Version:

Set up a TLS Gateway

This tutorial shows how to set up a TLS Gateway in both manual and simple modes. It also explains how to configure authentication for an mTLS Gateway based on certificate details.

Prerequisites

Deploy a sample HttpBin service and a sample Function.
Set up your custom domain and export the following values as environment variables:
Click to copy
```
export DOMAIN_TO_EXPOSE_WORKLOADS={DOMAIN_NAME}
export GATEWAY=$NAMESPACE/httpbin-gateway
```

Set up a TLS Gateway in simple mode

To create a TLS Gateway in simple mode, run:

Click to copy

```bash
  cat <<EOF | kubectl apply -f -
  apiVersion: networking.istio.io/v1alpha3
  kind: Gateway
  metadata:
    name: httpbin-gateway
    namespace: $NAMESPACE
  spec:
    selector:
      istio: ingressgateway # Use Istio Ingress Gateway as default
    servers:
      - port:
          number: 443
          name: https
          protocol: HTTPS
        tls:
          mode: SIMPLE
          credentialName: $TLS_SECRET
        hosts:
          - "*.$DOMAIN_TO_EXPOSE_WORKLOADS"
EOF
```

Set up a TLS Gateway in mutual mode

Create a mutual TLS Gateway. Run:

Click to copy

  cat <<EOF | kubectl apply -f -
  ---
  apiVersion: networking.istio.io/v1beta1
  kind: Gateway
  metadata:
    name: ${MTLS_GATEWAY_NAME}
    namespace: ${NAMESPACE}
  spec:
    selector:
      istio: ingressgateway
      app: istio-ingressgateway
    servers:
      - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: MUTUAL
        credentialName: ${TLS_SECRET}
        minProtocolVersion: TLSV1_2
        cipherSuites:
          - ECDHE-RSA-CHACHA20-POLY1305
          - ECDHE-RSA-AES256-GCM-SHA384
          - ECDHE-RSA-AES256-SHA
          - ECDHE-RSA-AES128-GCM-SHA256
          - ECDHE-RSA-AES128-SHA
        hosts:
          - '*.${DOMAIN_TO_EXPOSE_WORKLOADS}'
      - port:
          number: 80
          name: http
          protocol: HTTP
        tls:
          httpsRedirect: true
        hosts:
          - '*.${DOMAIN_TO_EXPOSE_WORKLOADS}'
EOF

Export the following value as an environment variable:

Click to copy

export CLIENT_ROOT_CA_CRT_ENCODED=$(cat ${CLIENT_ROOT_CA_CRT_FILE}| base64)

Add client root CA to the CA cert bundle Secret for mTLS Gateway. Run:

Click to copy

  cat <<EOF | kubectl apply -f -
  ---
  apiVersion: v1
  kind: Secret
  metadata:
    name: ${TLS_SECRET}-cacert
    namespace: istio-system
  type: Opaque
  data:
    cacert: ${CLIENT_ROOT_CA_CRT_ENCODED}
EOF