Replies: 1 comment 1 reply
-
Requests for Istio mesh internal services should not go through the Ingress Gateway. If you want to downgrade HTTPS to HTTP, you can use HTTP rewrites. For example: apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: internal-example-service
namespace: backends
spec:
gateways:
- mesh
hosts:
- example-service.xxxxx.com
http:
- match:
- uri:
prefix: "/"
rewrite:
authority: https://example-service.xxxxx.com
route:
- destination:
host: example-service-blue |
Beta Was this translation helpful? Give feedback.
1 reply
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
We are currently providing app services with the following architecture.
All traffic are using https(tls) by default, and TLS offloading through AWS certificates to NLB.
external user(or app) -> NLB -> external-ingressgateway -> APP
internal user(or app) -> NLB -> internal-ingressgateway -> APP
However, if you set it as below, it was confirmed that the mesh network was done through the APP pod's sidecar container(istio-proxy) without passing through the ingressgateway if you make HTTP request.
For example, when communicating between internal mesh(APP1 -> APP2) HTTPS (TLS), is there a way to communicate without going through internal-ingressgateway?
Or If there is no way or if TLS authentication is required unconditionally, is there a way to change https requests to http only for the internal mesh network?
Beta Was this translation helpful? Give feedback.
All reactions