How to not use https(tls) to internal mesh network(traffic)

[seun9su]

We are currently providing app services with the following architecture.
All traffic are using https(tls) by default, and TLS offloading through AWS certificates to NLB.

external user(or app) -> NLB -> external-ingressgateway -> APP
internal user(or app) -> NLB -> internal-ingressgateway -> APP

However, if you set it as below, it was confirmed that the mesh network was done through the APP pod's sidecar container(istio-proxy) without passing through the ingressgateway if you make HTTP request.

---
apiVersion: v1
kind: Service
metadata:
  name: example-blue
  namespace: backends
  labels:
    app: example-service
spec:
  selector:
    app: example-service
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 8080
    - name: https
      protocol: TCP
      port: 443
      targetPort: 8080
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  name: example-green
  namespace: backends
  labels:
    app: example-service
spec:
  selector:
    app: example-service
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 8080
    - name: https
      protocol: TCP
      port: 443
      targetPort: 8080
  type: ClusterIP
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: example-service-internal
  namespace: istio-system
spec:
  selector:
    istio: internal-ingressgateway
  servers:
    - hosts:
        - example-service.xxxxx.com
      port:
        name: http
        number: 80
        protocol: HTTP
      tls:
        httpsRedirect: false
    - hosts:
        - example-service.xxxxx.com
      port:
        name: https
        number: 443
        protocol: HTTP
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: internal-example-service
  namespace: backends
spec:
  gateways:
    - istio-system/example-service-internal
    - mesh
  hosts:
    - example-service.xxxxx.com
  http:
    - match:
        - headers:
            blueGreen:
              exact: green
      route:
        - destination:
            host: example-service-green
          weight: 100
    - match:
        - {}
      name: default
      route:
        - destination:
            host: example-service-blue
          weight: 100
        - destination:
            host: example-service-green
          weight: 0
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: example-service-blue
  namespace: backends
spec:
  host: example-service-blue
  trafficPolicy:
    connectionPool:
      http:
        idleTimeout: 60s
        maxRequestsPerConnection: 1
    loadBalancer:
      simple: LEAST_CONN

For example, when communicating between internal mesh(APP1 -> APP2) HTTPS (TLS), is there a way to communicate without going through internal-ingressgateway?

Or If there is no way or if TLS authentication is required unconditionally, is there a way to change https requests to http only for the internal mesh network?

• APP1 -> curl https://example-service.xxxxx.com) -> convert -> https://example-service.xxxxx.com -> APP2

[rootsongjc]

Requests for Istio mesh internal services should not go through the Ingress Gateway. If you want to downgrade HTTPS to HTTP, you can use HTTP rewrites. For example:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: internal-example-service
  namespace: backends
spec:
  gateways:
    - mesh
  hosts:
    - example-service.xxxxx.com
  http:
    - match:
        - uri:
            prefix: "/"
      rewrite:
        authority: https://example-service.xxxxx.com
      route:
        - destination:
            host: example-service-blue

[seun9su]

Thank you for your reply. I tried setting it up as you told me, but I'm getting a "400 bad request" error.

I created a new virtualservice named "internal-example-service-mesh" to handle only the mesh network as shown below. The reason for this is that if you exclude "istio-system/seungsu-test-internal" in spec.gateway of internal-example-service, the "example-service.xxxxx.com" domain created by external-dns will be deleted, so the "example-service.xxxxx.com" domain will not be looked up. (For reference, the "example-service.xxxxx.com" domain is resolved to the ALB IP address created in external-dns)

Is it possible to make the domain used by internal mesh services look up the svc.cluster.local domain?

• https://example-service.xxxxx.com -> https://example-service-blue.backends.svc.cluster.local
  I changed the rewrite setting to "https://example-service-blue.backends.svc.cluster.local" but I still get a "400 bad request" error.

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: internal-example-service
  namespace: backends
spec:
  gateways:
    - istio-system/example-service-internal
  hosts:
    - example-service.xxxxx.com
  http:
    - match:
        - headers:
            blueGreen:
              exact: green
      route:
        - destination:
            host: example-service-green
          weight: 100
    - match:
        - {}
      name: default
      route:
        - destination:
            host: example-service-blue
          weight: 100
        - destination:
            host: example-service-green
          weight: 0
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: internal-example-service-mesh
  namespace: backends
spec:
  gateways:
    - mesh
  hosts:
    - example-service.xxxxx.com
  http:
    - match:
        - headers:
            blueGreen:
              exact: green
      rewrite:
        authority: https://example-service.xxxxx.com
      route:
        - destination:
            host: example-service-green
          weight: 100
    - match:
        - {}
      name: default
      rewrite:
        authority: https://example-service.xxxxx.com
      route:
        - destination:
            host: example-service-blue
          weight: 100
        - destination:
            host: example-service-green
          weight: 0