I need some help to enabel egress gateway to endpoint with selfi signed certificate.
I install Istio with below config:
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
namespace: istio-system
spec:
profile: demo
components:
pilot:
k8s:
env:
- name: VERIFY_CERTIFICATE_AT_CLIENT
value: "true"
egressGateways:
- name: istio-egressgateway
enabled: true
k8s:
env:
- name: VERIFY_CERTIFICATE_AT_CLIENT
value: "true"
values:
global:
logging:
level: "default:debug"
meshConfig:
outboundTrafficPolicy:
mode: REGISTRY_ONLY
defaultConfig:
proxyMetadata:
# Enable Istio agent to handle DNS requests for known hosts
# Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
ISTIO_META_DNS_CAPTURE: "true"
ISTIO_META_DNS_AUTO_ALLOCATE: "true"
and I created the serviceEntry/Gateway/VirtualService/DestinationRule:
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: dashboard
spec:
hosts:
- selfsignedhost.com
ports:
- number: 80
name: http
protocol: HTTP
- number: 443
name: tcp-port
protocol: TCP
addresses:
- 20.71.x.x
location: MESH_EXTERNAL
resolution: STATIC
endpoints:
- address: 20.71.x.x
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: istio-egressgateway
spec:
selector:
istio: egressgateway
servers:
- port:
number: 80
name: http-port-for-tls-origination
protocol: HTTP
hosts:
- selfsignedhost.com
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: dashboardegressgatewaydestinationrule
spec:
host: istio-egressgateway.istio-system.svc.cluster.local
subsets:
- name: dashboard
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: dashboard
spec:
hosts:
- selfsignedhost.com
gateways:
- istio-egressgateway
- mesh
http:
- match:
- gateways:
- mesh
port: 80
route:
- destination:
host: istio-egressgateway.istio-system.svc.cluster.local
subset: dashboard
port:
number: 80
weight: 100
- match:
- gateways:
- istio-egressgateway
port: 80
route:
- destination:
host: selfsignedhost.com
port:
number: 443
weight: 100
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: dashboarddestinationrule
spec:
host: selfsignedhost.com
trafficPolicy:
loadBalancer:
simple: ROUND_ROBIN
portLevelSettings:
- port:
number: 443
tls:
mode: SIMPLE # initiates HTTPS for connections to selfsignedhost.com
insecureSkipVerify: true
Error in egress gateway:
