Trouble with .local in domain names (Istio 1.11.2)

1

Hi everyone!

I’m having trouble with a certain configuration:

From my application containers i want to call a resource which resides outside of the mesh, and let Istio do the TLS.

In short, i want to call http://abc.def.local:2080 in my application, and have Istio send it to abc.def.local:2443 with TLS.

Hence i created a serviceentry, virtualservice and destinationrule, just like for any other such case.

I ran into this problem though:
There are routes being created in envoy. But the .local suffix seems to get lost in the domain names that the routes are bound to.
This only happens for domain names that consist of exactly three elements.
abc.def.ghi.local seems to work.
abc.local works too.
Only abc.def.local loses its .local suffix.

Does anyone have any pointers where this behaviour may be coming from?

ServiceEntry:

kind: ServiceEntry
metadata:
name: abc-example
spec:
hosts:
- “abc.local”
- “abc.def.local”
- “abc.def.ghi.local”
location: MESH_EXTERNAL
ports:
- name: http-out-1
number: 2080
protocol: HTTP
- name: https-out-1
number: 2443
protocol: HTTPS
resolution: DNS

Istioctl proxy-config routes output:

istioctl pc route debug-pod | grep 2080
2080 abc.def.ghi.local /*
2080 abc.def /* ##### .local suffix is missing here!
2080 abc.local /*

2

This turned out to be a known bug.