ingress-gateway
  namespace: istio-system
  annotations:
    kubernetes.io/ingress.global-static-ip-name: earth-616
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http2
        protocol: HTTP2
      hosts:
        - "*"
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: test-app
  namespace: foo
spec:
  hosts:
    - "*"
  gateways:
    - "istio-system/ingress-gateway"
  http:
    - match:
        - uri:
            exact: /
      route:
        - destination:
            host: test-app
            port:
              number: 8000

Upvotes: 1

Views: 408

Answers (1)

Piotr Malec
Piotr Malec

Reputation: 3647

Pointing k8s ingress towards istio ingress would result in additional latency and additional requirement for the istio gateway to use ingress sni passthrough to accept the HTTPS (already TLS terminated traffic).

Instead the best practice here would be to use the certificate directly with istio Secure Gateway.

You can use the certificate and key issued by Google CA. e.g. from Certificate Authority Service and create a k8s secret to hold the certificate and key. Then configure istio Secure Gateway to terminate the TLS traffic as documented in here.

Upvotes: 1

Related Questions