istio: use service registry to make internal HTTPS request

Question

we are using kubernetes (1.17.14-gke.1600) and istio (1.7.4)
we have several deployments that need to make each other HTTPS requests using the public DNS record (mydomain.com). The goal here is to make internal HTTPS request instead of going public and then come back.

we cannot change the host with the "internal" dns (ex my-svc.my-namespace.svc.cluster-domain.example ) because sometimes the same host is returned to the client to make HTTP request from the client browser

Our services are exposed in HTTP so I understand that if we want to use HTTPS scheme we need to pass through the istio gateway

Here is my VirtualService, adding the mesh gateway I'm able to make internal HTTP request with the public DNS, but this doesn't work with HTTPS

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: myservice
spec:
  gateways:
  - istio-system/gateway
  - mesh
  hosts:
  - myservice.mydomain.com
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: myservice
        port:
          number: 3000
        subset: v1

Here is the gateway:

apiVersion: v1
items:
- apiVersion: networking.istio.io/v1beta1
  kind: Gateway
  metadata:
    name: gateway
    namespace: istio-system
  spec:
    selector:
      istio: ingressgateway
    servers:
    - hosts:
      - '*'
      port:
        name: http
        number: 80
        protocol: HTTP
      tls:
        httpsRedirect: true
    - hosts:
      - '*'
      port:
        name: https
        number: 443
        protocol: HTTPS
      tls:
        credentialName: ingress-cert
        mode: SIMPLE

I've figured out one workaround to solve the problem is to use a Service Entry like this:

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: internal-https-redirect
spec:
  endpoints:
  - address: 10.43.2.170 # istio-ingressgateway ClusterIP
  hosts:
  - '*.mydomain.com'
  location: MESH_INTERNAL
  ports:
  - name: internal-redirect
    number: 443
    protocol: HTTPS
  resolution: STATIC

But I'm not sure if the right way to do it or if that is considered a bad practice.

Thank you

Answer 1

So you want to enable services inside your cluster to be able to use the same hostname that external calls use?

With the VirtualService setup that you are running, instead of adding a ServiceEntry you could try to add a rewrite rule to the DNS setup itself on your cluster to point to the loadbalancer/clusterip of the ingress gateway. This will result in traffic initiated from your service mesh to hit the ingress gateway without you having to know the actual IP at any time.

Here is an example for coredns which is probably what you are using.

The downside to this approach is that you need to find a way that fits your setup to inject this into the coredns config map instead of just deploying an additional piece of configuration like with a ServiceEntry.

apiVersion: v1
kind: ConfigMap
metadata:
  name: coredns
  namespace: kube-system
data:
Corefile: |
.:53 {
  ...
  rewrite name exact myservice.mydomain.com istio-gateway.istio-system.svc.cluster.local
  ...
  loop
  reload
  loadbalance
}