Skip to content

Changes to ingress-gw ports effect outbound traffic #16196

@jacob-koren-zooz

Description

@jacob-koren-zooz

Bug description
Changing the port definition in istio-ingressgateway service, effect outbound traffic to https targets
Affected product area (please put an X in all that apply)

[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[X] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

Expected behavior
Istio ingress gw service definition should not affect outbound traffic at all.
Steps to reproduce the bug

  1. Remove https port and change http2 to be:
    - name: http2 nodePort: 31380 port: 443 protocol: TCP targetPort: 80

  2. Now you can't reach https targets. For example:
    Unexpected warning for https://registry.npmjs.org/: Miscellaneous Warning EPROTO: request to https://registry.npmjs.org/ansi-regex failed, reason: write EPROTO 139747852671880:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:827:\n

  3. Changing the port name in ingress-gw service to 'https' resolve the issue. But the point is - ingress gw service definition should have no effect on the ability to reach external https targets.

Version (include the output of istioctl version --remote and kubectl version)

istio 1.2.2

Client Version: version.Info{Major:"1", Minor:"12", GitVersion:"v1.12.0", GitCommit:"0ed33881dc4355495f623c6f22e7dd0b7632b7c0", GitTreeState:"clean", BuildDate:"2018-09-27T17:05:32Z", GoVersion:"go1.10.4", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"12+", GitVersion:"v1.12.10-eks-2e569f", GitCommit:"2e569fd887357952e506846ed47fc30cc385409a", GitTreeState:"clean", BuildDate:"2019-07-25T23:13:33Z", GoVersion:"go1.10.8", Compiler:"gc", Platform:"linux/amd64"}

How was Istio installed?
Helm
Environment where bug was observed (cloud vendor, OS, etc)
EKS

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions