Several Traffic Configuration Paths Under an Istio Gateway

1. Common Object Configuration

1.1 Gateway

selector
- Selects the Envoy on which the rules take effect
servers
- The domains to match
- Port
- Protocol
- TLS certificate

1.2 VirtualService

gateways
- Specifies the gateway on which this takes effect; the default value mesh is for east-west traffic, while specifying a Gateway object makes it north-south traffic
http
- Layer 7 routing
- Redirect
- Rewrite
- Retry
- Condition rules
- Timeout
- Fault injection
- CORS policy
tcp
- Layer 7 routing
tls
- Routing with certificates
- TLS certificate

1.3 DestinationRule

host
- Routing
trafficPolicy
- Mirroring traffic
- Failover
- Circuit breaker
- Load balancing
subsets
- Provides Pod grouping, usable for blue-green deployment

2. Layer 7: Gateway->HTTPRoute->Service

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: default-gateway
  namespace: default
spec:
  selector:
    istio: ingressgateway
  servers:
    - hosts:
        - "*"
      port:
        name: http
        number: 80
        protocol: HTTP
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: chenshaowen
  namespace: default
spec:
  gateways:
    - default/default-gateway
  hosts:
    - "istio.chenshaowen.com"
  http:
    - match:
        - uri:
            exact: /
      route:
        - destination:
            host: blog.default.svc.cluster.local
            port:
              number: 80

This exposes the blog service in the default namespace to the outside through the Istio Gateway.

Mapping a host port plus the Istio Gateway to the host’s NodePort lets you reach the service. As shown below:

3. Layer 4: Gateway->TCPRoute->Service

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: default-gateway
  namespace: default
spec:
  selector:
    istio: ingressgateway
  servers:
    - hosts:
        - "*"
      port:
        name: tcp
        number: 80
        protocol: TCP
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: chenshaowen
  namespace: default
spec:
  gateways:
    - default/default-gateway
  hosts:
    - "istio.chenshaowen.com"
  tcp:
    - match:
        - port: 80
      route:
        - destination:
            host: blog.default.svc.cluster.local
            port:
              number: 80

When a VirtualService uses TCP, the Gateway must use TCP as well — the protocols have to match.