-
Notifications
You must be signed in to change notification settings - Fork 8.1k
Description
Bug description
Changing the port definition in istio-ingressgateway service, effect outbound traffic to https targets
Affected product area (please put an X in all that apply)
[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[X] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
Expected behavior
Istio ingress gw service definition should not affect outbound traffic at all.
Steps to reproduce the bug
-
Remove https port and change http2 to be:
- name: http2 nodePort: 31380 port: 443 protocol: TCP targetPort: 80
-
Now you can't reach https targets. For example:
Unexpected warning for https://registry.npmjs.org/: Miscellaneous Warning EPROTO: request to https://registry.npmjs.org/ansi-regex failed, reason: write EPROTO 139747852671880:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:827:\n
-
Changing the port name in ingress-gw service to 'https' resolve the issue. But the point is - ingress gw service definition should have no effect on the ability to reach external https targets.
Version (include the output of istioctl version --remote
and kubectl version
)
istio 1.2.2
Client Version: version.Info{Major:"1", Minor:"12", GitVersion:"v1.12.0", GitCommit:"0ed33881dc4355495f623c6f22e7dd0b7632b7c0", GitTreeState:"clean", BuildDate:"2018-09-27T17:05:32Z", GoVersion:"go1.10.4", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"12+", GitVersion:"v1.12.10-eks-2e569f", GitCommit:"2e569fd887357952e506846ed47fc30cc385409a", GitTreeState:"clean", BuildDate:"2019-07-25T23:13:33Z", GoVersion:"go1.10.8", Compiler:"gc", Platform:"linux/amd64"}
How was Istio installed?
Helm
Environment where bug was observed (cloud vendor, OS, etc)
EKS