title: Accessing HTTPS Istio Ingress Gateway from Pod
body: <p>I have a fairly simple setup in my kubernetes cluster, with two zones:</p>
  <ul>
  <li>Low trust (public facing)</li>
  <li>Medium trust (non public)</li>
  </ul>
  <p>Both zones have Istio enabled, with:</p>
  <ul>
  <li>Ingress gateway with SSL enabled. For testing within my local docker desktop, I use port 443 for the public facing, and port 443 for medium trust</li>
  <li>Virtual service</li>
  <li>Destination rule</li>
  </ul>
  <p>I am deploying apache HTTPD - acting as a reverse proxy within the low trust. The plan is for the HTTPD to then forward the traffic to istio ingress gateway in the medium trust.
  Within the medium trust is a Spring boot application.</p>
  <p>So, lets say, user is accessing <a href="https://lowtrust.avengers.local/avengers" rel="nofollow noreferrer">https://lowtrust.avengers.local/avengers</a>. This request will be serviced by the ingress gateway in the lowtrust, and will end up in the HTTPD, which then forward the request to ingress gateway in mediumtrust.</p>
  <pre><code>LOWTRUST                      MEDIUMTRUST
  | GW--&gt; VS--&gt;HTTPD Pod|======&gt;| GW --&gt; VS --&gt;Java Pod|
  </code></pre>
  <p>I have created a github repo to demonstrate this:
  <a href="https://github.com/alexwibowo/avengersKubernetes" rel="nofollow noreferrer">https://github.com/alexwibowo/avengersKubernetes</a></p>
  <p>The HTTP proxy configuration is here: <a href="https://github.com/alexwibowo/avengersKubernetes/blob/main/httpd/conf/proxy.conf" rel="nofollow noreferrer">https://github.com/alexwibowo/avengersKubernetes/blob/main/httpd/conf/proxy.conf</a>.</p>
  <p>The Istio ingress gateway for lowtrust:
  <a href="https://github.com/alexwibowo/avengersKubernetes/blob/main/kubernetes/avengers/charts/avengers-istio/templates/istio-httpd.yaml" rel="nofollow noreferrer">https://github.com/alexwibowo/avengersKubernetes/blob/main/kubernetes/avengers/charts/avengers-istio/templates/istio-httpd.yaml</a></p>
  <p>and istio ingress gateway for mediumtrust:
  <a href="https://github.com/alexwibowo/avengersKubernetes/blob/main/kubernetes/avengers/charts/avengers-istio/templates/istio-app.yaml" rel="nofollow noreferrer">https://github.com/alexwibowo/avengersKubernetes/blob/main/kubernetes/avengers/charts/avengers-istio/templates/istio-app.yaml</a></p>
  <p>As you can see, both gateways have their own certs configured. At the moment, I kind of 'cheat' by modifying my /etc/host file to have the following:</p>
  <pre><code>127.0.0.1            lowtrust.avengers.local
  &lt;CLUSTER_IP_ADDRESS&gt; mediumtrust.avengers.local
  </code></pre>
  <p>By doing this, when HTTPD pod making request to 'mediumtrust.avengers.local', it will get directed to the istio ingress gateway (thats my understanding anyway).</p>
  <p>I've heard that you can actually set up a mutual TLS for the scenario I've described above. With this approach, I wont need to setup the certificate in my mediumtrust ingress gateway - and just use 'ISTIO_MUTUAL'. I think for this, I will also need to set up a 'proxy' service &amp; virtual service in the lowtrust namespace. The virtual service will then manage the communication between lowtrust &amp; mediumtrust. But I'm not 100% how to do this.</p>
  <p>Any help / advice is much appreciated!</p>
  <p>Edit 1 (2021/07/01)
  I've been reading more about this topic. So another option, is to have Service of type 'ExternalName' within the 'lowtrust' namespace.
  Which, if I might use the analogy, will act like a 'proxy' for connecting to the service on the other namespace.
  e.g.:</p>
  <pre><code>apiVersion: v1
  kind: Service
  metadata:
    name: cr1-avengers-app
    namespace: &quot;lowtrust&quot;
  spec:
    type: ExternalName
    externalName: &quot;cr1-avengers-app.mediumtrust.svc.cluster.local
    ports:
      - port: 8081
        targetPort: 8080
        protocol: TCP
        name: http
  </code></pre>
  <p>But by using this, I will effectively bypass the Istio VirtualService, DestinationRule that I've defined on the mediumtrust namespace.</p>