Egress using Wildcard Hosts

    Suppose you want to enable egress traffic in Istio for the wikipedia.org sites in all languages. Each version of wikipedia.org in a particular language has its own hostname, e.g., en.wikipedia.org and de.wikipedia.org in the English and the German languages, respectively. You want to enable egress traffic by common configuration items for all the Wikipedia sites, without the need to specify every language’s site separately.

    • Install Istio using the demo configuration profile and with the blocking-by-default outbound traffic policy:

      You can run this task on an Istio configuration other than the demo profile as long as you make sure to , enable Envoy’s access logging, and in your installation. You will also need to add the second gateway using your own IstioOperator CR instead of the one shown in setup egress gateway with SNI proxy.

    • Deploy the sample app to use as a test source for sending requests. If you have automatic sidecar injection enabled, run the following command to deploy the sample app:

      1. $ kubectl apply -f @samples/sleep/sleep.yaml@

      Otherwise, manually inject the sidecar before deploying the sleep application with the following command:

      1. $ kubectl apply -f <(istioctl kube-inject -f @samples/sleep/sleep.yaml@)

      You can use any pod with curl installed as a test source.

    • Set the SOURCE_POD environment variable to the name of your source pod:

      1. $ export SOURCE_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})

    The first, and simplest, way to access a set of hosts within a common domain is by configuring a simple ServiceEntry with a wildcard host and calling the services directly from the sidecar. When calling services directly (i.e., not via an egress gateway), the configuration for a wildcard host is no different than that of any other (e.g., fully qualified) host, only much more convenient when there are many hosts within the common domain.

    Note that the configuration below can be easily bypassed by a malicious application. For a secure egress traffic control, direct the traffic through an egress gateway.

    Note that the DNS resolution cannot be used for wildcard hosts. This is why the NONE resolution (omitted since it is the default) is used in the service entry below.

    1. Define a ServiceEntry for *.wikipedia.org:

      1. $ kubectl exec "$SOURCE_POD" -c sleep -- sh -c 'curl -s https://en.wikipedia.org/wiki/Main_Page | grep -o "<title>.*</title>"; curl -s https://de.wikipedia.org/wiki/Wikipedia:Hauptseite | grep -o "<title>.*</title>"'
      2. <title>Wikipedia, the free encyclopedia</title>
      3. <title>Wikipedia – Die freie Enzyklopädie</title>
    1. $ kubectl delete serviceentry wikipedia

    Wildcard configuration for a single hosting server

    When all wildcard hosts are served by a single server, the configuration for egress gateway-based access to a wildcard host is very similar to that of any host, with one exception: the configured route destination will not be the same as the configured host, i.e., the wildcard. It will instead be configured with the host of the single server for the set of domains.

    1. Create an egress Gateway for \.wikipedia.org*, a destination rule and a virtual service to direct the traffic through the egress gateway and from the egress gateway to the external service.

      1. $ kubectl apply -f - <<EOF
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5.   name: istio-egressgateway
      6. spec:
      7.   selector:
      8.     istio: egressgateway
      10.   - port:
      11.       number: 443
      12.       name: https
      13.     hosts:
      14.     - "*.wikipedia.org"
      15.     tls:
      16.       mode: PASSTHROUGH
      17. ---
      18. apiVersion: networking.istio.io/v1alpha3
      19. kind: DestinationRule
      20. metadata:
      21.   name: egressgateway-for-wikipedia
      22. spec:
      23.   host: istio-egressgateway.istio-system.svc.cluster.local
      24.   subsets:
      25.     - name: wikipedia
      26. ---
      27. apiVersion: networking.istio.io/v1alpha3
      28. kind: VirtualService
      29. metadata:
      30.   name: direct-wikipedia-through-egress-gateway
      31. spec:
      32.   hosts:
      33.   - "*.wikipedia.org"
      34.   gateways:
      35.   - mesh
      36.   - istio-egressgateway
      37.   tls:
      38.   - match:
      39.     - gateways:
      40.       - mesh
      42.       sniHosts:
      43.       - "*.wikipedia.org"
      44.     route:
      45.         host: istio-egressgateway.istio-system.svc.cluster.local
      46.         subset: wikipedia
      47.         port:
      48.           number: 443
      49.       weight: 100
      50.   - match:
      51.     - gateways:
      52.       - istio-egressgateway
      53.       port: 443
      54.       sniHosts:
      55.       - "*.wikipedia.org"
      56.     route:
      57.     - destination:
      58.         host: www.wikipedia.org
      59.         port:
      60.           number: 443
      61.       weight: 100
      62. EOF

    2. Create a ServiceEntry for the destination server, .

    3. Send HTTPS requests to https://en.wikipedia.org and :

      1. $ kubectl exec "$SOURCE_POD" -c sleep -- sh -c 'curl -s https://en.wikipedia.org/wiki/Main_Page | grep -o "<title>.*</title>"; curl -s https://de.wikipedia.org/wiki/Wikipedia:Hauptseite | grep -o "<title>.*</title>"'
      2. <title>Wikipedia, the free encyclopedia</title>
      3. <title>Wikipedia – Die freie Enzyklopädie</title>

    4. Check the statistics of the egress gateway’s proxy for the counter that corresponds to your requests to \.wikipedia.org*. If Istio is deployed in the istio-system namespace, the command to print the counter is:

      1. $ kubectl exec "$(kubectl get pod -l istio=egressgateway -n istio-system -o jsonpath='{.items[0].metadata.name}')" -c istio-proxy -n istio-system -- pilot-agent request GET clusters | grep '^outbound|443||www.wikipedia.org.*cx_total:'
      2. outbound|443||www.wikipedia.org::208.80.154.224:443::cx_total::2

    Cleanup wildcard configuration for a single hosting server

    1. $ kubectl delete serviceentry www-wikipedia
    2. $ kubectl delete gateway istio-egressgateway
    3. $ kubectl delete virtualservice direct-wikipedia-through-egress-gateway

    • Shutdown the sleep service:

    • Uninstall Istio from your cluster: