Skip to main content
Mapagam

Configuring Egress Gateways

1. Creating Egress Gateway Resources

Resource Type Description Example
EgressGateway Defines the egress gateway configuration for routing traffic outside the mesh 
apiVersion: networking.istio.io/v1beta1
kind: EgressGateway
metadata:
  name: egress-gateway
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "https://api.example.com"

Example: Define Egress Gateway for External API

apiVersion: networking.istio.io/v1beta1
kind: EgressGateway
metadata:
  name: external-api-gateway
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "https://api.example.com"

2. Configuring Egress Gateway Routing

Property Description Example
egressGateway.name Name of the Egress Gateway resource egress-gateway
egressGateway.namespace Namespace where Egress Gateway is deployed istio-system
egressGateway.hosts List of hostnames to route through the gateway [“api.example.com”, “external.service.com”]
egressGateway.port Port to use for routing egress traffic 443

Example: Egress Gateway Configuration

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: egress-gateway
  namespace: istio-system
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - api.example.com
    - external.service.com

Example: Egress Route Configuration

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: egress-destination
spec:
  host: api.example.com
  trafficPolicy:
    connectionPool:
      http:
        http1MaxPendingRequests: 100
        maxRequestsPerConnection: 10
    outlierDetection:
      consecutive5xxErrors: 5

3. Implementing Egress Traffic Control

Property Description Example
egress.gateway Defines the egress gateway for outbound traffic egress.gateway: "istio-egressgateway"
destination.host Specifies the host to which traffic is routed destination.host: "external-api.example.com"
port.number Port number for egress traffic port.number: 443

Example: Egress Gateway Configuration

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: egress-gateway
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - external-api.example.com

Example: Egress Traffic Policy

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: egress-destination-rule
spec:
  host: external-api.example.com
  trafficPolicy:
    connectionPool:
      http:
        http1MaxPendingRequests: 100
        maxRequestsPerConnection: 10
Note: Egress traffic control requires proper configuration of the service mesh to ensure that external traffic is properly routed and secured.

4. Setting Up TLS Origination

Property Description Value Notes
tls.origination Enables TLS origination for egress traffic true Must be set to enable TLS for outbound connections
tls.certificate Path to the certificate file /etc/certs/client.crt Required when TLS is enabled
tls.key Path to the private key file /etc/certs/client.key Required when TLS is enabled
tls.ca Path to the CA certificate file /etc/certs/ca.crt Used for validating server certificates

Example: Configuring TLS Origination in a Service Mesh

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: tls-origination
spec:
  host: external-api.example.com
  trafficPolicy:
    tls:
      mode: SIMPLE
      clientCertificate: /etc/certs/client.crt
      privateKey: /etc/certs/client.key
      caCertificates: /etc/certs/ca.crt

5. Configuring External Service Access

Property Description Default Notes
egressGateway.enabled Enables or disables the egress gateway false Set to true to enable external service access
egressGateway.port Port on which the egress gateway listens 8080 Typically 80 or 443 for HTTP/HTTPS
egressGateway.host Host address for the egress gateway 0.0.0.0 Bind to all interfaces or specific IP

Example: Egress Gateway Configuration

egressGateway:
  enabled: true
  port: 8080
  host: 0.0.0.0
Note: Egress gateways are used to control and secure access to external services from within the service mesh.

6. Implementing Egress Policy Enforcement

Policy Type Description Configuration Example Notes
egress.policy Enforces egress traffic control at the gateway level allow or deny Controls whether traffic is allowed to exit the mesh
destination.host Specifies the destination host for egress traffic api.example.com Used in conjunction with policy enforcement
destination.port Specifies the port to which egress traffic is directed 443 Must match the service port in the mesh

Example: Egress Policy Configuration

apiVersion: networking.istio.io/v1beta1
kind: EgressGateway
metadata:
  name: my-egress-gateway
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - api.example.com

Example: Enforcing Egress Policy

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: egress-policy
spec:
  host: api.example.com
  trafficPolicy:
    connectionPool:
      http:
        maxRequestsPerConnection: 1
Note: Egress policy enforcement requires proper configuration of the EgressGateway and DestinationRule to ensure traffic is routed correctly.
Warning: Misconfiguring egress policies can lead to traffic being blocked or misrouted, affecting service availability.

