Configuring Istio Ingress with AWS NLB: A Step-by-Step Guide

Istio provides a default gateway implementation that can be used to handle ingress traffic. However, when following a secure ingress setup, macOS users may need to add an additional patch to generate certificates for TLS. This article will walk you through the process of deploying an ingress gateway for HTTPBin on port 80 and 443 using Istio's default gateway implementation.

Step 1: Configure Proxy Protocol

To enable proxy protocol with Istio Ingress, we can use the `/.http_connection_manager.v2.HttpConnectionManager` configuration. This allows us to specify a custom connection manager that enables proxy protocol without any middle proxy.

Here is an example of how to configure proxy protocol:

```

apiVersion: /v1alpha3

kind: EnvoyFilter

metadata:

spec:

workloadSelector:

matchLabels:

app: httpbin

configPatches:

- applyTo: NETWORK_FILTER

patch:

'@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v2.HttpConnectionManager

statPrefix: envoy.http_connection_manager

route_config:

virtual_hosts:

- name: localhost

domains:

- '*'

routes:

- match: path: /api/status

route:

cluster: httpbin

retry_policy: @type: type.googleapis.com/envoy.retry.RetryPolicy

```

Step 2: Create Proxy-Protocol Envoy Filter

To enable proxy protocol and X-Forwarded-For at the same time, we can use a separate setup for port 80 and 443. Here is an example of how to create a proxy-protocol envoy filter:

```

apiVersion: /v1alpha3

kind: EnvoyFilter

metadata:

spec:

workloadSelector:

matchLabels:

app: httpbin

configPatches:

- applyTo: NETWORK_FILTER

patch:

'@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v2.HttpConnectionManager

statPrefix: envoy.http_connection_manager

route_config:

virtual_hosts:

- name: localhost

domains:

- '*'

routes:

- match: path: /api/status

route:

cluster: httpbin

retry_policy: @type: type.googleapis.com/envoy.retry.RetryPolicy

```

Step 3: Deploy Ingress Gateway

To deploy the ingress gateway, we can use Helm to install Istio. Here is an example of how to do this:

```

helm upgrade --set global.proxy.protocol='h2' istio-base

```

In conclusion, configuring Istio Ingress with AWS NLB requires some additional setup and configuration. By following these steps, you can enable proxy protocol and X-Forwarded-For at the same time using Envoy Filters. Additionally, you can use other automation tools such as Terraform to achieve the same goal.

References

* Configuring Istio Ingress with AWS NLB: A Step-by-Step Guide

* Istio documentation: 'https://istio.io/docs/concepts/traffic-management/injection/'(https://istio.io/docs/concepts/traffic-management/injection/)

* AWS NLB portal: 'https://aws.amazon.com/nlb/'(https://aws.amazon.com/nlb/)

Waf nlb