Istio with AWS ALB and TLS to istio-ingressgateway

Hi there,

I want to use AWS ALB to offload my ssl. I want to use an official Amazon certificate for that. In my backend, which is served by istio-ingressgateway I will use self signed certificates to encrypt the connection from ALB to istio-ingressgateway.

Overview:
Client → ALB offloading TLS → ALB opens new TLS connection to istio-ingressgateway — :x:—> istio-ingressgateway

Unfortunately ALB doesn’t support SNI to the backends. Is it possible to connect to the istio-ingressgateway with a kind of default certificate and then select the service via host header?

Best regards
Fabian

This is my configuration of one service. The other services are configured the same way but with other host. Without ALB the services are reachable directly via istio-ingressgateway.

---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: echoserver-tls-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: echoserver-tls-credential
    hosts:
    - "echoserver-tls.example.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: echoserver-tls
spec:
  hosts:
  - "echoserver-tls.example.com"
  gateways:
  - echoserver-tls-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        port:
          number: 80
        host: echoserver-tls

Yes it is possible. We use Terraform to do our deployments with a public and private ALB that routes traffic to two separate istioingress controllers. We use ExternalDNS and a wildcard cert for our ALB then we define an ingress manifest to tell it that it uses class alb.

Is your istio-ingressgateway using TLS (connection from ALB to istio-ingressgateway)? And if yes, could you provide your yaml from Ingress, Gateway and VirtualService?

I’ve done that too with Ingress for ALB with Wildcard certificate. But I couldn’t get TLS working for my Gateway, because ALB doesn’t speak SNI to the backends.