Skip to content

Latest commit

 

History

History
51 lines (36 loc) · 1.79 KB

README.md

File metadata and controls

51 lines (36 loc) · 1.79 KB
Raw

Ingress SNI Passthrough

Simple TLS Mode

  1. Create a secret ngnix-certificate where the istio-ingressgateway is running

    openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=example Inc./CN=example.com' -keyout example.com.key -out example.com.crt
openssl req -out nginx.example.com.csr -newkey rsa:2048 -nodes -keyout nginx.example.com.key -subj "/CN=nginx.example.com/O=some organization"
openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set_serial 0 -in nginx.example.com.csr -out nginx.example.com.crt

export CONTROL_PLANE=istio-system

oc create secret tls nginx-certificate --key nginx.example.com.key --cert nginx.example.com.crt -n $CONTROL_PLANE

  2. Launch the deployment

    export DATA_PLANE=app-namespace

export BASE_DOMAIN=apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')

helm upgrade --install app nginx/ -f cd/simple.yaml --set mesh.baseDomain=$BASE_DOMAIN -n $DATA_PLANE

  3. Test the gateway

    export GATEWAY_URL=$(oc get route -lmaistra.io/gateway-name=app-mesh -o jsonpath='{.items..spec.host}' -n $CONTROL_PLANE)
curl -k https://$GATEWAY_URL/health

Passthrough Mode

  1. Launch the deployment

    export DATA_PLANE=app-namespace

export BASE_DOMAIN=apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')

helm upgrade --install app nginx/ -f cd/passthrough.yaml --set mesh.baseDomain=$BASE_DOMAIN -n $DATA_PLANE

    It using the service.alpha.openshift.io/serving-cert-secret-nameannotations for the certificate.

  2. Test the gateway

    export GATEWAY_URL=$(oc get route -lmaistra.io/gateway-name=app-mesh -o jsonpath='{.items..spec.host}' -n $CONTROL_PLANE)
curl -k https://$GATEWAY_URL/health