7. Managing Egress Gateway Security

Feature Description Configuration Notes
egressGateway.tls.enabled Enables TLS for egress traffic true Required for secure communication
egressGateway.tls.certificate Path to TLS certificate file /etc/certs/tls.crt Must be valid PEM format
egressGateway.tls.key Path to TLS private key file /etc/certs/tls.key Must match the certificate
egressGateway.tls.ca Path to CA certificate file /etc/certs/ca.crt Used for client certificate validation

Example: Egress Gateway TLS Configuration

egressGateway:
  tls:
    enabled: true
    certificate: /etc/certs/tls.crt
    key: /etc/certs/tls.key
    ca: /etc/certs/ca.crt
Note: Ensure that the certificate and key files are accessible to the egress gateway pod.
Warning: Misconfigured TLS settings can lead to connection failures or security vulnerabilities.
Security Setting Default Value Description Impact
egressGateway.tls.minVersion TLSv1.2 Minimum TLS version allowed Higher versions provide better security
egressGateway.tls.ciphers ECDHE-RSA-AES256-GCM-SHA512 Allowed cipher suites Restricts to secure ciphers only
egressGateway.tls.verifyHostname true Verify server hostname in certificate Prevents man-in-the-middle attacks

8. Configuring Egress Gateway High Availability

Example: Egress Gateway HA Configuration

apiVersion: v1
kind: Service
metadata:
  name: egress-gateway-ha
  namespace: istio-system
spec:
  selector:
    app: egress-gateway-ha
  ports:
    - name: http
      port: 80
    - name: https
      port: 443
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: egress-gateway-ha
  namespace: istio-system
spec:
  replicas: 3
  selector:
    matchLabels:
      app: egress-gateway-ha
  template:
    metadata:
      labels:
        app: egress-gateway-ha
    spec:
      containers:
      - name: egress-gateway
        image: istio/proxyv2:1.21.0
        args:
        - "--domain"
        - $(POD_NAMESPACE).svc.cluster.local
        - "--log_level"
        - info
Configuration Description Values Notes
replicas Number of gateway instances 3 Ensures high availability and load distribution
service.type Service type for gateway LoadBalancer Allows external access to the gateway
gateway.name Gateway name egress-gateway-ha Used for routing and identification
Note: Ensure that the gateway pods are scheduled across different nodes to avoid single point of failure.
Warning: Using replicas: 1 in production environments may lead to service disruption during gateway maintenance or node failures.

9. Monitoring Egress Traffic

Component Description Monitoring Type Metrics
Egress Gateway Proxy instance handling outbound traffic from the mesh Telemetry istio_egress_gateway_requests_total, istio_egress_gateway_response_time_seconds
Traffic Metrics Metrics collected for egress traffic Telemetry istio_requests_total, istio_request_duration_seconds
Latency Time taken for egress traffic to complete Telemetry istio_egress_gateway_response_time_seconds

