O que estamos tentando alcançar é apontar o tráfego de malha para um serviço externo por meio de um gateway de saída.
Tentamos várias iterações e agora tentamos com um gateway de saída entre elas.
O serviço externo está funcionando com nossos certificados.
Malha > Egressgateway > Serviço externo.
O erro no gateway é:
[2020-08-21T14:52:37.523Z] "GET / HTTP/1.1" 503 UF,URX "-" "TLS error: 268436496:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE 268435610:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO" 0 91 62 - "10.32.64.16" "curl/7.61.1" "f57b76e9-99b1-43bd-8905-1226ab2c7e69" "<vm-name>.europe-west1-b.c.<google-project-name>.internal" "10.32.3.207:8123" outbound|8123|notebook-ext|<vm-name>.europe-west1-b.c.<google-project-name>.internal - 10.32.65.2:8123 10.32.64.16:54912 <vm-name>.europe-west1-b.c.<google-project-name>.internal -
Yamls:
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: notebook
namespace: istio-system
spec:
hosts:
- <vm-name>.europe-west1-b.c.<google-project-name>.internal
ports:
- number: 80
name: http-port-for-tls-origination
protocol: http
- number: 8123
name: https
protocol: HTTPS
resolution: DNS
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: istio-egressgateway-notebook
namespace: istio-system
spec:
selector:
istio: egressgateway
servers:
- port:
number: 80
name: http-port-for-tls-origination
protocol: HTTP
hosts:
- <vm-name>.europe-west1-b.c.<google-project-name>.internal
- port:
number: 8123
name: https
protocol: HTTPS
hosts:
- <vm-name>.europe-west1-b.c.<google-project-name>.internal
tls:
mode: MUTUAL
serverCertificate: /temp-certs/cert-chain.pem
privateKey: /temp-certs/key.pem
caCertificates: /temp-certs/root-cert.pem
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: egressgateway-for-notebook
namespace: istio-system
spec:
host: istio-egressgateway.istio-system.svc.cluster.local
subsets:
- name: notebook
trafficPolicy:
loadBalancer:
simple: ROUND_ROBIN
portLevelSettings:
- port:
number: 8123
tls:
mode: ISTIO_MUTUAL
sni: <vm-name>.europe-west1-b.c.<google-project-name>.internal
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: direct-notebook-through-egress
namespace: istio-system
spec:
hosts:
- <vm-name>.europe-west1-b.c.<google-project-name>.internal
gateways:
- mesh
- istio-egressgateway-notebook
http:
- match:
- gateways:
- mesh
port: 80
sniHosts:
- <vm-name>.europe-west1-b.c.<google-project-name>.internal
route:
- destination:
host: istio-egressgateway.istio-system.svc.cluster.local
subset: notebook
port:
number: 8123
- match:
- gateways:
- istio-egressgateway-notebook
port: 8123
sniHosts:
- <vm-name>.europe-west1-b.c.<google-project-name>.internal
route:
- destination:
host: <vm-name>.europe-west1-b.c.<google-project-name>.internal
subset: notebook-ext
port:
number: 8123
weight: 100
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: notebook
namespace: istio-system
spec:
#exportTo: ["."]
host: <vm-name>.europe-west1-b.c.<google-project-name>.internal
subsets:
- name: notebook-ext
trafficPolicy:
loadBalancer:
simple: ROUND_ROBIN
portLevelSettings:
- port:
number: 8123
tls:
mode: SIMPLE
sni: <vm-name>.europe-west1-b.c.<google-project-name>.internal
serverCertificate: /temp-certs/cert-chain.pem
privateKey: /temp-certs/key.pem
caCertificates: /temp-certs/root-cert.pem
O objetivo final para isso é ter algo disponível na malha em http que passará pelo egressgateway e o TLS se originará a partir daí. Isso ocorre porque queremos direcionar o tráfego de um gateway de entrada público de volta para fora da malha para o serviço externo por meio do gateway de saída. Para ter HTTPS
Os certificados acima estão presentes no pod do gateway de saída conforme curl abaixo:
Se eu executar no pod egressgateway e curl https://<vm-name>.europe-west1-b.c.<google-project-name>.internal:8123 --cacert /temp-certs/root-cert.pem -vobtiver a resposta da VM externa.
Alguma idéia de por que isso estaria acontecendo?