Ingress Gateway without TLS Termination

    The example HTTPS service used for this task is a simple NGINX server. In the following steps you first deploy the NGINX service in your Kubernetes cluster. Then you configure a gateway to provide ingress access to the service via host .

    For this task you can use your favorite tool to generate certificates and keys. The commands below use openssl

    1. Create a root certificate and private key to sign the certificate for your services:

    2. Create a certificate and a private key for nginx.example.com:

      1. $ openssl req -out nginx.example.com.csr -newkey rsa:2048 -nodes -keyout nginx.example.com.key -subj "/CN=nginx.example.com/O=some organization"
      2. $ openssl x509 -req -sha256 -days 365 -CA example.com.crt -CAkey example.com.key -set_serial 0 -in nginx.example.com.csr -out nginx.example.com.crt
      1. $ kubectl create secret tls nginx-server-certs --key nginx.example.com.key --cert nginx.example.com.crt

    2. Create a configuration file for the NGINX server:

      1. $ cat <<\EOF > ./nginx.conf
      2. events {
      3. }
      5. http {
      6.   log_format main '$remote_addr - $remote_user [$time_local]  $status '
      7.   '"$request" $body_bytes_sent "$http_referer" '
      8.   '"$http_user_agent" "$http_x_forwarded_for"';
      9.   access_log /var/log/nginx/access.log main;
      10.   error_log  /var/log/nginx/error.log;
      12.   server {
      13.     listen 443 ssl;
      15.     root /usr/share/nginx/html;
      16.     index index.html;
      18.     server_name nginx.example.com;
      19.     ssl_certificate /etc/nginx-server-certs/tls.crt;
      20.     ssl_certificate_key /etc/nginx-server-certs/tls.key;
      21.   }
      22. }
      23. EOF

    3. Create a Kubernetes ConfigMap to hold the configuration of the NGINX server:

    4. Deploy the NGINX server:

      1. $ cat <<EOF | istioctl kube-inject -f - | kubectl apply -f -
      2. apiVersion: v1
      3. kind: Service
      4. metadata:
      5.   name: my-nginx
      6.   labels:
      7.     run: my-nginx
      8. spec:
      9.   ports:
      10.   - port: 443
      11.     protocol: TCP
      12.   selector:
      13.     run: my-nginx
      14. ---
      15. apiVersion: apps/v1
      16. metadata:
      17.   name: my-nginx
      18. spec:
      19.   selector:
      20.     matchLabels:
      22.   replicas: 1
      23.   template:
      24.     metadata:
      25.       labels:
      26.         run: my-nginx
      27.     spec:
      28.       containers:
      29.       - name: my-nginx
      30.         image: nginx
      31.         ports:
      32.         - containerPort: 443
      33.         volumeMounts:
      34.         - name: nginx-config
      35.           mountPath: /etc/nginx
      36.           readOnly: true
      37.         - name: nginx-server-certs
      38.           mountPath: /etc/nginx-server-certs
      39.           readOnly: true
      40.       volumes:
      41.       - name: nginx-config
      42.         configMap:
      43.           name: nginx-configmap
      44.       - name: nginx-server-certs
      45.         secret:
      46.           secretName: nginx-server-certs
      47. EOF

    5. To test that the NGINX server was deployed successfully, send a request to the server from its sidecar proxy without checking the server’s certificate (use the -k option of curl). Ensure that the server’s certificate is printed correctly, i.e., common name (CN) is equal to nginx.example.com.

      1. $ kubectl exec "$(kubectl get pod  -l run=my-nginx -o jsonpath={.items..metadata.name})" -c istio-proxy -- curl -sS -v -k --resolve nginx.example.com:443:127.0.0.1 https://nginx.example.com
      2. ...
      3. SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
      4. ALPN, server accepted to use http/1.1
      5. Server certificate:
      6.   subject: CN=nginx.example.com; O=some organization
      7.   start date: May 27 14:18:47 2020 GMT
      8.   expire date: May 27 14:18:47 2021 GMT
      9.   issuer: O=example Inc.; CN=example.com
      10.   SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
      12. > GET / HTTP/1.1
      13. > User-Agent: curl/7.58.0
      14. > Host: nginx.example.com
      15. ...
      16. < HTTP/1.1 200 OK
      18. < Server: nginx/1.17.10
      19. <!DOCTYPE html>
      20. <html>
      21. <head>
      22. <title>Welcome to nginx!</title>
      23. ...
      1. $ kubectl apply -f - <<EOF
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5.   name: mygateway
      6. spec:
      7.   selector:
      8.     istio: ingressgateway # use istio default ingress gateway
      9.   servers:
      10.   - port:
      11.       number: 443
      12.       name: https
      13.       protocol: HTTPS
      14.     tls:
      15.       mode: PASSTHROUGH
      16.     hosts:
      17.     - nginx.example.com
      18. EOF

    2. Configure routes for traffic entering via the Gateway:

    3. Follow the instructions in Determining the ingress IP and ports to define the SECURE_INGRESS_PORT and INGRESS_HOST environment variables.

    4. Access the NGINX service from outside the cluster. Note that the correct certificate is returned by the server and it is successfully verified (SSL certificate verify ok is printed).

      1. $ curl -v --resolve "nginx.example.com:$SECURE_INGRESS_PORT:$INGRESS_HOST" --cacert example.com.crt "https://nginx.example.com:$SECURE_INGRESS_PORT"
      2. Server certificate:
      3.   subject: CN=nginx.example.com; O=some organization
      4.   start date: Wed, 15 Aug 2018 07:29:07 GMT
      5.   expire date: Sun, 25 Aug 2019 07:29:07 GMT
      6.   issuer: O=example Inc.; CN=example.com
      7.   SSL certificate verify ok.
      9.   < HTTP/1.1 200 OK
      10.   < Server: nginx/1.15.2
      11.   ...
      12.   <html>
      13.   <head>
      14.   <title>Welcome to nginx!</title>

    1. Remove created Kubernetes resources:

      1. $ kubectl delete secret nginx-server-certs
      2. $ kubectl delete configmap nginx-configmap
      3. $ kubectl delete service my-nginx
      4. $ kubectl delete deployment my-nginx
      5. $ kubectl delete gateway mygateway
      1. $ rm example.com.crt example.com.key nginx.example.com.crt nginx.example.com.key nginx.example.com.csr

    3. Delete the generated configuration files used in this example: