How to configure TLS origination in ISTIO?

Question

Istio does not route to external HTTPs service via TLS origination.

I have a pod containing two containers: - Application - ISTIO Proxy

Application makes a call to external third party API which resides on https://someurl.somedomain.com/v1/some-service

Application sends HTTP requests to this service by calling http://someurl.somedomain.com/v1/some-service - notice that it's HTTP and not HTTPs.

I then configured the following in ISTIO:

• Virtual service to route HTTP traffic to port 443:

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: someservice-vs
spec:
  hosts:
  - someurl.somedomain.com
  http:
  - match:
    - port: 80    
    route:
    - destination:
        host: someurl.somedomain.com
        port:
          number: 443      
    timeout: 40s
    retries:
      attempts: 10
      perTryTimeout: 4s      
      retryOn: gateway-error,connect-failure,refused-stream,retriable-4xx,5xx 

• Service Entry that allows the traffic out. As you can see, we specify that service is external to the mesh and we opened 443 and 80 both of which use HTTP, but 443 is configured for TLS origination.

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: someservice-se
spec:
  hosts:
  - someurl.somedomain.com
  location: MESH_EXTERNAL
  ports:
  - number: 443
    name: http-port-for-tls-origination
    protocol: HTTP
  - number: 80
    name: http-port
    protocol: HTTP
  resolution: DNS

Finally, I have a destination rule that applies simple TLS to the outgoing traffic:

---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: someservice-destinationrule
spec:
  host: someurl.somedomain.com
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: SIMPLE # initiates HTTPS when accessing someurl.somedomain.com 

For some reason this does not work and I get 404 when calling the service from my application container, which indicates that traffic isn't being encrypted via TLS.

The reason why I use TLS origination is because I need to apply re-tries in my virtual service and I can only do this with HTTP routes as otherwise ISTIO cannot see request and work with it.

Been scratching my head for two days and need some help please :-)

Answer 1

Got to the bottom of this. ISTIO documentation was correct - TLS origination and retries work as expected.

The issue was caused by the perTryTimeout value which was too low. Requests were not completing in allocated time, so the gateway was timing out. It caught us out because the external service's performance has degraded recently and we didn't think to check it.