Example: Egress Gateway Metrics Query

istioctl proxy-config metrics <egress-gateway-pod-name></code>
</pre>
</div>
</div>
<div class="note">
<strong>Note:</strong> Ensure Prometheus is configured to scrape metrics from the egress gateway pods.
</div>
<div class="summary">
<h2 id="key-metrics-for-egress-monitoring">Key Metrics for Egress Monitoring<a href="#key-metrics-for-egress-monitoring" class="toc__headingLink" aria-label="Link to this section"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path></svg></a></h2>
<ul>
<li><code>istio_egress_gateway_requests_total</code>: Total number of requests handled by the egress gateway.</li>
<li><code>istio_egress_gateway_response_time_seconds</code>: Average response time for egress traffic.</li>
<li><code>istio_requests_total</code>: Total number of requests, including egress traffic.</li>
</ul>
</div>
<h2 id="10-troubleshooting-egress-gateway-issues">10. Troubleshooting Egress Gateway Issues<a href="#10-troubleshooting-egress-gateway-issues" class="toc__headingLink" aria-label="Link to this section"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path></svg></a></h2>
<table>
<tbody>
<tr>
<th>Issue</th>
<th>Possible Cause</th>
<th>Solution</th>
</tr>
<tr>
<td class="property">Egress traffic blocked</td>
<td>Missing or incorrect egress policy</td>
<td>Verify egress policies in the service mesh configuration. Ensure that the egress rules allow traffic to the destination.</td>
</tr>
<tr>
<td class="property">Timeouts on egress traffic</td>
<td>Network latency or misconfigured timeouts</td>
<td>Adjust timeout values in the mesh configuration. Check for network issues between the gateway and the destination.</td>
</tr>
<tr>
<td class="property">503 Service Unavailable errors</td>
<td>Gateway not ready or misconfigured</td>
<td>Check gateway logs for errors. Ensure the gateway is running and properly configured to handle egress traffic.</td>
</tr>
<tr>
<td class="property">Certificate validation errors</td>
<td>Invalid or expired TLS certificates</td>
<td>Verify that the gateway has valid TLS certificates. Update or renew certificates as needed.</td>
</tr>
<tr>
<td class="property">High latency in egress traffic</td>
<td>Gateway resource constraints or inefficient routing</td>
<td>Monitor gateway resource usage (CPU, memory). Optimize routing rules or scale the gateway if necessary.</td>
</tr>
</tbody>
</table>
<div class="example">
<h2 id="example-egress-policy-configuration">Example: Egress Policy Configuration<a href="#example-egress-policy-configuration" class="toc__headingLink" aria-label="Link to this section"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path></svg></a></h2>
<div class="codeBlock" data-language="yaml">
<pre><code>apiVersion: networking.istio.io/v1beta1
kind: EgressGateway
metadata:
  name: my-egress-gateway
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "example.com"
Note: Ensure that the egress gateway is properly configured to handle traffic to external services. Misconfigurations can lead to connectivity issues or security vulnerabilities.

11. Implementing Egress Gateway Failover

Example: Basic Egress Gateway Failover Configuration

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: egress-gateway-failover
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - &#34;*.example.com&#34;
    tls:
      mode: PASSTHROUGH
Field Description Values Notes
selector.istio Gateway type selector egressgateway Must match the gateway pod label
servers.port.number Port to listen on 443 HTTPS port for egress traffic
servers.hosts Hosts to route through gateway *.example.com Wildcard for domain matching
servers.tls.mode TLS mode for egress traffic PASSTHROUGH Preserves original TLS handshake
Note: The egress gateway must be configured with the same selector label as the gateway pod to ensure traffic is routed correctly.

Example: Egress Gateway with Multiple Failover Endpoints

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: egress-gateway-failover-dr
spec:
  host: egress-gateway.istio-system.svc.cluster.local
  trafficPolicy:
    connectionPool:
      http:
        maxRequestsPerConnection: 10
    outlierDetection:
      consecutiveErrors: 2
      interval: 30s
      baseEjectionTime: 30s
Field Description Values Notes
host Gateway service address egress-gateway.istio-system.svc.cluster.local Service name for the egress gateway
trafficPolicy.outlierDetection.consecutiveErrors Number of consecutive errors to trigger failover 2 Triggers failover after 2 failed requests
trafficPolicy.outlierDetection.interval Interval for outlier detection 30s Check every 30 seconds for failures
trafficPolicy.outlierDetection.baseEjectionTime Base time for ejection 30s Gateway will be ejected for 30 seconds

12. Managing Egress Gateway Credentials

Credential Type Description Usage Notes
TLS Certificate X.509 certificate for mTLS with external services Used in DestinationRule or PeerAuthentication Required for secure egress to external APIs or services
API Key Secret key for authenticating to external services Applied via RequestAuthentication or custom headers Can be managed with Secret CRD in Istio
JWT Token JSON Web Token for OAuth2 or OIDC integration Configured in AuthorizationPolicy or RequestAuthentication Supports audience and issuer validation

Example: Configuring TLS Certificate for Egress

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: egress-tls
spec:
  host: external-api.example.com
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
      clientCertificate: /etc/certs/client.crt
      privateKey: /etc/certs/client.key
      caCertificates: /etc/certs/root.crt

Example: Using API Key in Egress

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: api-key-auth
spec:
  jwtRules:
  - issuer: https://api.example.com
    jwksUri: https://api.example.com/.well-known/jwks.json
    forwardOriginalToken: true
Note: Ensure that credentials are securely stored and rotated regularly to maintain egress gateway security.

Was this article helpful?

Related Cheat Sheets