Egress using Wildcard Hosts
The Accessing External Services6 task and
the Configure an Egress Gateway7 example
describe how to configure egress traffic for specific hostnames, like edition.cnn.com
.
This example shows how to enable egress traffic for a set of hosts in a common domain, for
example *.wikipedia.org
, instead of configuring each and every host separately.
Background
Suppose you want to enable egress traffic in Istio for the wikipedia.org
sites in all languages.
Each version of wikipedia.org
in a particular language has its own hostname, e.g., en.wikipedia.org
and
de.wikipedia.org
in the English and the German languages, respectively.
You want to enable egress traffic by common configuration items for all the Wikipedia sites,
without the need to specify every language’s site separately.
Before you begin
Install Istio using the
demo
configuration profile8 and with the blocking-by-default outbound traffic policy:Deploy the sleep9 sample app to use as a test source for sending requests. If you have automatic sidecar injection enabled, run the following command to deploy the sample app:
Otherwise, manually inject the sidecar before deploying the
sleep
application with the following command:Set the
SOURCE_POD
environment variable to the name of your source pod:
Configure direct traffic to a wildcard host
The first, and simplest, way to access a set of hosts within a common domain is by configuring
a simple ServiceEntry
with a wildcard host and calling the services directly from the sidecar.
When calling services directly (i.e., not via an egress gateway), the configuration for
a wildcard host is no different than that of any other (e.g., fully qualified) host,
only much more convenient when there are many hosts within the common domain.
Define a
ServiceEntry
for*.wikipedia.org
:Send HTTPS requests to https://en.wikipedia.org11 and https://de.wikipedia.org12:
Cleanup direct traffic to a wildcard host
Wildcard configuration for a single hosting server
When all wildcard hosts are served by a single server, the configuration for egress gateway-based access to a wildcard host is very similar to that of any host, with one exception: the configured route destination will not be the same as the configured host, i.e., the wildcard. It will instead be configured with the host of the single server for the set of domains.
Create an egress
Gateway
for *.wikipedia.org, a destination rule and a virtual service to direct the traffic through the egress gateway and from the egress gateway to the external service.Create a
ServiceEntry
for the destination server, www.wikipedia.org.Send HTTPS requests to https://en.wikipedia.org11 and https://de.wikipedia.org12:
Check the statistics of the egress gateway’s proxy for the counter that corresponds to your requests to *.wikipedia.org. If Istio is deployed in the
istio-system
namespace, the command to print the counter is:
Cleanup wildcard configuration for a single hosting server
Cleanup
Shutdown the sleep9 service:
Uninstall Istio from your cluster: