how to call ingress gateway from mesh

[hanstf]

Hi all is there any way for ingress gateway to be accessed via another pod in the mesh through istio mutual tls ? It seems that currently the traffic from another pod to ingress gateway always go through passthroughclusterh

[abasitt]

Hi Hans, Yes possible.
You can use the same example of egress-gateway here and then route the traffic back to in-cluster service using VS.

[abasitt]

I saw your another post as well, let me know if you are still stuck and will try to create for you the working example of it.

[hanstf]

Hi thanks for the reference, I have tried to follow the "Perform TLS origination with an egress gateway" example, but it seems after it arrived to egress gateway, we getting "filter_chain_not_found" error and response_flags: "NR". This is my config:

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: cf-ingress
  namespace: ns
spec:
  exportTo:
    - "."
  hosts:
    - "portal2.example.com"
  gateways:
    - ingressgateway
    - mesh
  http:
    - name: main-3
      match:
        - port: 8082
          gateways:
            - mesh
      route:
        - destination:
            host: ingressgateway.ns.svc.cluster.local
            subset: upgrade-mtls
            port:
              number: 8082
    - name: portal-0
      match:
        - gateways:
            - ingressgateway
      route:
        - destination:
            host: main-service.ns.svc.cluster.local
            port:
              number: 80

gateway chart values:

    labels:
      app: ingressgateway
      istio: ingressgateway
    service:
      type: ClusterIP
      ports:
        - name: https
          port: 8082

gateway:

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: ingressgateway
  namespace: ns
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 8082
        name: tls-ingress
        protocol: HTTPS
      hosts:
        - "portal2.example.com"
      tls:
        mode: ISTIO_MUTUAL

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: ingressgateway
  namespace: ns
spec:
  host: ingressgateway.ns.svc.cluster.local
  subsets:
  - name: upgrade-mtls
    trafficPolicy:
      loadBalancer:
        simple: ROUND_ROBIN
      portLevelSettings:
        - port:
            number: 8082
          tls:
            mode: ISTIO_MUTUAL
            sni: "portal2.example.com"

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: ingressgateway
  namespace: ns
spec:
  exportTo:
    - '.'
  hosts:
    - "portal2.example.com"
  ports:
    - name: http
      number: 8082
      protocol: HTTP
  resolution: DNS

[hanstf]

upon checking further it seems that the traffic is keep on redirected to 172.20.105.90 8082 listener instead of 0.0.0.0 8082 listener.
this causes the traffic never go to destinationrule subset since the its defined on the viertualService on 0.0.0.0:8082 route.

ADDRESSES     PORT MATCH                                DESTINATION
0.0.0.0       8082 Trans: raw_buffer; App: http/1.1,h2c Route: 8082
0.0.0.0       8082 ALL                                  PassthroughCluster
172.20.105.90 8082 ALL                                  Cluster: outbound|8082||ingressgateway.ns.svc.cluster.local

do you know is there any way I could use the 0.0.0.0 listener instead of the specific ip one ?

[abasitt]

Can you follow this example ? It should work.
https://github.com/abasitt/kube6/tree/main/istio/singlestack-withkind/apps/ingress-from-mesh-demo

[hanstf]

Hi it works! Thanks!