Istio Ingress Gateway with Cert-Manager TLS

1

I am trying to deploy ingress gateway handling SSL certificates with Cert-Manager. I have followed the documentation at https://istio.io/docs/tasks/traffic-management/ingress/ingress-certmgr/ - however I can only connect to services using istio ingress through http and not https, getting connection refused to port 443. When inspecting istio ingressgateway I can see the following error:

[warning][config] [bazel-out/k8-opt/bin/external/envoy/source/common/config/_virtual_includes/grpc_mux_subscription_lib/common/config/grpc_mux_subscription_impl.h:77] gRPC config for type.googleapis.com/envoy.api.v2.Listener rejected: Error adding/updating listener(s) 0.0.0.0_443: Invalid path: sds

What did I miss?

2

What version of Istio are you running? You might be facing this issue: https://github.com/istio/istio/issues/13358

3

I am running 1.1.10, and it seems to me that the linked issue is not affecting me (for now at least)

4

I’m having this same issue with istio 1.2. Could you solve the problem?

5

Hi Guys.

You are forgetting to enable sds and https labels in the istio-system namespace. You should:

Disable Ingress
Enable SDS and https labels at istio-system namespace
gateways.istio-ingressgateway.sds.enabled=true
global.k8sIngress.enableHttps=true
Enable Ingress

Check ingressgateway logs, you should see something like:

2019-10-29T06:48:25.513093Z info sdsServiceLog SDS gRPC server for ingress gateway controller starts, listening on “/var/run/ingress_gateway/sds”
2019-10-29T06:48:25.513234Z info sdsServiceLog Start SDS grpc server for ingress gateway proxy
2019-10-29T06:48:26.401725Z info sdsServiceLog CONNECTION ID: router~xyz~istio-ingressgateway-5d96ddd8c-lsm29.istio-system~istio-system.svc.cluster.local-1, RESOURCE NAME: YOURCERTIFICATE , EVENT: pushed key/cert pair to proxy

@gustavovalverde

1 Like
6

Stumbled in the same issue. How did you solve the problem?
I tried the solution from @epicvinny but with no luck.

I tried:

istioctl manifest apply --set values.global.k8sIngress.enabled=false
istioctl manifest apply --set values.global.k8sIngress.enableHttps=true
istioctl manifest apply --set values.gateways.istio-ingressgateway.sds.enabled=true
istioctl manifest apply --set values.global.k8sIngress.enabled=true
7

@avodaqstephan were you able to solve the problem? I am also struggling with the same thing.

8

@fai555 I switched to Istio v1.5 and I do have a lot less hassle to get everything running.
In v1.5 you don’t need to enable SDS, because it is enabled by default. Further the overhead of running the Istio components is way lower now.
I just needed a “public-gateway”, a Issuer and a Certificate ressource for the cert-manager. Everything works like a charm :slight_smile:

2 Likes